New Crowdin updates

[ashkan-deriv]

No description provided.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

To fix the problem, we need to replace the substring check with a more secure method of verifying the hostname. Specifically, we should parse the URL and check if the host matches an allowed list of hosts. This ensures that the check is not bypassed by embedding the allowed host in an unexpected location within the URL.

1. Parse the URL to extract the hostname.
2. Check if the hostname matches an allowed list of hosts.
3. Update the relevant lines in the code to implement this change.

To fix the problem, we need to parse the URL and check the host value against a whitelist of allowed hosts. This ensures that the check handles arbitrary subdomain sequences correctly and prevents malicious URLs from bypassing the security check.

1. Parse the URL to extract the hostname.
2. Compare the extracted hostname against a whitelist of allowed hosts.
3. Update the code to use this new approach.

To fix the problem, we need to replace the substring check with a more robust method of verifying the hostname. Specifically, we should parse the URL and check if the hostname matches an allowed list of hosts. This ensures that only the exact allowed hosts are accepted, preventing any bypass attempts.

1. Parse the URL to extract the hostname.
2. Use an explicit whitelist of allowed hosts to check if the hostname is valid.
3. Update the relevant code to implement this change.

To fix the problem, we need to replace the substring check with a more robust method of validating the hostname. Specifically, we should parse the URL and check if the hostname matches an allowed list of hosts. This ensures that the check handles arbitrary subdomain sequences correctly and prevents bypassing the validation.

1. Parse the URL to extract the hostname.
2. Use an explicit whitelist of allowed hosts to validate the hostname.
3. Update the relevant lines in the code to implement this change.

To fix the problem, we need to replace the substring check with a more secure method of validating the hostname. Specifically, we should parse the URL and check if the host is in a whitelist of allowed hosts. This ensures that only the exact allowed hosts or their subdomains are accepted.

1. Parse the URL to extract the hostname.
2. Check if the extracted hostname is in a whitelist of allowed hosts.
3. Replace the substring check with this new validation method.

To fix the problem, we need to ensure that the hostname is properly validated against a whitelist of allowed hosts. This involves parsing the URL to extract the hostname and then checking if it matches any of the allowed hosts. We will use the URL constructor to parse the URL and compare the hostname against a predefined list of allowed hosts.

1. Parse the URL using the URL constructor to extract the hostname.
2. Define a whitelist of allowed hosts.
3. Check if the parsed hostname is in the whitelist.
4. Update the code to use this secure method for hostname validation.

To fix the problem, we need to parse the URL and check the host value against a whitelist of allowed hosts. This ensures that only legitimate subdomains of deriv.com are accepted. We will use the URL constructor to parse the URL and then check the hostname against a predefined list of allowed hosts.

1. Parse the URL using the URL constructor.
2. Extract the hostname from the parsed URL.
3. Check if the hostname is in the list of allowed hosts.
4. Update the code to use this new check instead of the substring check.

To fix the problem, we need to ensure that the email variable is properly encoded before being included in the URL. This can be achieved by using the encodeURIComponent function, which encodes a URI component by replacing each instance of certain characters by one, two, three, or four escape sequences representing the UTF-8 encoding of the character.

• Locate the line where the email variable is used in the URL redirection.
• Replace the direct usage of email with encodeURIComponent(email) to ensure that any special characters in the email are properly encoded.

To fix the problem, we need to ensure that the user-provided email is properly encoded before being included in the URL. This can be achieved by using encodeURIComponent to encode the email, which will escape any special characters and prevent XSS attacks.

• Locate the line where the URL is constructed with the user-provided email.
• Replace the direct inclusion of the email with an encoded version using encodeURIComponent.
• Ensure that the fix is applied consistently wherever the email is used in constructing URLs.

To fix the problem, we need to ensure that the email variable is properly encoded before being used in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email address, making it safe to include in a URL.

• Locate the line where the email variable is used in the URL construction.
• Replace the direct usage of email with encodeURIComponent(email) to ensure that any special characters are properly encoded.
• This change should be made in the file public/email/crowdin/translations/bn/lp-forex-ebook.html on line 1578.

To fix the problem, we need to ensure that the email value is properly encoded before being used in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email address, making it safe to include in a URL.

• Locate the line where the URL is constructed with the email value.
• Replace the direct usage of email with encodeURIComponent(email) to ensure the email is properly encoded.
• This change should be made in the file public/email/crowdin/translations/bn/lp-forex-ebook.html on line 1580.

To fix the problem, we need to ensure that the email variable is properly encoded before being used in the URL. This can be achieved by using encodeURIComponent to encode the email variable, which will escape any special characters and prevent XSS attacks.

• Locate the line where the email variable is used in the URL.
• Replace the direct usage of email with encodeURIComponent(email) to ensure it is properly encoded.

To fix the problem, we need to ensure that the email variable is properly encoded before being used in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email address, making it safe to include in a URL.

• Locate the line where the email variable is used in the URL.
• Replace the direct interpolation of email with encodeURIComponent(email) to ensure the email address is safely encoded.

To fix the problem, we need to ensure that the email variable is properly encoded before being used in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email address, making it safe to include in a URL.

• Locate the line where the email variable is used in the URL.
• Replace the direct usage of email with encodeURIComponent(email) to ensure that the email address is properly encoded.

To fix the problem, we need to ensure that the email variable is properly encoded before being used in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email address, making it safe to include in a URL.

• Locate the line where the URL is constructed with the email variable.
• Replace the direct use of email with encodeURIComponent(email) to ensure that any special characters are properly encoded.
• This change should be made in the file public/email/crowdin/translations/fr/lp-forex-ebook.html on line 1580.

To fix the problem, we need to ensure that the email variable is properly encoded before being used in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email address, making it safe to include in a URL.

• Replace the usage of the email variable in the URL construction with encodeURIComponent(email).
• This change should be made on line 1578 and line 1580 to ensure the email is properly encoded in both cases.

To fix the problem, we need to ensure that the user-provided email is properly encoded before being included in the URL. This can be achieved by using the encodeURIComponent function, which encodes special characters in the email, making it safe to include in a URL.

• Replace the direct use of the email variable in the URL with an encoded version using encodeURIComponent.
• This change should be made on line 1580 where the URL is constructed.