translation-injection (ODOO043)

Preview (since 0.16.2.2) · Related issues · View source

Derived from the odoo linter.

This rule is unstable and in preview. The --preview flag is required for use.

What it does

Checks for .format(...) called on the result of a translation, e.g. _("...{}...").format(value).

Why is this bad?

Calling str.format on translated text lets a malicious translation access attributes of the format arguments ({0.__class__}-style injection).

Example

_("Hello {}").format(name)

Use instead:

_("Hello %s") % name