#32 ✓invalid
Domizio Demichelis

The translation helper is unsafe!

Reported by Domizio Demichelis | November 23rd, 2010 @ 01:33 PM

(ActionView::Helpers::TranslationHelper.translate)

If a translation key has the suffix "_html or the last element of the key is the word "html" the returned string is marked as safe_html.

That is unsafe because the interpolated variables might be unsafe an the helper is marking them as safe without escaping.

Example:

your_key_html: "<b>This is a</b> %{unsafe}  output because it is %{something} against the %{rails} policy"

When you use it in possible many place in the application you have to remember that you must manually escape all the variables all the time you use it, that's because the helper will mark the translated string as safe, regardless to what is contained (the html_safe? status) in the interpolated variables.

If you use the translation of the example in 10 places, you will have to remember to escape 30 variables, and that is not only silly but is a main source of problems. Besides it is specially bad because it works against the new rails policy, that allows you to forget about security and just have everything escaped automatically. IMHO that is a mayor breach of security.

Every helper that produce html MUST escape the (potentially unsafe) input, adding its own html (which is obviously safe) and mark its output as safe. That way the input that contains html marked as safe will not be escaped (because the h(variable) mark for escape only what is not marked as safe).

We need to keep the html suffix as a convention to mark the base translation string as safe BUT the interpolated variables MUST be escaped, AND the output must be always marked as safe. In case the base translation string is not marked as safe (not "html" suffixed) it must be escaped as well, AND the output must be marked as safe.

In conclusion the helper must always return a safe_html string, escaping the base translation string when its key is not suffixed with "html" and must escape all the interpolated variable.

If you agree with the principle, I could write a patch for that. Please, let me know. Thank you.

Comments and changes to this ticket

  • Sven Fuchs

    Sven Fuchs December 26th, 2010 @ 05:58 PM

    • State changed from “new” to “invalid”

    Hi ddnexus,

    your approach sounds good to me. I think this lighthouse is the wrong place to report though because the translation helper is part of Rails.

    Could you reopen the ticket over at Rails' lighthouse and provide a patch?

    Thanks a lot! :)

    https://rails.lighthouseapp.com/

    Will close the ticket here.

  • murphy (at rubychan)

    murphy (at rubychan) November 4th, 2011 @ 12:07 PM

    Hi ddnexus and Sven!

    Apparently, the issue never got fixed in Rails 2.3 or later.

    I couldn't find any corresponding ticket in the Rails project, so I will create a new one.

    In any case, here's a simple patch for 2.3:

    # abandoned ticket from 2010-11-23: http://i18n.lighthouseapp.com/projects/14948/tickets/32-the-translation-helper-is-unsafe
    module ActionView::Helpers::TranslationHelper
      def translate_with_html_safe_options(keys, options = {})
        if !options.empty? && keys =~ /(\b|_|\.)html$/
          options = {}.tap do |html_safe_options|
            for name, value in options
              html_safe_options[name] = h(value)
            end
          end
        end
        
        translate_without_html_safe_options keys, options
      end
      alias t_with_html_safe_options translate_with_html_safe_options
      
      alias_method_chain :translate, :html_safe_options
      alias_method_chain :t,         :html_safe_options
    end
    
  • game online

    game online November 30th, 2018 @ 10:43 AM

    You can easily to play with friends in your computer,now one a single click here this site and read the basic info http://tanktrouble.xyz many users have no idea how do i play or control this game.

  • Nexplas35

    Nexplas35 May 16th, 2019 @ 08:27 AM

    This HTML translation helper is not safe to use. so must be aware of it and try to avoid its much as possible. Get the uk best essays which is more useful for the all level of university students. Thank you for letting us aware about this fact that will keep my device safe and sound.

  • Linda34

    Linda34 May 23rd, 2019 @ 12:33 PM

    if you are looking for best guitar then check out guitar guru

  • roger lagasca

    roger lagasca October 1st, 2019 @ 11:17 PM

    I thought it was going to be some boring old post, but it really compensated for my time. I will post a link to this page on my blog. I am sure my visitors will find that very useful. facebook

  • Will Sam

    Will Sam October 5th, 2019 @ 02:15 PM

    Thanks for raising a ticket. I have tried the same i got the same error. Looking forward to fix this soon. Menwhile try the following links to get fixed.

