Sanitize Value Strategy and translate-compile

[bettysteger]

I updated angular-translate to 2.7.2 and am now using 'sanitizeParameters' as strategy!
But when using translate-compile the inner text is not shown:

<p translate="TEXT" translate-value-link="<a href='' translate='TEXT_LINK'></a>" translate-compile></p>

(with 'null' as strategy it works fine, like before)
my question: is it possible to use translate-compile with this new strategies? if yes, how?

[knalli]

Please provide a demo of your case. Anyway, that one should match the issue: http://plnkr.co/edit/qE0ooWOgDKicPeymjmzr?p=preview

And yes, that seems not to work. After enabling the last config line with $translateProvider.useSanitizeValueStrategy('sanitizeParameters');, the inner translation won't work.

I would assume that the "custom" attribute translate will be stripped away from the sanitization module which would be actually correct and expected.

Unless we find a suitable version, I would recommend building the text on yourself. In case of a pattern used multiple times, I would recommend a custom directive and configuring the content on yourself using $sce and its deeper configuration options (I think there were some).

[bettysteger]

Your plnkr does match the issue when you enable the useSanitizeValueStrategy as you described!

What exactly do you mean by

building the text on yourself ?

I have translate-compile very often in different parts of the code, often used to add a a-tag.. so maybe there I can use a custom directive..!

[knalli]

What exactly do you mean by […]

You have to create a custom directive (highly recommend) which calls the translate service (incl. the correct interpolation) and injects the values directly (i.e. via DOM).

You also could try to decorate our directive component, but I'm not sure this would be very suitable. It looks like a very special case?

[bettysteger]

Ok, now I know, thank you!

I don't think it is a special case? I often have links in translations and I don't want to have HTML in the translation.. E.g. I prefer a {{link}} placeholder instead of a long a-tag!

[knalli]

Well, use an appropiate sanitize/escape strategy. At the moment, I cannot see something does not working as expected.

[bettysteger]

Sorry, it seems that I am a bit slow, .. :/ but it does not work as expected and you said it yourself in your first comment - so will there be a bugfix or not? ;)

I mean, of course, I can make a directive that solves this, but I am really wondering, if I am the only one having this problem.

[knalli]

No. If you are using a sanitization of the result, don't be surprised by a sanitized string. Same for escaping.

That is how sanitization or escaping is working.

[bettysteger]

whatever strategy used, translate-compile is not working

[knalli]

Sure it's working with the expected result of the selected strategy.

Anyway: Please show a working example where the strategy is not working.

[bettysteger]

http://plnkr.co/edit/qfM2PvjkX63z8k5Eo7HP?p=preview

[knalli]

Yes. The dynamic value (containing HTML) will be sanitized. Works as expected! $sanitize removes translate as being not a wellknown attribute, but that's how this component works.

[whjvenyl]

Use the translate-filter then:

this.a = '<a href="https://github.com">{{"translate_hello"|translate}}</a>';

[bettysteger]

@whjvenyl yes thought about that too ;)

maybe with one-time-binding:

<a href="https://github.com">{{::'translate_hello' | translate}}</a>

[FrancescoMussi]

Hi guys! I am getting too this error message: pascalprecht.translate.$translateSanitization: No sanitization strategy has been configured. This can have serious security implications.

Has been found a solution?

[knalli]

@FrancescoMussi Did you follow the link? :)

[FrancescoMussi]

Ah ok, I see. So basically all I have to do is to add $translateProvider.useSanitizeValueStrategy('sanitize'); in the config, right?

[knalli]

If the strategy is right for you, that will be basically the step.

At the moment we have no standard (no decision made for you) whether you have to use sanitization or escaping.

[FrancescoMussi]

Ok, thank you!