test: escape placeholder values in the translate() mock, matching real behaviour

package.json

@@ -32,9 +32,11 @@
     "@nextcloud/eslint-config": "^8.4.2",
     "@nextcloud/stylelint-config": "^3.1.1",
     "@nextcloud/vite-config": "^2.5.2",
+    "@types/escape-html": "^1.0.4",
     "@vitejs/plugin-vue": "^6.0.7",
     "@vue/test-utils": "^2.4.11",
     "@vue/tsconfig": "^0.9.1",
+    "escape-html": "^1.0.3",
     "jsdom": "^30.0.1",
     "typescript": "^5.9.3",
     "vite": "^7.2.7",

src/test-utils/translateMock.spec.ts

@@ -0,0 +1,28 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { describe, expect, it } from 'vitest'
+import { translate } from '@nextcloud/l10n'
+
+// vitest.setup.ts mocks translate() for every spec in the suite. Pin its
+// contract against the real implementation's default behaviour — real
+// translate() escapes every placeholder value (escape-html) before
+// substitution, and a mock that skips this hides a whole class of bug: a
+// component whose translated string reaches an HTML sink (or, conversely,
+// an ARIA attribute, where the escaping is actually wrong) behaves
+// differently under test than for a real user.
+describe('translate() mock', () => {
+	it('escapes HTML-significant characters in a placeholder value', () => {
+		const result = translate('office', 'Shared by {owner}', { owner: '<b>&"\'' })
+
+		expect(result).toBe('Shared by &lt;b&gt;&amp;&quot;&#39;')
+	})
+
+	it('leaves the surrounding template text alone', () => {
+		const result = translate('office', 'Shared by {owner}', { owner: 'Bob' })
+
+		expect(result).toBe('Shared by Bob')
+	})
+})

vitest.setup.ts

@@ -1,5 +1,6 @@
 import { config } from '@vue/test-utils'
 import { vi } from 'vitest'
+import escapeHTML from 'escape-html'
 
 // shallowMount()'s auto-stubs render nothing by default, including slot
 // content passed to them — without this, any content nested inside a
@@ -20,12 +21,15 @@ function substitutePlaceholders(text: string, vars?: Record<string, unknown>): s
 	})
 }
 
+// Real translate() escapes every placeholder value by default (escape-html) —
+// match that here, or a component relying on the default silently ships
+// double-escaped output that only breaks against the real implementation.
 vi.mock('@nextcloud/l10n', async (importOriginal) => ({
 	...(await importOriginal<typeof import('@nextcloud/l10n')>()),
 	translate: (app: string, text: string, placeholders?: Record<string, unknown>) =>
 		text.replace(/{([^{}]*)}/g, (match: string, key: string) => {
 			const value = placeholders?.[key]
-			return value !== undefined ? String(value) : match
+			return value !== undefined ? escapeHTML(String(value)) : match
 		}),
 }))