useEncodeURIComponent to add security to dynamic import

2020-10-05 21:27:48 +02:00
parent d8a8869b98
commit 6d1c36b6d3
22 changed files with 30 additions and 23 deletions
--- a/src/editor/extensions/ext-closepath/ext-closepath.js
+++ b/src/editor/extensions/ext-closepath/ext-closepath.js
@@ -10,7 +10,7 @@
 const loadExtensionTranslation = async function (lang) {
  let translationModule;
  try {
-    translationModule = await import(`./locale/${lang}.js`);
+    translationModule = await import(`./locale/${encodeURIComponent(lang)}.js`);
  } catch (_error) {
    // eslint-disable-next-line no-console
    console.error(`Missing translation (${lang}) - using 'en'`);