Angular i18n directives should treat as HTML only values that are marked as such #26173
Labels
Project:i18n
Team:Core
Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc
Currently all values that are passed via
i18n-values
directive are treated as HTML. Even though values are sanitized and don't introduce a security risk it still may have undesired effect for values that may look like HTML (e.g. contains<
or>
), but in reality aren't.Ideally we should explicitly mark values that should be treated as HTML (e.g. with
html_
prefix like was discussed in #23684), the rest should be treated as plain text.In the scope of this issue we should audit all existing cases where we use
i18n-values
and make sure we use HTML only where it's really needed.The text was updated successfully, but these errors were encountered: