New Crowdin updates

[ashkan-deriv]

No description provided.

To fix the issue, we need to replace the substring check hostname.includes('deriv.com') with a more secure method of validating the hostname. Specifically, we should compare the hostname against a whitelist of allowed domains or subdomains. This ensures that only legitimate domains like deriv.com or its subdomains (e.g., www.deriv.com, beta.deriv.com) are accepted.

The fix involves:

1. Parsing the hostname to ensure it is properly extracted.
2. Using an explicit whitelist of allowed domains and subdomains.
3. Checking if the hostname matches any entry in the whitelist.

---

To fix the issue, the email value should be sanitized or encoded before being interpolated into the URL string. Specifically, the encodeURIComponent function should be used to encode the email value. This function ensures that special characters in the email address are properly escaped, preventing them from being interpreted as part of the URL or as executable code.

The changes should be made on line 1578 and line 1580, where the email value is interpolated into the URL. The encodeURIComponent function will be applied to the email variable in both cases.

To fix the issue, the email variable should be sanitized or encoded before being interpolated into the URL. The best approach is to use encodeURIComponent, which ensures that special characters in the email are properly escaped, preventing them from being interpreted as part of the HTML or JavaScript. This change should be applied to the interpolation on line 1580 (and line 1578 for consistency).

To fix the issue, replace the substring check hostname.includes('deriv.com') with a more secure validation method. Specifically, parse the hostname and compare it against a whitelist of allowed hostnames or use exact matching to ensure that only legitimate hostnames are accepted.

Steps to implement the fix:

1. Define a whitelist of allowed hostnames (e.g., ['deriv.com', 'www.deriv.com']).
2. Parse the hostname using new URL(window.location.href).hostname to extract the actual hostname.
3. Check if the parsed hostname matches one of the entries in the whitelist.

To fix the issue, the email variable should be sanitized or encoded before being embedded in the URL. Specifically, the encodeURIComponent function should be used to encode the email value, ensuring that any special characters or potentially malicious input are safely escaped. This change should be applied to the construction of the URL on line 1578.

To fix the issue, the email value should be properly encoded before being used in the URL. This can be achieved using encodeURIComponent, which ensures that special characters in the email value are safely escaped. This prevents any malicious input from being interpreted as HTML or JavaScript.

Steps to fix:

1. Replace the direct usage of email in the URL construction with encodeURIComponent(email).
2. Ensure that all instances where email is used in constructing URLs are properly encoded.

---

To fix the issue, the email value should be sanitized or encoded before being used in the URL. The best approach is to use encodeURIComponent, which ensures that special characters in the email value are properly escaped, preventing them from being interpreted as HTML or causing other security issues.

Steps to fix:

1. Replace the direct interpolation of email in the URL with encodeURIComponent(email).
2. Ensure that the emailPattern.test(email) validation remains intact to filter out invalid email formats.

---

To fix the issue, we need to replace the substring check hostname.includes('deriv.com') with a more secure method that ensures the hostname is exactly deriv.com or one of its subdomains. This can be achieved by parsing the hostname and verifying it against a whitelist of allowed domains. The endsWith method can be used to ensure that the hostname ends with .deriv.com or is exactly deriv.com.

Changes to be made:

1. Replace the hostname.includes('deriv.com') check with a function that validates the hostname against a whitelist of allowed domains.
2. Add a helper function to perform this validation.

---

To fix the issue, the user input (emailInput?.value) must be sanitized or encoded before being used in the URL. The best approach is to use a function that performs contextual output encoding, such as encodeURIComponent, which ensures that special characters in the email value are properly escaped. This prevents the input from being interpreted as HTML or JavaScript.

Steps to fix:

1. Replace the direct interpolation of email in the URL with a sanitized version using encodeURIComponent.
2. Ensure that all instances where email is used in URLs are sanitized similarly.

To fix the issue, the email variable should be sanitized or encoded before being interpolated into the URL. Specifically, the email value should be URL-encoded to ensure that any special characters are safely represented in the query string. This can be achieved using JavaScript's encodeURIComponent function, which encodes a string as a valid URI component.

The fix involves:

1. Replacing the direct use of email in the URL with encodeURIComponent(email).
2. Ensuring that the email value is properly sanitized before being used in the redirection.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files