I have html code which has to be generated in different languages.
Click <a href="https://here">here</a>
Kliknij <a href="https://here">tutaj</a>
How to handle this simple example with i18n and Thymeleaf assuming that url is a user input?
I try:
messages.click_here = Click <a href="{0}">here</a>
and then in thymeleaf:
<span th:text="#{messages.click_here(${url})}"></span>
but then my code is not interpreted as HTML
so I can use utext
<span th:utext="#{messages.click_here(${url})}"></span>
But now my application is exposed to code injection. Someone could pass malicious parameter through ${url}, close the tag and generate js. utext can do anything.
What is the best solution for this?