fix(pci-public-ip): fix the i18n t interpolation config #11655
Conversation
ref: DTCORE-2189 ref: DTCORE-2198 Signed-off-by: LIDRISSI Hamid <abdelghani-lidrissi.hamid.ext@ovhcloud.com>
seven-amid
requested review from
kqesar,
frenautvh,
antonymarion,
oalkabouss and
anooparveti
and removed request for
a team
|
| interpolation: { | ||
| escapeValue: false, | ||
| }, |
There was a problem hiding this comment.
we have this configuration directly in the initI18n function from react-shell-client package
It's better to have it by default and not duplicate it in each translation
There was a problem hiding this comment.
The reason behind not make it in global config is the risk of XXS attack https://www.i18next.com/translation-function/interpolation#unescape
There was a problem hiding this comment.
Except we usually interpolate data that come from our APIs (properties of an object, error messages) and display it to the user. We don't often interpolate data that come from user input and even less often send those to the APIs.
We have more cases where we don't want to escape value (because we use accents in our languages) than not doing it so it should be the default in my opinion.
If there is a risk of XXS attack we can add the configuration interpolation: {escapeValue: true} specifically for this case. Instead of adding interpolation: {escapeValue: false} everywhere if there is an accent or a special character in the i18n text
ref: DTCORE-2189
ref: DTCORE-2198
Description
Related