Skip to content
This repository has been archived by the owner on Jan 29, 2024. It is now read-only.

Offer alternative MessageFormat renderer to resolve CSP issues #1875

Open
oliversalzburg opened this issue Jan 31, 2019 · 0 comments
Open

Offer alternative MessageFormat renderer to resolve CSP issues #1875

oliversalzburg opened this issue Jan 31, 2019 · 0 comments

Comments

@oliversalzburg
Copy link

Due to the way MessageFormat is implemented in angular-translate, it is not possible to build a satisfactory CSP (#1227). The MessageFormat.js team suggests to pre-compile your expressions and not use the compiler at runtime. The current implementation in angular-translate specifically relies on the runtime compiler though.

The MessageFormat.js team suggested that there is an alternative implementation in intl-messageformat (messageformat/messageformat#180) that could be utilized, which doesn't have the same CSP implications.

I'm currently testing https://github.com/fairmanager/angular-translate-interpolation-intlmessageformat and it seems to work fine just as a drop-in replacement. I think it would be nice if an alternative renderer could be offered officially with this package or if the topic could be addressed in documentation.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

2 participants