single quote ' in translation string breaks ui_app.jade #10580

Closed
srl295 opened this Issue Feb 25, 2017 · 6 comments

Comments

Projects
None yet
4 participants
@srl295
Contributor

srl295 commented Feb 25, 2017

Kibana version: master (6.0.0 alpha, 7084d55)

Original install method (e.g. download page, yum, from source, etc.): source

Description of the problem including expected versus actual behavior:

French translation with a single quote breaks startup page, because UI-WELCOME_ERROR is substituted into the inline script without escaping.

The specific translation bundle ( plugins/kibana_translation/translations/fr.json ) looks like this:

{
  "UI-WELCOME_MESSAGE": "En chargeant Kibana",
  "UI-WELCOME_ERROR": "Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information."
}

Steps to reproduce:

  1. unpack the enclosed .tgz ( creates plugins/kibana_translation/… )
  2. startup kibana with npm run start
  3. bring up a browser configured for French (fr)

Errors in browser console (if relevant):

Uncaught SyntaxError: Unexpected identifier @ kibana:179

The specific line is:

err.innerText = 'Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information.';

This is caused by the source in ui_app.jade:

err.innerText = '#{i18n('UI-WELCOME_ERROR')}';

I think this can be corrected with some escaping. Probably using JSON.stringify as elsewhere on the same page.

@srl295

This comment has been minimized.

Show comment
Hide comment
@srl295

srl295 Feb 25, 2017

Contributor

fyi @hickeyma - this is reproducible without phase 2 #8766 so I am filing separately.

Contributor

srl295 commented Feb 25, 2017

fyi @hickeyma - this is reproducible without phase 2 #8766 so I am filing separately.

@srl295

This comment has been minimized.

Show comment
Hide comment
@srl295

srl295 Feb 25, 2017

Contributor

Note that in the welcome message, ' is fine, as shown below. (PS: pardon any issues with the français, SVP)

{
  "UI-WELCOME_MESSAGE": "En chargeant Kibana, s'il vous plait!",
  "UI-WELCOME_ERROR": "Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information."
}

I wonder if it should be err.innerHtml because Jade might HTML-escape something here.

Contributor

srl295 commented Feb 25, 2017

Note that in the welcome message, ' is fine, as shown below. (PS: pardon any issues with the français, SVP)

{
  "UI-WELCOME_MESSAGE": "En chargeant Kibana, s'il vous plait!",
  "UI-WELCOME_ERROR": "Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information."
}

I wonder if it should be err.innerHtml because Jade might HTML-escape something here.

@hickeyma

This comment has been minimized.

Show comment
Hide comment
@hickeyma

hickeyma Feb 27, 2017

Contributor

@srl295 Good catch, thanks. This would have been a silent issue until Phase 4, so it is good that you could do some testing with other languages that introduce single quotes.

It only applies to UI-WELCOME_ERROR because the jade code references it in a single quote and therefore the single quote in the text string is not escaped.

To show this message the server would need to be killed as welcome/loading page is in progress. Then the error page would be loaded.

Contributor

hickeyma commented Feb 27, 2017

@srl295 Good catch, thanks. This would have been a silent issue until Phase 4, so it is good that you could do some testing with other languages that introduce single quotes.

It only applies to UI-WELCOME_ERROR because the jade code references it in a single quote and therefore the single quote in the text string is not escaped.

To show this message the server would need to be killed as welcome/loading page is in progress. Then the error page would be loaded.

@srl295

This comment has been minimized.

Show comment
Hide comment
@srl295

srl295 Mar 1, 2017

Contributor

@hickeyma to be clear, the error prevents Kibana page startup… it's not just a broken message when the server is killed at the right time.

Contributor

srl295 commented Mar 1, 2017

@hickeyma to be clear, the error prevents Kibana page startup… it's not just a broken message when the server is killed at the right time.

@hickeyma

This comment has been minimized.

Show comment
Hide comment
@hickeyma

hickeyma Mar 1, 2017

Contributor

@srl295 My bad on #10580 (comment). It ewas the way I was testing the issue initially.

Contributor

hickeyma commented Mar 1, 2017

@srl295 My bad on #10580 (comment). It ewas the way I was testing the issue initially.

srl295 added a commit to srl295/kibana that referenced this issue Mar 7, 2017

Move UI-WELCOME_ERROR from a script insertion to a hidden <div>
* store the error message in an extra div for later retrieval

Fixes: elastic#10580

srl295 added a commit to srl295/kibana that referenced this issue Mar 21, 2017

Move UI-WELCOME_ERROR from a script insertion to a hidden <div>
* store the error message in an extra div for later retrieval

Fixes: elastic#10580

srl295 added a commit to srl295/kibana that referenced this issue Feb 21, 2018

Move UI-WELCOME_ERROR from a script insertion to a hidden <div>
* store the error message in an extra div for later retrieval

Fixes: elastic#10580
@cjcenizal

This comment has been minimized.

Show comment
Hide comment
@cjcenizal

cjcenizal Jul 15, 2018

Contributor

Closing this as we’re moving to a different localization system which should address this problem.

Contributor

cjcenizal commented Jul 15, 2018

Closing this as we’re moving to a different localization system which should address this problem.

@cjcenizal cjcenizal closed this Jul 15, 2018

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment