Problem/Motivation

When translating certain labels, characters such as apostrophes are escaped.

Steps to reproduce

Add a translation language for widget texts. In Processor Details Label, add Détails de l'Entreprise du Processeur. Check cookie documentation page and identify escaped characters.

Proposed resolution

In the Twig file, add |raw to all Labels so that they do not escape.
Find the root cause and better logics to fix this.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

neptuneDG created an issue. See original summary.

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented
Version: 1.2.8 » 1.2.x-dev
Issue summary: View changes

Thanks for the report @neptuneDG. While we should never use |raw for security reasons, I think there are already some related or even duplicate issues which discuss this problem.

I think it's something that needs to be changed and solved in the root logics of this module, so that escaping works like in all other cases. I'd be super happy if someone could take the time to check more in deep, where things go wrong and why. It's since day 1, I guess.

neptune-dc’s picture

neptune-dc commented

If you think that |raw is unsafe in this situation, then do you not already have a vulnerability? In the very same twig, you call the following line:

<article id="{{ id }}" {{attributes.addClass(classes)}}>

The output of attributes.addClass(classes) is marked as safe by twig and returns all attributes without escapes. Because the attributes I have marked as |raw are also inside that, I thought I was not adding an additional vulnerability with this change.

At the moment in your current implementation, your data attributes are not escaped, yet your user-visible tags are escaped.

neptune-dc’s picture

neptune-dc commented

Do you think your code is related to this change in drupal 9? https://www.drupal.org/project/drupal/issues/2297711

anybody’s picture

anybody
Primary language German
Location Porta Westfalica
commented

Honestly it's not my code, but from the original maintainer of this module. We should try to not use |raw where ever possible and it's no option for me here, until I'm 100% sure, there's no better way. And I'm quite sure, there are better ways.

So I agree with the issue, but not with the solution. Too busy currently to look into it deeper, but of course I'll review MR's when ever possible. Thanks for your report and work on this.

kewin.nammert’s picture

kewin.nammert commented

I've noticed that moving labels from nested #attributes to the main array fixes the problem, but I'm not sure that's a good solution. If it is I can do the MR. Somehow passing the values as Markup which shouldn't be escaped doesn't have an effect either. Any ideas why?