#32 ✓invalid
Domizio Demichelis

The translation helper is unsafe!

Reported by Domizio Demichelis | November 23rd, 2010 @ 01:33 PM

(ActionView::Helpers::TranslationHelper.translate)

If a translation key has the suffix "_html or the last element of the key is the word "html" the returned string is marked as safe_html.

That is unsafe because the interpolated variables might be unsafe an the helper is marking them as safe without escaping.

Example:

your_key_html: "<b>This is a</b> %{unsafe}  output because it is %{something} against the %{rails} policy"

When you use it in possible many place in the application you have to remember that you must manually escape all the variables all the time you use it, that's because the helper will mark the translated string as safe, regardless to what is contained (the html_safe? status) in the interpolated variables.

If you use the translation of the example in 10 places, you will have to remember to escape 30 variables, and that is not only silly but is a main source of problems. Besides it is specially bad because it works against the new rails policy, that allows you to forget about security and just have everything escaped automatically. IMHO that is a mayor breach of security.

Every helper that produce html MUST escape the (potentially unsafe) input, adding its own html (which is obviously safe) and mark its output as safe. That way the input that contains html marked as safe will not be escaped (because the h(variable) mark for escape only what is not marked as safe).

We need to keep the html suffix as a convention to mark the base translation string as safe BUT the interpolated variables MUST be escaped, AND the output must be always marked as safe. In case the base translation string is not marked as safe (not "html" suffixed) it must be escaped as well, AND the output must be marked as safe.

In conclusion the helper must always return a safe_html string, escaping the base translation string when its key is not suffixed with "html" and must escape all the interpolated variable.

If you agree with the principle, I could write a patch for that. Please, let me know. Thank you.

Comments and changes to this ticket

  • duawazifa

    duawazifa February 9th, 2024 @ 11:32 AM

    In this blog post, we will explore the power of dua for the deceased, its importance, and how we can use it to find comfort during difficult times.

  • Arjun Mohan

    Arjun Mohan April 17th, 2024 @ 02:44 PM

    • no changes were found...
  • William Patel

    William Patel May 31st, 2024 @ 01:09 PM

    Hi all, I am William Patel working as Software Tester in a leading IT company named TrijaTech Software . It is a top notch software development company that designs tools related to data/cloud migration, file recovery ,etc. It offers wide range of automated tools along with 24*7 customer tech support. The products are designed by advanced algorithms which helps in safe and secure data handling. Any common user can opt for these utilities and complete the task effortlessly.

  • hsolritik

    hsolritik June 17th, 2024 @ 11:32 AM

    Hello, I'm Ritik from the technical team, here to assist you with any issues related to email not receiving. If you're facing problems with your email not arriving in your inbox, our website offers a range of solutions to help you resolve these issues quickly and efficiently. We understand the importance of reliable email communication and aim to provide you with the tools and knowledge to troubleshoot and fix these problems.

    Whether you're a seasoned email user or new to managing email accounts, our website is designed to provide clear and practical advice to help you ensure your emails are received without interruption. Explore our resources for expert tips on diagnosing and solving common issues that prevent emails from reaching your inbox, including server settings, spam filters, and more.

    For those with a keen interest in technical solutions, I encourage you to read my latest blog post, where I delve into the various aspects of resolving email not receiving issues. In this post, I share valuable insights, step-by-step instructions, and recommendations based on our team's extensive experience. Stay informed and empowered as you learn how to address and prevent email delivery problems effectively.

    Visit our website today to find comprehensive solutions to email not receiving issues and enhance your email experience.

  • prakash

    prakash June 19th, 2024 @ 02:38 PM

    Comprehensive Solutions for YouTube TV Black Screen Issues

    In the realm of digital entertainment, YouTube TV has revolutionized how we consume media, offering a diverse array of channels and content accessible via internet streaming. However, encountering a YouTube TV black screen can be a frustrating setback, disrupting your viewing experience and leaving you searching for solutions. At Help-N-Support, we specialize in diagnosing and resolving such issues to ensure seamless streaming experiences for our users.

    Understanding YouTube TV Black Screen Problems

    A YouTube TV black screen can manifest for various reasons, ranging from device-specific issues to connectivity problems or software glitches. Common triggers include outdated browser versions, incompatible device settings, or network connectivity issues. Our dedicated support team is well-versed in identifying these root causes through systematic troubleshooting methods.

  • prakash

    prakash June 19th, 2024 @ 02:42 PM

    Competitive Pricing for Roof PUF Panel 80mm

    Discover the competitive pricing of Roof PUF Panel 80mm at Big Value Shop. These panels are meticulously designed to offer superior thermal insulation for roofs, ensuring optimal energy efficiency and substantial cost savings over time. Whether you're upgrading an existing structure or embarking on a new construction project, our Roof PUF Panels 80mm provide a reliable solution to enhance comfort and reduce heating and cooling expenses. Visit our website today to explore more about the benefits and technical specifications of our Roof PUF Panels 80mm, and place your order conveniently online to transform your building's insulation capabilities.

  • prakash

    prakash June 19th, 2024 @ 02:47 PM

    Troubleshooting Guide: Router Keeps Dropping WiFi Signal

    If your router is experiencing frequent drops in WiFi signal, it can be frustrating and disruptive to your internet connectivity. At Contact Help Support, we provide expert guidance on resolving issues related to router keeps dropping WiFi signal. Our troubleshooting tips help diagnose and fix common causes such as interference, outdated firmware, or hardware issues. Stay connected with reliable solutions from our team.

  • prakash

    prakash June 19th, 2024 @ 02:47 PM

    Troubleshooting Guide: Router Keeps Dropping WiFi Signal

    If your router is experiencing frequent drops in WiFi signal, it can be frustrating and disruptive to your internet connectivity. At Contact Help Support, we provide expert guidance on resolving issues related to router keeps dropping WiFi signal. Our troubleshooting tips help diagnose and fix common causes such as interference, outdated firmware, or hardware issues. Stay connected with reliable solutions from our team.

  • prakash

    prakash June 19th, 2024 @ 02:50 PM

    Easy Bellsouth Email Login Assistance

    Accessing your Bellsouth email account is seamless with our dedicated support at Bellsouth email login. Whether you're encountering login issues or need guidance on account setup, our experts provide comprehensive assistance to ensure you stay connected effortlessly. Visit our website for step-by-step instructions and reliable support for all your Bellsouth email login needs.

  • prakash

    prakash June 19th, 2024 @ 02:53 PM

    Simplifying Linksys Router Setup: Expert Support

    Setting up your Linksys router is now easier than ever with professional assistance from our Linksys router setup services. Whether you're configuring a new router or troubleshooting issues, our dedicated team ensures seamless connectivity for your home or office network. Trust us to optimize your router's performance and security settings, ensuring reliable internet access tailored to your needs. Contact us today for comprehensive Linksys support solutions.

  • prakash

    prakash June 19th, 2024 @ 02:55 PM

    Expert Samsung Printer Setup Services

    At Contact Support Team, we provide comprehensive assistance for Samsung printer setup. Our dedicated team offers step-by-step guidance to ensure your Samsung printer is correctly configured and ready to use. Whether you're setting up a new printer or troubleshooting existing issues, rely on our expertise for seamless setup and optimal printer performance. Reach out to us today for reliable Samsung printer support services.

  • Rohithsol

    Rohithsol June 27th, 2024 @ 03:27 PM

    Introduction
    Yahoo Mail is a widely used email service, but sometimes users encounter issues where their inbox stops receiving new emails. This guide aims to help you troubleshoot and resolve the issue effectively, ensuring you receive emails without interruptions.

    Explore our comprehensive guide to resolve the Yahoo Mail not receiving emails problem.

    Not Receiving Emails in Yahoo Mail
    If you're facing the issue of not receiving emails in your Yahoo Mail inbox, it can be frustrating and potentially disruptive. This section provides step-by-step troubleshooting tips to diagnose and fix the problem.

    For detailed troubleshooting steps, visit Not Receiving Emails in Yahoo Mail.

    Conclusion
    In conclusion, resolving issues with Yahoo Mail not receiving emails requires patience and systematic troubleshooting. By following the steps outlined in this guide, you can diagnose and resolve the issue effectively, ensuring your Yahoo Mail operates smoothly and you receive all your important emails without any delays.

  • Rohithsol

    Rohithsol June 27th, 2024 @ 03:28 PM

    Introduction
    Connecting your laptop to WiFi is essential for accessing the internet and staying productive. When your laptop fails to connect to WiFi, it can be frustrating and disruptive to your work or entertainment. This guide explores common issues and provides solutions to help you resolve connectivity problems quickly.

