Skip to content

fix(localization): don't load manifest.json as a locale - #1821

Merged
Xe merged 1 commit into
TecharoHQ:mainfrom
SihyeonJeon:fix/localization-und-panic
Aug 6, 2026
Merged

fix(localization): don't load manifest.json as a locale#1821
Xe merged 1 commit into
TecharoHQ:mainfrom
SihyeonJeon:fix/localization-und-panic

Conversation

@SihyeonJeon

Copy link
Copy Markdown
Contributor

Accept-Language: und panics the challenge handler.

NewLocalizationService loads every locales/*.json into the bundle, including manifest.json. go-i18n derives a locale from the file name, so manifest — which is not a language tag — registers under language.Und. A request whose highest priority tag is und then matches that entry instead of the "en" fallback appended in GetLocalizerFromRequest, the message is missing from it, and MustLocalize panics:

http: panic serving 10.0.0.1:1234: message "making_sure_not_bot" not found in language "und"

Skipping manifest.json when populating the bundle removes the bogus locale. Other unusual tags already fell back correctly — und-US, mul, zxx, qaa, and unknown subtags such as xx — only the exact zero tag was affected.

The test asserts through T() rather than GetLang() on purpose: GetLang() swallows the lookup error and reports "en" either way, so a test built on it would pass with and without this change. Reverting only localization.go makes it fail with the panic above.

Fixes #1776

Checklist:

  • Added a description of the changes to the [Unreleased] section of docs/docs/CHANGELOG.md
  • Added test cases to the relevant parts of the codebase
  • Ran integration tests npm run test:integration (unsupported on Windows, please use WSL)
  • All of my commits have verified signatures

npm run test, go vet ./... and staticcheck all pass. I could not get the Playwright harness up locally: TestPlaywrightBrowser fails with could not connect to remote browser: Connection closed on unmodified main as well, so it looks environmental rather than related to this change.

manifest.json lists the supported languages; it is metadata rather than a
translation catalog. go-i18n derives a locale from the file name, so loading
it registers the file under language.Und. A request whose highest priority
Accept-Language tag is "und" then matches that entry instead of falling back
to English, the message is missing from it, and MustLocalize panics:

    http: panic serving: message "making_sure_not_bot" not found in language "und"

Skip manifest.json when populating the bundle. Other unusual tags (und-US,
mul, zxx, and unknown subtags such as xx) already fell back correctly; only
the exact zero tag was affected.

The test asserts through T() rather than GetLang(): GetLang() swallows the
lookup error and reports "en" either way, so a test built on it would pass
both with and without this change.

Fixes TecharoHQ#1776

Assisted-by: Claude Opus 5 via Claude Code
Signed-off-by: Sihyeon Jeon <[email protected]>
@Xe

Xe commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Just wondering so I can investigate further, but are you seeing bots passing the und language tag?

@SihyeonJeon

Copy link
Copy Markdown
Contributor Author

No, I found it in the issue tracker and reproduced it locally. The traffic report is @Commod0re's in #1776.

Only a bare und at top priority hits it. und-US, mul, zxx, art-x-bork all fall back to en fine, and de,und;q=0.9 resolves to de. Not bot-specific either, anything that reaches a challenge page can trigger it.

@Xe
Xe merged commit d80538b into TecharoHQ:main Aug 6, 2026
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

"making_sure_not_bot" not found in language "und"

2 participants