i18next-http-middleware 3.7.3 → 3.7.4

package/cjs/LanguageDetector.js

@@ -81,9 +81,8 @@ var LanguageDetector = function () {
         if (!detections) return;
         if (!Array.isArray(detections)) detections = [detections];
         detections = detections.filter(function (d) {
-          return d !== undefined && d !== null;
-        });
-        detections = detections.map(function (d) {
+          return d !== undefined && d !== null && !utils.hasXSS(d);
+        }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
         });
         if (_this.services.languageUtils.getBestMatchFromCodes) {

package/cjs/utils.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
+exports.hasXSS = hasXSS;
 exports.removeLngFromUrl = removeLngFromUrl;
 exports.setPath = setPath;
 function setPath(object, path, newValue) {
@@ -60,4 +61,11 @@ function removeLngFromUrl(url, lookupFromPathIndex) {
 }
 function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
+}
+function hasXSS(input) {
+  if (typeof input !== 'string') return false;
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  return xssPatterns.some(function (pattern) {
+    return pattern.test(input);
+  });
 }

package/esm/LanguageDetector.js

@@ -72,9 +72,8 @@ var LanguageDetector = function () {
         if (!detections) return;
         if (!Array.isArray(detections)) detections = [detections];
         detections = detections.filter(function (d) {
-          return d !== undefined && d !== null;
-        });
-        detections = detections.map(function (d) {
+          return d !== undefined && d !== null && !utils.hasXSS(d);
+        }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
         });
         if (_this.services.languageUtils.getBestMatchFromCodes) {

package/esm/utils.js

@@ -50,4 +50,11 @@ export function removeLngFromUrl(url, lookupFromPathIndex) {
 }
 export function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
+}
+export function hasXSS(input) {
+  if (typeof input !== 'string') return false;
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  return xssPatterns.some(function (pattern) {
+    return pattern.test(input);
+  });
 }

package/lib/LanguageDetector.js

@@ -66,8 +66,9 @@ class LanguageDetector {
       if (!detections) return
       if (!Array.isArray(detections)) detections = [detections]
 
-      detections = detections.filter((d) => d !== undefined && d !== null)
-      detections = detections.map((d) => this.options.convertDetectedLanguage(d))
+      detections = detections
+        .filter((d) => d !== undefined && d !== null && !utils.hasXSS(d))
+        .map((d) => this.options.convertDetectedLanguage(d))
 
       if (this.services.languageUtils.getBestMatchFromCodes) { // new i18next v19.5.0
         found = this.services.languageUtils.getBestMatchFromCodes(detections)

package/lib/utils.js

@@ -69,3 +69,26 @@ export function escape (str) {
     .replace(/\\/g, '\')
     .replace(/`/g, '`'))
 }
+
+export function hasXSS (input) {
+  if (typeof input !== 'string') return false
+
+  // Common XSS attack patterns
+  const xssPatterns = [
+    /<\s*script.*?>/i,
+    /<\s*\/\s*script\s*>/i,
+    /<\s*img.*?on\w+\s*=/i,
+    /<\s*\w+\s*on\w+\s*=.*?>/i,
+    /javascript\s*:/i,
+    /vbscript\s*:/i,
+    /expression\s*\(/i,
+    /eval\s*\(/i,
+    /alert\s*\(/i,
+    /document\.cookie/i,
+    /document\.write\s*\(/i,
+    /window\.location/i,
+    /innerHTML/i
+  ]
+
+  return xssPatterns.some((pattern) => pattern.test(input))
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.7.3",
+  "version": "3.7.4",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",