    Explore our comprehensive troubleshooting guide to resolve issues with your laptop not connecting to WiFi.

    Laptop Not Connecting to WiFi
    If your laptop is unable to connect to WiFi networks, it could be due to several reasons such as network configuration issues, driver problems, or hardware faults. This section provides step-by-step troubleshooting tips to diagnose and fix the issue.

    For detailed troubleshooting steps, visit Laptop Not Connecting to WiFi.

    Conclusion
    In conclusion, resolving issues with your laptop not connecting to WiFi requires systematic troubleshooting to identify and address the underlying cause. By following the tips and solutions provided in this guide, you can troubleshoot and fix WiFi connectivity issues effectively, ensuring seamless internet access for your laptop.

  • Rohithsol

    Rohithsol June 27th, 2024 @ 03:29 PM

    Introduction
    Roku devices are known for their seamless streaming experience, but encountering frequent restarts can be disruptive. This guide provides solutions to help you address the issue of your Roku device restarting unexpectedly, ensuring uninterrupted viewing pleasure.

    Explore our troubleshooting tips tailored to resolve the problem of your Roku device restarting repeatedly.

    My Roku Keeps Restarting
    Experiencing frequent restarts with your Roku device can be frustrating. Discover effective troubleshooting steps to diagnose and resolve the issue of your Roku device restarting unexpectedly.

    For detailed troubleshooting, visit My Roku Keeps Restarting.

    Conclusion
    In conclusion, resolving the issue of your Roku device restarting unexpectedly requires systematic troubleshooting. By following the steps outlined in this guide, you can identify and address the underlying causes, ensuring a stable and uninterrupted streaming experience with your Roku device.

  • Rohithsol

    Rohithsol June 27th, 2024 @ 03:30 PM

    Introduction
    The Canon MX922 printer is known for its reliability and quality, but like any device, it can encounter issues. One common error that users face is the Support Code B200 error. This error can prevent you from printing and may require troubleshooting steps to resolve.

    Explore our comprehensive guide to learn how to troubleshoot and fix the Canon MX922 Support Code B200 error.

    Canon MX922 Support Code B200
    The Canon MX922 Support Code B200 error can be frustrating, causing your printer to stop working unexpectedly. This section provides detailed troubleshooting steps to help you resolve the B200 error and get your printer back to normal operation.

    For detailed troubleshooting tips, visit Canon MX922 Support Code B200.

    Conclusion
    In conclusion, addressing the Canon MX922 Support Code B200 error requires patience and systematic troubleshooting. By following the steps outlined in this guide, you can effectively resolve the B200 error and resume printing with your Canon MX922 printer.

  • Rohithsol

    Rohithsol June 27th, 2024 @ 03:31 PM

    Introduction
    Setting up your Canon printer is essential to start printing efficiently. Canon provides an easy setup process through its IJ Setup, ensuring that you can quickly get your printer up and running. This guide covers the steps required to set up your Canon printer using the IJ Setup method.

    Explore our comprehensive guide to learn how to set up your Canon printer with IJ Setup.

    Canon.setup/IJ Setup
    Canon.setup/IJ Setup is the official method for setting up Canon printers. This section provides step-by-step instructions to guide you through the setup process, ensuring that your printer is configured correctly.

    For detailed instructions on Canon.setup/IJ Setup, visit Canon.setup/IJ Setup.

    Conclusion
    In conclusion, setting up your Canon printer using the IJ Setup method is straightforward with the right guidance. Follow the steps outlined in this guide to ensure a seamless setup process and start printing with your Canon printer without any hassle.

  • liam smith

    liam smith September 12th, 2024 @ 01:45 PM

    The translation helper may pose safety risks if it mishandles sensitive data or lacks secure encryption. dish network cable and internet bundles To protect your information, use trusted tools with strong security measures and privacy policies. Always verify the credibility of translation services to ensure your data remains secure and confidential during the translation process.

  • jasonjox
  • DAVISO JONSON
  • DAVISO JONSON
  • DAVISO JONSON
  • DAVISO JONSON

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.

New-ticket Create new ticket

Create your profile

Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป

Repository for collecting Locale data for Ruby on Rails I18n as well as other interesting, Rails related I18n stuff

People watching this ticket

Attachments

Tags

Pages