Skip to content

Allow language spoofing in status messages

H1 user ryotac reported yet another variant of #30683 (closed), but this one is not covered by that patch because XSLT errors have their own separate bundle and displaying logic.

POC: https://people.torproject.org/~ma1/pbugs/42288/poc/

I believe in this case, rather than spoofing English in the error page, we should just match Chromium's behavior and just fail silently, displaying the untransformed document - and possibly fix upstream too, looking at this comment.

[EDIT]

In the end I decided to fix this with logic similar to #30683 (closed), instead of radically changing Firefox's behavior (potentially informative and valuable to developers debugging XML/XSLT problems) to align it with Chromium.

So in !851 (merged) we rather spoof language in XSLT error messages as well, when needed.

Edited by ma1
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information