angularjs - HTML escaping does not behave the same if angular-translate is used as directive (instead of as a filter) -


angular-translate - version: 2.8, angular-version 1.3.5

translation-key mykey contains <i>text</i>

given snippet:

<p translate="mykey"></p> <p translate="{{'mykey'}}"></p> <p><translate>mykey</translate></p> <p>{{'mykey' | translate}}</p> 

results in:

text          --> italic, why not escaped? text          --> italic, why not escaped? text          --> italic, why not escaped? <i>text</i>   --> expect way 

why translate-filter escapes expected, directive fails escape anything?

i tampered around $translateprovider.usesanitizevaluestrategy('sanitize');, doesn't difference above example.

in angularjs applications, filter's output escaped always. done automatically , not under control of filter function itself. in opposite, directive has complete control , how information appended/ removed/ , on.

// ensure angular-sanitize.js present $translateprovider.usesanitizevaluestrategy('sanitize'); 

sanitization not escaping! instead of escaping everything, checks valid (and secure) string (html, javascript, css). if valid, use actual input. otherwise rejected.

i've made overview matrix of directive, filter , escape/sanitization settings in angular-translate. case ongoing issue utf-8 characters, think it: http://plnkr.co/edit/8bhonojhsxbxxo9ovyok?p=preview

disclaimer: i'm co-maintaining angular-translate.


Comments