mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
Merge pull request from GHSA-cfjv-5498-mph5
Prior to this commit, when a translation key indicated that the translation text was HTML, the value returned by `I18n.translate` would always be marked as `html_safe`. However, the value returned by `I18n.translate` could be an untrusted value directly from `options[:default]`. This commit ensures values directly from `options[:default]` are not marked as `html_safe`.
This commit is contained in:
parent
5259062868
commit
e663f08446
2 changed files with 15 additions and 1 deletions
|
@ -96,9 +96,13 @@ module ActionView
|
|||
end
|
||||
end
|
||||
|
||||
html_safe_options[:default] = MISSING_TRANSLATION unless html_safe_options[:default].blank?
|
||||
|
||||
translation = I18n.translate(fully_resolved_key, **html_safe_options.merge(raise: i18n_raise))
|
||||
|
||||
if translation.respond_to?(:map)
|
||||
if translation.equal?(MISSING_TRANSLATION)
|
||||
translated_text = options[:default].first
|
||||
elsif translation.respond_to?(:map)
|
||||
translated_text = translation.map { |element| element.respond_to?(:html_safe) ? element.html_safe : element }
|
||||
else
|
||||
translated_text = translation.respond_to?(:html_safe) ? translation.html_safe : translation
|
||||
|
@ -150,6 +154,9 @@ module ActionView
|
|||
alias :l :localize
|
||||
|
||||
private
|
||||
MISSING_TRANSLATION = Object.new
|
||||
private_constant :MISSING_TRANSLATION
|
||||
|
||||
def scope_key_by_partial(key)
|
||||
stringified_key = key.to_s
|
||||
if stringified_key.start_with?(".")
|
||||
|
|
|
@ -247,6 +247,13 @@ class TranslationHelperTest < ActiveSupport::TestCase
|
|||
assert_equal false, translation.html_safe?
|
||||
end
|
||||
|
||||
def test_translate_does_not_mark_unsourced_string_default_as_html_safe
|
||||
untrusted_string = "<script>alert()</script>"
|
||||
translation = translate(:"translations.missing", default: [:"translations.missing_html", untrusted_string])
|
||||
assert_equal untrusted_string, translation
|
||||
assert_not_predicate translation, :html_safe?
|
||||
end
|
||||
|
||||
def test_translate_with_string_default
|
||||
translation = translate(:'translations.missing', default: "A Generic String")
|
||||
assert_equal "A Generic String", translation
|
||||
|
|
Loading…
Reference in a new issue