@intlify/core-base 10.0.6 → 10.0.8

package/dist/core-base.cjs

@@ -1,5 +1,5 @@
 /*!
-  * core-base v10.0.6
+  * core-base v10.0.8
   * (c) 2025 kazuya kawaguchi
   * Released under the MIT License.
   */
@@ -8,6 +8,80 @@
 var messageCompiler = require('@intlify/message-compiler');
 var shared = require('@intlify/shared');
 
+function isMessageAST(val) {
+    return (shared.isObject(val) &&
+        resolveType(val) === 0 &&
+        (shared.hasOwn(val, 'b') || shared.hasOwn(val, 'body')));
+}
+const PROPS_BODY = ['b', 'body'];
+function resolveBody(node) {
+    return resolveProps(node, PROPS_BODY);
+}
+const PROPS_CASES = ['c', 'cases'];
+function resolveCases(node) {
+    return resolveProps(node, PROPS_CASES, []);
+}
+const PROPS_STATIC = ['s', 'static'];
+function resolveStatic(node) {
+    return resolveProps(node, PROPS_STATIC);
+}
+const PROPS_ITEMS = ['i', 'items'];
+function resolveItems(node) {
+    return resolveProps(node, PROPS_ITEMS, []);
+}
+const PROPS_TYPE = ['t', 'type'];
+function resolveType(node) {
+    return resolveProps(node, PROPS_TYPE);
+}
+const PROPS_VALUE = ['v', 'value'];
+function resolveValue$1(node, type) {
+    const resolved = resolveProps(node, PROPS_VALUE);
+    if (resolved != null) {
+        return resolved;
+    }
+    else {
+        throw createUnhandleNodeError(type);
+    }
+}
+const PROPS_MODIFIER = ['m', 'modifier'];
+function resolveLinkedModifier(node) {
+    return resolveProps(node, PROPS_MODIFIER);
+}
+const PROPS_KEY = ['k', 'key'];
+function resolveLinkedKey(node) {
+    const resolved = resolveProps(node, PROPS_KEY);
+    if (resolved) {
+        return resolved;
+    }
+    else {
+        throw createUnhandleNodeError(6 /* NodeTypes.Linked */);
+    }
+}
+function resolveProps(node, props, defaultValue) {
+    for (let i = 0; i < props.length; i++) {
+        const prop = props[i];
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        if (shared.hasOwn(node, prop) && node[prop] != null) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            return node[prop];
+        }
+    }
+    return defaultValue;
+}
+const AST_NODE_PROPS_KEYS = [
+    ...PROPS_BODY,
+    ...PROPS_CASES,
+    ...PROPS_STATIC,
+    ...PROPS_ITEMS,
+    ...PROPS_KEY,
+    ...PROPS_MODIFIER,
+    ...PROPS_VALUE,
+    ...PROPS_TYPE
+];
+function createUnhandleNodeError(type) {
+    return new Error(`unhandled node type: ${type}`);
+}
+
 function format(ast) {
     const msg = (ctx) => formatParts(ctx, ast);
     return msg;
@@ -30,14 +104,6 @@ function formatParts(ctx, ast) {
         return formatMessageParts(ctx, body);
     }
 }
-const PROPS_BODY = ['b', 'body'];
-function resolveBody(node) {
-    return resolveProps(node, PROPS_BODY);
-}
-const PROPS_CASES = ['c', 'cases'];
-function resolveCases(node) {
-    return resolveProps(node, PROPS_CASES, []);
-}
 function formatMessageParts(ctx, node) {
     const static_ = resolveStatic(node);
     if (static_ != null) {
@@ -50,14 +116,6 @@ function formatMessageParts(ctx, node) {
         return ctx.normalize(messages);
     }
 }
-const PROPS_STATIC = ['s', 'static'];
-function resolveStatic(node) {
-    return resolveProps(node, PROPS_STATIC);
-}
-const PROPS_ITEMS = ['i', 'items'];
-function resolveItems(node) {
-    return resolveProps(node, PROPS_ITEMS, []);
-}
 function formatMessagePart(ctx, node) {
     const type = resolveType(node);
     switch (type) {
@@ -103,48 +161,6 @@ function formatMessagePart(ctx, node) {
             throw new Error(`unhandled node on format message part: ${type}`);
     }
 }
-const PROPS_TYPE = ['t', 'type'];
-function resolveType(node) {
-    return resolveProps(node, PROPS_TYPE);
-}
-const PROPS_VALUE = ['v', 'value'];
-function resolveValue$1(node, type) {
-    const resolved = resolveProps(node, PROPS_VALUE);
-    if (resolved) {
-        return resolved;
-    }
-    else {
-        throw createUnhandleNodeError(type);
-    }
-}
-const PROPS_MODIFIER = ['m', 'modifier'];
-function resolveLinkedModifier(node) {
-    return resolveProps(node, PROPS_MODIFIER);
-}
-const PROPS_KEY = ['k', 'key'];
-function resolveLinkedKey(node) {
-    const resolved = resolveProps(node, PROPS_KEY);
-    if (resolved) {
-        return resolved;
-    }
-    else {
-        throw createUnhandleNodeError(6 /* NodeTypes.Linked */);
-    }
-}
-function resolveProps(node, props, defaultValue) {
-    for (let i = 0; i < props.length; i++) {
-        const prop = props[i];
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        if (shared.hasOwn(node, prop) && node[prop] != null) {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            return node[prop];
-        }
-    }
-    return defaultValue;
-}
-function createUnhandleNodeError(type) {
-    return new Error(`unhandled node type: ${type}`);
-}
 
