Tuesday, February 11, 2025
1 change
Security fixes and vulnerability patches
Translated text in the web interface now handles embedded formatting more safely by escaping regular text automatically when formatted markup is included. This reduces the risk of unsafe content appearing in the browser while also simplifying how developers create translated messages with formatting.
Original PR description
Automatically escape source terms and non-markup values passed to _t if at least one of the inserted values in a markup. This approach is believed to have the following benefits: - More XSS-proof -…
Automatically escape source terms and non-markup values passed to _t if at least one of the inserted values in a markup.
This approach is believed to have the following benefits:
- More XSS-proof
- Any piece of HTML that needs to be inserted has to be wrapped in a call to markup. This will increase the number of lines requiring special attention that will be caught by the CI/security check.
- Any part of the translated string that's not markup is escaped.
- Better syntax
- It eliminates the need for the sprintf function to insert markup into the safely escaped translated string, as well as the need for the escape function to escape the string itself and the interpolated non-markup values.
- API consistency (i.e. it matches the behavior of gettext with markups as it currently exists on the Python side)
```js
return markup(
sprintf(escape(_t("Create %(value)s as a new %(field)s?")), {
value: `<strong>${escape(this.props.value)}</strong>`,
field: escape(this.props.name),
})
);
```
```js
return _t("Create %(value)s as a new %(field)s?", {
value: markup(`<strong>${escape(this.props.value)}</strong>`),
field: this.props.name,
});
```
Task-4519529
Backport of odoo/odoo#195291
Related to https://github.com/odoo/enterprise/pull/78717