    deals saving offers promos discounts sale

  • Clark

    Clark October 28th, 2019 @ 05:55 PM

    Thank you for sharing this information. x`

  • Jamie anderson

    Jamie anderson February 28th, 2020 @ 12:42 PM

    Really good and important. You've really helped many people reading the blog and supplying them with useful information.

    business intelligence assignment help
    business intelligence assignment help

  • Mike Symonds

    Mike Symonds February 29th, 2020 @ 09:09 AM

    This article is great as well as inspiring. I'm pretty pleased with your fantastic work. You put information that's really very helpful. Keep up. Keep on blogging. Expecting to read your next post. Here we have information about it management assignment help

    it management assignment help

  • peyila

    peyila March 14th, 2020 @ 10:56 AM

    I really appreciate this wonderful post that you have provided for us. I assure this would be beneficial for most of the people. 안전놀이터

  • peyila

    peyila March 15th, 2020 @ 12:46 PM

    I use basically superior fabrics : you will discover these products by: the lost book of herbal remedies by nicole

  • Austin Taylor

    Austin Taylor March 16th, 2020 @ 08:31 AM

    It was a piece of nice information shared by the author. Please share some more articles.

    expository essays help online

    help in mba assignment by experts

  • peyila

    peyila March 18th, 2020 @ 10:53 PM

    Amazing, this is great as you want to learn more, I invite to This is my page. اعلانات انستغرام

  • peyila

    peyila March 21st, 2020 @ 10:25 AM

    Normally when I browse the internet I search for web-sites that provide reliable information and so I found this site. Very often when I have been to this web site I've truly really liked the great content listed here. I will be certain to look for your next post.. Thanks for the fantastic post I am going to come back in the future. germany call forwarding

  • peyila

    peyila March 21st, 2020 @ 06:01 PM

    I just thought it may be an idea to post incase anyone else was having problems researching but I am a little unsure if I am allowed to put names and addresses on here. 안전공원

  • peyila

    peyila March 22nd, 2020 @ 11:48 AM

    Initial You got a awesome blog .I determination be involved in plus uniform minutes. i view you got truly very functional matters , i determination be always checking your blog blesss. 온라인카지노

  • peyila

    peyila March 22nd, 2020 @ 12:00 PM

    wow this saintly however ,I love your enter plus nice pics might be part personss negative love being defrent mind total poeple , 안전놀이터

  • peyila

    peyila March 23rd, 2020 @ 11:46 AM

    This is very interesting content! I have thoroughly enjoyed reading your points and have come to the conclusion that you are right about many of them. You are great. мебели софия

  • peyila

    peyila March 23rd, 2020 @ 11:53 AM

    On that website page, you'll see your description, why not read through this. мебели варна

  • peyila

    peyila March 24th, 2020 @ 08:26 AM

    Here you will learn what is important, it gives you a link to an interesting web page: avenir price

  • peyila

    peyila March 24th, 2020 @ 08:30 AM

    You bear through a awesome vacancy. I sanity definitely quarry it moreover personally suggest to my buddys. I am self-possessed they determination be benefited from this scene. hyll on Holland price

  • peyila

    peyila March 24th, 2020 @ 08:33 AM

    This is helpful, nonetheless it can be crucial so that you can check out the following website: van Holland price

  • peyila

    peyila March 24th, 2020 @ 08:36 AM

    Gives you the best website address I know there alone you'll find how easy it is. the landmark price

  • peyila

    peyila March 24th, 2020 @ 08:38 AM

    You should mainly superior together with well-performing material, which means that see it: the m condo showflat

  • peyila

    peyila March 24th, 2020 @ 08:41 AM

    Your texts on this subject are correct, see how I wrote this site is really very good. peak residence price

  • peyila

    peyila March 24th, 2020 @ 08:43 AM

    Within this webpage, you'll see the page, you need to understand this data. forett at bukit timah price

  • BRAVO

    BRAVO May 18th, 2020 @ 10:01 PM

    It is fine, nonetheless evaluate the information and facts around this correct. เซ็กซี่ บาคาร่า

  • ISOPro9001

    ISOPro9001 May 20th, 2020 @ 11:53 AM

    Really appreciate this wonderful post that you have provided for us.
    I assure this would be beneficial for most of the people.
    I'm going to highly recommend this web site!

    ISO 9001 Certification in Saudi Arabia

  • John Barban

    John Barban May 23rd, 2020 @ 10:29 AM

    John barban's weight loss pill called Resurge Resurge is the world’s first fat burning supplement that cures the exact cause of overweight and stubborn belly fat. It contains unique and 100% natural ingredients to reduce fat and to provide a good and peaceful deep sleep.

