Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Twitter and various other web companies allow users to help translate the user interface into their language.

Crowdsourcing translations isn’t new for us. Since October, 2009, we’ve counted on Twitter users to volunteer as translators and help us localize Twitter.

An HTML template then probably substitutes delimited primary language strings with those from the output language. Since the output language strings come from an untrusted source, they could contain a payload to exploit an XSS vulnerability, or, if the results show up in feeds, an XML entity attack or the like.

Does anyone know whether such attacks have shown up in the wild?

share|improve this question

They obviously need to be sanitized/encoded. But I don't see how it is more vulnerable to XSS and the like than other user supplied data.

I'd worry more about messages that mean something different in that other language being substituted. That could be used for social engineering, or to lower the reputation of your website by inserting inappropriate or insulting content.

share|improve this answer
Encoding works if all translation strings are plain text. – Mike Samuel Jan 15 '12 at 2:45
If not, you can use BB-Code, Markdown or a html sanitizer, like every website that allows users to enter formatted text. – CodesInChaos Jan 15 '12 at 10:23
my question is not what I can do, but whether people who have not done so have had problems. – Mike Samuel Jan 19 '12 at 1:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.