Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential Abuse of Reusable Quote (%q) in bluetooth/utils_notify.go #5

Closed
Artoria2e5 opened this issue Jan 19, 2016 · 8 comments
Closed

Comments

@Artoria2e5
Copy link

See https://github.com/linuxdeepin/dde-daemon/blob/release/3.0/bluetooth/utils_notify.go.

%q is not quite intended for use with UI text; actually 'a double-quoted string safely escaped with Go syntax' -- yes, a piece of reusable source code. For quoting normal people use a pair of curly single quotes ‘...’ in general UI text (GNOME HIG, see also gettext en@boldquot), and for localization one might leave two strings consisting only of these characters to be left out for translation like "‘" and "’".

CLI Dark Ages? People used ``...', and likewise they leave "`"` and `"'"` out for translation.

@fasheng
Copy link

fasheng commented Jan 20, 2016

Thanks for the advice. So you mean we should use following string instead?

format := Tr("Make sure '%q' is turned on and in range")

It's really an importante rule for translation, I will report to my colleagues to let them known.

@Artoria2e5
Copy link
Author

%s. %q, as stated before, gives you a segment of string literal, and putting quotes around such literal sounds even worse.

你的好友 “"你好,世界"” 已经掉线,正在抢救。

Nobody wants that, right? (Also assuming the chinese "hello-world" is not being transformed into any \u crap here)

@Artoria2e5
Copy link
Author

So here is how old things like grep handled their quoting to be translatable…

Basically, things are passed down to Gnulib: Quoting.

The full implementation is here at http://git.savannah.gnu.org/cgit/gnulib.git/tree/lib/quotearg.c#n1001. We only want the gettext-enabled quote(char* s) functionality, so let's just track it down…

  • tailcall quote_n(0, s)
  • tailcall quote_n_mem(0, s, SIZE_MAX)
  • tailcall quotearg_n_options(0, s, SIZE_MAX, {locale_quoting_style, 0, {0}, NULL, NULL})
  • newbuf.. on buf: quotearg_buffer_restyled..... (elide_outer_quotes = false)
    • (case locale_quoting_style: backslash escape enabled!)
    • strbuf = ngettext("") + s + ngettext("'")`
    • (argsize is SIZE_MAX, we have a null-terminated string, so forget about \0..)
    • replace \a \b \f \v \\ with their escaped forms..
    • default: some multibyte checks.
  • ret buf.

These steps show what are needed by GNU guys to make their things. Hmm, now I feel like you should just write something that chops off the quotes from %q results and replace them with good quotes. I don't have Go here, but hopefully they will not \u-ize non-ascii things.

@fasheng
Copy link

fasheng commented Jan 20, 2016

Amazing skill!

Looks I misunderstand you at first. You mean we should quote the argument string through a general function to make the localization right. Yes, it's a better style, I have post it to the upstream developer center, and welcome to discuss more things there :)

BTW: looks the bluetooth module do not need a quoting operation for it should provide the original name of the device~

@fasheng fasheng closed this as completed Jan 20, 2016
@snyh
Copy link
Member

snyh commented Jan 21, 2016

There has a g_shell_quote function we can use.
But it need invoke cgo which is too expensive.

@Artoria2e5
Copy link
Author

Yes, and that's why I wrote down what it basically does here so you can just implement it yourself even without reading the code (and breaking some clean-room rules or whatever)…

@snyh
Copy link
Member

snyh commented Jan 21, 2016

The std packages of golang has this https://golang.org/pkg/strconv/#Quote
Thanks notice the quote problem

@Artoria2e5
Copy link
Author

……The quote function is merely another %q: a double-quoted Go string literal representing s.

However, as mentioned in that comment again, I think just removing the quotes from the string literal produced and plugging in the localized quotes is acceptable, i.e. locquote(s) = (s) => ngettext("") + Quote(s)[1:-1] + ngettext("'")`.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants