Add HTML sanitizer for translated message resources - #4
Conversation
Closes #37428 Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
|
bugbot run |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| configureAuthenticators=Sukonfigūruotas autentifikatorius | ||
| mobile=Mobilus | ||
| totpStep1=Įdiekite <a href="https://freeotp.github.io/" target="_blank">FreeOTP</a> arba Google Authenticator savo įrenginyje. Programėlės prieinamos <a href="https://play.google.com">Google Play</a> ir Apple App Store. | ||
| totpStep1=Installa una delle seguenti applicazioni sul tuo cellulare: |
There was a problem hiding this comment.
Lithuanian translation replaced with Italian text
High Severity
The totpStep1 and loginTotpStep1 values in the Lithuanian (_lt) properties files were replaced with Italian text ("Installa una delle seguenti applicazioni sul tuo cellulare:") instead of Lithuanian. The Italian translation files (_it) contain nearly identical Italian text, confirming this is a language mix-up. Lithuanian users will see Italian instructions for the TOTP setup step.
Additional Locations (1)
| configureAuthenticators=配置的认证者 | ||
| mobile=手机 | ||
| totpStep1=在你的设备上安装 <a href="https://fedorahosted.org/freeotp/" target="_blank">FreeOTP</a> 或者 Google Authenticator.两个应用可以从 <a href="https://play.google.com">Google Play</a> 和 Apple App Store下载。 | ||
| totpStep1=在您的手機上安裝以下應用程式之一： |
There was a problem hiding this comment.
Simplified Chinese file contains Traditional Chinese text
Medium Severity
The totpStep1 value in the Simplified Chinese file (messages_zh_CN.properties) uses Traditional Chinese characters (手機, 安裝, 應用程式) instead of Simplified Chinese (手机, 安装, 应用程序). The zh_TW (Traditional Chinese) file already has its own correct Traditional Chinese translation. Simplified Chinese users will see unfamiliar character forms.
| webauthn-passwordless-help-text=Use your Passkey for passwordless sign in. | ||
| passwordless=Passwordless | ||
| error-invalid-multivalued-size=Attribute {{0}} must have at least {{1}} and at most {{2}} value(s). | ||
| error-invalid-multivalued-size=Attribute {0} must have at least {1} and at most {2} {2,choice,0#values|1#value|1<values}. |
There was a problem hiding this comment.
i18next interpolation broken by Java MessageFormat syntax
High Severity
The error-invalid-multivalued-size message was changed from i18next-compatible {{0}} interpolation to Java {0} format with {2,choice,...} ChoiceFormat syntax. The account-ui and admin-ui are React apps using react-i18next, which requires {{0}} for interpolation. All other error messages in these files use {{0}} format. The setUserProfileServerError utility passes params to i18next's t() function, which won't recognize {0} or {2,choice,...}, causing raw format tokens to appear in the UI instead of actual values.
Additional Locations (1)
2 participants
Test 7nnn## Summary by CodeRabbitnn## Release Notesnn* New Featuresn * Added recovery codes display and management localizationn * Introduced attribute translation management interfacen * Added logout token configuration settingsnn* Improvementsn * Updated TOTP setup guidance across multiple languagesn * Fixed HTML formatting issues in email notifications and authentication error messagesn * Enhanced validation messages with context-aware pluralizationnn✏️ Tip: You can customize this high-level summary in your review settings.nnn---nReplicated from ai-code-review-evaluation/keycloak-coderabbit#7
Note
Medium Risk
Build-time verification becomes stricter and may fail existing/custom translations that relied on embedded HTML or differing anchor attributes. Runtime behavior is mostly unchanged aside from updated localized strings, but the change can impact release pipelines.
Overview
Theme message verification now enforces HTML safety for translations. The
theme-verifierplugin loads each.propertiesbundle alongside its English source, sanitizes values with OWASP HTML Sanitizer, and reports illegal/extra HTML; it also restricts translated<a>tags to exactly match the source string (with a few key-specific normalizations).Adds new verifier dependencies (
owasp-java-html-sanitizer,commons-text) plus new tests/fixtures covering illegal tags, disallowed HTML when the English string has none, and altered anchors.Updates multiple theme message bundles to comply: fixes malformed/unsafe HTML in email/login strings (notably
<br/>→<br />and broken tags), tightenstemplateHelpplaceholder formatting, replaces TOTP step text in several locales to remove embedded anchor HTML, and improveserror-invalid-multivalued-sizemessages to use ICUchoicepluralization (and fixes Slovak pluralization).Written by Cursor Bugbot for commit 5d77e7e. Configure here.