single quote ' in translation string breaks ui_app.jade

[srl295]

Kibana version: master (6.0.0 alpha, 7084d55)

Original install method (e.g. download page, yum, from source, etc.): source

Description of the problem including expected versus actual behavior:

French translation with a single quote breaks startup page, because UI-WELCOME_ERROR is substituted into the inline script without escaping.

The specific translation bundle ( plugins/kibana_translation/translations/fr.json ) looks like this:

{
  "UI-WELCOME_MESSAGE": "En chargeant Kibana",
  "UI-WELCOME_ERROR": "Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information."
}

Steps to reproduce:

1. unpack the enclosed .tgz ( creates plugins/kibana_translation/… )
2. startup kibana with npm run start
3. bring up a browser configured for French (fr)

Errors in browser console (if relevant):

Uncaught SyntaxError: Unexpected identifier @ kibana:179

The specific line is:

err.innerText = 'Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information.';

This is caused by the source in ui_app.jade:

err.innerText = '#{i18n('UI-WELCOME_ERROR')}';

I think this can be corrected with some escaping. Probably using JSON.stringify as elsewhere on the same page.

[srl295]

fyi @hickeyma - this is reproducible without phase 2 #8766 so I am filing separately.

[srl295]

Note that in the welcome message, ' is fine, as shown below. (PS: pardon any issues with the français, SVP)

{
  "UI-WELCOME_MESSAGE": "En chargeant Kibana, s'il vous plait!",
  "UI-WELCOME_ERROR": "Kibana n'a pas chargé correctement. Vérifiez le rendement du serveur pour plus d'information."
}

I wonder if it should be err.innerHtml because Jade might HTML-escape something here.

[hickeyma]

@srl295 Good catch, thanks. This would have been a silent issue until Phase 4, so it is good that you could do some testing with other languages that introduce single quotes.

It only applies to UI-WELCOME_ERROR because the jade code references it in a single quote and therefore the single quote in the text string is not escaped.

To show this message the server would need to be killed as welcome/loading page is in progress. Then the error page would be loaded.

[srl295]

@hickeyma to be clear, the error prevents Kibana page startup… it's not just a broken message when the server is killed at the right time.

[hickeyma]

@srl295 My bad on #10580 (comment). It ewas the way I was testing the issue initially.

[cjcenizal]

Closing this as we’re moving to a different localization system which should address this problem.