i18next-http-middleware 3.9.2 → 3.9.4

package/README.md

@@ -2,7 +2,6 @@
 
 [![Actions](https://github.com/i18next/i18next-http-middleware/workflows/node/badge.svg)](https://github.com/i18next/i18next-http-middleware/actions?query=workflow%3Anode)
 [![Actions deno](https://github.com/i18next/i18next-http-middleware/workflows/deno/badge.svg)](https://github.com/i18next/i18next-http-middleware/actions?query=workflow%3Adeno)
-[![Travis](https://img.shields.io/travis/i18next/i18next-http-middleware/master.svg?style=flat-square)](https://travis-ci.org/i18next/i18next-http-middleware)
 [![npm version](https://img.shields.io/npm/v/i18next-http-middleware.svg?style=flat-square)](https://www.npmjs.com/package/i18next-http-middleware)
 
 This is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.

package/cjs/LanguageDetector.js

@@ -12,8 +12,7 @@ var _header = _interopRequireDefault(require("./languageLookups/header.js"));
 var _session = _interopRequireDefault(require("./languageLookups/session.js"));
 var _httpFunctions = require("./httpFunctions.js");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(e) { return e ? t : r; })(e); }
-function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != _typeof(e) && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function _interopRequireWildcard(e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != _typeof(e) && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (var _t in e) "default" !== _t && {}.hasOwnProperty.call(e, _t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, _t)) && (i.get || i.set) ? o(f, _t, i) : f[_t] = e[_t]); return f; })(e, t); }
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function _classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
 function _defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, _toPropertyKey(o.key), o); } }

package/cjs/index.js

@@ -1,6 +1,5 @@
 "use strict";
 
-function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
@@ -18,14 +17,15 @@ var utils = _interopRequireWildcard(require("./utils.js"));
 var _LanguageDetector = _interopRequireDefault(require("./LanguageDetector.js"));
 var _httpFunctions = require("./httpFunctions.js");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function _getRequireWildcardCache(e) { return e ? t : r; })(e); }
-function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != _typeof(e) && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function _interopRequireWildcard(e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != _typeof(e) && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (var _t in e) "default" !== _t && {}.hasOwnProperty.call(e, _t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, _t)) && (i.get || i.set) ? o(f, _t, i) : f[_t] = e[_t]); return f; })(e, t); }
+function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : i + ""; }
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
-function _regeneratorRuntime() { "use strict"; _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function _regenerator() { var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i.return) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
+function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
 function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
 function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
 var LanguageDetector = exports.LanguageDetector = _LanguageDetector.default;
@@ -93,7 +93,7 @@ function handle(i18next) {
         res.locals.resolvedLanguage = i18n.resolvedLanguage;
       }
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-        options.setHeader(res, 'Content-Language', utils.escape(lng));
+        options.setHeader(res, 'Content-Language', utils.sanitizeHeaderValue(lng));
       }
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
       req.resolvedLanguage = i18n.resolvedLanguage;
@@ -107,7 +107,7 @@ function handle(i18next) {
     }
     req.language = req.locale = req.lng = lng;
     if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-      options.setHeader(res, 'Content-Language', utils.escape(lng));
+      options.setHeader(res, 'Content-Language', utils.sanitizeHeaderValue(lng));
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
     req.resolvedLanguage = i18n.resolvedLanguage;
@@ -148,20 +148,19 @@ function plugin(instance, options, next) {
 function koaPlugin(i18next, options) {
   var middleware = handle(i18next, options);
   return function () {
-    var _koaMiddleware = _asyncToGenerator(_regeneratorRuntime().mark(function _callee(ctx, next) {
-      return _regeneratorRuntime().wrap(function _callee$(_context) {
-        while (1) switch (_context.prev = _context.next) {
+    var _koaMiddleware = _asyncToGenerator(_regenerator().m(function _callee(ctx, next) {
+      return _regenerator().w(function (_context) {
+        while (1) switch (_context.n) {
           case 0:
-            _context.next = 2;
+            _context.n = 1;
             return new Promise(function (resolve) {
               return middleware(ctx, ctx, resolve);
             });
-          case 2:
-            _context.next = 4;
+          case 1:
+            _context.n = 2;
             return next();
-          case 4:
-          case "end":
-            return _context.stop();
+          case 2:
+            return _context.a(2);
         }
       }, _callee);
     }));
@@ -173,10 +172,10 @@ function koaPlugin(i18next, options) {
 }
 function freshPlugin(i18next, options) {
   return function () {
-    var _ref = _asyncToGenerator(_regeneratorRuntime().mark(function _callee2(ctx) {
-      var placeholder, resp;
-      return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-        while (1) switch (_context2.prev = _context2.next) {
+    var _ref = _asyncToGenerator(_regenerator().m(function _callee2(ctx) {
+      var placeholder, resp, contentLanguage, setCookie;
+      return _regenerator().w(function (_context2) {
+        while (1) switch (_context2.n) {
           case 0:
             handle(i18next, _objectSpread(_objectSpread({}, options), {}, {
               attachLocals: true
@@ -189,15 +188,19 @@ function freshPlugin(i18next, options) {
             ctx.state.languages = ctx.req.languages;
             placeholder = ctx.state.res;
             delete ctx.state.res;
-            _context2.next = 11;
+            _context2.n = 1;
             return ctx.next();
-          case 11:
-            resp = _context2.sent;
-            resp.headers.set('Content-Language', placeholder.headers.get('Content-Language'));
-            return _context2.abrupt("return", resp);
-          case 14:
-          case "end":
-            return _context2.stop();
+          case 1:
+            resp = _context2.v;
+            contentLanguage = placeholder.headers.get('Content-Language');
+            if (contentLanguage) {
+              resp.headers.set('Content-Language', contentLanguage);
+            }
+            setCookie = placeholder.headers.get('Set-Cookie');
+            if (setCookie) {
+              resp.headers.set('Set-Cookie', setCookie);
+            }
+            return _context2.a(2, resp);
         }
       }, _callee2);
     }));
@@ -248,6 +251,8 @@ function getResourcesHandler(i18next) {
       languages = options.getParams(req)[options.lngParam || 'lng'] ? options.getParams(req)[options.lngParam || 'lng'].split(' ') : [];
       namespaces = options.getParams(req)[options.nsParam || 'ns'] ? options.getParams(req)[options.nsParam || 'ns'].split(' ') : [];
     }
+    languages = languages.filter(utils.isSafeIdentifier);
+    namespaces = namespaces.filter(utils.isSafeIdentifier);
     namespaces.forEach(function (ns) {
       if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
         i18next.options.ns.push(ns);
@@ -280,22 +285,26 @@ function missingKeyHandler(i18next) {
       return options.send(res, 'i18next-express-middleware:: no backend configured');
     }
     var body = options.getBody(req);
+    var saveMissingKeys = function saveMissingKeys(src) {
+      if (!src || _typeof(src) !== 'object') return;
+      for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
+        var m = _Object$keys[_i];
+        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue;
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
+      }
+    };
     if (typeof body === 'function') {
       var promise = body();
       if (promise && typeof promise.then === 'function') {
         return new Promise(function (resolve) {
           promise.then(function (b) {
-            for (var m in b) {
-              i18next.services.backendConnector.saveMissing([lng], ns, m, b[m]);
-            }
+            saveMissingKeys(b);
             resolve(options.send(res, 'ok'));
           });
         });
       }
     }
-    for (var m in body) {
-      i18next.services.backendConnector.saveMissing([lng], ns, m, body[m]);
-    }
+    saveMissingKeys(body);
     return options.send(res, 'ok');
   };
 }

