Skip to content

translation-format-interpolation (ODOO056)

Preview (since 0.16.2.9) · Related issues · View source

Derived from the odoo linter.

This rule is unstable and in preview. The --preview flag is required for use.

What it does

Checks for translation calls interpolated with str.format, either on the term (_("Hello {}".format(name))) or on the translated result (_("Hello {}").format(name)).

Why is this bad?

Since Odoo 14.0 the translation functions (_, self.env._) interpolate the values themselves using printf-style placeholders: _("Hello %s", name). Formatting the term interpolates before translation, so the looked-up term never matches the exported translation entry; formatting the result lets a malicious translation access attributes of the format arguments.

Example

_("Hello {}").format(name)

Use instead: 

_("Hello %s", name)