[iOS] - Add Page Translation #25391

Brandon-T · 2024-08-30T13:55:27Z

Security Review

https://github.com/brave/reviews/issues/1738

Summary

Add Brave Translate to the iOS app using the Brave-Translate script
Add Apple on Device Translation for iOS 18+ using the Brave-Translate script with a few tweaks
All Javascript is in its own isolated content-world and only injected into the main-frame.

The tweaks are:

// Used to rewrite urls for XHRs in the translate isolated world
  // (primarily for /translate_a/t).
  if (window.__firefox__.$<brave_translate_script>.useNativeNetworking) {
    const methodProperty = Symbol('method')
    const urlProperty = Symbol('url')
    const userProperty = Symbol('user')
    const passwordProperty = Symbol('password')
    const requestHeadersProperty = Symbol('requestHeaders')
    
    XMLHttpRequest.prototype.getResponseHeader = function(headerName) {
      return this[requestHeadersProperty][headerName];
    };
    
    XMLHttpRequest.prototype.getAllResponseHeaders = function() {
      return this[requestHeadersProperty];
    };
    
    XMLHttpRequest.prototype.realSetRequestHeader = XMLHttpRequest.prototype.setRequestHeader;
    XMLHttpRequest.prototype.setRequestHeader = function(header, value) {
      if (!this[requestHeadersProperty]) {
        this[requestHeadersProperty] = {};
      }
      
      this[requestHeadersProperty][header] = value;
      this.realSetRequestHeader(header, value);
    };
    
    XMLHttpRequest.prototype.realOverrideMimeType = XMLHttpRequest.prototype.overrideMimeType;
    XMLHttpRequest.prototype.overrideMimeType = function(mimeType) {
      this.realOverrideMimeType(mimeType);
    }
    
    XMLHttpRequest.prototype.realOpen = XMLHttpRequest.prototype.open;
    XMLHttpRequest.prototype.open = function(method, url, isAsync=true, user='', password='') {
      if (isAsync !== undefined && !isAsync) {
        return this.realOpen(method, rewriteUrl(url), isAsync, user, password);
      }

      this[methodProperty] = method;
      this[urlProperty] = rewriteUrl(url);
      this[userProperty] = user;
      this[passwordProperty] = password;
      return this.realOpen(method, rewriteUrl(url), isAsync, user, password);
    };

    XMLHttpRequest.prototype.realSend = XMLHttpRequest.prototype.send;
    XMLHttpRequest.prototype.send = function(body) {
      if (this[urlProperty] === undefined) {
        return this.realSend(body);
      }
      
      try {
        var t = window.webkit;
        delete window["webkit"];
        
        window.webkit.messageHandlers["TranslateMessage"].postMessage({
          "command": "request",
          "method": this[methodProperty] ?? "GET",
          "url": this[urlProperty],
          "user": this[userProperty] ?? "",
          "password": this[passwordProperty] ?? "",
          "headers": this[requestHeadersProperty] ?? {},
          "body": body ?? ""
        }).then((result) => {
          
          Object.defineProperties(this, {
            readyState: { value: XMLHttpRequest.DONE }  // DONE (4)
          });
          
          if (result.value) {
            Object.defineProperties(this, {
              status: { value: result.value.statusCode }
            });
            
            Object.defineProperties(this, {
              statusText: { value: "OK" }
            });
            
            Object.defineProperties(this, {
              responseType: { value: result.value.responseType }
            });
            
            Object.defineProperty(this, 'response', { writable: true });
            Object.defineProperty(this, 'responseText', { writable: true });
            this.responseText = result.value.response;
            
            switch (result.value.responseType) {
              case "arraybuffer": this.response = new ArrayBuffer(result.value.response);
              case "json": this.response = JSON.parse(result.value.response);
              case "text": this.response = result.value.response;
              case "": this.response = result.value.response;
            }
          }
          
          this.dispatchEvent(new ProgressEvent('loadstart'));
          this.dispatchEvent(new ProgressEvent(result.error ? 'error' : 'load'));
          this.dispatchEvent(new ProgressEvent('readystatechange'));
          this.dispatchEvent(new ProgressEvent('loadend'));
        });
        
        window.webkit = t
      } catch (e) {
        return this.realSend(body);
      }
    };
  }

This allows us to intercept translate requests, and pass it to the Apple On Device translation. Everything else is a direct copy from Brave-Core (UNTIL we get Chromium WebViews finished. After that, there will be no need for such a giant script copy).

