i18n sanitization strategy warning about sqid

[mkroetzsch]

I am also concerned by this. It is planned to extend SQID for remote editing of Wikidata (OAUTH based), so XSS could be a real issue then.

I do not know what would be needed to exploit this potential issue. Can anyone do this without having write access to our message files? I have tested what happens with HTML characters in, e.g., item labels, but I could not produce any problems there.

OTOH, I have not found any way to have HTML variable replacements with any form of sanitization. It seems that this feature is not well developed in angular translate, since there is no advanced sanitization that can allow restricted (or custom) HTML. I also don't know of any other hook to inject values before display.

In any case, it would be nice if we could at least switch off the public advertisement of this possible security issue in the console.