Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Changes interpolation strategy to
sanitize
Adds ngSanitize so we can use HTML in translation strings, changes angular-translate's sanitization strategy to `sanitize` instead of `escape`. My motivation here is to make the translation strings be non-ridiculous. Without being able to inject un-escaped HTML into the translation, we end up chopping up the translation keys to the point where they're not comprehensible within lokalise, and doing weird gymnastics in the angular template like `<span translate>key</span>: <strong translate>value</strong>` because both are contained within the same parent. The cost here is that there's an [open bug on angular-translate][1] for the `sanitize` strategy where unicode gets double-encoded. I tried `sce` as a strategy, but it seemed open to XSS (ie. include `<script>alert('xss')</script>` in a translation and you'll see the alert. The `sanitize` strategy successfully killed this vector). The cost here is that as much as possible we need to use the `<tag translate>` form instead of the `{$ 'string' | translate $}` form. For the most part, we're not translating arbitrary user input, but no sense in leaving that door open for us to forget about down the road. [1]: angular-translate/angular-translate#1101
- Loading branch information