Skip to content

Translating strings with links #223

Description

@DethAriel

I'm submitting a ... (check one with "x")

[ ] bug report => check the FAQ and search github for a similar issue or PR before submitting
[x] support request => check the FAQ and search github for a similar issue before submitting
[x] feature request

This is somewhere in between "how to" and "what if".

Use case

Embedding angular links into translation resources, something like:

{
  "ALREADY_SIGNED_UP": "Already signed up? <a routerLink=\"/login\">Log in</a>!",
  "ACCEPT_TERMS": "I have read and accept <a routerLink=\"/terms\">Terms and Conditions</a>"
}
<span [innerHTML]="'ALREADY_SIGNED_UP' | translate"></span>

The strings are self-explanatory.

Work-around

One could do something along those lines:

{
  "ALREADY_SIGNED_UP_PREFIX": "Already signed up? ",
  "ALREADY_SIGNED_UP_LINK": "Log in",
  "ALREADY_SIGNED_UP_SUFFIX": "!"
}
<span>
  {{ 'ALREADY_SIGNED_UP_PREFIX' | translate }}
  <a routerLink="/login">{{ 'ALREADY_SIGNED_UP_LINK' | translate }}</a>
  {{ 'ALREADY_SIGNED_UP_SUFFIX' | translate }}
</span>

which would be much harder to track for the localization team.

Difficulties

  1. Security. Such template layout would require to call DomSanitizer.bypassSecurityTrustHtml at the very least, which in turn requires extracting the localizable string into a variable (see this plunker):

    import {DomSanitizer} from '@angular/platform-browser';
    
    @Component({
      selector: 'my-signup',
      template: `<span [innerHTML]="label"></span>`,
    })
    export class SignUpComponentLocalized {
      private label;
      constructor(private translate: TranslateService, sanitizer: DomSanitizer) {
        translate.get('ALREADY_SIGNED_UP').subscribe(s =>
          this.label = sanitizer.bypassSecurityTrustHtml(s);
        );
      }
    }

    If this is skipped, the following string will be output to browser console: "WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss).". The resulting HTML will not contain the routerLink attribute on an <a> element.

  2. Router hooks. Even if we bypass the HTML sanitization, it's still unclear how Angular is supposed to tie such a link into the routing stuff. In the above plunker the thing is not hooked, and I have yet to figure this out (any help?)

Now what?

That's the thing - I don't know, and I'm looking for suggestions on how to solve this problem in a non-workaroundish way. AFAIK it's not possible to do something like bypassSecurityTrustHtml from within a custom pipe (though it would probably be a nice, but heavily misused feature).

On the other hand, if we could make the plunker work in expected way, this could potentially be extracted into a reusable TranslateInsecureContentService utility.

Please tell us about your environment:

  • ng2-translate version: 2.4.3
  • Angular version: 2.0.0-rc.6
  • Browser: all
  • Language: all

No activity

Activity on this issue will appear here.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions