{"action":"created","issue":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1589","repository_url":"https://api.github.com/repos/angular-translate/angular-translate","labels_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1589/labels{/name}","comments_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1589/comments","events_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1589/events","html_url":"https://github.com/angular-translate/angular-translate/issues/1589","id":177404144,"number":1589,"title":"sce sanitization strategy is not secure","user":{"login":"kazinov","id":13249813,"avatar_url":"https://avatars.githubusercontent.com/u/13249813?v=3","gravatar_id":"","url":"https://api.github.com/users/kazinov","html_url":"https://github.com/kazinov","followers_url":"https://api.github.com/users/kazinov/followers","following_url":"https://api.github.com/users/kazinov/following{/other_user}","gists_url":"https://api.github.com/users/kazinov/gists{/gist_id}","starred_url":"https://api.github.com/users/kazinov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kazinov/subscriptions","organizations_url":"https://api.github.com/users/kazinov/orgs","repos_url":"https://api.github.com/users/kazinov/repos","events_url":"https://api.github.com/users/kazinov/events{/privacy}","received_events_url":"https://api.github.com/users/kazinov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-16T11:32:22Z","updated_at":"2016-09-16T13:31:45Z","closed_at":null,"body":"Hi,\r\n\r\n`sce` strategy uses ```$sce.trustAsHtml``` which does nothing against unsecure html and javascript.\r\n\r\nI modified your plunker example added onmouseover='document.write(666);'  to it.\r\nhttp://plnkr.co/edit/BOvjiLQmHMH7YwFlcLsM?p=preview\r\nAnd obviously javascript was evaluated using `sce` strategy.\r\n`sanitize` strategy works well.\r\n\r\nSo why ```useSanitizeValueStrategy('sce')``` strategy is better that simple ```useSanitizeValueStrategy(null)```?"},"comment":{"url":"https://api.github.com/repos/angular-translate/angular-translate/issues/comments/247601125","html_url":"https://github.com/angular-translate/angular-translate/issues/1589#issuecomment-247601125","issue_url":"https://api.github.com/repos/angular-translate/angular-translate/issues/1589","id":247601125,"user":{"login":"knalli","id":65389,"avatar_url":"https://avatars.githubusercontent.com/u/65389?v=3","gravatar_id":"","url":"https://api.github.com/users/knalli","html_url":"https://github.com/knalli","followers_url":"https://api.github.com/users/knalli/followers","following_url":"https://api.github.com/users/knalli/following{/other_user}","gists_url":"https://api.github.com/users/knalli/gists{/gist_id}","starred_url":"https://api.github.com/users/knalli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/knalli/subscriptions","organizations_url":"https://api.github.com/users/knalli/orgs","repos_url":"https://api.github.com/users/knalli/repos","events_url":"https://api.github.com/users/knalli/events{/privacy}","received_events_url":"https://api.github.com/users/knalli/received_events","type":"User","site_admin":false},"created_at":"2016-09-16T13:31:45Z","updated_at":"2016-09-16T13:31:45Z","body":"Well, it you cannot trust your own translation texts, you will have to use `escape`.\r\n\r\nIf you can trust your translation texts (so trust them), you probably should always escape the params (because they are unsafe).\r\n\r\nIf you replace your `document.write` with a less \"explosive\" `console.log` (and count the different translation texts) as in http://plnkr.co/edit/I44HyUrXg6yPiu63LDWt?p=preview, you will see only the translation texts are being injected."}}
{"actor":{"display_login":"knalli"}}