{"action":"created","issue":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1213","labels_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1213/labels{/name}","comments_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1213/comments","events_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1213/events","html_url":"https://github.com/angular-translate/angular-translate/issues/1213","id":106948831,"number":1213,"title":"Escaping of variable content documentation outdated","user":{"login":"k-nut","id":1096357,"avatar_url":"https://avatars.githubusercontent.com/u/1096357?v=3","gravatar_id":"","url":"https://api.github.com/users/k-nut","html_url":"https://github.com/k-nut","followers_url":"https://api.github.com/users/k-nut/followers","following_url":"https://api.github.com/users/k-nut/following{/other_user}","gists_url":"https://api.github.com/users/k-nut/gists{/gist_id}","starred_url":"https://api.github.com/users/k-nut/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k-nut/subscriptions","organizations_url":"https://api.github.com/users/k-nut/orgs","repos_url":"https://api.github.com/users/k-nut/repos","events_url":"https://api.github.com/users/k-nut/events{/privacy}","received_events_url":"https://api.github.com/users/k-nut/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-09-17T09:51:13Z","updated_at":"2015-09-17T19:48:36Z","closed_at":null,"body":"The [`Escaping of variable content`](http://angular-translate.github.io/docs/#/guide/19_security) documentation tries to explain the different escaping strategies by showing one example where XSS is possible and one where it is not thanks to escaping. The output in both cases is the exact same though: Escaped content. \r\n```\r\nXSS possible!\r\n\r\nHello <span style='color:red;'>HACKED</span>!\r\n```\r\nDid the internal behaviour change and the documentation is outdated?\r\n\r\n This is especially important since angular-translate warns if not sanitization strategy was chosen and links to this page.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/comments/141206014","html_url":"https://github.com/angular-translate/angular-translate/issues/1213#issuecomment-141206014","issue_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1213","id":141206014,"user":{"login":"knalli","id":65389,"avatar_url":"https://avatars.githubusercontent.com/u/65389?v=3","gravatar_id":"","url":"https://api.github.com/users/knalli","html_url":"https://github.com/knalli","followers_url":"https://api.github.com/users/knalli/followers","following_url":"https://api.github.com/users/knalli/following{/other_user}","gists_url":"https://api.github.com/users/knalli/gists{/gist_id}","starred_url":"https://api.github.com/users/knalli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knalli/subscriptions","organizations_url":"https://api.github.com/users/knalli/orgs","repos_url":"https://api.github.com/users/knalli/repos","events_url":"https://api.github.com/users/knalli/events{/privacy}","received_events_url":"https://api.github.com/users/knalli/received_events","type":"User","site_admin":false},"created_at":"2015-09-17T19:48:36Z","updated_at":"2015-09-17T19:48:36Z","body":"If you open the demo in plnkr, it works correctly. Looks like the embedded ones have an issue. :/"}}