Avoid XSS via translations about oasis-wallet-ext HOT 6 CLOSED

Why use the Trans component and are there any risks? I prefer I18n to return strings instead of components

from oasis-wallet-ext.

I think Trans component is safe, but strings are even better

In that case, these need to be updated:

from oasis-wallet-ext.

should dontclose be change ? is this have question ? because there have style with text in a line ?

from oasis-wallet-ext.

yes

from oasis-wallet-ext.

ok, If I split with a special string and then set the style, is it safe? like "And [[ do not close ]] this window." ,I will split by [[ and ]] , then set bold style

from oasis-wallet-ext.

You might be able to do that safely, but it seems too complex. E.g. simple "dontclose": "And [[do not close]] this window.", + <p className="wallet-tip-description" key={tip} dangerouslySetInnerHTML={{ __html: getLanguage(tip).replace('[[', '<b>').replace(']]', '</b>') }} /> is not safe.

Splitting translations "dontclose1": "And", "dontclose2": "do not close", "dontclose3": "this window." seems too annoying.

I would say either:

• use string and remove style "dontclose": "And do not close this window.", + <p className="wallet-tip-description" key={tip}>{ getLanguage(tip) }</p>
• use Trans "dontclose": "And <strong>do not close</strong> this window.", + <p className="wallet-tip-description" key={tip}><Trans i18nKey={tip}></Trans></p>

from oasis-wallet-ext.