Skip to content

l10n: Add POC translation files for security research#3

Closed
Benasin wants to merge 1 commit intoShopify:masterfrom
Benasin:l10n-poc-heredoc-injection
Closed

l10n: Add POC translation files for security research#3
Benasin wants to merge 1 commit intoShopify:masterfrom
Benasin:l10n-poc-heredoc-injection

Conversation

@Benasin
Copy link

@Benasin Benasin commented Jan 20, 2026

This commit adds translation files that demonstrate a heredoc injection vulnerability in the l10n workflow.

Thanks for taking the time to contribute to Git! Please be advised that the
Git community does not use github.com for their contributions. Instead, we use
a mailing list (git@vger.kernel.org) for code submissions, code reviews, and
bug reports. Nevertheless, you can use GitGitGadget (https://gitgitgadget.github.io/)
to conveniently send your Pull Requests commits to our mailing list.

For a single-commit pull request, please leave the pull request description
empty
: your commit message itself should describe your changes.

Please read the "guidelines for contributing" linked above!

This commit adds translation files that demonstrate
a heredoc injection vulnerability in the l10n workflow.
@github-actions
Copy link

Errors and warnings found by git-po-helper in workflow #7:

ERROR invalid language code for locale "l10n-inject" 
ERROR invalid language code for locale "poc"       
------------------------------------------------------------------------------
WARNING commit 2a18b1b: subject length 53 > 50, about 63% commits have a subject less than 50 characters 
------------------------------------------------------------------------------
ERROR commit 2a18b1b: cannot find "Signed-off-by:" signature 
INFO checking commits: 0 passed, 1 failed.        
------------------------------------------------------------------------------
INFO downloading pot file from https://github.com/git-l10n/pot-changes/raw/pot/master/po/git.pot 

ERROR: fail to execute "git-po-helper check-commits"

@Benasin Benasin closed this Jan 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant