i18next-http-middleware 3.9.11 → 3.10.1

package/cjs/index.js

@@ -132,7 +132,7 @@ function handle(i18next) {
       i18next.services.languageDetector.cacheUserLanguage(req, res, lng);
     }
     if (!req.lng) return next();
-    i18next.loadLanguages(req.lng, function () {
+    i18n.loadLanguages(req.lng, function () {
       return next();
     });
   };
@@ -253,17 +253,16 @@ function getResourcesHandler(i18next) {
     }
     languages = languages.filter(utils.isSafeLangIdentifier);
     namespaces = namespaces.filter(utils.isSafeNsIdentifier);
-    namespaces.forEach(function (ns) {
-      if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
-        i18next.options.ns.push(ns);
-      }
-    });
     var loaded = false;
     var onLoaded;
     i18next.services.backendConnector.load(languages, namespaces, function () {
       languages.forEach(function (lng) {
         namespaces.forEach(function (ns) {
-          utils.setPath(resources, [lng, ns], i18next.getResourceBundle(lng, ns));
+          var bundle = i18next.getResourceBundle(lng, ns);
+          if (bundle && i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
+            i18next.options.ns.push(ns);
+          }
+          utils.setPath(resources, [lng, ns], bundle);
         });
       });
       loaded = true;
@@ -300,12 +299,14 @@ function missingKeyHandler(i18next) {
     }
     var body = options.getBody(req);
     var keySeparator = i18next.options && i18next.options.keySeparator;
+    var utilsOfRequest = req.i18n && req.i18n.services && req.i18n.services.utils;
+    var hasLoadedNamespace = utilsOfRequest && utilsOfRequest.hasLoadedNamespace;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
         if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
-        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m], undefined, undefined, undefined, hasLoadedNamespace);
       }
     };
     if (typeof body === 'function') {

package/cjs/utils.js

@@ -30,8 +30,7 @@ function isSafeIdentifierBase(v) {
 }
 function isSafeLangIdentifier(v) {
   if (!isSafeIdentifierBase(v)) return false;
-  if (v.indexOf('/') > -1) return false;
-  return true;
+  return /^[A-Za-z0-9_@.-]+$/.test(v);
 }
 function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);

package/esm/index.js

@@ -115,7 +115,7 @@ export function handle(i18next) {
       i18next.services.languageDetector.cacheUserLanguage(req, res, lng);
     }
     if (!req.lng) return next();
-    i18next.loadLanguages(req.lng, function () {
+    i18n.loadLanguages(req.lng, function () {
       return next();
     });
   };
@@ -236,17 +236,16 @@ export function getResourcesHandler(i18next) {
     }
     languages = languages.filter(utils.isSafeLangIdentifier);
     namespaces = namespaces.filter(utils.isSafeNsIdentifier);
-    namespaces.forEach(function (ns) {
-      if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
-        i18next.options.ns.push(ns);
-      }
-    });
     var loaded = false;
     var onLoaded;
     i18next.services.backendConnector.load(languages, namespaces, function () {
       languages.forEach(function (lng) {
         namespaces.forEach(function (ns) {
-          utils.setPath(resources, [lng, ns], i18next.getResourceBundle(lng, ns));
+          var bundle = i18next.getResourceBundle(lng, ns);
+          if (bundle && i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
+            i18next.options.ns.push(ns);
+          }
+          utils.setPath(resources, [lng, ns], bundle);
         });
       });
       loaded = true;
@@ -283,12 +282,14 @@ export function missingKeyHandler(i18next) {
     }
     var body = options.getBody(req);
     var keySeparator = i18next.options && i18next.options.keySeparator;
+    var utilsOfRequest = req.i18n && req.i18n.services && req.i18n.services.utils;
+    var hasLoadedNamespace = utilsOfRequest && utilsOfRequest.hasLoadedNamespace;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
         if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
-        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m], undefined, undefined, undefined, hasLoadedNamespace);
       }
     };
     if (typeof body === 'function') {

package/esm/utils.js

@@ -13,8 +13,7 @@ function isSafeIdentifierBase(v) {
 }
 export function isSafeLangIdentifier(v) {
   if (!isSafeIdentifierBase(v)) return false;
-  if (v.indexOf('/') > -1) return false;
-  return true;
+  return /^[A-Za-z0-9_@.-]+$/.test(v);
 }
 export function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);

package/lib/index.js

@@ -127,9 +127,11 @@ export function handle (i18next, options = {}) {
     if (i18next.services.languageDetector) {
       i18next.services.languageDetector.cacheUserLanguage(req, res, lng)
     }
-    // load resources
+    // load resources: through the request's clone, as loadLanguages() adds
+    // the language to options.preload, and every request on the shared
+    // instance pays for the length of that list until the process restarts
     if (!req.lng) return next()
-    i18next.loadLanguages(req.lng, () => next())
+    i18n.loadLanguages(req.lng, () => next())
   }
 }
 
@@ -265,23 +267,19 @@ export function getResourcesHandler (i18next, options = {}) {
     languages = languages.filter(utils.isSafeLangIdentifier)
     namespaces = namespaces.filter(utils.isSafeNsIdentifier)
 
-    // extend ns
-    namespaces.forEach(ns => {
-      if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
-        i18next.options.ns.push(ns)
-      }
-    })
-
     let loaded = false
     let onLoaded
     i18next.services.backendConnector.load(languages, namespaces, function () {
       languages.forEach(lng => {
         namespaces.forEach(ns => {
-          utils.setPath(
-            resources,
-            [lng, ns],
-            i18next.getResourceBundle(lng, ns)
-          )
+          const bundle = i18next.getResourceBundle(lng, ns)
+          // extend ns only with a namespace the backend has: every request
+          // pays for the length of this shared list, and a made-up ns from
+          // the request would stay in it until the process restarts
+          if (bundle && i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
+            i18next.options.ns.push(ns)
+          }
+          utils.setPath(resources, [lng, ns], bundle)
         })
       })
       loaded = true
@@ -335,6 +333,8 @@ export function missingKeyHandler (i18next, options = {}) {
 
     const body = options.getBody(req)
     const keySeparator = i18next.options && i18next.options.keySeparator
+    const utilsOfRequest = req.i18n && req.i18n.services && req.i18n.services.utils
+    const hasLoadedNamespace = utilsOfRequest && utilsOfRequest.hasLoadedNamespace
 
     // iterate only over own, non-prototype-polluting keys. The check also
     // rejects dotted variants like `__proto__.polluted` whose segments under
@@ -343,7 +343,9 @@ export function missingKeyHandler (i18next, options = {}) {
       if (!src || typeof src !== 'object') return
       for (const m of Object.keys(src)) {
         if (utils.hasUnsafeKeySegment(m, keySeparator)) continue
-        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m])
+        // i18next >= 26.7 takes the check of this request's instance (one clone per
+        // request) as the 8th argument; without it, it checks the newest clone
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m], undefined, undefined, undefined, hasLoadedNamespace)
       }
     }
 

package/lib/utils.js

@@ -17,14 +17,16 @@ function isSafeIdentifierBase (v) {
   return true
 }
 
-// Strict — also rejects `/`. Applied to `lng`:
-// no legitimate BCP-47 / i18next language-code shape
-// (https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)
-// contains `/`, so allowing it would only enable attacks.
+// Strict, applied to `lng`: on top of the base checks, the shape i18next accepts
+// for a language code from outside since 26.7 (the rule of its exported
+// `isSafeLanguageCode`): letters, digits, `-`, `_`, `@` and `.`. It is not a
+// BCP-47 check (https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted),
+// so `en_US`, `zh_Hant_TW` and `sr@latin` pass. `/`, quotes, spaces and `=` do
+// not: a detected language ends up in `<html lang="...">`, and a value like
+// `" onmouseover="x()` passed the base checks and the XSS patterns.
 export function isSafeLangIdentifier (v) {
   if (!isSafeIdentifierBase(v)) return false
-  if (v.indexOf('/') > -1) return false
-  return true
+  return /^[A-Za-z0-9_@.-]+$/.test(v)
 }
 
 // Loose — allows `/`. Applied to `ns`:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.11",
+  "version": "3.10.1",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",