Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need a way to _not_ escape markup in external args #37

Open
reedstrm opened this issue May 16, 2017 · 1 comment
Open

Need a way to _not_ escape markup in external args #37

reedstrm opened this issue May 16, 2017 · 1 comment

Comments

@reedstrm
Copy link

When translating complex pages on a website, we ran into a problem where we have variable content that contains HTML markup, that is passed as l10-n-args attribute values in the DOM. This content is fro a trusted/vetted source, so we don't need the sanitizeArgs escaping. However, there doesn't seem to be a way to avoid it. Since the args are sanitized when the keys are fetched from context, before they are passed to translation, I don't see a way to add a special TrustedText type. I was considering a builtin function HTML() or some such that would reverse the santiizeArgs replacements.

@zbraniecki
Copy link
Collaborator

@stasm - was it a deliberate choice to not let args be passed unsanitized? I remember some conversation about it during the security review, but I do not remember the outcome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants