diff --git a/services/web/scripts/translations/sanitize.js b/services/web/scripts/translations/sanitize.js index 223feb801d..4f2469c7dc 100644 --- a/services/web/scripts/translations/sanitize.js +++ b/services/web/scripts/translations/sanitize.js @@ -25,6 +25,9 @@ function sanitize(input) { a: ['href', 'class'], }, textFilter(text) { + // Block Angular XSS + if (text === '{') return '{' + if (text === '}') return '}' return text .replace(/\{\{/, '{{') .replace(/\}\}/, '}}')