Repository navigation
i18n/l10n: fix HTML-escaping of translated strings - #3239
Merged
Merged
Conversation
MichaIng
force-pushed
the
fix-jinja2-html-escaping
branch
6 times, most recently
from
December 11, 2025 15:36
56958f5 to
7f9f78c
Compare
With `newstyle=True`, the `safe` flag is added to all translated strings added with `{{ _("foo") }}` gettext call, hence no HTML-escaping happens. We do not make use of any format placeholders in our strings, hence `newstyle`, which makes such formatting easier, is irrelevant for us, and even adds the need to escape `%` with is otherwise interpreted as placeholder by Jinja2. A literal string injection but with assured HTML-escaping is reasonable in our case, which is what `newstyle=False` (default) provides.
Since with `newstyle=False`, Python format placeholders are not interpreted automatically, `%` does not need to be escaped, respectively it must not be escaped to appear as single character in the resulting HTML document. Only the source strings are updated here, while the translations will be bulk-updated via Weblate, to also trigger new MO files there.
`trim_blocks=False` is the default and we do not have any XML templates, hence removing those.
Signed-off-by: MichaIng <micha@dietpi.com>
MichaIng
force-pushed
the
fix-jinja2-html-escaping
branch
from
December 11, 2025 19:44
7f9f78c to
aaab268
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With
newstyle=True, thesafeflag is added to all translated strings added with{{ _("foo") }}gettext call, hence no HTML-escaping happens. We do not make use of any format placeholders in our strings, hencenewstyle, which makes such formatting easier, is irrelevant for us, and even adds the need to escape%with is otherwise interpreted as placeholder by Jinja2. A literal string injection but with assured HTML-escaping is reasonable in our case, which is whatnewstyle=False(default) provides.Since with
newstyle=False, Python format placeholders are not interpreted automatically,%does not need to be escaped, respectively it must not be escaped to appear as single character in the resulting HTML document. Only the source strings are updated here, while the translations will be bulk-updated via Weblate, to also trigger new MO files there.The whole
jinja2.ext.i18nextension in fact is unnecessary in our case. We don't use any of its features, but only need to pass thegettextfunction_()into the Jinja2 environment.trim_blocks=Falseis the default and we do not have any XML templates, hence removing those.