i18next-http-middleware 3.7.3 → 3.8.0

package/README.md

@@ -403,6 +403,7 @@ As with all modules you can either pass the constructor function (class) to the
   cookiePath: '/my/path',
   cookieSecure: true, // if need secure cookie
   cookieSameSite: 'strict', // 'strict', 'lax' or 'none'
+  cookieHttpOnly: true // prevent client-side script access to the cookie
 
   // optional conversion function used to modify the detected language code
   convertDetectedLanguage: 'Iso15897',

package/cjs/LanguageDetector.js

@@ -81,9 +81,8 @@ var LanguageDetector = function () {
         if (!detections) return;
         if (!Array.isArray(detections)) detections = [detections];
         detections = detections.filter(function (d) {
-          return d !== undefined && d !== null;
-        });
-        detections = detections.map(function (d) {
+          return d !== undefined && d !== null && !utils.hasXSS(d);
+        }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
         });
         if (_this.services.languageUtils.getBestMatchFromCodes) {

package/cjs/index.js

@@ -190,7 +190,7 @@ function getResourcesHandler(i18next) {
     }
     var resources = {};
     options.setContentType(res, 'application/json');
-    if (options.cache !== undefined ? options.cache : typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'production') {
+    if (options.cache !== undefined ? options.cache : typeof process !== 'undefined' && typeof process.env !== 'undefined' && process.env && process.env.NODE_ENV === 'production') {
       options.setHeader(res, 'Cache-Control', 'public, max-age=' + maxAge);
       options.setHeader(res, 'Expires', new Date(new Date().getTime() + maxAge * 1000).toUTCString());
     } else {

package/cjs/languageLookups/cookie.js

@@ -69,6 +69,7 @@ var _default = exports.default = {
   cacheUserLanguage: function cacheUserLanguage(req, res, lng) {
     var options = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {};
     if (options.lookupCookie && req !== 'undefined') {
+      var _options$cookieHttpOn;
       var expirationDate = options.cookieExpirationDate;
       if (!expirationDate) {
         expirationDate = new Date();
@@ -78,7 +79,7 @@ var _default = exports.default = {
         expires: expirationDate,
         domain: options.cookieDomain,
         path: options.cookiePath,
-        httpOnly: false,
+        httpOnly: (_options$cookieHttpOn = options.cookieHttpOnly) !== null && _options$cookieHttpOn !== void 0 ? _options$cookieHttpOn : false,
         overwrite: true,
         sameSite: options.cookieSameSite
       };

package/cjs/utils.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
+exports.hasXSS = hasXSS;
 exports.removeLngFromUrl = removeLngFromUrl;
 exports.setPath = setPath;
 function setPath(object, path, newValue) {
@@ -60,4 +61,11 @@ function removeLngFromUrl(url, lookupFromPathIndex) {
 }
 function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
+}
+function hasXSS(input) {
+  if (typeof input !== 'string') return false;
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  return xssPatterns.some(function (pattern) {
+    return pattern.test(input);
+  });
 }

package/esm/LanguageDetector.js

@@ -72,9 +72,8 @@ var LanguageDetector = function () {
         if (!detections) return;
         if (!Array.isArray(detections)) detections = [detections];
         detections = detections.filter(function (d) {
-          return d !== undefined && d !== null;
-        });
-        detections = detections.map(function (d) {
+          return d !== undefined && d !== null && !utils.hasXSS(d);
+        }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
         });
         if (_this.services.languageUtils.getBestMatchFromCodes) {

package/esm/index.js

@@ -173,7 +173,7 @@ export function getResourcesHandler(i18next) {
     }
     var resources = {};
     options.setContentType(res, 'application/json');
-    if (options.cache !== undefined ? options.cache : typeof process !== 'undefined' && process.env && process.env.NODE_ENV === 'production') {
+    if (options.cache !== undefined ? options.cache : typeof process !== 'undefined' && typeof process.env !== 'undefined' && process.env && process.env.NODE_ENV === 'production') {
       options.setHeader(res, 'Cache-Control', 'public, max-age=' + maxAge);
       options.setHeader(res, 'Expires', new Date(new Date().getTime() + maxAge * 1000).toUTCString());
     } else {

