You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[Maintainer] i18n follow-ups from the #1148 review #1155
One more item from Security's review of #1148 (L1):
Full proxy tests: add tests that run the whole proxy() function, plus matcher tests in apps/editor/proxy.test.ts. Today's tests call the helpers directly. [Bugs] Editor proxy: harden middleware matcher #1156's matcher tests on main cover part of this.
One more item from Security's review of #1148 (L2b):
Stricter tag check in scripts/i18n.ts (~line 195): <img/src=x onerror=...>, <svg/onload=...> and <!-- --> still get past tag validation. It isn't exploitable, because translations render as text. To fix it, treat any < followed by a letter, ! or / as a tag, and add test cases.
#1148 merged as 374b781. One more item from Tooling's review:
Test speed:bun run test now runs the i18n script tests outside Turbo's cache, which takes about 66s locally. Move them into a cached Turbo task, or scope them to changes under scripts/.
Bugbot's open findings on #1148 (scoped-locale parse, decimal write-back, floor-plan number formatting, SSR snapshot) are being fixed in a separate follow-up PR, not tracked here.
Activity
Aymericr commentedon Oct 27, 2026
One more item from Security's review of #1148 (L1):
proxy()function, plus matcher tests inapps/editor/proxy.test.ts. Today's tests call the helpers directly. [Bugs] Editor proxy: harden middleware matcher #1156's matcher tests on main cover part of this.Aymericr commentedon Oct 27, 2026
One more item from Security's review of #1148 (L2b):
scripts/i18n.ts(~line 195):<img/src=x onerror=...>,<svg/onload=...>and<!-- -->still get past tag validation. It isn't exploitable, because translations render as text. To fix it, treat any<followed by a letter,!or/as a tag, and add test cases.Aymericr commentedon Oct 27, 2026
#1148 merged as 374b781. One more item from Tooling's review:
bun run testnow runs the i18n script tests outside Turbo's cache, which takes about 66s locally. Move them into a cached Turbo task, or scope them to changes underscripts/.Bugbot's open findings on #1148 (scoped-locale parse, decimal write-back, floor-plan number formatting, SSR snapshot) are being fixed in a separate follow-up PR, not tracked here.