From b2fa7304e932af6a3e7e3a1ac29be34c7d86d513 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <barisusakli@gmail.com>
Date: Fri, 16 Jan 2026 13:00:41 -0500
Subject: [PATCH] fix: closes #13887, make translator.escape stricter

only match [[namespace:key]] allow underscores,dashes and dots in namespace key
add test
---
 public/src/modules/translator.common.js |  2 +-
 test/translator.js                      | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/public/src/modules/translator.common.js b/public/src/modules/translator.common.js
index c69a9cc265..40468f0f7a 100644
--- a/public/src/modules/translator.common.js
+++ b/public/src/modules/translator.common.js
@@ -464,7 +464,7 @@ module.exports = function (utils, load, warn) {
 		 */
 		Translator.escape = function escape(text) {
 			return typeof text === 'string' ?
-				text.replace(/\[\[/g, '&lsqb;&lsqb;').replace(/\]\]/g, '&rsqb;&rsqb;') :
+				text.replace(/\[\[([a-zA-Z0-9_.-]+:[a-zA-Z0-9_.-]+)\]\]/g, '&lsqb;&lsqb;$1&rsqb;&rsqb;') :
 				text;
 		};
 
diff --git a/test/translator.js b/test/translator.js
index 017efd3ce2..ccbd724cec 100644
--- a/test/translator.js
+++ b/test/translator.js
@@ -334,6 +334,22 @@ describe('Translator static methods', () => {
 			);
 			done();
 		});
+
+		it('should escape all translation patterns within text', (done) => {
+			assert.strictEqual(
+				Translator.escape('some nice text [[global:home]] here and [[global:search]] there'),
+				'some nice text &lsqb;&lsqb;global:home&rsqb;&rsqb; here and &lsqb;&lsqb;global:search&rsqb;&rsqb; there'
+			);
+			done();
+		});
+
+		it('should not escape markdown links', (done) => {
+			assert.strictEqual(
+				Translator.escape('[link text [test]](https://example.org)'),
+				'[link text [test]](https://example.org)'
+			);
+			done();
+		});
 	});
 
 	describe('.unescape', () => {