libintl: no way to use private message catalogs (resend)

[Ulrich Drepper]

On Fri, 2002-06-14 at 04:38, Bruno Haible wrote:

> Zack Weinberg reported that there is no way for a user of an
> internationalized program to use message catalogs other than those
> installed under $prefix/share/locale. This is something a translator
> will want to do: testing his message catalog without having write
> access to $prefix/share/locale.

That's not an oversight, that's the design.  Allowing anything but the
standard places (or those allowed by a call to bindtextdomain) is a
security problem.  Since any message can be replaced by anything else if
you control the .mo file it would be an open invitation for those who
want to do harm.  Format strings can get replaced, replacements like

   do you really want to delete this file (y/n)?

with

   do you really want to keep this file (y/n)?


If you want testing, let individual programs allow using
bindtextdomain.  This must be an individual solution since this mode
must disable potentially dangerous operations.

-- 
---------------.                          ,-.   1325 Chesapeake Terrace
Ulrich Drepper  \    ,-------------------'   \  Sunnyvale, CA 94089 USA
Red Hat          `--' drepper at redhat.com   `------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 232 bytes
Desc: This is a digitally signed message part
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20020628/f6e1277a/attachment.sig>