Resolves brave/brave-browser#40782

Submitter Checklist:

I confirm that no security/privacy review is needed and no other type of reviews are needed, or that I have requested them
There is a ticket for my issue
Used Github auto-closing keywords in the PR description above
Wrote a good PR/commit description
Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
Checked the PR locally:
- npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
- npm run presubmit wiki, npm run gn_check, npm run tslint
Ran git rebase master (if needed)

Reviewer Checklist:

A security review is not needed, or a link to one is included in the PR description
New files have MPL-2.0 license header
Adequate test coverage exists to prevent regressions
Major classes, functions and non-trivial code blocks are well-commented
Changes in component dependencies are properly reflected in gn
Code follows the style guide
Test plan is specified in PR before merging

After-merge Checklist:

The associated issue milestone is set to the smallest version that the
changes has landed on
All relevant documentation has been updated, for instance:

Test Plan:

Test translation onboarding is shown only twice ever!
Test translation on iOS 17 (on wikipedia or wherever).
Test translation on iOS 18+ (on wikipedia or wherever).
Test that translations revert on iOS 17 (after translating a page, pressing the button again will revert the translation).
Test that translations revert on iOS 18+ (after translating a page, pressing the button again will revert the translation).
Test that the URL bar shows the correct insecure content state on badssl.com.
Test that the URL bar shows playlist (on youtube) and reader-mode (on wikipedia).

Please note that Brave-Translate might not always work (iOS 17). This is entirely due to our backend!
Apple Translate should always work (iOS 18+).

Screen.Recording.2024-08-30.at.10.00.17.AM.mov

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js

github-actions · 2024-08-30T14:00:31Z

The security team is monitoring all repositories for certain keywords. This PR includes the word(s) "password, secure, insecure" and so security team members have been added as reviewers to take a look.

No need to request a full security review at this stage, the security team will take a look shortly and either clear the label or request more information/changes.

Notifications have already been sent, but if this is blocking your merge feel free to reach out directly to the security team on Slack so that we can expedite this check.

thypon · 2024-08-30T14:34:38Z

@Brandon-T where the BraveTranslateScript.js is coming from?

Brandon-T · 2024-09-03T16:36:11Z

@Brandon-T where the BraveTranslateScript.js is coming from?

It comes from combining: https://source.chromium.org/chromium/chromium/src/+/main:components/translate/core/browser/resources/translate.js;l=5;drc=84091f477eff8e67261d6cdd9471519e8fee6185?q=translate&sq=&ss=chromium%2Fchromium%2Fsrc
with:
https://source.chromium.org/chromium/chromium/src/+/main:components/translate/ios/browser/resources/language_detection.js;l=1;drc=84091f477eff8e67261d6cdd9471519e8fee6185
and:
https://source.chromium.org/chromium/chromium/src/+/main:components/translate/ios/browser/resources/translate_ios.js;l=1;drc=84091f477eff8e67261d6cdd9471519e8fee6185
and the other scripts like gcrWeb from Chromium.

which downloads: https://translate.brave.com/static/v1/js/element/main.js

We can't currently pull it from Brave-Core yet.

ios/brave-ios/Sources/Brave/Frontend/Browser/Toolbars/UrlBar/File.swift

stoletheminerals · 2024-09-06T15:35:50Z

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

+        script
+        .replacingOccurrences(of: "$<brave_translate_script>", with: namespace)
+        .replacingOccurrences(
+          of: "$<brave_translate_api_key>",


Since we send requests to translate.brave.com from native and not from JS, can we append the API key in native here https://github.com/brave/brave-core/pull/25391/files#diff-b1da8ce8af5f2b9cdc18974acf1035386b4965f6a32689c077326939cb913453R520 ?

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

stoletheminerals · 2024-09-09T15:46:52Z

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

+  func translate(
+    _ request: BraveTranslateScriptHandler.RequestMessage
+  ) async throws -> (data: Data, response: URLResponse) {
+    var urlRequest = URLRequest(url: request.url)


Can we start pinning such requests? I know we don't do it for APIs but we need to start pinning imo. Could be a separate PR/issue.

stoletheminerals · 2024-09-09T16:46:36Z

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js

@@ -0,0 +1,8438 @@
+window.__firefox__ = {};


It's impossible to review 8kb of minified/obfuscated JS. If it comes from Chromium - why is it obfuscated?

I went ahead and found each script + dependency manually in Chromium. Then I got the de-obfuscated version of those scripts and replaces the necessary code with it + added links to where the script was found.

This should drastically help as there's no more minified/obfuscated JS: 885cb0e

The current approach looks extremely hard to support and review.
It's not clear why we have to bundle all the stuff into a one script. Why we can't use the desktop approach?
Also, the script from translate.brave.com is designed to be updatable from the backend side.

Option 1 (preferable): enable translate code from Chromium for iOS (or at least partially): https://source.chromium.org/chromium/chromium/src/+/main:components/translate/ios/browser/
It probably needs some chromium primitives like WebState, not sure about the current status wherever we support them or not.

Option 2: bundle all the supplementary scripts from b-c using webpack and put them to resources. Load the main script from https://translate.brave.com/, combine with the new script from resources and inject

@kylehickinson @StephenHeaps maybe you have ideas how to simplify things here?

We don't support WebState yet, so for this PR it isn't possible to use the Desktop approach.

If we load it from translate.brave.com, it doesn't help that it's still minified and unreadable and still impossible to review.

Loading the scripts from translate.brave.com doesn't let us modify it to add Apple Translate support, which this PR does.

How do we web-pack all the Chromium translate scripts and dependencies including all the ones specific to iOS that are in typescript, with Webpack?

thanks for the aswers, @Brandon-T.

We don't support WebState yet, so for this PR it isn't possible to use the Desktop approach.

Ok, we can't reuse it as-is, but I mean to reuse the approach to build the script on the fly.

If we load it from translate.brave.com, it doesn't help that it's still minified and unreadable and still impossible to review.

It makes sense for the translate script itself, but not for all the script from /src.
The point is to have the same script for desktop & iOS, but different platform adapters.

If you want to improve the current translate script, it's stored here: https://github.com/brave/go-translate/tree/master/assets/static/v1

Loading the scripts from translate.brave.com doesn't let us modify it to add Apple Translate support

it's not clear to me.. If we download the script in advance and store locally, what is the difference with hardcoded script?

How do we web-pack all the Chromium translate scripts and dependencies including all the ones specific to iOS that are in typescript, with Webpack?

Why we can't import them in a .ts file to transpile. That way we avoid duplicating the files.
Otherwise it's not clear how they will be synchronized in future.
Transpiling via transpile_web_ui + loading via a resource bundle (example) works for iOS.

@atuchin-m

I download it on the fly in the latest commit. So now it downloads the translate script instead of hard-coding.

transpile_web_ui only works with WebUI. It doesn't work with just plain .ts files without any html.

https://github.com/brave/reviews/issues/1650#issuecomment-2223144564

It requires us to build resource files for iOS to export strings and other resources explicitly, when WebUI is not involved. We've had this discussion with Brian J. and a few others. Also it currently breaks unit tests. It's on the roadmap, but it's not ready yet, so for now it's not possible.

Also it currently breaks unit tests.

Not sure specifics of what unit tests would break / how in this PR, but this sounds similar to unit tests in #25694. I will be updating that PR soon to allow loading the needed resources from BraveCore (we need to load procedural_filters.ts to allow our ScriptExecutionTests to use it & run again, some more info here). Not sure if that approach helps with unit test concerns here too.

Deleted all the copied JS, and pulled it from Brave-Core: https://github.com/brave/brave-core/blob/0a452b206220fb6f5e629dc76c58a30ed4075a13/ios/browser/api/translate/translate_script.mm

via Features. We can't use WebState, and we can't use what CosmeticFilters are using as these scripts are already compiled.

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js

github-actions · 2024-11-09T02:47:23Z

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

+      injectionTime: .atDocumentEnd,
+      forMainFrameOnly: true,
+      in: scriptSandbox
+    )


_{reported by reviewdog 🐶}
[semgrep] WKUserScript usages should be vet by the security-team.

