Merge pull request #74 from edx/inventhouse/validate-flunk-added-html

Lint po files to forbid adding HTML

README.rst

@@ -85,6 +85,13 @@ Details of the config.yaml file are in `edx-platform/conf/locale/config.yaml
 
 Changes
 =======
+v0.4.7
+-------
+
+* Test that tag validation catches HTML added to translations.
+
+* When tag validation finds differences, output should be deterministic.
+
 v0.4.6
 -------
 

i18n/__init__.py

@@ -6,7 +6,7 @@
 
 from . import config
 
-__version__ = '0.4.6'
+__version__ = '0.4.7'
 
 
 class Runner:

i18n/validate.py

@@ -161,8 +161,8 @@ def check_messages(filename, report_empty=False):
 
             # Check if tags don't match
             if id_tags != tx_tags:
-                id_has = u", ".join(u'"{}"'.format(t) for t in id_tags - tx_tags)
-                tx_has = u", ".join(u'"{}"'.format(t) for t in tx_tags - id_tags)
+                id_has = u", ".join(sorted(u'"{}"'.format(t) for t in id_tags - tx_tags))
+                tx_has = u", ".join(sorted(u'"{}"'.format(t) for t in tx_tags - id_tags))
                 if id_has and tx_has:
                     diff = u"{} vs {}".format(id_has, tx_has)
                 elif id_has:

setup.py

@@ -4,7 +4,7 @@
 
 setup(
     name='edx-i18n-tools',
-    version='0.4.6',
+    version='0.4.7',
     description='edX Internationalization Tools',
     author='edX',
     author_email='[email protected]',

tests/data/validation_problems.po

@@ -22,6 +22,10 @@ msgstr "One tag: {one} and not two"
 msgid "One tag: {one}"
 msgstr "Two tags: {one} and {two}"
 
+# HTML added to translations could create cross-site security issues
+msgid "No tags"
+msgstr "Added some <a href='https://en.wikipedia.org/wiki/HTML'>HTML</a>"
+
 # TODO: This doesn't raise a validation error: the characters comes through as
 # a surrogate pair, and so isn't a problem.  So are astral characters a
 # problem?
@@ -72,5 +76,6 @@ msgstr ""
 msgid "Look &mdash; a dog!"
 msgstr "Look -- a dog!"
 
+# <abbr> could come-and-go with translations
 msgid "The <abbr>CIA</abbr> said so"
 msgstr "The secret agency said so"

tests/test_changed.py

@@ -26,6 +26,7 @@ def test_detect_changes(self):
         file_name = fake_locale_dir / 'LC_MESSAGES' / 'mako.po'
         copy = fake_locale_dir / 'LC_MESSAGES' / 'mako_copy.po'
 
+        # Note: this fails if you have not-yet-committed changes to test fixture .po files
         self.assertFalse(self.changed.detect_changes())
 
         try:

tests/test_validate.py

@@ -36,6 +36,12 @@
         u'Two tags: {one} and {two}',
         u'"{two}" added',
     ),
+    (
+        'Different tags in source and translation',
+        'No tags',
+        "Added some <a href='https://en.wikipedia.org/wiki/HTML'>HTML</a>",
+        '"</a>", "<a href=\'https://en.wikipedia.org/wiki/HTML\'>" added'
+    ),
     (
         'Non-BMP char',
         u'Astral character (pile of poo), bad for JavaScript: \U0001f4a9',