Twitter and various other web companies allow users to help translate the user interface into their language.

Crowdsourcing translations isn’t new for us. Since October, 2009, we’ve counted on Twitter users to volunteer as translators and help us localize Twitter.

An HTML template then probably substitutes delimited primary language strings with those from the output language. Since the output language strings come from an untrusted source, they could contain a payload to exploit an XSS vulnerability, or, if the results show up in feeds, an XML entity attack or the like.

Does anyone know whether such attacks have shown up in the wild?


1 Answer 1


They obviously need to be sanitized/encoded. But I don't see how it is more vulnerable to XSS and the like than other user supplied data.

I'd worry more about messages that mean something different in that other language being substituted. That could be used for social engineering, or to lower the reputation of your website by inserting inappropriate or insulting content.

  • Encoding works if all translation strings are plain text. Jan 15, 2012 at 2:45
  • If not, you can use BB-Code, Markdown or a html sanitizer, like every website that allows users to enter formatted text. Jan 15, 2012 at 10:23
  • my question is not what I can do, but whether people who have not done so have had problems. Jan 19, 2012 at 1:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .