490232 - L10n isn't escaped in .js files

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect, P1)

Description

[Wil Clouser [:clouserw]]

1) Load https://addons.mozilla.org/it/firefox/addon/4988
2) Note the JS error.  It's because the locale uses single quotes in their string and this isn't being escaped.

Comment 1

[Wil Clouser [:clouserw]]

I'd like to get this in for 5.0.5

Comment 2

[Wil Clouser [:clouserw]]

Attachment: escape values

Comment 3

[Jeff Balogh (:jbalogh)]

Comment on attachment 374685 [details] [diff] [review]
escape values

var addOnNotAvailableForPlatform = "";

_sanitizeArray escapes the param in place and doesn't return the escaped value, so everything comes out blank.

Comment 4

[Jeff Balogh (:jbalogh)]

Attachment: Another try at escaping js_constants

This one is closer, but not quite there because it breaks sprintf:

var addOnNotAvailableForPlatform = "%1$s is not available for %2$s.";

Comment 5

[Jeff Balogh (:jbalogh)]

And it breaks inserting HTML: 

var app_compat_update_firefox = "<a href="http://getfirefox.com">Upgrade Firefox</a> to use this add-on";

It seems the _sanitizeArray hammer is not quite right in this case.

Comment 6

[Fred Wenzel [:wenzel]]

Yeah sanitizeArray is not a good idea for JS, it's HTML-escaping stuff. Just use addslashes.

Comment 7

[Jeff Balogh (:jbalogh)]

Attachment: This one just escapes single and double quotes.

It's different from the one I showed you, using backslashes instead of html entities because that doesn't play well with javascript.

Comment 8

[Jeff Balogh (:jbalogh)]

r24933

Comment 9

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED:

Loading https://addons.mozilla.org/it/firefox/addon/4988, I get:

Error: missing ; before statement
Source File: https://addons.mozilla.org/it/firefox/pages/js_constants.js
Line: 30, Column: 25
Source Code:
var devcp_js_add_email = 'Inserire l'indirizzo e-mail dell'autore da aggiungere.'; 

Loading https://preview.addons.mozilla.org/it/firefox/addon/4988, however, I don't see any errors.