1972282 - xsl:sort appears not to honor spoof_english

Status: VERIFIED FIXED

(Core :: XSLT, defect)

Description

[Henri Sivonen (:hsivonen)]

Disclaimer: This is from code inspection, and I haven't actually tested if there is a bug. Still, I'm filing this so that it's not forgotten in case there is a bug.

From code inspection, it appears that if an XSLT transform from the Web uses xsl:sort and doesn't specify a language, the unspoofed Firefox UI language is used for sorting. https://searchfox.org/mozilla-central/rev/b4412cedce6e2900f5553cbdc43c3fa49c4b9adb/dom/xslt/xslt/txXPathResultComparator.cpp#31

When a language isn't specified, xsl:sort should use the same spoof_english-honoring manner of deciding the language as the JS Intl API uses for undefined as the language.

If this bug isn't fixed ahead of bug 1937541, I'd like to do the right thing in bug 1937541 instead of deliberately repeating the bug. thorin, is that a problem in terms of attention drawn?

Comment 1

[Thorin [:thorin]]

collation when undefined can be telling - https://arkenfox.github.io/TZP/tests/collation.html uses a refined set of characters/strings and can currently get 97 results (84 unique) from 124 supported locales

Will come back to this with some testing - not an expert on XSLT - to see if it leaks app language (with spoof english), unless someone beats me to it

Comment 2

[Pier Angelo Vendrame]

STR:

1. Install Swedish (sv-SE)
2. Go to https://www.w3schools.com/Xml/tryxslt.asp?xmlfile=cdcatalog&xsltfile=cdcatalog_sort
3. Use this XML code:

<?xml version="1.0" encoding="UTF-8"?>
<catalog>
  <cd>
    <title>z</title>
    <artist>z</artist>
    <country>USA</country>
    <company>Columbia</company>
    <price>10.90</price>
    <year>1985</year>
  </cd>
  <cd>
    <title>a</title>
    <artist>a</artist>
    <country>USA</country>
    <company>Columbia</company>
    <price>10.90</price>
    <year>1985</year>
  </cd>
  <cd>
    <title>å</title>
    <artist>å</artist>
    <country>USA</country>
    <company>Columbia</company>
    <price>10.90</price>
    <year>1985</year>
  </cd>
</catalog>

4. Result will be a/z/å, both with and without spoof English.

If you test it in another language (including en-US), the order will be a/å/z.

Comment 3

[Pier Angelo Vendrame]

Attachment: (secure)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/832577bb1e26
https://hg.mozilla.org/integration/autoland/rev/aafc527bf08c
Check for spoof English in xsl:sort. r=smaug

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0ae7bd3f5be4
https://hg.mozilla.org/integration/autoland/rev/270d2c511f59
Revert "Bug 1972282 - Check for spoof English in xsl:sort. r=smaug" for causing bustages at txNodeSorter.cpp.

Comment 6

[Donal Meehan [:dmeehan]]

Backed out for causing build bustages

Backout link

Push with failures

Failure log

Comment 7

[Pier Angelo Vendrame]

It seems unified builds somehow introduced a using namespace mozilla; and included nsRFPService.h.
I sent an updated revision that fixes the problems.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/860b2488de31
https://hg.mozilla.org/integration/autoland/rev/1be113fbb5f9
Check for spoof English in xsl:sort. r=smaug

Comment 9

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

https://hg.mozilla.org/mozilla-central/rev/1be113fbb5f9

Comment 10

[Ryan VanderMeulen [:RyanVM]]

Please nominate this for ESR140 approval when you get a chance.

Comment 11

[Henri Sivonen (:hsivonen)]

Do we have a guarantee that if aLangExpr is not null, it will evaluate to a non-empty string?

Comment 12

[Pier Angelo Vendrame]

(In reply to Henri Sivonen (:hsivonen) from comment #11)

Do we have a guarantee that if aLangExpr is not null, it will evaluate to a non-empty string?

Good catch, lang="" indeed bypasses the patch.

Comment 13

[Pier Angelo Vendrame]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D254784

Comment 14

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: The patch fixes a spoof English bypass.
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: STR in comment 2 of the Bug
• Risk associated with taking this patch: Low
• Explanation of risk level: Unsupported Firefox configuration (RFP/FFP)
• String changes made/needed: None
• Is Android affected?: yes

Comment 15

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/dc55052c8ba3

Comment 16

[Ciprian Georgiu, Desktop QA]

Hi Pier! When following the steps from comment 2 to reproduce this issue on an affected Nightly build (2025-06-16) with Windows 11, I’m getting a, å, z after changing the language to Swedish (sv-SE). However, I see the same results on a fixed build, Beta 142.0b5.

I’m wondering if I might be doing something wrong while verifying this issue, or if the issue is not properly fixed. Could you please take a look?

Comment 17

[Pier Angelo Vendrame]

Hi!
I've just tried with 2025-06-16, and I get a, z, å, both on Windows 11 and on Linux.

I've realized that "install/change the language to sv-SE" might be ambiguous: the bug is triggered when the app language is sv-SE.
Is it possible you set accepted languages ("Choose your preferred language for displaying pages") instead?
Or, in other words, if the UI is displayed in Swedish, I'd expect the bug to show, if it's still in English, it shouldn't.

Please notice that the controls to change language might are disabled by default in nightly (i.e., intl.multilingual.enabled is false).
You can either flip that pref and install a langpack compatible with that version, or you can install a build that is already localized.
More information are available at https://firefox-source-docs.mozilla.org/l10n/fluent/tutorial.html#testing-other-locales.

Comment 18

[Pier Angelo Vendrame]

Attachment: Screenshot by trying the STR from comment 2 in 141.0a1 from 2025-06-16

Comment 19

[Ciprian Georgiu, Desktop QA]

(In reply to Pier Angelo Vendrame from comment #17)

Hi!
I've just tried with 2025-06-16, and I get a, z, å, both on Windows 11 and on Linux.

I've realized that "install/change the language to sv-SE" might be ambiguous: the bug is triggered when the app language is sv-SE.
Is it possible you set accepted languages ("Choose your preferred language for displaying pages") instead?

Yes, that’s what I did.

Thanks for explaining! I can confirm the fix as verified on Beta 142.0b5 and ESR 140.2.0 (treeherder build) on macOS 15, Ubuntu 24, and Windows 11.