I'm submitting a ... (check one with "x")
[ ] bug report => check the FAQ and search github for a similar issue or PR before submitting
[x] support request => check the FAQ and search github for a similar issue before submitting
[x] feature request
This is somewhere in between "how to" and "what if".
Use case
Embedding angular links into translation resources, something like:
{
"ALREADY_SIGNED_UP": "Already signed up? <a routerLink=\"/login\">Log in</a>!",
"ACCEPT_TERMS": "I have read and accept <a routerLink=\"/terms\">Terms and Conditions</a>"
}
<span [innerHTML]="'ALREADY_SIGNED_UP' | translate"></span>
The strings are self-explanatory.
Work-around
One could do something along those lines:
{
"ALREADY_SIGNED_UP_PREFIX": "Already signed up? ",
"ALREADY_SIGNED_UP_LINK": "Log in",
"ALREADY_SIGNED_UP_SUFFIX": "!"
}
<span>
{{ 'ALREADY_SIGNED_UP_PREFIX' | translate }}
<a routerLink="/login">{{ 'ALREADY_SIGNED_UP_LINK' | translate }}</a>
{{ 'ALREADY_SIGNED_UP_SUFFIX' | translate }}
</span>
which would be much harder to track for the localization team.
Difficulties
-
Security. Such template layout would require to call DomSanitizer.bypassSecurityTrustHtml at the very least, which in turn requires extracting the localizable string into a variable (see this plunker):
import {DomSanitizer} from '@angular/platform-browser';
@Component({
selector: 'my-signup',
template: `<span [innerHTML]="label"></span>`,
})
export class SignUpComponentLocalized {
private label;
constructor(private translate: TranslateService, sanitizer: DomSanitizer) {
translate.get('ALREADY_SIGNED_UP').subscribe(s =>
this.label = sanitizer.bypassSecurityTrustHtml(s);
);
}
}
If this is skipped, the following string will be output to browser console: "WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss).". The resulting HTML will not contain the routerLink attribute on an <a> element.
-
Router hooks. Even if we bypass the HTML sanitization, it's still unclear how Angular is supposed to tie such a link into the routing stuff. In the above plunker the thing is not hooked, and I have yet to figure this out (any help?)
Now what?
That's the thing - I don't know, and I'm looking for suggestions on how to solve this problem in a non-workaroundish way. AFAIK it's not possible to do something like bypassSecurityTrustHtml from within a custom pipe (though it would probably be a nice, but heavily misused feature).
On the other hand, if we could make the plunker work in expected way, this could potentially be extracted into a reusable TranslateInsecureContentService utility.
Please tell us about your environment:
- ng2-translate version: 2.4.3
- Angular version: 2.0.0-rc.6
- Browser: all
- Language: all
I'm submitting a ... (check one with "x")
This is somewhere in between "how to" and "what if".
Use case
Embedding angular links into translation resources, something like:
{ "ALREADY_SIGNED_UP": "Already signed up? <a routerLink=\"/login\">Log in</a>!", "ACCEPT_TERMS": "I have read and accept <a routerLink=\"/terms\">Terms and Conditions</a>" }The strings are self-explanatory.
Work-around
One could do something along those lines:
{ "ALREADY_SIGNED_UP_PREFIX": "Already signed up? ", "ALREADY_SIGNED_UP_LINK": "Log in", "ALREADY_SIGNED_UP_SUFFIX": "!" }which would be much harder to track for the localization team.
Difficulties
Security. Such template layout would require to call
DomSanitizer.bypassSecurityTrustHtmlat the very least, which in turn requires extracting the localizable string into a variable (see this plunker):If this is skipped, the following string will be output to browser console:
"WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss).". The resulting HTML will not contain therouterLinkattribute on an<a>element.Router hooks. Even if we bypass the HTML sanitization, it's still unclear how Angular is supposed to tie such a link into the routing stuff. In the above plunker the thing is not hooked, and I have yet to figure this out (any help?)
Now what?
That's the thing - I don't know, and I'm looking for suggestions on how to solve this problem in a non-workaroundish way. AFAIK it's not possible to do something like
bypassSecurityTrustHtmlfrom within a custom pipe (though it would probably be a nice, but heavily misused feature).On the other hand, if we could make the plunker work in expected way, this could potentially be extracted into a reusable
TranslateInsecureContentServiceutility.Please tell us about your environment: