From 1e47bce1c4e08ab8044dcefb7840eccd377d997b Mon Sep 17 00:00:00 2001
From: wixetech <156924108+wixetech@users.noreply.github.com>
Date: Sun, 31 May 2026 07:36:48 -0700
Subject: [PATCH] fixed code execution with translations vulnerability :3

now unescaping strings with own method
---
 scripts/i18n_Language.rb | 47 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 43 insertions(+), 4 deletions(-)

diff --git a/scripts/i18n_Language.rb b/scripts/i18n_Language.rb
index 88763ea..94a0ee4 100644
--- a/scripts/i18n_Language.rb
+++ b/scripts/i18n_Language.rb
@@ -29,6 +29,45 @@ class Language
       reset_fonts(@text_sprites)
       Oneshot.set_yes_no(tr('Yes'), tr('No'))
     end
+	  
+    def unescape_string(str)
+      unescaped = []
+      
+      string_began = false
+      escape = false
+      str.chars.each do |c|
+        if not string_began
+          string_began = true if c == '"'
+		  next
+        end
+		
+        next if c == "\n"
+        next if c == "\r"
+	
+        if not escape
+          break if c == '"'
+          if c == '\\'
+        	escape = true
+			next
+		  end
+		else
+		  escape = false
+		  case c
+		  when 'n'
+			unescaped.push("\n")
+		  when 'r'
+			unescaped.push("\r")
+		  else
+			unescaped.push(c)
+		  end
+		  next
+		end
+	
+        unescaped.push(c)
+	  end
+	
+	  return unescaped.join('')
+	end
 
     def load_pot(path)
       msgid = nil
@@ -42,25 +81,25 @@ class Language
             line = line[6..-1]
             #unescape the string
 			#note that I tried using undump here instead before, but it doesn't play nicely with non-ascii characters
-            eval("msgid = " + line)
+            msgid = unescape_string(line)
             lastLineWasMsgId = true
             lastLineWasMsgStr = false
       
           elsif line.start_with?("msgstr ")
             line = line[7..-1]
             #unescape the string
-            eval("msgstr = " + line)
+            msgstr = unescape_string(line)
             lastLineWasMsgId = false
             lastLineWasMsgStr = true
       
           elsif line.start_with?("\"")
             if lastLineWasMsgId
-              eval("msgid += " + line)
+              msgid += unescape_string(line)
               lastLineWasMsgId = true
               lastLineWasMsgStr = false
         
             elsif lastLineWasMsgStr
-              eval("msgstr += " + line)
+              msgstr += unescape_string(line)
               lastLineWasMsgId = false
               lastLineWasMsgStr = true