{"action":"created","issue":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993","labels_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993/labels{/name}","comments_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993/comments","events_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993/events","html_url":"https://github.com/angular-translate/angular-translate/issues/993","id":67355059,"number":993,"title":"Translate directive should only render sanitized HTML when postCompile is off","user":{"login":"marklagendijk","id":1188039,"avatar_url":"https://avatars.githubusercontent.com/u/1188039?v=3","gravatar_id":"","url":"https://api.github.com/users/marklagendijk","html_url":"https://github.com/marklagendijk","followers_url":"https://api.github.com/users/marklagendijk/followers","following_url":"https://api.github.com/users/marklagendijk/following{/other_user}","gists_url":"https://api.github.com/users/marklagendijk/gists{/gist_id}","starred_url":"https://api.github.com/users/marklagendijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marklagendijk/subscriptions","organizations_url":"https://api.github.com/users/marklagendijk/orgs","repos_url":"https://api.github.com/users/marklagendijk/repos","events_url":"https://api.github.com/users/marklagendijk/events{/privacy}","received_events_url":"https://api.github.com/users/marklagendijk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/angular-translate/angular-translate/labels/enhancement","name":"enhancement","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":18,"created_at":"2015-04-09T12:53:28Z","updated_at":"2015-04-20T16:16:55Z","closed_at":null,"body":"The translate directive renders the text as HTML instead of text. Example:\r\n\r\n``` javascript\r\n{\r\n  MY_LABEL: 'This is<br /> an example.'\r\n}\r\n```\r\n\r\n``` html\r\n<div translate=\"MY_LABEL\"><div>\r\n```\r\nIs rendered as:\r\n```\r\nThis is\r\nan example.\r\n```\r\n\r\nThis is a nice feature. However, when I found out about this feature I tested what would happen if I would put a script tag in the label. Turns out that it is rendered and the containing script executed. Example:\r\n\r\n``` javascript\r\n{\r\n  MY_LABEL: 'This is<br /> an example.<script type=\"text/javascript\">alert(\"Wait! What?\");</script>'\r\n}\r\n```\r\n\r\nThis is a serious security issue. The solution would be to make it work in the same way as [ngBindHtml](https://docs.angularjs.org/api/ng/directive/ngBindHtml) by using the [$sanitize](https://docs.angularjs.org/api/ngSanitize/service/$sanitize) service. This will add a dependency on ngSanitize, but is the only way to do this properly."},"comment":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/comments/94497714","html_url":"https://github.com/angular-translate/angular-translate/issues/993#issuecomment-94497714","issue_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993","id":94497714,"user":{"login":"knalli","id":65389,"avatar_url":"https://avatars.githubusercontent.com/u/65389?v=3","gravatar_id":"","url":"https://api.github.com/users/knalli","html_url":"https://github.com/knalli","followers_url":"https://api.github.com/users/knalli/followers","following_url":"https://api.github.com/users/knalli/following{/other_user}","gists_url":"https://api.github.com/users/knalli/gists{/gist_id}","starred_url":"https://api.github.com/users/knalli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knalli/subscriptions","organizations_url":"https://api.github.com/users/knalli/orgs","repos_url":"https://api.github.com/users/knalli/repos","events_url":"https://api.github.com/users/knalli/events{/privacy}","received_events_url":"https://api.github.com/users/knalli/received_events","type":"User","site_admin":false},"created_at":"2015-04-20T16:16:55Z","updated_at":"2015-04-20T16:16:55Z","body":"@marklagendijk : Yes, this looks good! I'm with you.\r\n\r\nIn the final implementation I would think it is better to split the strategies (dedicated component functions?) and no hardcoded combinations (except a default one in the future).\r\n\r\nWhat happens in an AJS 1.2 environment with this one? https://gist.github.com/marklagendijk/55b98aba74f053752c19#file-default-interpolation-js-L78\r\n\r\nI guess this will break everything (at least the running context). It would be okay to catch it gracefully and fallback to something else. We can cover this in the tests as they are running in each context (AJS 1.2, AJS 1.3, AJS 1.4)."}}