fix: guard against directional override characters in translator args

2025-12-16 05:20:24 +01:00 · 2025-02-21 21:40:25 -05:00
1 changed files with 1 additions and 1 deletions
--- a/public/src/modules/translator.common.js
+++ b/public/src/modules/translator.common.js
@@ -260,7 +260,7 @@ module.exports = function (utils, load, warn) {
 				return Promise.all(argsToTranslate).then(function (translatedArgs) {
 					let out = translated;
 					translatedArgs.forEach(function (arg, i) {
-						let escaped = arg.replace(/%(?=\d)/g, '&#37;').replace(/\\,/g, '&#44;');
+						let escaped = `<bdi>${arg.replace(/%(?=\d)/g, '&#37;').replace(/\\,/g, '&#44;')}</bdi>`;
 						// fix double escaped translation keys, see https://github.com/NodeBB/NodeBB/issues/9206
 						escaped = escaped.replace(/&amp;lsqb;/g, '&lsqb;')
 							.replace(/&amp;rsqb;/g, '&rsqb;');