rails/rails — Issue #3515: _html translation should escape interpolated arguments
Author: korny
Created: 2011-11-04 11:26:29+00:00
State: open

ActionView::Helpers::TranslationHelper#translate automatically marks a translation for a key ending with "_html" as html_safe, but fails to escape the given arguments:

```yaml
# translation file
my_html: "I am %{name}"
```

```haml
= t 'my_html', :name => ''
```

I consider this a security problem, since it violates the expected behavior of safe helpers.

The issue was reported a year ago for I18n by Domizio Demichelis: http://i18n.lighthouseapp.com/projects/14948-rails-i18n/tickets/32-the-translation-helper-is-unsafe, but it was never reopened as Rails ticket.

The fix for Rails 2.3 is a bit more complicated, since the method still supports deprecated array key arguments. My quick monkey patch was:

```ruby
module ActionView::Helpers::TranslationHelper
def translate_with_html_safe_options(keys, options = {})
if !options.empty? && keys =~ /(\b|_|\.)html$/
options = {}.tap do |html_safe_options|
for name, value in options
html_safe_options[name] = h(value)
end
end
end

translate_without_html_safe_options keys, options
end
alias t_with_html_safe_options translate_with_html_safe_options

alias_method_chain :translate, :html_safe_options
alias_method_chain :t, :html_safe_options
end
```