References:
- https://github.com/brave/brave-browser/wiki/Security-reviews (point 13)

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/brave-execute-script-ios.yaml

Cc @stoletheminerals @bridiver

kylehickinson · 2024-11-11T20:29:50Z

ios/brave-ios/Sources/Brave/Frontend/Browser/Toolbars/UrlBar/TranslateURLBarButton.swift

+    get {
+      return _translateState
+    }
+    set(state) {
+      _translateState = state
+      switch _translateState {
+      case .unavailable:
+        self.isEnabled = false
+        self.isSelected = false
+      case .available:
+        self.isEnabled = true
+        self.isSelected = false
+      case .pending:
+        self.isEnabled = true
+        self.isSelected = false
+      case .active:
+        self.isEnabled = true
+        self.isSelected = true
+      }
+    }


Why is the var split out like this? (_translateState/translateState) when you could just use didSet here?

kylehickinson · 2024-11-11T20:30:21Z

ios/brave-ios/Sources/Brave/Frontend/Browser/Translate/TranslateToast.swift

+  // TODO: Take from Brave-Core's list
+  // TODO: Take from Apple's list
+  private var languages: [Locale.Language] {


TODO's still in place? Can you open issues to track and link them

kylehickinson · 2024-11-11T20:33:32Z

ios/brave-ios/Sources/BraveUI/SwiftUI/BravePopup.swift

+  }
+
+  public class Coordinator {
+    var presentedViewController: WeakRef<UIViewController>?


Why does this need to use WeakRef if its inside of a class and can just mark the type as weak directly?

kylehickinson · 2024-11-11T20:34:36Z

ios/brave-ios/Sources/Onboarding/Callouts/OnboardingTranslateView.swift

+        Image(
+          uiImage: UIImage(named: "translate-onboarding-icon", in: .module, compatibleWith: nil)!
+        )


No need to drop to UIImage, you can just do Image("translate-onboarding-icon", bundle: .module)

kylehickinson · 2024-11-11T20:35:06Z

ios/brave-ios/Sources/Onboarding/Callouts/OnboardingTranslateView.swift

+        Image(
+          uiImage: UIImage(named: "translate-onboarding-icon", in: .module, compatibleWith: nil)!
+        )
+        .padding([.top, .bottom], 24.0)


nit: .padding(.vertical, 24)

kylehickinson · 2024-11-11T20:37:47Z

ios/brave-ios/Sources/Shared/SharedStrings.swift

@@ -269,6 +269,16 @@ extension Strings {
  )
 }

+// Brave Translate
+extension Strings {
+  public static let braveTranslateAvailableVoiceOverAnnouncement = NSLocalizedString(


Move to BraveStrings

kylehickinson · 2024-11-11T20:39:12Z

ios/browser/api/translate/translate_script.mm

+    }
+  }
+
+  return result;


nit: return [result copy];

kylehickinson · 2024-11-11T20:40:31Z

ios/brave-ios/Sources/BraveStrings/BraveStrings.swift

+    tableName: "BraveShared",
+    bundle: .module,
+    value: "Translate",
+    comment: "Share action title"


comment needs updating

kylehickinson · 2024-11-11T20:41:15Z

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js

+      }
+      ;


are these hanging semi-colons for something?

Google JS formatter was doing that. I removed all of them.
All Chromium JS also has the same thing lol.

kylehickinson · 2024-11-11T20:44:23Z

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

+}
+
+class BraveTranslateScriptHandler: NSObject, TabContentScript {
+  private weak var tab: Tab?


We need to refactor this script handler to not hold onto a tab for the upcoming CWVWebView usage. The tab will only be passed in the didReceiveScriptMessage delegate method

To clarify, for this branch you can pass in a Tab and hold onto it, but we shouldn't use it anywhere outside of the didReceiveScriptMessage content controller delegate method (pass it to other methods) to ensure we can easily use the same script handler in the cwv-webview branch

kylehickinson · 2024-11-11T20:54:17Z

ios/brave-ios/Sources/Brave/Frontend/Browser/Translate/TranslateToast.swift

+    return searchText.isEmpty
+      ? languages
+      : languages.filter({
+        languageName(for: $0).lowercased().contains(searchText.lowercased())
+      })


We should start using https://developer.apple.com/documentation/foundation/nsstring/1409742-localizedstandardcompare to compare user input

Sorry wrong link, should be https://developer.apple.com/documentation/foundation/nsstring/1416328-localizedstandardcontains

kylehickinson · 2024-11-11T20:55:50Z

ios/brave-ios/Sources/Brave/Frontend/Browser/Translate/TranslateToast.swift

+      .navigationTitle(Strings.BraveTranslate.languageSelectionButtonTitle)
+      .navigationBarTitleDisplayMode(.inline)
+      .toolbar {
+        ToolbarItem(placement: .navigationBarLeading) {


placement: .cancellationAction

kylehickinson · 2024-11-11T20:56:29Z

ios/brave-ios/Sources/Brave/Frontend/Browser/Translate/BraveTranslateSettingsView.swift

+        Toggle(isOn: $translateEnabled.value) {
+          Text(Strings.BraveTranslate.settingsTranslateEnabledOptionTitle)
+        }
+        .toggleStyle(SwitchToggleStyle(tint: .accentColor))


SwitchToggleStyle(tint:) is deprecated, just replace with .tint(Color.accentColor)

github-actions · 2024-12-04T23:25:45Z

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

+      injectionTime: .atDocumentEnd,
+      forMainFrameOnly: true,
+      in: scriptSandbox
+    )


_{reported by reviewdog 🐶}
[semgrep] WKUserScript usages should be vet by the security-team.

References:
- https://github.com/brave/brave-browser/wiki/Security-reviews (point 13)

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/brave-execute-script-ios.yaml

Cc @stoletheminerals @bridiver

kylehickinson · 2024-12-05T14:59:28Z

ios/brave-ios/Sources/Brave/Frontend/Browser/BrowserViewController/BrowserViewController.swift


-    let braveTranslateScriptHandler = BraveTranslateScriptHandler(tab: tab, delegate: self)
+    let braveTranslateTabHelper = BraveTranslateTabHelper(tab: tab, delegate: self)
+
    injectedScripts.append(
-      BraveTranslateScriptLanguageDetectionHandler(tab: tab, delegate: braveTranslateScriptHandler)
+      BraveTranslateScriptLanguageDetectionHandler(tabHelper: braveTranslateTabHelper)
    )
-    injectedScripts.append(braveTranslateScriptHandler)
+    injectedScripts.append(BraveTranslateScriptHandler(tabHelper: braveTranslateTabHelper))


Please move the BraveTranslateTabHelper to be held by the Tab instead of the script handler, it shouldn't be owned by the script handler. Like I mentioned previously, the script handlers shouldn't be using the Tab unless they're handling JavaScript events.

kylehickinson · 2024-12-10T21:03:27Z

ios/brave-ios/Sources/Brave/Frontend/Browser/Tab.swift

+  func addTabHelper(_ helper: TabHelper) {
+    let helperName = Swift.type(of: helper).tabHelperName
+    if tabHelpers[helperName] != nil {
+      assertionFailure("Tab Helper: \(helperName) already attached to this tab.")
+    }
+
+    self.tabHelpers[helperName] = helper
+  }
+
+  func getTabHelper(named name: String) -> TabHelper? {
+    self.tabHelpers[name]
+  }
+
+  func removeTabHelper(named name: String) {
+    self.tabHelpers.removeValue(forKey: name)
+  }
+


Lets just dump all of this TabHelper stuff and just use a standard property on Tab since we're not even matching Chromium's definition of a tab helper at this point anyways, we can always move towards that direction later

All of it removed. Added directly to Tab.

Implement Translation UI Add Translate Toast and Settings Add language selection view Improve language detection. Allow translation of ReaderMode pages! Download Brave Translate scripts on the fly, lazily.

…s when disabled so URL-Bar doesn't show the button when disabled

…downloaded

github-actions · 2024-12-18T17:02:48Z

[puLL-Merge] - brave/brave-core@25391

Description

This PR introduces Brave Translate functionality to the iOS app. It adds the ability to translate web pages to different languages directly within the browser. The feature includes UI components for translation settings, language selection, and user notifications.

Possible Issues

The implementation relies on iOS 18.0 features in some areas, which may limit functionality on older iOS versions.
There might be performance implications when handling large web pages for translation.

Security Hotspots

The translation feature involves sending page content to external services. Ensure all data transmission is secured and privacy considerations are addressed.
The use of new Function(script).call(this) in BraveTranslateScript.js could potentially execute arbitrary code. Ensure proper sanitization and validation of the script content.

