{"action":"created","issue":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993","labels_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993/labels{/name}","comments_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993/comments","events_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993/events","html_url":"https://github.com/angular-translate/angular-translate/issues/993","id":67355059,"number":993,"title":"Translate directive should only render sanitized HTML when postCompile is off","user":{"login":"marklagendijk","id":1188039,"avatar_url":"https://avatars.githubusercontent.com/u/1188039?v=3","gravatar_id":"","url":"https://api.github.com/users/marklagendijk","html_url":"https://github.com/marklagendijk","followers_url":"https://api.github.com/users/marklagendijk/followers","following_url":"https://api.github.com/users/marklagendijk/following{/other_user}","gists_url":"https://api.github.com/users/marklagendijk/gists{/gist_id}","starred_url":"https://api.github.com/users/marklagendijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marklagendijk/subscriptions","organizations_url":"https://api.github.com/users/marklagendijk/orgs","repos_url":"https://api.github.com/users/marklagendijk/repos","events_url":"https://api.github.com/users/marklagendijk/events{/privacy}","received_events_url":"https://api.github.com/users/marklagendijk/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/angular-translate/angular-translate/labels/enhancement","name":"enhancement","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-04-09T12:53:28Z","updated_at":"2015-04-20T08:34:32Z","closed_at":null,"body":"The translate directive renders the text as HTML instead of text. Example:\r\n\r\n``` javascript\r\n{\r\n  MY_LABEL: 'This is<br /> an example.'\r\n}\r\n```\r\n\r\n``` html\r\n<div translate=\"MY_LABEL\"><div>\r\n```\r\nIs rendered as:\r\n```\r\nThis is\r\nan example.\r\n```\r\n\r\nThis is a nice feature. However, when I found out about this feature I tested what would happen if I would put a script tag in the label. Turns out that it is rendered and the containing script executed. Example:\r\n\r\n``` javascript\r\n{\r\n  MY_LABEL: 'This is<br /> an example.<script type=\"text/javascript\">alert(\"Wait! What?\");</script>'\r\n}\r\n```\r\n\r\nThis is a serious security issue. The solution would be to make it work in the same way as [ngBindHtml](https://docs.angularjs.org/api/ng/directive/ngBindHtml) by using the [$sanitize](https://docs.angularjs.org/api/ngSanitize/service/$sanitize) service. This will add a dependency on ngSanitize, but is the only way to do this properly."},"comment":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/comments/94392939","html_url":"https://github.com/angular-translate/angular-translate/issues/993#issuecomment-94392939","issue_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/993","id":94392939,"user":{"login":"marklagendijk","id":1188039,"avatar_url":"https://avatars.githubusercontent.com/u/1188039?v=3","gravatar_id":"","url":"https://api.github.com/users/marklagendijk","html_url":"https://github.com/marklagendijk","followers_url":"https://api.github.com/users/marklagendijk/followers","following_url":"https://api.github.com/users/marklagendijk/following{/other_user}","gists_url":"https://api.github.com/users/marklagendijk/gists{/gist_id}","starred_url":"https://api.github.com/users/marklagendijk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/marklagendijk/subscriptions","organizations_url":"https://api.github.com/users/marklagendijk/orgs","repos_url":"https://api.github.com/users/marklagendijk/repos","events_url":"https://api.github.com/users/marklagendijk/events{/privacy}","received_events_url":"https://api.github.com/users/marklagendijk/received_events","type":"User","site_admin":false},"created_at":"2015-04-20T08:34:32Z","updated_at":"2015-04-20T08:34:32Z","body":"The idea I had was to have two kind of strategies:\r\n\r\n1. sanitizeValueStrategy\r\n2. sanitizeTranslationStrategy\r\n\r\nThe idea of the sanitizeTranslationStrategy is that it would be applied on the whole result, [after interpolation](https://github.com/angular-translate/angular-translate/blob/master/src/service/default-interpolation.js#L92).\r\n\r\nWas your idea to use one strategy both? This would be possible. We could just call the same sanitize function (belonging to the currently selected strategy) in both cases. This function should then check whether it got passed an object (-> params) or an string (-> whole translation), and act accordingly.\r\n\r\nThis would also make it a non-breaking change, so it could already be released as part of 2.x. We could just add several strategies:\r\n\r\n1. `escaped`: keep this exactly the same, for backwards compatability. Warn in the docs against using it. The name should be deprecated.\r\n2. `escapedParameters`: new name for the old `escaped` strategy. \r\n2. `sanitizedTranslation`: sanitizes the whole result, does nothing with the parameters.\r\n3. `sanitizedTranslationEscapedParameters`: sanitizes the whole result, and escapes the parameters (useful if the parameters come from user input, and you want to forbid HTML).\r\n3. `escapedTranslation`: escapes the whole result, does nothing with the parameters (because they are already escaped as part of the whole result).\r\n\r\nIn 3.0 we would change to either `sanitizedTranslation` or `sanitizedTranslationEscapedParameters` as the default strategy.\r\n\r\n@knalli let me know what you think. If you have suggestions for better names they are also welcome."}}