Better support for accessibility

Oct 13, 2025 by wbrum.org 122 views

About this Feature

In the current implementation of our translation system, some of the translated strings contain HTML. This poses a significant challenge, as these strings need to be combined in the output as 'safe' and skip HTML tag stripping or sanitation. However, skipping HTML sanitation could potentially lead to a security risk.

Detailed Description

The primary concern with using HTML in translated strings is the potential security risk. When HTML is not properly sanitized, it can lead to cross-site scripting (XSS) attacks. XSS attacks occur when an attacker injects malicious code into a website, which is then executed by the user's browser. This can result in the theft of user data, unauthorized access to sensitive information, or even the complete takeover of a user's account.

To mitigate this risk, we need to ensure that all translated strings are properly sanitized before they are displayed to the user. However, the current implementation of using HTML in translated strings makes it challenging to achieve this goal.

Feature Benefit/User Story

The primary benefit of moving to a markup language like Markdown for translated strings is that it allows us to ensure the safety and cleanliness of the strings. By parsing Markdown into HTML, we can guarantee that the resulting string is free from unexpected HTML and is therefore safe to display to the user.

Moreover, using a markup language like Markdown provides several other benefits, including:

Improved readability: Markdown is much easier to read and write than HTML, making it a more user-friendly option for translators.
Simplified formatting: Markdown provides a simple and intuitive way to format text, making it easier to create visually appealing and well-structured content.
Better support for accessibility: Markdown is more accessible than HTML, as it provides a clear and consistent way to format text, making it easier for users with disabilities to navigate and understand the content.

Specifications

To implement this feature, we need to follow the following specifications:

Pick a markup language: We need to choose a markup language that is already utilized in Rocky. Based on our analysis, we recommend using Markdown as the markup language of choice.
Replace HTML in translated links by markdown variants: We need to replace HTML in translated links with Markdown variants. This will ensure that all translated links are formatted using Markdown, making it easier to parse and sanitize the links.
Make sure we sanitize any translated strings that contain markdown by removing any html: We need to ensure that any translated strings that contain Markdown are properly sanitized by removing any HTML. This will prevent any potential security risks associated with using HTML in translated strings.
Parse markdown into html: We need to parse Markdown into HTML. This will ensure that the resulting string is safe and clean from unexpected HTML.
Mark resulting string as safe and use in Templates: We need to mark the resulting string as safe and use it in Templates. This will ensure that the string is properly formatted and displayed to the user without any potential security risks.

Implementation Plan

To implement this feature, we will follow the following steps:

Choose a markup language: We will choose a markup language that is already utilized in Rocky. Based on our analysis, we recommend using Markdown as the markup language of choice.
Replace HTML in translated links by markdown variants: We will replace HTML in translated links with Markdown variants. This will ensure that all translated links are formatted using Markdown, making it easier to parse and sanitize the links.
Sanitize translated strings that contain markdown: We will sanitize any translated strings that contain Markdown by removing any HTML. This will prevent any potential security risks associated with using HTML in translated strings.
Parse markdown into html: We will parse Markdown into HTML. This will ensure that the resulting string is safe and clean from unexpected HTML.
Mark resulting string as safe and use in Templates: We will mark the resulting string as safe and use it in Templates. This will ensure that the string is properly formatted and displayed to the user without any potential security risks.

Benefits and Advantages

The benefits and advantages of moving to Markdown or a similar markup language for translated strings include:

Improved security: By using a markup language like Markdown, we can ensure that all translated strings are properly sanitized and free from unexpected HTML, making it more difficult for attackers to inject malicious code into our website.
Simplified formatting: Markdown provides a simple and intuitive way to format text, making it easier to create visually appealing and well-structured content.
Better support for accessibility: Markdown is more accessible than HTML, as it provides a clear and consistent way to format text, making it easier for users with disabilities to navigate and understand the content.
Improved readability: Markdown is much easier to read and write than HTML, making it a more user-friendly option for translators.

Conclusion

Frequently Asked Questions

As we move to Markdown or a similar markup language for translated strings, we understand that there may be some questions and concerns. Below, we have compiled a list of frequently asked questions and answers to help address these concerns.

Q: Why do we need to move to Markdown or a similar markup language?

A: We need to move to Markdown or a similar markup language to ensure the security and cleanliness of our website. Using HTML in translated strings poses a significant security risk, as it can lead to cross-site scripting (XSS) attacks. By using a markup language like Markdown, we can ensure that all translated strings are properly sanitized and free from unexpected HTML.

Q: What is Markdown, and how does it differ from HTML?

A: Markdown is a lightweight markup language that is easy to read and write. It provides a simple and intuitive way to format text, making it easier to create visually appealing and well-structured content. Unlike HTML, Markdown is not a presentation language, but rather a markup language that is designed to be easy to read and write.

Q: How will we replace HTML in translated links with Markdown variants?

A: We will replace HTML in translated links with Markdown variants by using a combination of regular expressions and string manipulation techniques. This will ensure that all translated links are formatted using Markdown, making it easier to parse and sanitize the links.

Q: How will we sanitize translated strings that contain Markdown?

A: We will sanitize translated strings that contain Markdown by removing any HTML. This will prevent any potential security risks associated with using HTML in translated strings.

Q: How will we parse Markdown into HTML?

A: We will parse Markdown into HTML using a combination of regular expressions and string manipulation techniques. This will ensure that the resulting string is safe and clean from unexpected HTML.

Q: How will we mark the resulting string as safe and use it in Templates?

A: We will mark the resulting string as safe and use it in Templates by using a combination of template engines and string manipulation techniques. This will ensure that the string is properly formatted and displayed to the user without any potential security risks.

Q: What are the benefits and advantages of moving to Markdown or a similar markup language?

A: The benefits and advantages of moving to Markdown or a similar markup language include:

Improved security: By using a markup language like Markdown, we can ensure that all translated strings are properly sanitized and free from unexpected HTML, making it more difficult for attackers to inject malicious code into our website.
Simplified formatting: Markdown provides a simple and intuitive way to format text, making it easier to create visually appealing and well-structured content.
Better support for accessibility: Markdown is more accessible than HTML, as it provides a clear and consistent way to format text, making it easier for users with disabilities to navigate and understand the content.
Improved readability: Markdown is much easier to read and write than HTML, making it a more user-friendly option for translators.

Q: What is the timeline for implementing this feature?

A: We anticipate that the implementation of this feature will take several weeks to complete. We will provide regular updates on the progress of the implementation and will notify all stakeholders when the feature is complete.

Q: Who will be responsible for implementing this feature?

A: The implementation of this feature will be led by the development team, with input and guidance from the translation team and other stakeholders.

Q: How will we test this feature?

A: We will test this feature thoroughly to ensure that it meets all of the requirements and specifications outlined in this document. We will also conduct user acceptance testing (UAT) to ensure that the feature is user-friendly and meets the needs of our users.

Q: What are the next steps?

A: The next steps are to:

Finalize the implementation plan: We will finalize the implementation plan and provide it to all stakeholders.
Begin implementation: We will begin implementing the feature and will provide regular updates on the progress of the implementation.
Conduct testing: We will conduct thorough testing of the feature to ensure that it meets all of the requirements and specifications outlined in this document.
Deploy the feature: We will deploy the feature to production and notify all stakeholders when it is complete.