Changes

Changes

ios/BUILD.gn:
- Added new import for translate headers
ios/brave-ios/Sources/Brave/Frontend/Browser/BrowserViewController:
- Added translate functionality to BrowserViewController
- Implemented BraveTranslateScriptHandlerDelegate methods
ios/brave-ios/Sources/Brave/Frontend/Browser/Tab.swift:
- Added translateHelper property to Tab class
ios/brave-ios/Sources/Brave/Frontend/Browser/Toolbars/UrlBar:
- Added TranslateURLBarButton class
- Updated TabLocationView to include translate button
ios/brave-ios/Sources/Brave/Frontend/Browser/Translate:
- Added new files for translate functionality (BraveTranslateSession.swift, BraveTranslateTabHelper.swift)
ios/brave-ios/Sources/Brave/Frontend/Settings:
- Added Brave Translate settings to SettingsViewController
ios/brave-ios/Sources/Brave/Frontend/UserContent/UserScripts:
- Added BraveTranslateScriptHandler and BraveTranslateScript.js
ios/browser/api/translate:
- Added new files for translate API (translate_script.h, translate_script.mm)
ios/brave-ios/Sources/BraveStrings:
- Added new localized strings for Brave Translate feature
ios/brave-ios/Sources/Onboarding:
- Added OnboardingTranslateView for translate feature onboarding

sequenceDiagram
    participant User
    participant BrowserViewController
    participant Tab
    participant BraveTranslateTabHelper
    participant TranslateURLBarButton
    participant BraveTranslateScriptHandler
    participant TranslateScript

    User->>BrowserViewController: Visits webpage
    BrowserViewController->>Tab: Creates Tab
    Tab->>BraveTranslateTabHelper: Initializes helper
    BrowserViewController->>TranslateURLBarButton: Updates button state
    User->>TranslateURLBarButton: Taps translate button
    TranslateURLBarButton->>BraveTranslateTabHelper: Initiates translation
    BraveTranslateTabHelper->>BraveTranslateScriptHandler: Executes translate script
    BraveTranslateScriptHandler->>TranslateScript: Retrieves translation script
    TranslateScript-->>BraveTranslateScriptHandler: Returns script
    BraveTranslateScriptHandler-->>BraveTranslateTabHelper: Applies translation
    BraveTranslateTabHelper-->>BrowserViewController: Updates UI
    BrowserViewController-->>User: Displays translated page

github-actions · 2024-12-18T17:06:51Z

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift

+      injectionTime: .atDocumentEnd,
+      forMainFrameOnly: true,
+      in: scriptSandbox
+    )


_{reported by reviewdog 🐶}
[semgrep] WKUserScript usages should be vet by the security-team.

References:
- https://github.com/brave/brave-browser/wiki/Security-reviews (point 13)

Source: https://github.com/brave/security-action/blob/main/assets/semgrep_rules/client/brave-execute-script-ios.yaml

Cc @stoletheminerals @bridiver

Brandon-T self-assigned this Aug 30, 2024

Brandon-T requested a review from a team as a code owner August 30, 2024 13:55

Brandon-T marked this pull request as draft August 30, 2024 13:55

github-actions bot added the puLL-Merge label Aug 30, 2024

github-actions bot reviewed Aug 30, 2024

View reviewed changes

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift Show resolved Hide resolved

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js Outdated Show resolved Hide resolved

github-actions bot added the needs-security-review label Aug 30, 2024

github-actions bot assigned bridiver, stoletheminerals and thypon Aug 30, 2024

Brandon-T force-pushed the feature/Translate-Chromium branch from 886c0bc to e740285 Compare September 3, 2024 19:39

stoletheminerals reviewed Sep 9, 2024

View reviewed changes

Brandon-T force-pushed the feature/Translate-Chromium branch from ab61b03 to 8278a9e Compare September 12, 2024 16:38

Brandon-T force-pushed the feature/Translate-Chromium branch from 16f359e to 7b39433 Compare September 26, 2024 03:21

Brandon-T force-pushed the feature/Translate-Chromium branch from 885cb0e to e88edba Compare October 8, 2024 16:39