 const WARN_MESSAGE = `Detected HTML in '{source}' message. Recommend not using HTML messages to avoid XSS.`;
 function checkHtmlMessage(source, warnHtmlMessage) {
@@ -157,11 +173,6 @@ let compileCache = shared.create();
 function clearCompileCache() {
     compileCache = shared.create();
 }
-function isMessageAST(val) {
-    return (shared.isObject(val) &&
-        resolveType(val) === 0 &&
-        (shared.hasOwn(val, 'b') || shared.hasOwn(val, 'body')));
-}
 function baseCompile(message, options = {}) {
     // error detecting on compile
     let detectError = false;
@@ -674,7 +685,16 @@ function resolveValue(obj, path) {
     let last = obj;
     let i = 0;
     while (i < len) {
-        const val = last[hit[i]];
+        const key = hit[i];
+        /**
+         * NOTE:
+         * if `key` is intlify message format AST node key and `last` is intlify message format AST, skip it.
+         * because the AST node is not a key-value structure.
+         */
+        if (AST_NODE_PROPS_KEYS.includes(key) && isMessageAST(last)) {
+            return null;
+        }
+        const val = last[key];
         if (val === undefined) {
             return null;
         }
@@ -716,7 +736,7 @@ function getWarnMessage(code, ...args) {
  * Intlify core-base version
  * @internal
  */
-const VERSION = '10.0.6';
+const VERSION = '10.0.8';
 const NOT_REOSLVED = -1;
 const DEFAULT_LOCALE = 'en-US';
 const MISSING_RESOLVE_VALUE = '';
@@ -1508,9 +1528,13 @@ function translate(context, ...args) {
     const msgContext = createMessageContext(ctxOptions);
     const messaged = evaluateMessage(context, msg, msgContext);
     // if use post translation option, proceed it with handler
-    const ret = postTranslation
+    let ret = postTranslation
         ? postTranslation(messaged, key)
         : messaged;
+    // apply HTML sanitization for security
+    if (escapeParameter && shared.isString(ret)) {
+        ret = shared.sanitizeTranslatedHtml(ret);
+    }
     // NOTE: experimental !!
     {
         // prettier-ignore
@@ -1835,6 +1859,7 @@ function getMessageContextOptions(context, locale, message, options) {
 
 exports.CompileErrorCodes = messageCompiler.CompileErrorCodes;
 exports.createCompileError = messageCompiler.createCompileError;
+exports.AST_NODE_PROPS_KEYS = AST_NODE_PROPS_KEYS;
 exports.CORE_ERROR_CODES_EXTEND_POINT = CORE_ERROR_CODES_EXTEND_POINT;
 exports.CORE_WARN_CODES_EXTEND_POINT = CORE_WARN_CODES_EXTEND_POINT;
 exports.CoreErrorCodes = CoreErrorCodes;

package/dist/core-base.d.ts

@@ -13,6 +13,8 @@ declare type __ResourceFormatPath<T, Key extends keyof T> = Key extends string ?
 
 export declare type __ResourcePath<T, Key extends keyof T> = Key extends string ? T[Key] extends Record<string, any> ? `${Key}.${__ResourcePath<T[Key], Exclude<keyof T[Key], keyof any[]>> & string}` | `${Key}.${Exclude<keyof T[Key], keyof any[]> & string}` : never : never;
 
+export declare const AST_NODE_PROPS_KEYS: string[];
+
 export declare function clearCompileCache(): void;
 
 /* Excluded from this release type: clearDateTimeFormat */
@@ -1190,7 +1192,16 @@ export declare interface TranslateOptions<Locales = Locale> extends LocaleOption
     fallbackWarn?: boolean;
     /**
      * @remarks
-     * Whether do escape parameter for list or named interpolation values
+     * Whether to escape parameters for list or named interpolation values.
+     * When enabled, this option:
+     * - Escapes HTML special characters (`<`, `>`, `"`, `'`, `&`, `/`, `=`) in interpolation parameters
+     * - Sanitizes the final translated HTML to prevent XSS attacks by:
+     *   - Escaping dangerous characters in HTML attribute values
+     *   - Neutralizing event handler attributes (onclick, onerror, etc.)
+     *   - Disabling javascript: URLs in href, src, action, formaction, and style attributes
+     *
+     * @defaultValue false
+     * @see [HTML Message - Using the escapeParameter option](https://vue-i18n.intlify.dev/guide/essentials/syntax.html#using-the-escapeparameter-option)
      */
     escapeParameter?: boolean;
     /**

package/dist/core-base.esm-browser.js

@@ -1,8 +1,25 @@
 /*!
-  * core-base v10.0.6
+  * core-base v10.0.8
   * (c) 2025 kazuya kawaguchi
   * Released under the MIT License.
   */
+function warn(msg, err) {
+    if (typeof console !== 'undefined') {
+        console.warn(`[intlify] ` + msg);
+        /* istanbul ignore if */
+        if (err) {
+            console.warn(err.stack);
+        }
+    }
+}
+const hasWarned = {};
+function warnOnce(msg) {
+    if (!hasWarned[msg]) {
+        hasWarned[msg] = true;
+        warn(msg);
+    }
+}
+
 /**
  * Original Utilities
  * written by kazuya kawaguchi
@@ -55,10 +72,49 @@ const _create = Object.create;
 const create = (obj = null) => _create(obj);
 function escapeHtml(rawText) {
     return rawText
+        .replace(/&/g, '&') // escape `&` first to avoid double escaping
         .replace(/</g, '&lt;')
         .replace(/>/g, '&gt;')
         .replace(/"/g, '&quot;')
-        .replace(/'/g, '&apos;');
+        .replace(/'/g, '&apos;')
+        .replace(/\//g, '&#x2F;') // escape `/` to prevent closing tags or JavaScript URLs
+        .replace(/=/g, '&#x3D;'); // escape `=` to prevent attribute injection
+}
+function escapeAttributeValue(value) {
+    return value
+        .replace(/&(?![a-zA-Z0-9#]{2,6};)/g, '&amp;') // escape unescaped `&`
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&apos;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}
+function sanitizeTranslatedHtml(html) {
+    // Escape dangerous characters in attribute values
+    // Process attributes with double quotes
+    html = html.replace(/(\w+)\s*=\s*"([^"]*)"/g, (_, attrName, attrValue) => `${attrName}="${escapeAttributeValue(attrValue)}"`);
+    // Process attributes with single quotes
+    html = html.replace(/(\w+)\s*=\s*'([^']*)'/g, (_, attrName, attrValue) => `${attrName}='${escapeAttributeValue(attrValue)}'`);
+    // Detect and neutralize event handler attributes
+    const eventHandlerPattern = /\s*on\w+\s*=\s*["']?[^"'>]+["']?/gi;
+    if (eventHandlerPattern.test(html)) {
+        {
+            warn('Potentially dangerous event handlers detected in translation. ' +
+                'Consider removing onclick, onerror, etc. from your translation messages.');
+        }
+        // Neutralize event handler attributes by escaping 'on'
+        html = html.replace(/(\s+)(on)(\w+\s*=)/gi, '$1&#111;n$3');
+    }
+    // Disable javascript: URLs in various contexts
+    const javascriptUrlPattern = [
+        // In href, src, action, formaction attributes
+        /(\s+(?:href|src|action|formaction)\s*=\s*["']?)\s*javascript:/gi,
+        // In style attributes within url()
+        /(style\s*=\s*["'][^"']*url\s*\(\s*)javascript:/gi
+    ];
+    javascriptUrlPattern.forEach(pattern => {
+        html = html.replace(pattern, '$1javascript&#58;');
+    });
+    return html;
 }
 const hasOwnProperty = Object.prototype.hasOwnProperty;
 function hasOwn(obj, key) {
@@ -130,23 +186,6 @@ function generateCodeFrame(source, start = 0, end = source.length) {
     return res.join('\n');
 }
 
