Sanitize some translate values but not others

berkes

I have a angular-translate directive that takes arguments, which are mixed. Some are user-generated, others are HTML that must be compiled (with translate-compile).

See this plunker for a working, greatly simplified example.

When the translate-sanitize-strategy is set to "null", nothing is sanitized:

 <p translate
 translate-value-amount="<currency data-amount='balance'></currency>"
 translate-value-beneficiary="{{ beneficiary }}"
 translate-sanitize-strategy="null"
 translate-compile="true">PAY_TO</p>

This renders You must pay € 13.37 to john-doe.

But when a user sets a nickname to john-<span onmouseover="this.textContent=\'h@ck3d\'">doe</span>, it will run that and it renders, after mouseover, You must pay € 13.37 to john-h@ck3d. Clearly an example of XSS.

When I set the strategy to sanitizeParameters, which is also our global setting, the beneficiary is properly sanitized. But so is the amount, which I trust (at this point) and which needs to be compiled!

<p translate
 translate-value-amount="<currency data-amount='balance'></currency>"
 translate-value-beneficiary="{{ beneficiary }}"
 translate-sanitize-strategy="'sanitizeParameters'"
 translate-compile="true">PAY_TO</p>

This renders You must pay to john-doe. So the beneficiary value is properly sanitized, but so is the value-amount, which I need to remain unsanitized in order for angular to compile it.

I've searched for a solution where I manually sanitize the beneficiary value, with a filter:

{{ beneficiary | sanitize }}

But this seems to require me to write a filter that uses the ngSanitize Service; not that hard, but still some work, tests, code for something that I expect to be natively available. Somewhere.

I've read through the angular-translate code to find if there is a (hidden) flag or naming convention or so, that allows per-value setting of sanitization, but could not find that. Something like translate-sanitize-attributes="['foo', 'bar']" or even atranslate-value-amount-astrusted=` or somesuch. But could find nothing that hints at being able to set sanitization-strategies or omission thereof, per-value.

How is this usually achieved in angularjs and angular-translate?

Matthijs

How about:

<p translate
 translate-value-amount="<currency data-amount='balance'></currency>"
 translate-value-beneficiary="<span ng-bind='beneficiary'></span>"
 translate-sanitize-strategy="null"
 translate-compile="true">PAY_TO</p>

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

angular translate sanitize / escape

Subset does not work with some numeric values but with others

why for some values there is an infinity result but no for others?

Elasticsearch must some values and must not all others

matching on some values but not others in nested dict

DLookup returning True for some values, and False for others

angular-translate : sanitize strategies

Replicate some rows in R, keeping some values constant and changing others

Why are some TemplateBinding values not shown in designer but others are? [with repro code]

mysql how to mulitply some values in the same column but not others if it meets a condition

How to fix some pandas column values with a dictionary and leave the others?

numpy.linalg.pinv() hangs for some infinite values (but not for others)

Why does implicit conversion from some numeric values work but not others?

Pandas replace works on some values of a column does not on others

.Internal(La_rs()) returns negative values on some installations but not others

Keep some specific values in a DataFrame and set to zero the others

Why are some array values being overwritten and others are not? PHP

swap some values in an array of objects while maintain sorted others

Why does this *ngFor object list only have some values and not others?

Calculating coins for money amount works for some values, but not for others

transformed values return NaN in some cases but numbers in others

How to sanitize XML attributes values

sanitize column values in pyspark dataframe

How to select values with latest date when some values are repeated and others do not?

Some of my dataframe values include dictionaries, while others contain values. How do I remove the dictionaries?

How to plot only some cells with certain values of an array and others not with matplotlib.pyplot?

How to group pandas DataFrame if some values are range of integers, while others are pure integer?

In Google Sheets, how to list and sum values in some rows but not others depending on string?

Why are some Wordpress menu post_name values numbers and others slugs?