Description
I'm submitting a ... (check one with "x")
[ ] bug report => check the FAQ and search github for a similar issue or PR before submitting
[x] support request => check the FAQ and search github for a similar issue before submitting
[x] feature request
This is somewhere in between "how to" and "what if".
Use case
Embedding angular links into translation resources, something like:
{
"ALREADY_SIGNED_UP": "Already signed up? <a routerLink=\"/login\">Log in</a>!",
"ACCEPT_TERMS": "I have read and accept <a routerLink=\"/terms\">Terms and Conditions</a>"
}
<span [innerHTML]="'ALREADY_SIGNED_UP' | translate"></span>
The strings are self-explanatory.
Work-around
One could do something along those lines:
{
"ALREADY_SIGNED_UP_PREFIX": "Already signed up? ",
"ALREADY_SIGNED_UP_LINK": "Log in",
"ALREADY_SIGNED_UP_SUFFIX": "!"
}
<span>
{{ 'ALREADY_SIGNED_UP_PREFIX' | translate }}
<a routerLink="/login">{{ 'ALREADY_SIGNED_UP_LINK' | translate }}</a>
{{ 'ALREADY_SIGNED_UP_SUFFIX' | translate }}
</span>
which would be much harder to track for the localization team.
Difficulties
-
Security. Such template layout would require to call
DomSanitizer.bypassSecurityTrustHtml
at the very least, which in turn requires extracting the localizable string into a variable (see this plunker):import {DomSanitizer} from '@angular/platform-browser'; @Component({ selector: 'my-signup', template: `<span [innerHTML]="label"></span>`, }) export class SignUpComponentLocalized { private label; constructor(private translate: TranslateService, sanitizer: DomSanitizer) { translate.get('ALREADY_SIGNED_UP').subscribe(s => this.label = sanitizer.bypassSecurityTrustHtml(s); ); } }
If this is skipped, the following string will be output to browser console:
"WARNING: sanitizing HTML stripped some content (see http://g.co/ng/security#xss)."
. The resulting HTML will not contain therouterLink
attribute on an<a>
element. -
Router hooks. Even if we bypass the HTML sanitization, it's still unclear how Angular is supposed to tie such a link into the routing stuff. In the above plunker the thing is not hooked, and I have yet to figure this out (any help?)
Now what?
That's the thing - I don't know, and I'm looking for suggestions on how to solve this problem in a non-workaroundish way. AFAIK it's not possible to do something like bypassSecurityTrustHtml
from within a custom pipe (though it would probably be a nice, but heavily misused feature).
On the other hand, if we could make the plunker work in expected way, this could potentially be extracted into a reusable TranslateInsecureContentService
utility.
Please tell us about your environment:
- ng2-translate version: 2.4.3
- Angular version: 2.0.0-rc.6
- Browser: all
- Language: all