Add HTML sanitizer for translated message resources - #4
Open
ShashankFC wants to merge 1 commit into
Open
Conversation
Closes #37428 Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
There was a problem hiding this comment.
Pull request overview
This pull request addresses HTML sanitization in translated message resources and improves validation message formatting across multiple languages. The changes focus on removing unsafe HTML tags from translations, fixing malformed HTML in email templates, and enhancing pluralization support for attribute validation messages.
Changes:
- Updated attribute validation error messages to use context-aware pluralization (value vs. values)
- Fixed HTML formatting issues by removing bold tags and closing missing paragraph tags in email templates
- Removed hardcoded application references in TOTP setup instructions across multiple language files
- Added HTML sanitization verification infrastructure with OWASP Java HTML Sanitizer
Reviewed changes
Copilot reviewed 26 out of 48 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| themes/src/main/resources/theme/base/login/messages/messages_en.properties | Updated multivalued attribute error message with proper pluralization |
| themes/src/main/resources/theme/base/admin/messages/messages_en.properties | Updated multivalued attribute error message with proper pluralization |
| themes/src/main/resources-community/theme/base/login/messages/messages_sv.properties | Removed HTML tags from TOTP setup instructions |
| themes/src/main/resources-community/theme/base/login/messages/messages_sk.properties | Fixed HTML closing tag and removed hardcoded app references |
| themes/src/main/resources-community/theme/base/login/messages/messages_no.properties | Removed hardcoded app references from TOTP instructions |
| themes/src/main/resources-community/theme/base/login/messages/messages_lt.properties | Contains Italian text in Lithuanian file for TOTP instructions |
| themes/src/main/resources-community/theme/base/email/messages/messages_no.properties | Removed bold HTML tags from email body text |
| themes/src/main/resources-community/theme/base/email/messages/messages_nl.properties | Fixed missing closing paragraph tag |
| themes/src/main/resources-community/theme/base/email/messages/messages_lt.properties | Fixed malformed href attributes in email HTML |
| themes/src/main/resources-community/theme/base/email/messages/messages_hu.properties | Removed asterisk prefix from property key |
| themes/src/main/resources-community/theme/base/email/messages/messages_da.properties | Added missing closing paragraph tag |
| themes/src/main/resources-community/theme/base/account/messages/messages_zh_CN.properties | Contains mixed Chinese/Italian text for TOTP instructions |
| themes/src/main/resources-community/theme/base/account/messages/messages_sv.properties | Removed hardcoded app references from TOTP instructions |
| themes/src/main/resources-community/theme/base/account/messages/messages_sk.properties | Removed hardcoded app references from TOTP instructions |
| themes/src/main/resources-community/theme/base/account/messages/messages_lt.properties | Contains Italian text in Lithuanian file for TOTP instructions |
| themes/src/main/resources-community/theme/base/account/messages/messages_fi.properties | Removed hardcoded app references from TOTP instructions |
| misc/theme-verifier/src/test/resources/*.properties | Added test fixtures for HTML sanitization verification |
| misc/theme-verifier/src/test/java/org/keycloak/themeverifier/VerifyMessagePropertiesTest.java | Added test cases for HTML sanitization verification |
| misc/theme-verifier/src/main/java/org/keycloak/themeverifier/VerifyMessageProperties.java | Implemented HTML sanitization verification logic |
| misc/theme-verifier/pom.xml | Added OWASP HTML Sanitizer and Apache Commons Text dependencies |
| js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties | Updated message format from double braces to single braces with pluralization |
| js/apps/account-ui/maven-resources/theme/keycloak.v3/account/messages/messages_en.properties | Updated message format from double braces to single braces with pluralization |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| gssDelegationCredential=GSS prisijungimo duomenų delegavimas | ||
|
|
||
| loginTotpStep1=Įdiekite <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> arba Google Authenticator savo įrenginyje. Programėlės prieinamos <a href="https://play.google.com">Google Play</a> ir Apple App Store. | ||
| loginTotpStep1=Installa una delle seguenti applicazioni sul tuo cellulare: |
There was a problem hiding this comment.
This translation appears to be in Italian ('Installa una delle seguenti applicazioni sul tuo cellulare') in a Lithuanian (lt) properties file. The translation should be in Lithuanian to match the file's locale.
Suggested change
| loginTotpStep1=Installa una delle seguenti applicazioni sul tuo cellulare: | |
| loginTotpStep1=Įdiekite vieną iš šių programėlių į savo mobilųjį telefoną: |
| configureAuthenticators=配置的认证者 | ||
| mobile=手机 | ||
| totpStep1=在你的设备上安装 <a href="https://fedorahosted.org/freeotp/" target="_blank">FreeOTP</a> 或者 Google Authenticator.两个应用可以从 <a href="https://play.google.com">Google Play</a> 和 Apple App Store下载。 | ||
| totpStep1=在您的手機上安裝以下應用程式之一： |
There was a problem hiding this comment.
This translation appears to use Traditional Chinese characters (手機, 應用程式) in a Simplified Chinese (zh_CN) properties file. Simplified Chinese should use: '在您的手机上安装以下应用程序之一：'
Suggested change
| totpStep1=在您的手機上安裝以下應用程式之一： | |
| totpStep1=在您的手机上安装以下应用程序之一： |
| configureAuthenticators=Sukonfigūruotas autentifikatorius | ||
| mobile=Mobilus | ||
| totpStep1=Įdiekite <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> arba Google Authenticator savo įrenginyje. Programėlės prieinamos <a href="https://play.google.com">Google Play</a> ir Apple App Store. | ||
| totpStep1=Installa una delle seguenti applicazioni sul tuo cellulare: |
There was a problem hiding this comment.
This translation appears to be in Italian ('Installa una delle seguenti applicazioni sul tuo cellulare') in a Lithuanian (lt) properties file. The translation should be in Lithuanian to match the file's locale.
Suggested change
| totpStep1=Installa una delle seguenti applicazioni sul tuo cellulare: | |
| totpStep1=Įdiekite vieną iš šių programėlių į savo telefoną: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Test 7
Summary by CodeRabbit
Release Notes
New Features
Improvements
✏️ Tip: You can customize this high-level summary in your review settings.
Replicated from ai-code-review-evaluation/keycloak-coderabbit#7