X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/c36d2fa896e9ea42c0b6b0135ba04b4f4f60950f..99a123fa1680e5f3691f4e4a463ff9bc2196718e:/doc/plugins/po/discussion.mdwn

diff --git a/doc/plugins/po/discussion.mdwn b/doc/plugins/po/discussion.mdwn
index ab822e76c..50998e822 100644
--- a/doc/plugins/po/discussion.mdwn
+++ b/doc/plugins/po/discussion.mdwn
@@ -150,6 +150,23 @@ The following analysis was done with his help.
   variables; according to [[Joey]], this is "Freaky code, but seems ok
   due to use of `quotementa`".
 
+##### Locale::Po4a::Xhtml
+
+* does not run any external program
+* does not build regexp's from untrusted variables
+
+=> Seems safe as far as the `includessi` option is disabled; the po
+plugin explicitly disables it.
+
+Relies on Locale::Po4a::Xml` to do most of the work.
+
+##### Locale::Po4a::Xml
+
+* does not run any external program
+* the `includeexternal` option makes it able to read external files;
+  the po plugin explicitly disables it
+* untrusted variables are escaped when used to build regexp's
+
 ##### Text::WrapI18N
 
 `Text::WrapI18N` can cause DoS
@@ -513,7 +530,7 @@ finish it at some point in the first quarter of 2009. --[[intrigeri]]
 >>>>
 >>>>> Done. --[[intrigeri]]
 >>> 
-> * I'm very fearful of the `add_depends` in `postscan`. 
+> * I'm very fearful of the `add_depends` in `indexhtml`. 
 >   Does this make every page depend on every page that links
 >   to it? Won't this absurdly bloat the dependency pagespecs
 >   and slow everything down? And since nicepagetitle is given
@@ -627,28 +644,6 @@ daring a timid "please pull"... or rather, please review again :)
 >>> need improvements to the deletion UI to de-confuse that. It's fine to
 >>> put that off until needed --[[Joey]] 
 >> 
-> * Re the meta title escaping issue worked around by `change`. 
->   I suppose this does not only affect meta, but other things
->   at scan time too. Also, handling it only on rebuild feels
->   suspicious -- a refresh could involve changes to multiple
->   pages and trigger the same problem, I think. Also, exposing
->   this rebuild to the user seems really ugly, not confidence inducing.
->   
->   So I wonder if there's a better way. Such as making po, at scan time,
->   re-run the scan hooks, passing them modified content (either converted
->   from po to mdwn or with the escaped stuff cheaply de-escaped). (Of
->   course the scan hook would need to avoid calling itself!)
-> 
->   (This doesn't need to block the merge, but I hope it can be addressed
->   eventually..)
->  
-> --[[Joey]] 
->> 
->> I'll think about it soon.
->> 
->> --[[intrigeri]]
->>
->>> Did you get a chance to? --[[Joey]] 
 
  * As discussed at [[todo/l10n]] the templates needs to be translatable too.  They
    should be treated properly by po4a using the markdown option - at least with my