angularjs - HTML escaping does not behave the same if angular-translate is used as directive (instead of as a filter) -
angular-translate - version: 2.8, angular-version 1.3.5
translation-key mykey
contains <i>text</i>
given snippet:
<p translate="mykey"></p> <p translate="{{'mykey'}}"></p> <p><translate>mykey</translate></p> <p>{{'mykey' | translate}}</p>
results in:
text --> italic, why not escaped? text --> italic, why not escaped? text --> italic, why not escaped? <i>text</i> --> expect way
why translate-filter escapes expected, directive fails escape anything?
i tampered around $translateprovider.usesanitizevaluestrategy('sanitize');
, doesn't difference above example.
in angularjs applications, filter's output escaped always. done automatically , not under control of filter function itself. in opposite, directive has complete control , how information appended/ removed/ , on.
// ensure angular-sanitize.js present $translateprovider.usesanitizevaluestrategy('sanitize');
sanitization not escaping! instead of escaping everything, checks valid (and secure) string (html, javascript, css). if valid, use actual input. otherwise rejected.
i've made overview matrix of directive, filter , escape/sanitization settings in angular-translate. case ongoing issue utf-8 characters, think it: http://plnkr.co/edit/8bhonojhsxbxxo9ovyok?p=preview
disclaimer: i'm co-maintaining angular-translate.
Comments
Post a Comment