variables; according to [[Joey]], this is "Freaky code, but seems ok
due to use of `quotementa`".
+##### Locale::Po4a::Xhtml
+
+* does not run any external program
+* does not build regexp's from untrusted variables
+
+=> Seems safe as far as the `includessi` option is disabled; the po
+plugin explicitly disables it.
+
+Relies on Locale::Po4a::Xml` to do most of the work.
+
+##### Locale::Po4a::Xml
+
+* does not run any external program
+* the `includeexternal` option makes it able to read external files;
+ the po plugin explicitly disables it
+* untrusted variables are escaped when used to build regexp's
+
##### Text::WrapI18N
`Text::WrapI18N` can cause DoS
>>>>
>>>>> Done. --[[intrigeri]]
>>>
-> * I'm very fearful of the `add_depends` in `postscan`.
+> * I'm very fearful of the `add_depends` in `indexhtml`.
> Does this make every page depend on every page that links
> to it? Won't this absurdly bloat the dependency pagespecs
> and slow everything down? And since nicepagetitle is given
>>> need improvements to the deletion UI to de-confuse that. It's fine to
>>> put that off until needed --[[Joey]]
>>
-> * Re the meta title escaping issue worked around by `change`.
-> I suppose this does not only affect meta, but other things
-> at scan time too. Also, handling it only on rebuild feels
-> suspicious -- a refresh could involve changes to multiple
-> pages and trigger the same problem, I think. Also, exposing
-> this rebuild to the user seems really ugly, not confidence inducing.
->
-> So I wonder if there's a better way. Such as making po, at scan time,
-> re-run the scan hooks, passing them modified content (either converted
-> from po to mdwn or with the escaped stuff cheaply de-escaped). (Of
-> course the scan hook would need to avoid calling itself!)
->
-> (This doesn't need to block the merge, but I hope it can be addressed
-> eventually..)
->
-> --[[Joey]]
->>
->> I'll think about it soon.
->>
->> --[[intrigeri]]
->>
->>> Did you get a chance to? --[[Joey]]
* As discussed at [[todo/l10n]] the templates needs to be translatable too. They
should be treated properly by po4a using the markdown option - at least with my