first commit

services/web/bin/lint_locales

@@ -0,0 +1,43 @@
+#!/bin/bash
+
+set -e
+
+# Ensure all locale files are sorted.
+node scripts/translations/sort.js --check
+
+# Ensure all locales are still in use
+node scripts/translations/cleanupUnusedLocales.js --check
+
+# Ensure all locales use the same variables
+node scripts/translations/checkVariables.js --ignore-orphaned-translations
+
+# Ensure no locales contain single quotes.
+LOCALES_WITH_SINGLE_QUOTE=$(\
+  grep \
+    --files-with-matches \
+    --recursive locales/ \
+    --regex "'" \
+  || true
+)
+
+for file in ${LOCALES_WITH_SINGLE_QUOTE}; do
+  cat <<MSG >&2
+
+ERROR: $file contains a locale with a single quote.
+
+---
+$(grep "$file" --regex "'")
+---
+
+Using single quotes in locales can lead to Angular XSS.
+
+You will need to replace the quote with a similar looking character.
+’ (\u2019) is a good candidate.
+
+Links:
+ - https://en.wikipedia.org/wiki/Right_single_quotation_mark
+ - https://github.com/overleaf/issues/issues/4478
+
+MSG
+  exit 1
+done