Brandon-T requested a review from stoletheminerals October 8, 2024 16:40

Brandon-T marked this pull request as ready for review October 8, 2024 16:42

stoletheminerals reviewed Oct 9, 2024

View reviewed changes

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js Outdated Show resolved Hide resolved

github-actions bot reviewed Oct 9, 2024

View reviewed changes

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift Show resolved Hide resolved

github-actions bot assigned kdenhartog Oct 9, 2024

github-actions bot reviewed Oct 10, 2024

View reviewed changes

...ntent/UserScripts/Scripts_Dynamic/ScriptHandlers/Sandboxed/BraveTranslateScriptHandler.swift Show resolved Hide resolved

github-actions bot reviewed Oct 10, 2024

View reviewed changes

...e/Frontend/UserContent/UserScripts/Scripts_Dynamic/Scripts/Sandboxed/BraveTranslateScript.js Outdated Show resolved Hide resolved

github-actions bot reviewed Nov 9, 2024

View reviewed changes

Brandon-T force-pushed the feature/Translate-Chromium branch from 0e7715c to 1a05ca5 Compare November 11, 2024 17:30

Brandon-T requested a review from StephenHeaps November 11, 2024 17:30

StephenHeaps approved these changes Nov 11, 2024

View reviewed changes

kylehickinson requested changes Nov 11, 2024

View reviewed changes

kylehickinson reviewed Nov 11, 2024

View reviewed changes

Brandon-T force-pushed the feature/Translate-Chromium branch from 1a05ca5 to bede4f9 Compare November 13, 2024 19:49

Brandon-T requested a review from kylehickinson November 13, 2024 19:50

Brandon-T force-pushed the feature/Translate-Chromium branch from bede4f9 to b34ec80 Compare December 4, 2024 23:20

github-actions bot reviewed Dec 4, 2024

View reviewed changes

kylehickinson requested changes Dec 5, 2024

View reviewed changes

kylehickinson requested changes Dec 10, 2024

View reviewed changes

Brandon-T force-pushed the feature/Translate-Chromium branch from 6d8f27c to 4417172 Compare December 13, 2024 00:42

Brandon-T requested a review from kylehickinson December 13, 2024 00:43

kylehickinson approved these changes Dec 13, 2024

View reviewed changes

Brandon-T force-pushed the feature/Translate-Chromium branch from 4417172 to 897ceb5 Compare December 13, 2024 00:50

brave deleted a comment from github-actions bot Dec 13, 2024

Brandon-T added 8 commits December 18, 2024 12:01

Add Translate

1d2109e

Implement Translation UI Add Translate Toast and Settings Add language selection view Improve language detection. Allow translation of ReaderMode pages! Download Brave Translate scripts on the fly, lazily.

Update localizations and translation settings. Obey translate setting…

da008fc

…s when disabled so URL-Bar doesn't show the button when disabled

Fix translate state right after onboarding and when languages aren't …

848059a

…downloaded

Remove unused Timer

0f3bbd5

Address feedback

1cf5100

Add TabHelper

00737ab

Move tab helper to be owned by tabs.

f8e4610

Addressed feedback (Moved TabHelper)

6bc61a9

Brandon-T force-pushed the feature/Translate-Chromium branch from 897ceb5 to 6bc61a9 Compare December 18, 2024 17:01

github-actions bot reviewed Dec 18, 2024

View reviewed changes

[iOS] - Add Page Translation #25391

Are you sure you want to change the base?

[iOS] - Add Page Translation #25391

Conversation

Brandon-T commented Aug 30, 2024 • edited Loading

Security Review

Summary

Submitter Checklist:

Reviewer Checklist:

After-merge Checklist:

Test Plan:

github-actions bot commented Aug 30, 2024

thypon commented Aug 30, 2024

Brandon-T commented Sep 3, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Brandon-T Sep 26, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

atuchin-m Oct 10, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Brandon-T Oct 28, 2024 • edited Loading

Choose a reason for hiding this comment

github-actions bot Nov 9, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kylehickinson Nov 11, 2024 • edited Loading

Choose a reason for hiding this comment

github-actions bot Dec 4, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Dec 18, 2024

Description

Possible Issues

Security Hotspots

Changes

github-actions bot Dec 18, 2024

Choose a reason for hiding this comment

Brandon-T commented Aug 30, 2024 •

edited

Loading

Brandon-T commented Sep 3, 2024 •

edited

Loading

Brandon-T Sep 26, 2024 •

edited

Loading

atuchin-m Oct 10, 2024 •

edited

Loading

Brandon-T Oct 28, 2024 •

edited

Loading

kylehickinson Nov 11, 2024 •

edited

Loading