[5.6] Fix translation escaping

[X-Coder264]

Fixes #25515

d3c0a36 was a security fix because there was an XSS vulnerability when passing parameters as the second method to @lang. Unfortunately the fix escaped the whole output instead of only the parameters that were being replaced which resulted in a major breaking change (because people can no longer use HTML tags inside translations) -> #25408. This PR fixes that by escaping only the parameters that are being replaced so that there can't be any XSS, but doing it this way still allows people to have HTML in the translation files.

[taylorotwell]

This needs to go to 5.7.

[X-Coder264]

@taylorotwell What do you mean? You've already merged this to 5.6 and you merge stuff upstream so this will get to 5.7 too, or I misunderstood something? 😄

[derekmd]

Compared to the first @lang() attempt, I think you're going to find this commit will cause a louder backlash since it now affects __(), trans() and trans_choice() calls.

It's no longer possible to include HTML in replaced :keys strings (instead requiring new HtmlString() for every parameter), even when user-content is properly encoded and trusted. I know for the product I work on this will cause hundreds, if not thousands, of broken translation outputs now showing readable HTML.

I don't see why a translation service would be responsible for encoding HTML? Wouldn't that fall on the templating system and the end-user's choice? I personally have never touched the @lang() directive either. It seems like programmers should be using Blade {{ }} or {!! !!} to make encoding explicit?

[guidocella]

Another issue with this approach is that everytime you use trans() in an email subject, you have to remember to wrap the placeholder replacements with new HtmlString().

For example
$this->subject(__('Welcome :name', ['name' => "O'Brien"]))
would result in the subject
Welcome O'Brien

This would probably happen with other notification drivers too like SMS and Slack.

[derekmd]

It affects translations in JSON response bodies as well.

return response()->json([
    'status' => 'success',
    'data' => $company,
    'message' => __(':name successfully created!', ['name' => $company->name]),
]);

{"status":"success","data":{"id":1,"name":"..."},"message":"Ampersand & Sons successfully created!"}

    // What does JSON have to do with HTML?
    // Vue templating, etc. are responsible for encoding if output is shown in a DOM tree.
    'message' => __(':name successfully created!', ['name' => new HtmlString($company->name)]),
]);

If devs don't give a stuff about @lang() encoding, this will restore the old behavior whilst still allowing the ability to upgrade Laravel:

config/app.php

[
    'providers' => [
        // ...
        // Illuminate\Translation\TranslationServiceProvider::class,
        App\Providers\TranslationServiceProvider::class,

app/Providers/TranslationServiceProvider.php

namespace App\Providers;

use App\Support\Translator;
use Illuminate\Translation\TranslationServiceProvider as BaseTranslationServiceProvider;

class TranslationServiceProvider extends BaseTranslationServiceProvider
{
    public function register()
    {
        $this->registerLoader();

        $this->app->singleton('translator', function ($app) {
            $loader = $app['translation.loader'];

            $locale = $app['config']['app.locale'];

            $trans = new Translator($loader, $locale);

            $trans->setFallback($app['config']['app.fallback_locale']);

            return $trans;
        });
    }
}

app/Support/Translator.php

namespace App\Support;

use Illuminate\Support\Str;
use Illuminate\Translation\Translator as BaseTranslator;

class Translator extends BaseTranslator
{
    protected function makeReplacements($line, array $replace)
    {
        if (empty($replace)) {
            return $line;
        }

        $replace = $this->sortReplacements($replace);

        foreach ($replace as $key => $value) {
            $line = str_replace(
                [':'.$key, ':'.Str::upper($key), ':'.Str::ucfirst($key)],
                [$value, Str::upper($value), Str::ucfirst($value)],
                $line
            );
        }

        return $line;
    }
}

You just have to keep a watchful eye on these with every Composer version bump:

• https://github.com/laravel/framework/commits/5.7/src/Illuminate/Translation/TranslationServiceProvider.php
• https://github.com/laravel/framework/commits/5.7/src/Illuminate/Translation/Translator.php

[royduin]

When can we expect a new release with this for 5.6?