services:intl locales leaking into user-space options
See original GitHub issueIf your options object happens to be persistent across calls to t
, then you can run into a situation where the current locale(s) leak out into that instance and override the default locale stored in the service
let recipient = {who: 'World'};
intl.setLocale('en-us');
intl.t('say.hello', recipient); // 'Hello World'
// At this point, recipient contains a locale property and will override the default in the service
intl.setLocale('es');
intl.t('say.hello', recipient); // 'Hello World' ... expected 'Hola World'
Possible Bug Location
In services:intl
, the function returned by formatterProxy
appears to directly update the provided options
value with the service’s _locale
. I think the bug might be in the extend call. Not exactly sure how the custom extend
util works, but if it’s like other libraries, an empty seed object could be used to clone the provided object rather than directly manipulating it.
Issue Analytics
- State:
- Created 7 years ago
- Comments:8 (5 by maintainers)
Top Results From Across the Web
The Linux Kernel Key Retention Service and why you should ...
Many leaks happen because of software bugs and security vulnerabilities. In this post we will learn how the Linux kernel can help protect ......
Read more >macOS Leaks Application Usage, Forces Apple to Make Hard ...
Last week, users of macOS noticed that attempting to open non-Apple applications while connected to the Internet resulted in long delays, ...
Read more >Security Information -- DSA-5173-1 linux - Debian
The TCS Robot tool found an information leak in the PF_KEY subsystem. A local user can receive a netlink message when an IPsec...
Read more >How a simple Linux kernel memory corruption bug can lead to ...
This blog post describes a straightforward Linux kernel locking bug and how I exploited it against Debian Buster's 4.19.0-13-amd64 kernel. Based ...
Read more >Buffer Sharing and Synchronization
The three main components of this are: (1) dma-buf, representing a sg_table and exposed to userspace as a file descriptor to allow passing...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
2.10.0 contains this
Awesome!!! Thanks!
Null-safe Issue (#334)