@fkui/i18next-translate 6.43.0 → 6.43.1

package/dist/cjs/index.js

@@ -2297,6 +2297,7 @@ class Logger {
   }
   forward(args, lvl, prefix, debugOnly) {
     if (debugOnly && !this.debug) return null;
+    args = args.map(a => isString(a) ? a.replace(/[\r\n\x00-\x1F\x7F]/g, ' ') : a);
     if (isString(args[0])) args[0] = `${prefix}${this.prefix} ${args[0]}`;
     return this.logger[lvl](args);
   }
@@ -3202,8 +3203,8 @@ class Interpolator {
     this.prefix = prefix ? regexEscape(prefix) : prefixEscaped || '{{';
     this.suffix = suffix ? regexEscape(suffix) : suffixEscaped || '}}';
     this.formatSeparator = formatSeparator || ',';
-    this.unescapePrefix = unescapeSuffix ? '' : unescapePrefix || '-';
-    this.unescapeSuffix = this.unescapePrefix ? '' : unescapeSuffix || '';
+    this.unescapePrefix = unescapeSuffix ? '' : unescapePrefix ? regexEscape(unescapePrefix) : '-';
+    this.unescapeSuffix = this.unescapePrefix ? '' : unescapeSuffix ? regexEscape(unescapeSuffix) : '';
     this.nestingPrefix = nestingPrefix ? regexEscape(nestingPrefix) : nestingPrefixEscaped || regexEscape('$t(');
     this.nestingSuffix = nestingSuffix ? regexEscape(nestingSuffix) : nestingSuffixEscaped || regexEscape(')');
     this.nestingOptionsSeparator = nestingOptionsSeparator || ',';
@@ -3250,6 +3251,9 @@ class Interpolator {
       });
     };
     this.resetRegExp();
+    if (!this.escapeValue && typeof str === 'string' && /\$t\([^)]*\{[^}]*\{\{/.test(str)) {
+      this.logger.warn('nesting options string contains interpolated variables with escapeValue: false — ' + 'if any of those values are attacker-controlled they can inject additional ' + 'nesting options (e.g. redirect lng/ns). Sanitise untrusted input before passing ' + 'it to t(), or keep escapeValue: true.');
+    }
     const missingInterpolationHandler = options?.missingInterpolationHandler || this.options.missingInterpolationHandler;
     const skipOnVariables = options?.interpolation?.skipOnVariables !== undefined ? options.interpolation.skipOnVariables : this.options.interpolation.skipOnVariables;
     const todos = [{
@@ -3928,7 +3932,7 @@ class I18n extends EventEmitter {
         deferred.resolve(t);
         callback(err, t);
       };
-      if (this.languages && !this.isInitialized) return finish(null, this.t.bind(this));
+      if ((this.languages || this.isLanguageChangingTo) && !this.isInitialized) return finish(null, this.t.bind(this));
       this.changeLanguage(this.options.lng, finish);
     };
     if (this.options.resources || !this.options.initAsync) {