LinkSecurity check

[devimarj]

Would it be useful to have a check that flags insecure HTML attributes?

For example, translators adding target="_blank" without noopener or changing HTTPS links to HTTP.

[nijel]

https://docs.weblate.org/en/latest/user/checks.html#unsafe-html should do the trick.

[devimarj]

Thanks @nijel! You are totally right regarding SafeHTMLCheck.

I realized I was "cheating" a bit in my manual tests earlier (I wasn't testing it properly against the sanitizer), so my bad there. It does handle noopener correctly.

I'm not an expert, but I noticed that SafeHTMLCheck allows downgrading from https to http. I assume this is intended for compatibility.

However, I was wondering if it would be useful to have this as an opt-in check that only triggers when the URL structure remains identical to the source, but the protocol is downgraded. This way, projects can avoid Mixed Content warnings without being intrusive for those who actually need to localize their links.

Also, regarding attributes: does the xml-tags check cover empty values? From what I understood looking at the code, it seems to check if the attribute exists (keys), but not if it's empty (values). I assume this is also intended.
For standard HTML (alt="") this is fine, but for ARIA (like aria-label=""), leaving it empty breaks accessibility.

Regarding the European Accessibility Act (EAA) , I thought it might be helpful to have something specific for this, especially for projects that need to work strictly under that law. I tried to draft a small check for ARIA regressions.

class ARIAAccessibilityCheck(BaseXMLCheck):
    """Checks for ARIA attribute value regressions."""

    check_id = "aria-accessibility"
    name = gettext_lazy("ARIA accessibility")
    description = gettext_lazy("ARIA attributes (except aria-hidden) are emptied in translation.")
    default_disabled = True

    def check_single(self, source: str, target: str, unit: Unit) -> bool:
        try:
            source_tree, wrap = self.detect_xml_wrapping(source)
            target_tree = self.parse_xml(target, wrap)
        except SyntaxError:
            return False

        # zip with iterators to process nodes lazily (O(1) memory vs lists)
        for src, tgt in zip(source_tree.iter(), target_tree.iter()):
            if src.tag != tgt.tag:
                return False

            for attr, src_val in src.attrib.items():
                # fail fast
                if not src_val or not src_val.strip():
                    continue

                attr_lower = attr.lower()

                # focused only on role and aria-*
                if (
                    attr_lower == "aria-hidden"
                    or not (attr_lower == "role" or attr_lower.startswith("aria-"))
                ):
                    continue

                tgt_val = tgt.attrib.get(attr)

                # xml-tags catches it
                if tgt_val is None:
                    continue

                # but if it exists and is empty, we catch it here
                if not tgt_val.strip():
                    return True

        return False

[nijel]

The safe HTML check intentionally only checks for HTML markup (to avoid introducing new tags or attributes), not their content.

I'm not sure that doing such detailed HTML linting is in scope for Weblate. This could potentially go much deeper, and we definitely do not want to maintain an HTML accessibility linter.

For website translations, it might be better to not rely on translators to do a full accessibility markup and localize the accessibility labels separately and render the HTML from the localized portions.