Security harden 2 - #155
Open
cruzzer wants to merge 3 commits into
Open
Conversation
added 3 commits
September 4, 2026 20:35
I18n::get() assembled a fragment of PHP source from a translation key and ran it through eval() to reach a nested value; load() did the same on the write side, three more times. Replace all four with a plain array walk, which is what the generated code was doing anyway. Deriving code from data makes the lookup depend on keys being well formed in ways the dotted notation never promised, and it forces a layer of escaping onto values purely so they survive being embedded in that source. Walking the array removes both concerns, and is a good deal easier to follow. Two things worth knowing when reading the diff: - The addcslashes() call on the custom translation value existed only so the value would survive being embedded in generated source. With nothing embedded, it is removed; keeping it would leave literal backslashes in the string the user sees. On PHP 8.1+, where htmlspecialchars() defaults to ENT_QUOTES, it already did. - Values for dotted keys in the language files carry a second level of escaping for the same reason. 72 such values exist, in fr, ca, et and it. unescapeLangValue() undoes exactly that level on load, so every existing translation file keeps working unchanged. Normalising the files themselves would remove the need for it, but that is a change to translation data and belongs on its own. get() also stops emitting "Undefined array key" warnings on PHP 8 for missing keys, which the eval() produced on every lookup of one.
ttValidTranslationLine() decided whether a key was valid by asking whether it resolved, which ties the validity of input to how a lookup behaves for input that is not a key at all. Check the key against the notation it is documented to use -- words separated by dots -- before any lookup happens.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
2nd harden commit.