package/cjs/languageLookups/cookie.js

@@ -84,6 +84,8 @@ var _default = exports.default = {
         sameSite: options.cookieSameSite
       };
       if (options.cookieSecure) cookieOptions.secure = options.cookieSecure;
+      var sameSiteNormalised = typeof cookieOptions.sameSite === 'string' ? cookieOptions.sameSite.toLowerCase() : cookieOptions.sameSite;
+      if (sameSiteNormalised === 'none') cookieOptions.secure = true;
       var existingCookie = options.getHeader(res, 'set-cookie') || options.getHeader(res, 'Set-Cookie') || [];
       if (typeof existingCookie === 'string') existingCookie = [existingCookie];
       if (!Array.isArray(existingCookie)) existingCookie = [];

package/cjs/utils.js

@@ -3,12 +3,25 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.UNSAFE_KEYS = void 0;
 exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
 exports.hasXSS = hasXSS;
+exports.isSafeIdentifier = isSafeIdentifier;
 exports.removeLngFromUrl = removeLngFromUrl;
+exports.sanitizeHeaderValue = sanitizeHeaderValue;
 exports.setPath = setPath;
+var UNSAFE_KEYS = exports.UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
+function isSafeIdentifier(v) {
+  if (typeof v !== 'string') return false;
+  if (v.length === 0 || v.length > 128) return false;
+  if (UNSAFE_KEYS.indexOf(v) > -1) return false;
+  if (v.indexOf('..') > -1) return false;
+  if (v.indexOf('/') > -1 || v.indexOf('\\') > -1) return false;
+  if (/[\x00-\x1F\x7F]/.test(v)) return false;
+  return true;
+}
 function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);
@@ -16,11 +29,13 @@ function setPath(object, path, newValue) {
   while (stack.length > 1) {
     var _key = stack.shift();
     if (_key.indexOf('###') > -1) _key = _key.replace(/###/g, '.');
+    if (UNSAFE_KEYS.indexOf(_key) > -1) return;
     if (!object[_key]) object[_key] = {};
     object = object[_key];
   }
   var key = stack.shift();
   if (key.indexOf('###') > -1) key = key.replace(/###/g, '.');
+  if (UNSAFE_KEYS.indexOf(key) > -1) return;
   object[key] = newValue;
 }
 var arr = [];
@@ -62,9 +77,13 @@ function removeLngFromUrl(url, lookupFromPathIndex) {
 function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
 }
+function sanitizeHeaderValue(str) {
+  if (typeof str !== 'string') return str;
+  return str.replace(/[\r\n\x00-\x1F\x7F]/g, '');
+}
 function hasXSS(input) {
   if (typeof input !== 'string') return false;
-  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*\w+\s+[^>]*?\bon\w+\s*=/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
   return xssPatterns.some(function (pattern) {
     return pattern.test(input);
   });

