messere1 opened a new issue, #1913:
URL: https://github.com/apache/rocketmq-dashboard/issues/1913
## Bug description
`LangContext.t()` interpolates parameters with `String.replace(token,
String(value))`. JavaScript interprets replacement patterns such as `$&`, ``$`
``, and `$'` in the replacement string instead of inserting them literally.
As a result, valid user-controlled names can be corrupted in translated
labels and confirmation messages. For example, interpolating `orders$&` into
`Delete {name}?` renders `Delete orders{name}?` rather than preserving the
resource name. The current implementation also replaces only the first
occurrence of a placeholder.
## Expected behavior
Translation parameters should be inserted literally and every occurrence of
the corresponding placeholder should be replaced.
## Suggested fix
Use literal splitting/joining (or a replacement callback) and add regression
coverage for replacement-pattern characters.
## Affected branch
`rocketmq-studio`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
