Angular Translate sanitizing proposal

default-interpolation.js

/**
 * @ngdoc object
 * @name pascalprecht.translate.$translateDefaultInterpolation
 * @requires $interpolate
 *
 * @description
 * Uses angular's `$interpolate` services to interpolate strings against some values.
 *
 * @return {object} $translateInterpolator Interpolator service
 */
angular.module('pascalprecht.translate').factory('$translateDefaultInterpolation', ['$interpolate', '$injector', function($interpolate, $injector){

    var $translateInterpolator = {},
        $locale,
        $identifier = 'default',
        $sanitize,
        $sanitizeValueStrategy = null,

    // map of all sanitize strategies
        sanitizeValueStrategies = {
            sanitize: function(value){
                if(angular.isString(value)){
                    sanitizeValue(value);
                }
                else{
                    return value;
                }
            },
            escape: function(value){
                if(angular.isString(value)){
                    return escapeValue(value);
                }
                else{
                    return value;
                }
            },
            escapeParameters: function(value){
                if(angular.isString(value)){
                    return value;
                }
                else{
                    return mapInterpolateParameters(value, escapeValue);
                }
            },
            sanitizeParameters: function(value){
                if(angular.isString(value)){
                    return value;
                }
                else{
                    return mapInterpolateParameters(value, sanitizeValue);
                }
            },
            'sanitize-escapeParameters': function(value){
                if(angular.isString(value)){
                    return sanitizeValueStrategies.sanitize(value);
                }
                else{
                    return sanitizeValueStrategies.escapeParameters(value);
                }
            }
        };
    // Support legacy strategy name 'escaped' for backwards compatability. Should be removed in 3.0
    sanitizeValueStrategies.escaped = sanitizeValueStrategies.escapeParameters;

    var applySanitizeStrategy = function(value){
        if(angular.isFunction(sanitizeValueStrategies[$sanitizeValueStrategy])){
            return sanitizeValueStrategies[$sanitizeValueStrategy](value);
        }
        else if(angular.isFunction($sanitizeValueStrategy)){
            return $sanitizeValueStrategy(value);
        }
        return value;
    };

    var escapeValue = function(value){
        return angular.element('<div></div>').text(value).html();
    };

    var sanitizeValue = function(value){
        $sanitize = $sanitize || $injector.get('$sanitize', '$translateDefaultInterpolation');
        return $sanitize(value);
    };

    var mapInterpolateParameters = function(parameters, iteratee){
        var result = {};
        for(var key in parameters){
            if(Object.prototype.hasOwnProperty.call(parameters, key)){
                var value = parameters[key];
                if(angular.isNumber(value)){
                    result[key] = value;
                }
                else if(angular.isObject(value)){
                    result[key] = mapInterpolateParameters(value, iteratee);
                }
                else{
                    result[key] = iteratee(value);
                }
            }
        }
        return result;
    };

    /**
     * @ngdoc function
     * @name pascalprecht.translate.$translateDefaultInterpolation#setLocale
     * @methodOf pascalprecht.translate.$translateDefaultInterpolation
     *
     * @description
     * Sets current locale (this is currently not use in this interpolation).
     *
     * @param {string} locale Language key or locale.
     */
    $translateInterpolator.setLocale = function(locale){
        $locale = locale;
    };

    /**
     * @ngdoc function
     * @name pascalprecht.translate.$translateDefaultInterpolation#getInterpolationIdentifier
     * @methodOf pascalprecht.translate.$translateDefaultInterpolation
     *
     * @description
     * Returns an identifier for this interpolation service.
     *
     * @returns {string} $identifier
     */
    $translateInterpolator.getInterpolationIdentifier = function(){
        return $identifier;
    };

    $translateInterpolator.useSanitizeValueStrategy = function(value){
        $sanitizeValueStrategy = value;
        return this;
    };

    /**
     * @ngdoc function
     * @name pascalprecht.translate.$translateDefaultInterpolation#interpolate
     * @methodOf pascalprecht.translate.$translateDefaultInterpolation
     *
     * @description
     * Interpolates given string agains given interpolate params using angulars
     * `$interpolate` service.
     *
     * @returns {string} interpolated string.
     */
    $translateInterpolator.interpolate = function(string, interpolateParams){
        if($sanitizeValueStrategy){
            interpolateParams = applySanitizeStrategy(interpolateParams);
        }
        var result = $interpolate(string)(interpolateParams || {});
        if($sanitizeValueStrategy){
            result = applySanitizeStrategy(result);
        }
        return result;
    };

    return $translateInterpolator;
}]);

Changes in this default-interpolation.js compared to the original:

1. Added new strageties.
2. Added support for strategies which are a custom function
3. The strategy is now also applied to the whole result
4. Added recursion to the escaping / sanitizing of parameters