{"action":"created","issue":{"url":"https://api.github.com/repos/gadicc/meteor-messageformat/issues/206","repository_url":"https://api.github.com/repos/gadicc/meteor-messageformat","labels_url":"https://api.github.com/repos/gadicc/meteor-messageformat/issues/206/labels{/name}","comments_url":"https://api.github.com/repos/gadicc/meteor-messageformat/issues/206/comments","events_url":"https://api.github.com/repos/gadicc/meteor-messageformat/issues/206/events","html_url":"https://github.com/gadicc/meteor-messageformat/issues/206","id":137687874,"number":206,"title":"translate: include html-tags","user":{"login":"1u","id":4281072,"avatar_url":"https://avatars.githubusercontent.com/u/4281072?v=3","gravatar_id":"","url":"https://api.github.com/users/1u","html_url":"https://github.com/1u","followers_url":"https://api.github.com/users/1u/followers","following_url":"https://api.github.com/users/1u/following{/other_user}","gists_url":"https://api.github.com/users/1u/gists{/gist_id}","starred_url":"https://api.github.com/users/1u/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/1u/subscriptions","organizations_url":"https://api.github.com/users/1u/orgs","repos_url":"https://api.github.com/users/1u/repos","events_url":"https://api.github.com/users/1u/events{/privacy}","received_events_url":"https://api.github.com/users/1u/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/gadicc/meteor-messageformat/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-01T21:09:44Z","updated_at":"2016-03-10T15:40:52Z","closed_at":null,"body":"As we don't trust all translators (cause crowd-sourced, Cross-Site-Scripting..), we'd like to always escape most html from mf-strings.  \r\n\r\nWe thought about making an individual href-helper for `{{mf 'click_here' 'Click [[here]] to open.' href='/page1'}}` that generates a link for the string in angle brackets. (in this issue: https://github.com/schuel/hmmm/issues/277)\r\n\r\nOr either we could\r\n- create a special `mfHtml`-helper that allows several tags (`a`, `b`, `i`..):\r\n`{{{ mfHtml 'key' 'Propose <a href=\"/course/propose\">with our form</a>'}}}` resp.\r\n`{{{ mfHtml 'key' 'Propose <a href=\"{LINK}\">with our form</a>' LINK='/course/propose'}}}`\r\nwith html-scrubber-library for client-side, that cleans before displaying. we would only clean if mfHtml is used (otherwise html is not displayed at all).\r\n- Or we would clean most html when writing on serverside. But the server doen't know what mf-helper was used, so we would clean in all cases. (We would remove/escape all html-tags exept for Example`<a href=\"` or `<emph>`  that are written into db, if you still need `<` you would have to use `&lt;`)\r\n\r\n----\r\n\r\nAre you planing/interested in solving this problem in messageformat generally? \r\nWhat are your thoughts on this so far?\r\n(There is some related thoughts about this in #161 as well.)\r\n\r\n### What syntax could then be used?\r\n\r\nIf used only for a-tags (which I guess is the most used case) it could be:\r\n`{{mf 'klick_here' 'Click [[here]] to open.' href='http://messageformat.meteor.com'}}`\r\n\r\nOr shall there be a general solution with other html-tags supported? Some other syntax proposals:\r\n`{{mf 'important' 'This is [important]!' tag='<b>'}}`\r\n`{{mf 'klick_here' 'Click [here].' tag='<a href=\"http://example.com\">'}}`\r\nor: (maybe a bit easier for translators, cause easier distinction to {NAME} which doesn't need to be translated)\r\n`{{mf 'we_believe' 'We <>believe<> in this.' tag='<emph>'}}`\r\n`{{mf 'two lines' 'one line<>next line.' tag='<br />'}}`\r\nor: (to combine multiple tags in one string)\r\n`{{mf 'crossed' 'I remove <1>all<1>, <2>most<2>.' tag1='<del>' tag2='<b>'}}`\r\n`{{mf 'crossed' 'I remove <1>all<2>, <3>most<4>.' tag1='<del>' tag1='</del>' tag3='<b>' tag4='</b>'}}`\r\n\r\nJust brainstorming... and curious about your thoughts.\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/gadicc/meteor-messageformat/issues/comments/194910926","html_url":"https://github.com/gadicc/meteor-messageformat/issues/206#issuecomment-194910926","issue_url":"https://api.github.com/repos/gadicc/meteor-messageformat/issues/206","id":194910926,"user":{"login":"gadicc","id":381978,"avatar_url":"https://avatars.githubusercontent.com/u/381978?v=3","gravatar_id":"","url":"https://api.github.com/users/gadicc","html_url":"https://github.com/gadicc","followers_url":"https://api.github.com/users/gadicc/followers","following_url":"https://api.github.com/users/gadicc/following{/other_user}","gists_url":"https://api.github.com/users/gadicc/gists{/gist_id}","starred_url":"https://api.github.com/users/gadicc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gadicc/subscriptions","organizations_url":"https://api.github.com/users/gadicc/orgs","repos_url":"https://api.github.com/users/gadicc/repos","events_url":"https://api.github.com/users/gadicc/events{/privacy}","received_events_url":"https://api.github.com/users/gadicc/received_events","type":"User","site_admin":false},"created_at":"2016-03-10T15:40:52Z","updated_at":"2016-03-10T15:40:52Z","body":"Hey, agree those helpers make things a lot easier, but I'm reluctant to encourage strings that wouldn't work in regular messageformat.  We could maybe introduce a new messageformat extension like:\r\n\r\n```\r\nClick {href, link, here}\r\n```\r\n\r\n(where `href` is the variable, `link` is the extension, and `here` is the translatable text`), or something... maybe check if anyone else has addressed this problem.  For now, as you maybe saw in #161 and #164, we have some recommendations at the very bottom of http://messageformat-v2.meteor.com/examples.\r\n\r\nI used this as an opportunity to properly implement the `_html` attribute - to allow HTML in a message (including via parameter substition, like our \"A1a\" example in the link above) - see the commit above; take a look.  By default it will pass through `html-sanitizer`, and instead of `_html=true`, you could pass the name of a \"preset\".  Presets are added in JS and can be either options for `html-sanitizer` or the user's own custom function."}}