package/esm/index.js

@@ -4,7 +4,8 @@ function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t =
 function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : i + ""; }
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
-function _regeneratorRuntime() { "use strict"; _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function _regenerator() { var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i.return) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
+function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
 function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
 function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
 import * as utils from './utils.js';
@@ -75,7 +76,7 @@ export function handle(i18next) {
         res.locals.resolvedLanguage = i18n.resolvedLanguage;
       }
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-        options.setHeader(res, 'Content-Language', utils.escape(lng));
+        options.setHeader(res, 'Content-Language', utils.sanitizeHeaderValue(lng));
       }
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
       req.resolvedLanguage = i18n.resolvedLanguage;
@@ -89,7 +90,7 @@ export function handle(i18next) {
     }
     req.language = req.locale = req.lng = lng;
     if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-      options.setHeader(res, 'Content-Language', utils.escape(lng));
+      options.setHeader(res, 'Content-Language', utils.sanitizeHeaderValue(lng));
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng);
     req.resolvedLanguage = i18n.resolvedLanguage;
@@ -130,20 +131,19 @@ export function plugin(instance, options, next) {
 export function koaPlugin(i18next, options) {
   var middleware = handle(i18next, options);
   return function () {
-    var _koaMiddleware = _asyncToGenerator(_regeneratorRuntime().mark(function _callee(ctx, next) {
-      return _regeneratorRuntime().wrap(function _callee$(_context) {
-        while (1) switch (_context.prev = _context.next) {
+    var _koaMiddleware = _asyncToGenerator(_regenerator().m(function _callee(ctx, next) {
+      return _regenerator().w(function (_context) {
+        while (1) switch (_context.n) {
           case 0:
-            _context.next = 2;
+            _context.n = 1;
             return new Promise(function (resolve) {
               return middleware(ctx, ctx, resolve);
             });
-          case 2:
-            _context.next = 4;
+          case 1:
+            _context.n = 2;
             return next();
-          case 4:
-          case "end":
-            return _context.stop();
+          case 2:
+            return _context.a(2);
         }
       }, _callee);
     }));
@@ -155,10 +155,10 @@ export function koaPlugin(i18next, options) {
 }
 export function freshPlugin(i18next, options) {
   return function () {
-    var _ref = _asyncToGenerator(_regeneratorRuntime().mark(function _callee2(ctx) {
-      var placeholder, resp;
-      return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-        while (1) switch (_context2.prev = _context2.next) {
+    var _ref = _asyncToGenerator(_regenerator().m(function _callee2(ctx) {
+      var placeholder, resp, contentLanguage, setCookie;
+      return _regenerator().w(function (_context2) {
+        while (1) switch (_context2.n) {
           case 0:
             handle(i18next, _objectSpread(_objectSpread({}, options), {}, {
               attachLocals: true
@@ -171,15 +171,19 @@ export function freshPlugin(i18next, options) {
             ctx.state.languages = ctx.req.languages;
             placeholder = ctx.state.res;
             delete ctx.state.res;
-            _context2.next = 11;
+            _context2.n = 1;
             return ctx.next();
-          case 11:
-            resp = _context2.sent;
-            resp.headers.set('Content-Language', placeholder.headers.get('Content-Language'));
-            return _context2.abrupt("return", resp);
-          case 14:
-          case "end":
-            return _context2.stop();
+          case 1:
+            resp = _context2.v;
+            contentLanguage = placeholder.headers.get('Content-Language');
+            if (contentLanguage) {
+              resp.headers.set('Content-Language', contentLanguage);
+            }
+            setCookie = placeholder.headers.get('Set-Cookie');
+            if (setCookie) {
+              resp.headers.set('Set-Cookie', setCookie);
+            }
+            return _context2.a(2, resp);
         }
       }, _callee2);
     }));
@@ -230,6 +234,8 @@ export function getResourcesHandler(i18next) {
       languages = options.getParams(req)[options.lngParam || 'lng'] ? options.getParams(req)[options.lngParam || 'lng'].split(' ') : [];
       namespaces = options.getParams(req)[options.nsParam || 'ns'] ? options.getParams(req)[options.nsParam || 'ns'].split(' ') : [];
     }
+    languages = languages.filter(utils.isSafeIdentifier);
+    namespaces = namespaces.filter(utils.isSafeIdentifier);
     namespaces.forEach(function (ns) {
       if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
         i18next.options.ns.push(ns);
@@ -262,22 +268,26 @@ export function missingKeyHandler(i18next) {
       return options.send(res, 'i18next-express-middleware:: no backend configured');
     }
     var body = options.getBody(req);
+    var saveMissingKeys = function saveMissingKeys(src) {
+      if (!src || _typeof(src) !== 'object') return;
+      for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
+        var m = _Object$keys[_i];
+        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue;
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
+      }
+    };
     if (typeof body === 'function') {
       var promise = body();
       if (promise && typeof promise.then === 'function') {
         return new Promise(function (resolve) {
           promise.then(function (b) {
-            for (var m in b) {
-              i18next.services.backendConnector.saveMissing([lng], ns, m, b[m]);
-            }
+            saveMissingKeys(b);
             resolve(options.send(res, 'ok'));
           });
         });
       }
     }
-    for (var m in body) {
-      i18next.services.backendConnector.saveMissing([lng], ns, m, body[m]);
-    }
+    saveMissingKeys(body);
     return options.send(res, 'ok');
   };
 }