  • John Barban

    John Barban May 23rd, 2020 @ 10:30 AM

    On our assessment and research on these fat burning supplements now available in the market, we found that the Resurge weight loss supplement is an effective supplement to burn out stubborn fat. So we framed Resurge review for you.

  • Hallams home
  • mursalin

    mursalin June 27th, 2020 @ 06:48 PM

    Really very happy to say, your post is very interesting to read. I never stop myself to say something about it. You’re doing a great job.Keep it up San Diego, CA .. heating repair .. hvac santee

  • Hallams home

    Hallams home June 30th, 2020 @ 02:50 PM

    Your Post is very useful, I am truly happy to post my note on this blog . It helped me with ocean of awareness so I really consider you will do much better in the future. tree surgeons

  • Hallams home

    Hallams home July 11th, 2020 @ 10:03 AM

    Good topic, this is going to help a lot of people get the whole concept shark loans bad credit

  • Nafia Sch

    Nafia Sch August 15th, 2020 @ 02:29 PM

    Great post.. glad i came across this looking forward to share this with everyone here 
    Thanks for sharing

    The Ryse Residences
    Florence Residence
    3 Cuscaden
    Avenue South Residence
    Sengkang Grand Residences
    The Avenir
    Affinity at Serangoon

  • lookpong

    lookpong August 18th, 2020 @ 10:11 AM

    XOPGSLOT
    PG Slot Auto คือ ระบบเติมเงิน ฝาก ถอน เครดิต อัตโนมัติ ตลอด 24 ชั่วโมง โดยไม่ต้องผ่าน Call Center การสมัครสมาชิกรูปแบบใหม่ ฝาก ถอน เครดิต
    ด้วยตัวเองด้วยระบบเทพรวดเร็ว ปลอดภัย ระบบสมบูรณ์ 100% FULL PREMIUM AUTO (ฝาก-ถอน 15 วินาที) เจ้าแรกในไทย พร้อมให้บริการแล้ว

    https://www.xopgslot.com/
    https://youtu.be/byhMYo44lgc

  • lookpong

    lookpong August 18th, 2020 @ 10:12 AM

    XOSLOTXO
    SLOTXO AUTO ระบบเติม ถอน เครดิต อัตโนมัติโดยไม่ต้องผ่าน Call Center พบกับประสบการณ์ใหม่ในการสมัครสมาชิก ฝาก ถอน เครดิต ด้วยตัวเองกับระบบอัตโนมัติที่รวดเร็ว ปลอดภัย ระบบสมบรูณ์ 100% เจ้าแรกแห่งปรพเทศไทย

    https://www.xoslotxo.com/
    https://youtu.be/45Hyfhm6L_Y

  • lookpong

    lookpong August 25th, 2020 @ 09:42 AM

    JOKER AUTO https://xojoker.com/
    ไม่ว่าคุณจะเป็นผู้เล่นใหม่ที่ไม่เคยเล่นสล็อตมาก่อนในชีวิต หรือผู้เล่น ระดับ MATER คุณไม่ควรพลาดความสนุกทุกช่วงเวลาไปกับ JOKER SLOT อย่างแน่นอน เพราะเรามีภาพกราฟฟิกที่ดีเยี่ยม และระบบอัตโนมัติที่รวดเร็ว ที่ใช้เวลาเพียงแค่ไม่ถึง 1 นาที ก็เพลิดเพลินไปกับเกมส์สล็อตได้อย่างไม่มีขีดจำกัด ได้ที่ XOJOKER https://xojoker.com/

  • lookpong
  • mikebrown897

    mikebrown897 September 7th, 2020 @ 12:44 PM

    For Word Excel and PowerPoint tutorials visit Office.com/setup

  • mikebrown897

    mikebrown897 September 7th, 2020 @ 12:45 PM

    Lets get all the basics of powerpoint and excel with the help of shortcuts. All new features available.
    All new tutorials Office.com/setup

  • coupon malasiya

    coupon malasiya September 10th, 2020 @ 12:06 PM

    you are able to explore fashion. Amazon Coupon Code This is the latest, trendy, exciting, unique, etc.

  • lookpong

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Repository for collecting Locale data for Ruby on Rails I18n as well as other interesting, Rails related I18n stuff

Pages