Comments (4)
Clarification: the linebreaks in question are hard returns, what used to be called carriage return and line feed characters. The HTML linebreak tags
are allowed.
from jedchecker.
To be honest, I'm a bit shocked by the latest security patch. I know it is possible to use PHP's constants in string values, but website visitors are not able to manipulate language files, so I don't see the attack vector here.
The difference between normal and raw parsers is not just the support for multiline strings (although it was probably used before, e.g. for initial values in textarea
fields, and now developers have to rewrite code just to support the new syntax).
For example, in a normal parser you can specify values in both double and single quotes, but now single quotes will be parsed incorrectly (they will be included in the translated string). Of course, we can warn developers to replace single quotes with double quotes (and don't forget to escape double quotes inside the string).
But the most important thing: before it was possible to use escape sequences, but now only \"
is supported. For example, we discussed earlier that a backslash followed by a double quote should be encoded as \\\"
according to PHP rules (and I even patched PHP core to handle it properly). And now it doesn't work because in Joomla 5.0.0 it should be \\\"
and in 5.0.1 it should be \\"
. There is no common denominator!!!
Finally, this patch affects performance, because strings were previously loaded as
$strings = parse_ini_file($fileName);
and now
$strings = parse_ini_file($fileName, false, INI_SCANNER_RAW);
$strings = str_replace('\"', '"', $strings);
so, Joomla has to do post-processing on each and every loaded string.
I'll try my best, but there's clearly more to it than just a warning about multiline strings.
from jedchecker.
Thank you for your comments. Now I understand better what is involved, but it would be brilliant to get it done.
The change in 4.4.1 and 5.0.1 was a total surprise. I have been developing a component and the documentation at Creating a language definition file does not say that the language string is limited to one line and that no cr/lf characters are allowed. I just added the following text there: "Note also that from Joomla 4.4.1 and 5.0.1 each value can only be one line of text. Hard linebreaks invalidate the whole language definition file." Others who know more like you may edit the section about the PHP INI parser.
from jedchecker.
The PR #245 comes with all the necessary checks.
from jedchecker.
Related Issues (20)
- False positive The JEXEC security check was not found in this file. HOT 18
- [Suggestion] - Extend the readme on Crowdin Project
- False positive PH2 error HOT 4
- Dependency Dashboard
- Error: Whitespace in the key is not allowed HOT 3
- JED Checker 2.4.1 extension downloaded from the JED differs from development repository
- Language file is not loaded, when lang prefix is missing. HOT 1
- JEXEC security check HOT 6
- [PHP 8.1] Deprecated: trim(): Passing null to parameter #1 ($string) in rules/xmlinfo.php on line 322 HOT 2
- Warning: syntax error, unexpected '{' or '!' HOT 1
- NOTICE: Node <folder> has unknown attribute 'plugin' is wrong? HOT 2
- Not recognized in XML: <name>language KEY</name> HOT 3
- JEDchecked in Joomla 3.10.12 failed: TypeError: Failed to fetch HOT 17
- [J5] JED Checker extension only works with b/c plugin enabled HOT 2
- JEF Checker 2.4.2 has no checksum HOT 2
- 0 strpos(): Argument #3 ($offset) must be contained in argument #1 ($haystack) HOT 1
- JED Checker never finishes in PHP 8.3.0 HOT 14
- Wrong deprecation: Joomla\CMS\Filesystem\File and Joomla\CMS\Filesystem\Folder ? HOT 4
- There is interference in the mobile version, Joomla 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from jedchecker.