You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jan 29, 2024. It is now read-only.
Describe your issue here.
$translate.instant with angular expression, such like: {{constructor.constructor('alert(JSON.stringify(localStorage))')()}}
lt will pop alart after run this logic
Your environment
version of angular-translate 2.18.1
version of angular 1.8.2
which browser and its version Chrome Version 104.0.5112.81
Steps to reproduce
Tell us how to reproduce this issue. Please provide a working demo, you can use this template as a base.
Expected behaviour
Tell us what should happen
Actual behaviour
Tell us what happens instead
The text was updated successfully, but these errors were encountered:
angular-translate relies on the same technique under the hood when interpolating your variables. The translation keys are meant to be string keys and in your control. Both template and translation keys should be under your (and your app's) control.
In security aspects, that is not ideal. But the official long term support of AngularJS has also stopped at the beginning of this year.
If you think there is a reasonable fix for this without breaking everything, you are welcome making a PR.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Subject of the issue
Describe your issue here.
$translate.instant with angular expression, such like: {{constructor.constructor('alert(JSON.stringify(localStorage))')()}}
lt will pop alart after run this logic
Your environment
Steps to reproduce
Tell us how to reproduce this issue. Please provide a working demo, you can use this template as a base.
Expected behaviour
Tell us what should happen
Actual behaviour
Tell us what happens instead
The text was updated successfully, but these errors were encountered: