i18next-http-middleware 3.9.10 → 3.10.0

package/cjs/index.js

@@ -300,12 +300,14 @@ function missingKeyHandler(i18next) {
     }
     var body = options.getBody(req);
     var keySeparator = i18next.options && i18next.options.keySeparator;
+    var utilsOfRequest = req.i18n && req.i18n.services && req.i18n.services.utils;
+    var hasLoadedNamespace = utilsOfRequest && utilsOfRequest.hasLoadedNamespace;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
         if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
-        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m], undefined, undefined, undefined, hasLoadedNamespace);
       }
     };
     if (typeof body === 'function') {

package/cjs/languageLookups/header.js

@@ -32,7 +32,7 @@ var _default = exports.default = {
             var lng = m[1];
             var weight = m[5] || '1';
             var q = Number(weight);
-            if (lng && !isNaN(q)) {
+            if (lng && q > 0) {
               lngs.push({
                 lng: lng,
                 q: q

package/cjs/utils.js

@@ -30,8 +30,7 @@ function isSafeIdentifierBase(v) {
 }
 function isSafeLangIdentifier(v) {
   if (!isSafeIdentifierBase(v)) return false;
-  if (v.indexOf('/') > -1) return false;
-  return true;
+  return /^[A-Za-z0-9_@.-]+$/.test(v);
 }
 function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);

package/esm/index.js

@@ -283,12 +283,14 @@ export function missingKeyHandler(i18next) {
     }
     var body = options.getBody(req);
     var keySeparator = i18next.options && i18next.options.keySeparator;
+    var utilsOfRequest = req.i18n && req.i18n.services && req.i18n.services.utils;
+    var hasLoadedNamespace = utilsOfRequest && utilsOfRequest.hasLoadedNamespace;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
         if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
-        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m], undefined, undefined, undefined, hasLoadedNamespace);
       }
     };
     if (typeof body === 'function') {

package/esm/languageLookups/header.js

@@ -26,7 +26,7 @@ export default {
             var lng = m[1];
             var weight = m[5] || '1';
             var q = Number(weight);
-            if (lng && !isNaN(q)) {
+            if (lng && q > 0) {
               lngs.push({
                 lng: lng,
                 q: q

package/esm/utils.js

@@ -13,8 +13,7 @@ function isSafeIdentifierBase(v) {
 }
 export function isSafeLangIdentifier(v) {
   if (!isSafeIdentifierBase(v)) return false;
-  if (v.indexOf('/') > -1) return false;
-  return true;
+  return /^[A-Za-z0-9_@.-]+$/.test(v);
 }
 export function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);

package/lib/index.js

@@ -335,6 +335,8 @@ export function missingKeyHandler (i18next, options = {}) {
 
     const body = options.getBody(req)
     const keySeparator = i18next.options && i18next.options.keySeparator
+    const utilsOfRequest = req.i18n && req.i18n.services && req.i18n.services.utils
+    const hasLoadedNamespace = utilsOfRequest && utilsOfRequest.hasLoadedNamespace
 
     // iterate only over own, non-prototype-polluting keys. The check also
     // rejects dotted variants like `__proto__.polluted` whose segments under
@@ -343,7 +345,9 @@ export function missingKeyHandler (i18next, options = {}) {
       if (!src || typeof src !== 'object') return
       for (const m of Object.keys(src)) {
         if (utils.hasUnsafeKeySegment(m, keySeparator)) continue
-        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m])
+        // i18next >= 26.7 takes the check of this request's instance (one clone per
+        // request) as the 8th argument; without it, it checks the newest clone
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m], undefined, undefined, undefined, hasLoadedNamespace)
       }
     }
 

package/lib/languageLookups/header.js

@@ -26,7 +26,7 @@ export default {
           m = rgx.exec(acceptLanguage)
           if (m) {
             const lng = m[1]; const weight = m[5] || '1'; const q = Number(weight)
-            if (lng && !isNaN(q)) {
+            if (lng && q > 0) {
               lngs.push({ lng, q })
             }
           }

package/lib/utils.js

@@ -17,14 +17,16 @@ function isSafeIdentifierBase (v) {
   return true
 }
 
-// Strict — also rejects `/`. Applied to `lng`:
-// no legitimate BCP-47 / i18next language-code shape
-// (https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)
-// contains `/`, so allowing it would only enable attacks.
+// Strict, applied to `lng`: on top of the base checks, the shape i18next accepts
+// for a language code from outside since 26.7 (the rule of its exported
+// `isSafeLanguageCode`): letters, digits, `-`, `_`, `@` and `.`. It is not a
+// BCP-47 check (https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted),
+// so `en_US`, `zh_Hant_TW` and `sr@latin` pass. `/`, quotes, spaces and `=` do
+// not: a detected language ends up in `<html lang="...">`, and a value like
+// `" onmouseover="x()` passed the base checks and the XSS patterns.
 export function isSafeLangIdentifier (v) {
   if (!isSafeIdentifierBase(v)) return false
-  if (v.indexOf('/') > -1) return false
-  return true
+  return /^[A-Za-z0-9_@.-]+$/.test(v)
 }
 
 // Loose — allows `/`. Applied to `ns`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.10",
+  "version": "3.10.0",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",
@@ -47,7 +47,7 @@
     "eslint-plugin-standard": "5.0.0",
     "expect.js": "0.3.1",
     "express": "5.2.1",
-    "fastify": "5.12.1",
+    "fastify": "5.12.6",
     "i18next": "26.0.5",
     "mocha": "11.7.5",
     "preact": "10.29.1",