package/esm/languageLookups/cookie.js

@@ -78,6 +78,8 @@ export default {
         sameSite: options.cookieSameSite
       };
       if (options.cookieSecure) cookieOptions.secure = options.cookieSecure;
+      var sameSiteNormalised = typeof cookieOptions.sameSite === 'string' ? cookieOptions.sameSite.toLowerCase() : cookieOptions.sameSite;
+      if (sameSiteNormalised === 'none') cookieOptions.secure = true;
       var existingCookie = options.getHeader(res, 'set-cookie') || options.getHeader(res, 'Set-Cookie') || [];
       if (typeof existingCookie === 'string') existingCookie = [existingCookie];
       if (!Array.isArray(existingCookie)) existingCookie = [];

package/esm/utils.js

@@ -1,3 +1,13 @@
+export var UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
+export function isSafeIdentifier(v) {
+  if (typeof v !== 'string') return false;
+  if (v.length === 0 || v.length > 128) return false;
+  if (UNSAFE_KEYS.indexOf(v) > -1) return false;
+  if (v.indexOf('..') > -1) return false;
+  if (v.indexOf('/') > -1 || v.indexOf('\\') > -1) return false;
+  if (/[\x00-\x1F\x7F]/.test(v)) return false;
+  return true;
+}
 export function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);
@@ -5,11 +15,13 @@ export function setPath(object, path, newValue) {
   while (stack.length > 1) {
     var _key = stack.shift();
     if (_key.indexOf('###') > -1) _key = _key.replace(/###/g, '.');
+    if (UNSAFE_KEYS.indexOf(_key) > -1) return;
     if (!object[_key]) object[_key] = {};
     object = object[_key];
   }
   var key = stack.shift();
   if (key.indexOf('###') > -1) key = key.replace(/###/g, '.');
+  if (UNSAFE_KEYS.indexOf(key) > -1) return;
   object[key] = newValue;
 }
 var arr = [];
@@ -51,9 +63,13 @@ export function removeLngFromUrl(url, lookupFromPathIndex) {
 export function escape(str) {
   return str.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\//g, '&#x2F;').replace(/\\/g, '&#x5C;').replace(/`/g, '&#96;');
 }
+export function sanitizeHeaderValue(str) {
+  if (typeof str !== 'string') return str;
+  return str.replace(/[\r\n\x00-\x1F\x7F]/g, '');
+}
 export function hasXSS(input) {
   if (typeof input !== 'string') return false;
-  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*img.*?on\w+\s*=/i, /<\s*\w+\s*on\w+\s*=.*?>/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
+  var xssPatterns = [/<\s*script.*?>/i, /<\s*\/\s*script\s*>/i, /<\s*\w+\s+[^>]*?\bon\w+\s*=/i, /javascript\s*:/i, /vbscript\s*:/i, /expression\s*\(/i, /eval\s*\(/i, /alert\s*\(/i, /document\.cookie/i, /document\.write\s*\(/i, /window\.location/i, /innerHTML/i];
   return xssPatterns.some(function (pattern) {
     return pattern.test(input);
   });

package/lib/index.js

@@ -69,7 +69,7 @@ export function handle (i18next, options = {}) {
       }
 
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-        options.setHeader(res, 'Content-Language', utils.escape(lng))
+        options.setHeader(res, 'Content-Language', utils.sanitizeHeaderValue(lng))
       }
 
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng)
@@ -88,7 +88,7 @@ export function handle (i18next, options = {}) {
     // set locale
     req.language = req.locale = req.lng = lng
     if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-      options.setHeader(res, 'Content-Language', utils.escape(lng))
+      options.setHeader(res, 'Content-Language', utils.sanitizeHeaderValue(lng))
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng)
     req.resolvedLanguage = i18n.resolvedLanguage
@@ -162,7 +162,17 @@ export function freshPlugin (i18next, options) {
     const placeholder = ctx.state.res
     delete ctx.state.res
     const resp = await ctx.next()
-    resp.headers.set('Content-Language', placeholder.headers.get('Content-Language'))
+
+    const contentLanguage = placeholder.headers.get('Content-Language')
+    if (contentLanguage) {
+      resp.headers.set('Content-Language', contentLanguage)
+    }
+
+    const setCookie = placeholder.headers.get('Set-Cookie')
+    if (setCookie) {
+      resp.headers.set('Set-Cookie', setCookie)
+    }
+
     return resp
   }
 }
@@ -243,6 +253,14 @@ export function getResourcesHandler (i18next, options = {}) {
         : []
     }
 
+    // Drop user-supplied values containing patterns that could trigger path
+    // traversal / SSRF / prototype pollution when forwarded to the backend
+    // connector. i18next itself permits arbitrary language codes, so we do
+    // not impose a BCP-47 shape — we only block known-dangerous patterns.
+    // See: https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted
+    languages = languages.filter(utils.isSafeIdentifier)
+    namespaces = namespaces.filter(utils.isSafeIdentifier)
+
     // extend ns
     namespaces.forEach(ns => {
       if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
@@ -290,23 +308,28 @@ export function missingKeyHandler (i18next, options = {}) {
 
     const body = options.getBody(req)
 
+    // iterate only over own, non-prototype-polluting keys
+    const saveMissingKeys = src => {
+      if (!src || typeof src !== 'object') return
+      for (const m of Object.keys(src)) {
+        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue
+        i18next.services.backendConnector.saveMissing([lng], ns, m, src[m])
+      }
+    }
+
     if (typeof body === 'function') {
       const promise = body()
       if (promise && typeof promise.then === 'function') {
         return new Promise(resolve => {
           promise.then(b => {
-            for (const m in b) {
-              i18next.services.backendConnector.saveMissing([lng], ns, m, b[m])
-            }
+            saveMissingKeys(b)
             resolve(options.send(res, 'ok'))
           })
         })
       }
     }
 
-    for (const m in body) {
-      i18next.services.backendConnector.saveMissing([lng], ns, m, body[m])
-    }
+    saveMissingKeys(body)
 
     return options.send(res, 'ok')
   }

package/lib/languageLookups/cookie.js

@@ -86,6 +86,13 @@ export default {
 
       if (options.cookieSecure) cookieOptions.secure = options.cookieSecure
 
+      // SameSite=None requires Secure — browsers reject the cookie otherwise.
+      // Force Secure in that case so misconfigured setups still function.
+      const sameSiteNormalised = typeof cookieOptions.sameSite === 'string'
+        ? cookieOptions.sameSite.toLowerCase()
+        : cookieOptions.sameSite
+      if (sameSiteNormalised === 'none') cookieOptions.secure = true
+
       let existingCookie = options.getHeader(res, 'set-cookie') || options.getHeader(res, 'Set-Cookie') || []
       if (typeof existingCookie === 'string') existingCookie = [existingCookie]
       if (!Array.isArray(existingCookie)) existingCookie = []

package/lib/utils.js

@@ -1,3 +1,25 @@
+export const UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype']
+
+// Returns true if `v` can be safely forwarded as a language code or namespace
+// identifier to a backend connector. Denylist approach (i18next permits any
+// language-code shape — https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)
+// that blocks the concrete attack patterns without restricting legitimate use:
+//   - not one of `__proto__` / `constructor` / `prototype` (prototype pollution)
+//   - no path separators `/` or `\` (path traversal / SSRF in fs/http backends)
+//   - no `..` sequence (relative path traversal)
+//   - no control characters (header injection downstream, log forging)
+//   - non-empty, length <= 128
+export function isSafeIdentifier (v) {
+  if (typeof v !== 'string') return false
+  if (v.length === 0 || v.length > 128) return false
+  if (UNSAFE_KEYS.indexOf(v) > -1) return false
+  if (v.indexOf('..') > -1) return false
+  if (v.indexOf('/') > -1 || v.indexOf('\\') > -1) return false
+  // eslint-disable-next-line no-control-regex
+  if (/[\x00-\x1F\x7F]/.test(v)) return false
+  return true
+}
+
 export function setPath (object, path, newValue) {
   let stack
   if (typeof path !== 'string') stack = [].concat(path)
@@ -6,12 +28,14 @@ export function setPath (object, path, newValue) {
   while (stack.length > 1) {
     let key = stack.shift()
     if (key.indexOf('###') > -1) key = key.replace(/###/g, '.')
+    if (UNSAFE_KEYS.indexOf(key) > -1) return // guard against prototype pollution
     if (!object[key]) object[key] = {}
     object = object[key]
   }
 
   let key = stack.shift()
   if (key.indexOf('###') > -1) key = key.replace(/###/g, '.')
+  if (UNSAFE_KEYS.indexOf(key) > -1) return // guard against prototype pollution
   object[key] = newValue
 }
 
@@ -70,6 +94,15 @@ export function escape (str) {
     .replace(/`/g, '&#96;'))
 }
 
+// Strip control characters (CR, LF, NUL, other C0/C1) from a value before
+// writing it into an HTTP header. Prevents HTTP response splitting on older
+// Node.js, and unhandled ERR_INVALID_CHAR crashes on newer Node.js.
+export function sanitizeHeaderValue (str) {
+  if (typeof str !== 'string') return str
+  // eslint-disable-next-line no-control-regex
+  return str.replace(/[\r\n\x00-\x1F\x7F]/g, '')
+}
+
 export function hasXSS (input) {
   if (typeof input !== 'string') return false
 
@@ -77,8 +110,8 @@ export function hasXSS (input) {
   const xssPatterns = [
     /<\s*script.*?>/i,
     /<\s*\/\s*script\s*>/i,
-    /<\s*img.*?on\w+\s*=/i,
-    /<\s*\w+\s*on\w+\s*=.*?>/i,
+    // event handlers on any tag position (not just first attribute)
+    /<\s*\w+\s+[^>]*?\bon\w+\s*=/i,
     /javascript\s*:/i,
     /vbscript\s*:/i,
     /expression\s*\(/i,

package/licence

@@ -1,4 +1,4 @@
-Copyright (c) 2025 i18next
+Copyright (c) 2020-present i18next
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.2",
+  "version": "3.9.4",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",
@@ -28,15 +28,15 @@
   },
   "module": "./esm/index.js",
   "devDependencies": {
-    "@babel/cli": "7.25.9",
-    "@babel/core": "7.26.0",
-    "@babel/preset-env": "7.26.0",
-    "@hapi/hapi": "^21.3.12",
-    "@opentelemetry/api": "^1.9.0",
-    "@preact/signals": "^2.2.1",
-    "@types/express-serve-static-core": "^5.0.1",
-    "@koa/router": "12.0.1",
-    "koa": "2.16.1",
+    "@babel/cli": "7.28.6",
+    "@babel/core": "7.29.0",
+    "@babel/preset-env": "7.29.2",
+    "@hapi/hapi": "^21.4.8",
+    "@opentelemetry/api": "^1.9.1",
+    "@preact/signals": "^2.9.0",
+    "@types/express-serve-static-core": "^5.1.1",
+    "@koa/router": "15.4.0",
+    "koa": "3.2.0",
     "babel-plugin-add-module-exports": "1.0.4",
     "eslint": "8.53.0",
     "eslint-config-standard": "17.1.0",
@@ -46,14 +46,14 @@
     "eslint-plugin-require-path-exists": "1.1.9",
     "eslint-plugin-standard": "5.0.0",
     "expect.js": "0.3.1",
-    "express": "4.21.1",
-    "fastify": "5.3.2",
-    "i18next": "25.5.2",
-    "mocha": "10.8.2",
-    "preact": "10.27.2",
-    "preact-render-to-string": "6.6.3",
-    "supertest": "7.0.0",
-    "tsd": "0.31.2",
+    "express": "5.2.1",
+    "fastify": "5.8.5",
+    "i18next": "26.0.5",
+    "mocha": "11.7.5",
+    "preact": "10.29.1",
+    "preact-render-to-string": "6.6.7",
+    "supertest": "7.2.2",
+    "tsd": "0.33.0",
     "uglify-js": "3.19.3"
   },
   "description": "i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.",