Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Interpolation add missing reserved key #412

Conversation

tjoyal
Copy link
Contributor

@tjoyal tjoyal commented Apr 9, 2018

Add :exception_handler to the RESERVED_KEYS constant.

Based on https://github.com/svenfuchs/i18n/blob/master/lib/i18n/tests/interpolation.rb

# If no interpolation parameter is not given, I18n should not alter the string.
# This behavior is due to three reasons:
#
#   * Checking interpolation keys in all strings hits performance, badly;
#
#   * This allows us to retrieve untouched values through I18n. For example
#     I could have a middleware that returns I18n lookup results in JSON
#     to be processed through Javascript. Leaving the keys untouched allows
#     the interpolation to happen at the javascript level;
#
#   * Security concerns: if I allow users to translate a web site, they can
#     insert %{} in messages causing the I18n lookup to fail in every request.
#

Passing in a non-interpolation related custom exception handler for a translation would trip the interpolation behaviour when it is unexpected.

It took me a while to understand what was happening, I would suggest to rename the constants toward "interpolation" or move them in lib/i18n/interpolate/ruby.rb.

@radar
Copy link
Collaborator

radar commented Apr 10, 2018

Thank you! I will look at merging this tomorrow when I am back at work.

@radar radar merged commit 41e3274 into ruby-i18n:master Apr 18, 2018
@radar
Copy link
Collaborator

radar commented Apr 18, 2018

@tjoyal Thanks again :) I think moving the constants closer to where they're used would be the right approach. I'd happily review another PR for that.

@tjoyal tjoyal deleted the interpolation-missing-reserved-key-exception-handler branch April 18, 2018 12:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants