i18next-http-middleware 3.7.2 → 3.7.4

package/README.md

@@ -43,6 +43,7 @@ app.use(
 
 // in your request handler
 app.get('myRoute', (req, res) => {
+  var resolvedLng = req.resolvedLanguage // 'de-CH'
   var lng = req.language // 'de-CH'
   var lngs = req.languages // ['de-CH', 'de', 'en']
   req.i18n.changeLanguage('en') // will not load that!!! assert it was preloaded
@@ -117,6 +118,7 @@ server.route({
   method: 'GET',
   path: '/myRoute',
   handler: (request, h) => {
+    var resolvedLng = request.resolvedLanguage // 'de-CH'
     var lng = request.language // 'de-CH'
     var lngs = v.languages // ['de-CH', 'de', 'en']
     request.i18n.changeLanguage('en') // will not load that!!! assert it was preloaded
@@ -149,7 +151,9 @@ app.use(i18nextMiddleware.koaPlugin(i18next, {
 // in your request handler
 router.get('/myRoute', ctx => {
   ctx.body = JSON.stringify({
+    'ctx.resolvedLanguage': ctx.resolvedLanguage,
     'ctx.language': ctx.language,
+    'ctx.i18n.resolvedLanguage': ctx.i18n.resolvedLanguage,
     'ctx.i18n.language': ctx.i18n.language,
     'ctx.i18n.languages': ctx.i18n.languages,
     'ctx.i18n.languages[0]': ctx.i18n.languages[0],

package/cjs/LanguageDetector.js

@@ -81,9 +81,8 @@ var LanguageDetector = function () {
         if (!detections) return;
         if (!Array.isArray(detections)) detections = [detections];
         detections = detections.filter(function (d) {
-          return d !== undefined && d !== null;
-        });
-        detections = detections.map(function (d) {
+          return d !== undefined && d !== null && !utils.hasXSS(d);
+        }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
         });
         if (_this.services.languageUtils.getBestMatchFromCodes) {

package/cjs/index.js

@@ -80,11 +80,13 @@ function handle(i18next) {
       if (res.locals) {
         res.locals.language = lng;
         res.locals.languageDir = i18next.dir(lng);
+        res.locals.resolvedLanguage = i18n.resolvedLanguage;
       }
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
         options.setHeader(res, 'Content-Language', utils.escape(lng));
       }
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
+      req.resolvedLanguage = i18n.resolvedLanguage;
       if (i18next.services.languageDetector) {
         i18next.services.languageDetector.cacheUserLanguage(req, res, lng);
       }
@@ -98,6 +100,7 @@ function handle(i18next) {
       options.setHeader(res, 'Content-Language', utils.escape(lng));
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
+    req.resolvedLanguage = i18n.resolvedLanguage;
     i18n.changeLanguage(lng || i18next.options.fallbackLng[0]);
     if (req.i18nextLookupName === 'path' && options.removeLngFromUrl) {
       options.setUrl(req, utils.removeLngFromUrl(options.getUrl(req), i18next.services.languageDetector.options.lookupFromPathIndex));
@@ -112,6 +115,7 @@ function handle(i18next) {
       res.locals.exists = exists;
       res.locals.i18n = i18n;
       res.locals.language = lng;
+      res.locals.resolvedLanguage = i18n.resolvedLanguage;
       res.locals.languageDir = i18next.dir(lng);
     }
     if (i18next.services.languageDetector) {

package/cjs/utils.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
+exports.hasXSS = hasXSS;
 exports.removeLngFromUrl = removeLngFromUrl;
 exports.setPath = setPath;
 function setPath(object, path, newValue) {
@@ -60,4 +61,11 @@ function removeLngFromUrl(url, lookupFromPathIndex) {
 }
 function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
+}
+function hasXSS(input) {
+  if (typeof input !== 'string') return false;
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  return xssPatterns.some(function (pattern) {
+    return pattern.test(input);
+  });
 }

package/esm/LanguageDetector.js

@@ -72,9 +72,8 @@ var LanguageDetector = function () {
         if (!detections) return;
         if (!Array.isArray(detections)) detections = [detections];
         detections = detections.filter(function (d) {
-          return d !== undefined && d !== null;
-        });
-        detections = detections.map(function (d) {
+          return d !== undefined && d !== null && !utils.hasXSS(d);
+        }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
         });
         if (_this.services.languageUtils.getBestMatchFromCodes) {

package/esm/index.js

@@ -63,11 +63,13 @@ export function handle(i18next) {
       if (res.locals) {
         res.locals.language = lng;
         res.locals.languageDir = i18next.dir(lng);
+        res.locals.resolvedLanguage = i18n.resolvedLanguage;
       }
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
         options.setHeader(res, 'Content-Language', utils.escape(lng));
       }
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
+      req.resolvedLanguage = i18n.resolvedLanguage;
       if (i18next.services.languageDetector) {
         i18next.services.languageDetector.cacheUserLanguage(req, res, lng);
       }
@@ -81,6 +83,7 @@ export function handle(i18next) {
       options.setHeader(res, 'Content-Language', utils.escape(lng));
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
+    req.resolvedLanguage = i18n.resolvedLanguage;
     i18n.changeLanguage(lng || i18next.options.fallbackLng[0]);
     if (req.i18nextLookupName === 'path' && options.removeLngFromUrl) {
       options.setUrl(req, utils.removeLngFromUrl(options.getUrl(req), i18next.services.languageDetector.options.lookupFromPathIndex));
@@ -95,6 +98,7 @@ export function handle(i18next) {
       res.locals.exists = exists;
       res.locals.i18n = i18n;
       res.locals.language = lng;
+      res.locals.resolvedLanguage = i18n.resolvedLanguage;
       res.locals.languageDir = i18next.dir(lng);
     }
     if (i18next.services.languageDetector) {

package/esm/utils.js

@@ -50,4 +50,11 @@ export function removeLngFromUrl(url, lookupFromPathIndex) {
 }
 export function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
+}
+export function hasXSS(input) {
+  if (typeof input !== 'string') return false;
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  return xssPatterns.some(function (pattern) {
+    return pattern.test(input);
+  });
 }

package/lib/LanguageDetector.js

@@ -66,8 +66,9 @@ class LanguageDetector {
       if (!detections) return
       if (!Array.isArray(detections)) detections = [detections]
 
-      detections = detections.filter((d) => d !== undefined && d !== null)
-      detections = detections.map((d) => this.options.convertDetectedLanguage(d))
+      detections = detections
+        .filter((d) => d !== undefined && d !== null && !utils.hasXSS(d))
+        .map((d) => this.options.convertDetectedLanguage(d))
 
       if (this.services.languageUtils.getBestMatchFromCodes) { // new i18next v19.5.0
         found = this.services.languageUtils.getBestMatchFromCodes(detections)

package/lib/index.js

@@ -52,6 +52,7 @@ export function handle (i18next, options = {}) {
       if (res.locals) {
         res.locals.language = lng
         res.locals.languageDir = i18next.dir(lng)
+        res.locals.resolvedLanguage = i18n.resolvedLanguage
       }
 
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
@@ -59,6 +60,7 @@ export function handle (i18next, options = {}) {
       }
 
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng)
+      req.resolvedLanguage = i18n.resolvedLanguage
 
       if (i18next.services.languageDetector) {
         i18next.services.languageDetector.cacheUserLanguage(req, res, lng)
@@ -76,6 +78,7 @@ export function handle (i18next, options = {}) {
       options.setHeader(res, 'Content-Language', utils.escape(lng))
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng)
+    req.resolvedLanguage = i18n.resolvedLanguage
 
     // trigger sync to instance - might trigger async load!
     i18n.changeLanguage(lng || i18next.options.fallbackLng[0])
@@ -104,6 +107,7 @@ export function handle (i18next, options = {}) {
       res.locals.exists = exists
       res.locals.i18n = i18n
       res.locals.language = lng
+      res.locals.resolvedLanguage = i18n.resolvedLanguage
       res.locals.languageDir = i18next.dir(lng)
     }
 

package/lib/utils.js

@@ -69,3 +69,26 @@ export function escape (str) {
     .replace(/\\/g, '\')
     .replace(/`/g, '`'))
 }
+
+export function hasXSS (input) {
+  if (typeof input !== 'string') return false
+
+  // Common XSS attack patterns
+  const xssPatterns = [
+    /<\s*script.*?>/i,
+    /<\s*\/\s*script\s*>/i,
+    /<\s*img.*?on\w+\s*=/i,
+    /<\s*\w+\s*on\w+\s*=.*?>/i,
+    /javascript\s*:/i,
+    /vbscript\s*:/i,
+    /expression\s*\(/i,
+    /eval\s*\(/i,
+    /alert\s*\(/i,
+    /document\.cookie/i,
+    /document\.write\s*\(/i,
+    /window\.location/i,
+    /innerHTML/i
+  ]
+
+  return xssPatterns.some((pattern) => pattern.test(input))
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.7.2",
+  "version": "3.7.4",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",
@@ -34,7 +34,7 @@
     "@hapi/hapi": "^21.3.12",
     "@types/express-serve-static-core": "^5.0.1",
     "@koa/router": "12.0.1",
-    "koa": "2.15.3",
+    "koa": "2.16.1",
     "babel-plugin-add-module-exports": "1.0.4",
     "eslint": "8.53.0",
     "eslint-config-standard": "17.1.0",