-function warn(msg, err) {
-    if (typeof console !== 'undefined') {
-        console.warn(`[intlify] ` + msg);
-        /* istanbul ignore if */
-        if (err) {
-            console.warn(err.stack);
-        }
-    }
-}
-const hasWarned = {};
-function warnOnce(msg) {
-    if (!hasWarned[msg]) {
-        hasWarned[msg] = true;
-        warn(msg);
-    }
-}
-
 function createPosition(line, column, offset) {
     return { line, column, offset };
 }
@@ -1649,6 +1688,80 @@ function baseCompile$1(source, options = {}) {
     }
 }
 
+function isMessageAST(val) {
+    return (isObject(val) &&
+        resolveType(val) === 0 &&
+        (hasOwn(val, 'b') || hasOwn(val, 'body')));
+}
+const PROPS_BODY = ['b', 'body'];
+function resolveBody(node) {
+    return resolveProps(node, PROPS_BODY);
+}
+const PROPS_CASES = ['c', 'cases'];
+function resolveCases(node) {
+    return resolveProps(node, PROPS_CASES, []);
+}
+const PROPS_STATIC = ['s', 'static'];
+function resolveStatic(node) {
+    return resolveProps(node, PROPS_STATIC);
+}
+const PROPS_ITEMS = ['i', 'items'];
+function resolveItems(node) {
+    return resolveProps(node, PROPS_ITEMS, []);
+}
+const PROPS_TYPE = ['t', 'type'];
+function resolveType(node) {
+    return resolveProps(node, PROPS_TYPE);
+}
+const PROPS_VALUE = ['v', 'value'];
+function resolveValue$1(node, type) {
+    const resolved = resolveProps(node, PROPS_VALUE);
+    if (resolved != null) {
+        return resolved;
+    }
+    else {
+        throw createUnhandleNodeError(type);
+    }
+}
+const PROPS_MODIFIER = ['m', 'modifier'];
+function resolveLinkedModifier(node) {
+    return resolveProps(node, PROPS_MODIFIER);
+}
+const PROPS_KEY = ['k', 'key'];
+function resolveLinkedKey(node) {
+    const resolved = resolveProps(node, PROPS_KEY);
+    if (resolved) {
+        return resolved;
+    }
+    else {
+        throw createUnhandleNodeError(6 /* NodeTypes.Linked */);
+    }
+}
+function resolveProps(node, props, defaultValue) {
+    for (let i = 0; i < props.length; i++) {
+        const prop = props[i];
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        if (hasOwn(node, prop) && node[prop] != null) {
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            return node[prop];
+        }
+    }
+    return defaultValue;
+}
+const AST_NODE_PROPS_KEYS = [
+    ...PROPS_BODY,
+    ...PROPS_CASES,
+    ...PROPS_STATIC,
+    ...PROPS_ITEMS,
+    ...PROPS_KEY,
+    ...PROPS_MODIFIER,
+    ...PROPS_VALUE,
+    ...PROPS_TYPE
+];
+function createUnhandleNodeError(type) {
+    return new Error(`unhandled node type: ${type}`);
+}
+
 function format(ast) {
     const msg = (ctx) => formatParts(ctx, ast);
     return msg;
@@ -1671,14 +1784,6 @@ function formatParts(ctx, ast) {
         return formatMessageParts(ctx, body);
     }
 }
-const PROPS_BODY = ['b', 'body'];
-function resolveBody(node) {
-    return resolveProps(node, PROPS_BODY);
-}
-const PROPS_CASES = ['c', 'cases'];
-function resolveCases(node) {
-    return resolveProps(node, PROPS_CASES, []);
-}
 function formatMessageParts(ctx, node) {
     const static_ = resolveStatic(node);
     if (static_ != null) {
@@ -1691,14 +1796,6 @@ function formatMessageParts(ctx, node) {
         return ctx.normalize(messages);
     }
 }
-const PROPS_STATIC = ['s', 'static'];
-function resolveStatic(node) {
-    return resolveProps(node, PROPS_STATIC);
-}
-const PROPS_ITEMS = ['i', 'items'];
-function resolveItems(node) {
-    return resolveProps(node, PROPS_ITEMS, []);
-}
 function formatMessagePart(ctx, node) {
     const type = resolveType(node);
     switch (type) {
@@ -1744,48 +1841,6 @@ function formatMessagePart(ctx, node) {
             throw new Error(`unhandled node on format message part: ${type}`);
     }
 }
-const PROPS_TYPE = ['t', 'type'];
-function resolveType(node) {
-    return resolveProps(node, PROPS_TYPE);
-}
-const PROPS_VALUE = ['v', 'value'];
-function resolveValue$1(node, type) {
-    const resolved = resolveProps(node, PROPS_VALUE);
-    if (resolved) {
-        return resolved;
-    }
-    else {
-        throw createUnhandleNodeError(type);
-    }
-}
-const PROPS_MODIFIER = ['m', 'modifier'];
-function resolveLinkedModifier(node) {
-    return resolveProps(node, PROPS_MODIFIER);
-}
-const PROPS_KEY = ['k', 'key'];
-function resolveLinkedKey(node) {
-    const resolved = resolveProps(node, PROPS_KEY);
-    if (resolved) {
-        return resolved;
-    }
-    else {
-        throw createUnhandleNodeError(6 /* NodeTypes.Linked */);
-    }
-}
-function resolveProps(node, props, defaultValue) {
-    for (let i = 0; i < props.length; i++) {
-        const prop = props[i];
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        if (hasOwn(node, prop) && node[prop] != null) {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            return node[prop];
-        }
-    }
-    return defaultValue;
-}
-function createUnhandleNodeError(type) {
-    return new Error(`unhandled node type: ${type}`);
-}
 
