@atlassian/i18n-properties-loader 2.0.1 → 2.0.2

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [2.0.2](https://bitbucket.org/atlassianlabs/fe-server/branches/compare/@atlassian/i18n-properties-loader@2.0.2..@atlassian/i18n-properties-loader@2.0.1) (2026-05-29)
+
+
+### Bug Fixes
+
+* **@atlassian/i18n-properties-loader:** escape substitutions inside string literals ([6f1ac57](https://bitbucket.org/atlassianlabs/fe-server/commits/6f1ac575a4f7dbc2de1143bc7f77a8592e56698d))
+
+
+
 ## [2.0.1](https://bitbucket.org/atlassianlabs/fe-server/branches/compare/@atlassian/i18n-properties-loader@2.0.1..@atlassian/i18n-properties-loader@2.0.0) (2026-05-12)
 
 **Note:** Version bump only for package @atlassian/i18n-properties-loader

package/index.js

@@ -1,6 +1,6 @@
 /* eslint-env node */
 const fs = require('fs');
-const debounce = require('lodash.debounce');
+const debounce = require('lodash/debounce');
 const { PropertiesFile } = require('java-properties');
 const { getOptions } = require('loader-utils');
 const { validate } = require('schema-utils');
@@ -97,6 +97,29 @@ const clearCacheWhenIdle = debounce(() => {
   i18nCache = new Map();
 }, accessThreshold);
 
+// Returns the quote character (' or ") enclosing `offset` in `source`, or null if not in a string literal.
+function getEnclosingStringQuote(source, offset) {
+  let openQuote = null; // currently open string delimiter, or null
+  let escaped = false;
+  for (let i = 0; i < offset; i++) {
+    const ch = source[i];
+    if (escaped) {
+      escaped = false;
+    } else if (ch === '\\') {
+      escaped = true;
+    } else if (openQuote) {
+      if (ch === openQuote) openQuote = null;
+    } else if (ch === "'" || ch === '"') {
+      openQuote = ch;
+    }
+  }
+  return openQuote;
+}
+
+function escapeForStringLiteral(value, quote) {
+  return value.split(quote).join('\\' + quote);
+}
+
 function processI18nFiles(i18nFiles) {
   clearCacheWhenIdle();
 
@@ -152,8 +175,18 @@ module.exports = function (source, map) {
 
     // Replace "I18n.getText('some.translation.key', [param1], [paramN])" with the real translation string
     const properties = processI18nFiles(i18nFiles);
-    const newSource = source.replace(i18nRegExp, (...args) => {
-      const { namespace, key, endParam } = args.pop();
+    const newSource = source.replace(i18nRegExp, (match, ...args) => {
+      // replace() callback: (match, ...captures, offset, source, groups)
+      const groups = args[args.length - 1];
+      const matchSource = args[args.length - 2];
+      const offset = args[args.length - 3];
+
+      // Escape substitutions inside string literals (e.g. babel-plugin-istanbul's
+      // embedded inputSourceMap.sourcesContent) to avoid breaking the surrounding
+      // literal with unescaped quotes from JSON.stringify(message). See: DCA11Y-3344
+      const enclosingQuote = getEnclosingStringQuote(matchSource, offset);
+
+      const { namespace, key, endParam } = groups;
       const escapedKey = key.replace(/\s/g, '\\ ');
 
       let message = properties.get(escapedKey);
@@ -171,12 +204,10 @@ module.exports = function (source, map) {
       // Output string
       const escapedMessage = JSON.stringify(message);
 
-      if (endParam === ',') {
-        // We don't need to unquote the string since the WRM.format function has all the logic to do that
-        return `${formatFunctionCall}(${escapedMessage},`;
-      }
+      // For endParam === ',' we don't unquote — WRM.format handles unquoting
+      const result = endParam === ',' ? `${formatFunctionCall}(${escapedMessage},` : unquoteMessage(escapedMessage);
 
-      return unquoteMessage(escapedMessage);
+      return enclosingQuote ? escapeForStringLiteral(result, enclosingQuote) : result;
     });
 
     callback(null, newSource, map);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlassian/i18n-properties-loader",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "A webpack loader for i18n *.properties files that can be used in Atlassian Server products",
   "main": "index.js",
   "repository": {
@@ -39,7 +39,7 @@
   "dependencies": {
     "java-properties": "^1.0.2",
     "loader-utils": "2.0.4",
-    "lodash.debounce": "^4.0.8",
+    "lodash": "^4.18.1",
     "schema-utils": "^3.0.0"
   },
   "peerDependencies": {
@@ -53,5 +53,5 @@
   "engines": {
     "node": ">=12"
   },
-  "gitHead": "805e0888bfb7dcfb07c7369e2d1e11843b758986"
+  "gitHead": "d517f4b17c906fc9ea8a1fb5911f454a9ee41429"
 }