Merge branch...

Merge branch '393918-using-certain-string-replacement-patterns-like-leads-to-faulty-interpolations' into 'master'

Fix dollar replacements in sprintf

See merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/113721



Merged-by: Jiaan Louw <3468028-jiaan@users.noreply.gitlab.com>
Approved-by: James Rushford <jrushford@gitlab.com>
Approved-by: Jiaan Louw <3468028-jiaan@users.noreply.gitlab.com>
Reviewed-by: Miguel Rincon $' <mrincon@gitlab.com>
Reviewed-by: Jiaan Louw <3468028-jiaan@users.noreply.gitlab.com>
Reviewed-by: James Rushford <jrushford@gitlab.com>
Co-authored-by: Miguel Rincon <mrincon@gitlab.com>

app/assets/javascripts/locale/sprintf.js

@@ -22,7 +22,9 @@ export default (input, parameters, escapeParameters = true) => {
     mappedParameters.forEach((key, parameterName) => {
       const parameterValue = mappedParameters.get(parameterName);
       const escapedParameterValue = escapeParameters ? escape(parameterValue) : parameterValue;
-      output = output.replace(new RegExp(`%{${parameterName}}`, 'g'), escapedParameterValue);
+      // Pass the param value as a function to ignore special replacement patterns like $` and $'.
+      // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/replace#syntax
+      output = output.replace(new RegExp(`%{${parameterName}}`, 'g'), () => escapedParameterValue);
     });
   }
 

spec/frontend/locale/sprintf_spec.js

@@ -84,5 +84,16 @@ describe('locale', () => {
         expect(output).toBe('contains duplicated 15%');
       });
     });
+
+    describe('ignores special replacements in the input', () => {
+      it.each(['$$', '$&', '$`', `$'`])('replacement "%s" is ignored', (replacement) => {
+        const input = 'My odd %{replacement} is preserved';
+
+        const parameters = { replacement };
+
+        const output = sprintf(input, parameters, false);
+        expect(output).toBe(`My odd ${replacement} is preserved`);
+      });
+    });
   });
 });