 const WARN_MESSAGE = `Detected HTML in '{source}' message. Recommend not using HTML messages to avoid XSS.`;
 function checkHtmlMessage(source, warnHtmlMessage) {
@@ -1798,11 +1853,6 @@ let compileCache = create();
 function clearCompileCache() {
     compileCache = create();
 }
-function isMessageAST(val) {
-    return (isObject(val) &&
-        resolveType(val) === 0 &&
-        (hasOwn(val, 'b') || hasOwn(val, 'body')));
-}
 function baseCompile(message, options = {}) {
     // error detecting on compile
     let detectError = false;
@@ -2315,7 +2365,16 @@ function resolveValue(obj, path) {
     let last = obj;
     let i = 0;
     while (i < len) {
-        const val = last[hit[i]];
+        const key = hit[i];
+        /**
+         * NOTE:
+         * if `key` is intlify message format AST node key and `last` is intlify message format AST, skip it.
+         * because the AST node is not a key-value structure.
+         */
+        if (AST_NODE_PROPS_KEYS.includes(key) && isMessageAST(last)) {
+            return null;
+        }
+        const val = last[key];
         if (val === undefined) {
             return null;
         }
@@ -2357,7 +2416,7 @@ function getWarnMessage(code, ...args) {
  * Intlify core-base version
  * @internal
  */
-const VERSION = '10.0.6';
+const VERSION = '10.0.8';
 const NOT_REOSLVED = -1;
 const DEFAULT_LOCALE = 'en-US';
 const MISSING_RESOLVE_VALUE = '';
@@ -3149,9 +3208,13 @@ function translate(context, ...args) {
     const msgContext = createMessageContext(ctxOptions);
     const messaged = evaluateMessage(context, msg, msgContext);
     // if use post translation option, proceed it with handler
-    const ret = postTranslation
+    let ret = postTranslation
         ? postTranslation(messaged, key)
         : messaged;
+    // apply HTML sanitization for security
+    if (escapeParameter && isString(ret)) {
+        ret = sanitizeTranslatedHtml(ret);
+    }
     // NOTE: experimental !!
     {
         // prettier-ignore
@@ -3474,4 +3537,4 @@ function getMessageContextOptions(context, locale, message, options) {
     return ctxOptions;
 }
 
-export { CORE_ERROR_CODES_EXTEND_POINT, CORE_WARN_CODES_EXTEND_POINT, CompileErrorCodes, CoreErrorCodes, CoreWarnCodes, DATETIME_FORMAT_OPTIONS_KEYS, DEFAULT_LOCALE, DEFAULT_MESSAGE_DATA_TYPE, MISSING_RESOLVE_VALUE, NOT_REOSLVED, NUMBER_FORMAT_OPTIONS_KEYS, VERSION, clearCompileCache, clearDateTimeFormat, clearNumberFormat, compile, createCompileError, createCoreContext, createCoreError, createMessageContext, datetime, fallbackWithLocaleChain, fallbackWithSimple, getAdditionalMeta, getDevToolsHook, getFallbackContext, getLocale, getWarnMessage, handleMissing, initI18nDevTools, isAlmostSameLocale, isImplicitFallback, isMessageAST, isMessageFunction, isTranslateFallbackWarn, isTranslateMissingWarn, number, parse, parseDateTimeArgs, parseNumberArgs, parseTranslateArgs, registerLocaleFallbacker, registerMessageCompiler, registerMessageResolver, resolveLocale, resolveValue, resolveWithKeyValue, setAdditionalMeta, setDevToolsHook, setFallbackContext, translate, translateDevTools, updateFallbackLocale };
+export { AST_NODE_PROPS_KEYS, CORE_ERROR_CODES_EXTEND_POINT, CORE_WARN_CODES_EXTEND_POINT, CompileErrorCodes, CoreErrorCodes, CoreWarnCodes, DATETIME_FORMAT_OPTIONS_KEYS, DEFAULT_LOCALE, DEFAULT_MESSAGE_DATA_TYPE, MISSING_RESOLVE_VALUE, NOT_REOSLVED, NUMBER_FORMAT_OPTIONS_KEYS, VERSION, clearCompileCache, clearDateTimeFormat, clearNumberFormat, compile, createCompileError, createCoreContext, createCoreError, createMessageContext, datetime, fallbackWithLocaleChain, fallbackWithSimple, getAdditionalMeta, getDevToolsHook, getFallbackContext, getLocale, getWarnMessage, handleMissing, initI18nDevTools, isAlmostSameLocale, isImplicitFallback, isMessageAST, isMessageFunction, isTranslateFallbackWarn, isTranslateMissingWarn, number, parse, parseDateTimeArgs, parseNumberArgs, parseTranslateArgs, registerLocaleFallbacker, registerMessageCompiler, registerMessageResolver, resolveLocale, resolveValue, resolveWithKeyValue, setAdditionalMeta, setDevToolsHook, setFallbackContext, translate, translateDevTools, updateFallbackLocale };