package/esm/languageLookups/cookie.js

@@ -63,6 +63,7 @@ export default {
   cacheUserLanguage: function cacheUserLanguage(req, res, lng) {
     var options = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : {};
     if (options.lookupCookie && req !== 'undefined') {
+      var _options$cookieHttpOn;
       var expirationDate = options.cookieExpirationDate;
       if (!expirationDate) {
         expirationDate = new Date();
@@ -72,7 +73,7 @@ export default {
         expires: expirationDate,
         domain: options.cookieDomain,
         path: options.cookiePath,
-        httpOnly: false,
+        httpOnly: (_options$cookieHttpOn = options.cookieHttpOnly) !== null && _options$cookieHttpOn !== void 0 ? _options$cookieHttpOn : false,
         overwrite: true,
         sameSite: options.cookieSameSite
       };

package/esm/utils.js

@@ -50,4 +50,11 @@ export function removeLngFromUrl(url, lookupFromPathIndex) {
 }
 export function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
+}
+export function hasXSS(input) {
+  if (typeof input !== 'string') return false;
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  return xssPatterns.some(function (pattern) {
+    return pattern.test(input);
+  });
 }

package/lib/LanguageDetector.js

@@ -66,8 +66,9 @@ class LanguageDetector {
       if (!detections) return
       if (!Array.isArray(detections)) detections = [detections]
 
-      detections = detections.filter((d) => d !== undefined && d !== null)
-      detections = detections.map((d) => this.options.convertDetectedLanguage(d))
+      detections = detections
+        .filter((d) => d !== undefined && d !== null && !utils.hasXSS(d))
+        .map((d) => this.options.convertDetectedLanguage(d))
 
       if (this.services.languageUtils.getBestMatchFromCodes) { // new i18next v19.5.0
         found = this.services.languageUtils.getBestMatchFromCodes(detections)

package/lib/index.js

@@ -180,6 +180,7 @@ export function getResourcesHandler (i18next, options = {}) {
       options.cache !== undefined
         ? options.cache
         : typeof process !== 'undefined' &&
+          typeof process.env !== 'undefined' &&
           process.env &&
           process.env.NODE_ENV === 'production'
     ) {

package/lib/languageLookups/cookie.js

@@ -79,7 +79,7 @@ export default {
         expires: expirationDate,
         domain: options.cookieDomain,
         path: options.cookiePath,
-        httpOnly: false,
+        httpOnly: options.cookieHttpOnly ?? false,
         overwrite: true,
         sameSite: options.cookieSameSite
       }

package/lib/utils.js

@@ -69,3 +69,26 @@ export function escape (str) {
     .replace(/\\/g, '\')
     .replace(/`/g, '`'))
 }
+
+export function hasXSS (input) {
+  if (typeof input !== 'string') return false
+
+  // Common XSS attack patterns
+  const xssPatterns = [
+    /<\s*script.*?>/i,
+    /<\s*\/\s*script\s*>/i,
+    /<\s*img.*?on\w+\s*=/i,
+    /<\s*\w+\s*on\w+\s*=.*?>/i,
+    /javascript\s*:/i,
+    /vbscript\s*:/i,
+    /expression\s*\(/i,
+    /eval\s*\(/i,
+    /alert\s*\(/i,
+    /document\.cookie/i,
+    /document\.write\s*\(/i,
+    /window\.location/i,
+    /innerHTML/i
+  ]
+
+  return xssPatterns.some((pattern) => pattern.test(input))
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.7.3",
+  "version": "3.8.0",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",
@@ -45,7 +45,7 @@
     "eslint-plugin-standard": "5.0.0",
     "expect.js": "0.3.1",
     "express": "4.21.1",
-    "fastify": "5.1.0",
+    "fastify": "5.3.2",
     "i18next": "24.0.0",
     "mocha": "10.8.2",
     "supertest": "7.0.0",
@@ -75,7 +75,7 @@
     "compile": "npm run compile:esm && npm run compile:cjs",
     "build": "npm run compile",
     "test": "npm run lint && npm run build && mocha test -R spec --exit --experimental-modules && npm run test:types",
-    "test:deno": "deno test --allow-net test/deno/*.js",
+    "test:deno": "deno test --allow-net --allow-env test/deno/*.js",
     "test:types": "tsd",
     "preversion": "npm run test && npm run build && git push",
     "postversion": "git push && git push --tags"