2003388 - Enclose profile name in quotes in page titles and dialogs

Status: ASSIGNED

(Toolkit :: Startup and Profile System, defect)

Description

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

Per discussion with content and security, where we render profile names inside about page headings, we want to enclose the profile names in quotes to emphasize the distinction between user input and Firefox content.

An initial glance at the profiles code turns up the following l10n IDs we'll need to update:
copied-profile-page-header
delete-profile-page-title
delete-profile-header

Comment 1

[Daniel Veditz [:dveditz]]

Will you also reject profile names that contain quotes? If not then things like
Delete "${name}" profile?
can be turned into

     Delete "some" data and upload the rest? 
     See https://firefox-support.invalid/user-data-reporting/ for more information on legal
     surveillance requirements that apply. Confirm delete of "your" profile?

Watch out for all the Unicode quote variations that could mimic whichever quote you choose, and keep in mind that many locales will change the quote character being used. Unicode classes Pi and Pf capture most of them, but the ASCII versions and some others are Po and I'm guessing you won't want to forbid all the Po. You need to match at least
/(['"``\p{Pi}\p{Pf}\u201A\u201E\u301D-\u301F\uFF02\uFF07\uFF40])/u
If you don't mind blocking parens and brackets too that could be shortened to
/(['"``\p{Pi}\p{Pf}\p{Ps}\p{Pe}\uFF02\uFF07\uFF40])/u

A length limit as in bug 2003390 makes this kind of trick harder, but any reasonable length is still long enough for someone to try to escape the quotes.

Comment 2

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

Thanks--in that case I guess we'd perhaps want to upgrade the regexp in bug 2003390 comment 1 to include quotes, something like

/([\\*:?<>|\/'"``\p{Pi}\p{Pf}\p{Ps}\p{Pe}\uFF02\uFF07\uFF40])/u

is that right?

Comment 3

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

Er, I guess we'll want to use v-mode rather than u-mode, because input element pattern attribute validation uses v-mode. So, adding escaping for the double-backtick and pipe,

/([\\*:?<>\|\/'"\``\p{Pi}\p{Pf}\p{Ps}\p{Pe}\uFF02\uFF07\uFF40])/v

Comment 4

[Daniel Veditz [:dveditz]]

the double backtick in my comment is a bug/hack: if I used a single backtick then the highlighting got broken and I couldn't find an escape character for it. Doubling it seemed to be a functional escape, except it shows both of them. In a real regexp a single backtick worked to match that character so you don't need to escape it for v-mode.

/([\\*:?<>\|\/'"`\p{Pi}\p{Pf}\p{Ps}\p{Pe}\uFF02\uFF07\uFF40])/v

Note that this forbids ( ) [ ] { } that appear to have been previously allowed (as well as all the Unicode equivalents of course). If that's a problem then switch back to the explicit \u201A\u201E\u301D\u301E\u301F that are "QUOTATION" characters but tagged Ps/Pe instead of Pi/Pf. I don't know what the reasoning was.

Comment 5

[Daniel Veditz [:dveditz]]

Oh, and all versions I listed include apostrophe, but people probably do want to use that for profiles like Bob's medical stuff. As long as you don't use apostrophe as the quote character in the Firefox string--and comment to localizers that they shouldn't either!--then it's not a problem to allow it.