Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Separate i18n from Trails core #274

Open
tjwebb opened this issue Jan 3, 2017 · 3 comments
Open

Separate i18n from Trails core #274

tjwebb opened this issue Jan 3, 2017 · 3 comments

Comments

@tjwebb
Copy link
Member

tjwebb commented Jan 3, 2017

Issue Description

Originally, I thought that i18n (internationalization) support should be a core feature of trails. Due to the complexity and diversity of options for i18n, I think it should be moved to a trailpack

@jaumard
Copy link
Contributor

jaumard commented Jan 18, 2017

Yeah I don't see why i18n should be a core feature, so let's put it on a trailpack :) that will allow us to add more i18n functionalities without pollute Trails's code

@weyert
Copy link

weyert commented Apr 19, 2017

Sounds like a good idea as it's cause a vulnerability in trails:

Cross-site Scripting (XSS)

Medium severity
Vulnerable module: i18next
Introduced through: [email protected]
Detailed paths

Introduced through: [email protected][email protected]
Overview

i18next is i18next internationalization framework. Affected versions of the package are vulnerable to Cross-site Scripting (XSS) due to not escaping variables as expected. When passing any interpolation options without including escapeValue, the function this.escapeValue will get set to undefined in Interpolator. Meaning values aren't being escaped even though users expect them to be.

@jaumard
Copy link
Contributor

jaumard commented Apr 19, 2017

Maybe this can be planned for v3 ? Don't know if you already remove it @tjwebb

@tjwebb tjwebb added this to the 3.0 Release milestone Jun 13, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants