Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Angular i18n directives should treat as HTML only values that are marked as such #26173

Closed
azasypkin opened this issue Nov 26, 2018 · 1 comment
Assignees
Labels
Project:i18n Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc

Comments

@azasypkin
Copy link
Member

azasypkin commented Nov 26, 2018

Currently all values that are passed via i18n-values directive are treated as HTML. Even though values are sanitized and don't introduce a security risk it still may have undesired effect for values that may look like HTML (e.g. contains < or >), but in reality aren't.

Ideally we should explicitly mark values that should be treated as HTML (e.g. with html_ prefix like was discussed in #23684), the rest should be treated as plain text.

In the scope of this issue we should audit all existing cases where we use i18n-values and make sure we use HTML only where it's really needed.

@azasypkin azasypkin added Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Project:i18n labels Nov 26, 2018
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-platform

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Project:i18n Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc
Projects
None yet
Development

No branches or pull requests

3 participants