Bump ICU MessageFormat

This uses `Intl.PluralRules` for plural rules, and fixes a security vulnerability allowing JS injection through translation arguments.
flarum · Oct 26, 2021 · 7db2764 · 7db2764
1 parent 9724116
commit 7db2764
Show file tree

Hide file tree

Showing 3 changed files with 21 additions and 29 deletions.
diff --git a/js/package-lock.json b/js/package-lock.json
diff --git a/js/package.json b/js/package.json
@@ -3,8 +3,8 @@
   "name": "@flarum/core",
   "prettier": "@flarum/prettier-config",
   "dependencies": {
-    "@askvortsov/rich-icu-message-formatter": "^0.1.0",
-    "@ultraq/icu-message-formatter": "^0.10.1",
+    "@askvortsov/rich-icu-message-formatter": "^0.2.0",
+    "@ultraq/icu-message-formatter": "^0.12.0-beta.0",
     "bootstrap": "^3.4.1",
     "clsx": "^1.1.1",
     "color-thief-browser": "^2.0.2",

diff --git a/js/src/common/Translator.tsx b/js/src/common/Translator.tsx
@@ -55,16 +55,7 @@ export default class Translator {
       if (!parameters.username) parameters.username = username(user);
     }
 
-    const escapedParameters: TranslatorParameters = {};
-
-    for (const param in parameters) {
-      const paramValue = parameters[param];
-
-      if (typeof paramValue === 'string') escapedParameters[param] = <>{parameters[param]}</>;
-      else escapedParameters[param] = parameters[param];
-    }
-
-    return escapedParameters;
+    return parameters;
   }
 
   trans(id: string, parameters: TranslatorParameters = {}) {