i18next-http-middleware 3.9.4 → 3.9.5

package/cjs/index.js

@@ -251,8 +251,8 @@ function getResourcesHandler(i18next) {
       languages = options.getParams(req)[options.lngParam || 'lng'] ? options.getParams(req)[options.lngParam || 'lng'].split(' ') : [];
       namespaces = options.getParams(req)[options.nsParam || 'ns'] ? options.getParams(req)[options.nsParam || 'ns'].split(' ') : [];
     }
-    languages = languages.filter(utils.isSafeIdentifier);
-    namespaces = namespaces.filter(utils.isSafeIdentifier);
+    languages = languages.filter(utils.isSafeLangIdentifier);
+    namespaces = namespaces.filter(utils.isSafeNsIdentifier);
     namespaces.forEach(function (ns) {
       if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
         i18next.options.ns.push(ns);

package/cjs/utils.js

@@ -8,20 +8,31 @@ exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
 exports.hasXSS = hasXSS;
-exports.isSafeIdentifier = isSafeIdentifier;
+exports.isSafeIdentifier = void 0;
+exports.isSafeLangIdentifier = isSafeLangIdentifier;
+exports.isSafeNsIdentifier = isSafeNsIdentifier;
 exports.removeLngFromUrl = removeLngFromUrl;
 exports.sanitizeHeaderValue = sanitizeHeaderValue;
 exports.setPath = setPath;
 var UNSAFE_KEYS = exports.UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
-function isSafeIdentifier(v) {
+function isSafeIdentifierBase(v) {
   if (typeof v !== 'string') return false;
   if (v.length === 0 || v.length > 128) return false;
   if (UNSAFE_KEYS.indexOf(v) > -1) return false;
   if (v.indexOf('..') > -1) return false;
-  if (v.indexOf('/') > -1 || v.indexOf('\\') > -1) return false;
+  if (v.indexOf('\\') > -1) return false;
   if (/[\x00-\x1F\x7F]/.test(v)) return false;
   return true;
 }
+function isSafeLangIdentifier(v) {
+  if (!isSafeIdentifierBase(v)) return false;
+  if (v.indexOf('/') > -1) return false;
+  return true;
+}
+function isSafeNsIdentifier(v) {
+  return isSafeIdentifierBase(v);
+}
+var isSafeIdentifier = exports.isSafeIdentifier = isSafeLangIdentifier;
 function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);

package/esm/index.js

@@ -234,8 +234,8 @@ export function getResourcesHandler(i18next) {
       languages = options.getParams(req)[options.lngParam || 'lng'] ? options.getParams(req)[options.lngParam || 'lng'].split(' ') : [];
       namespaces = options.getParams(req)[options.nsParam || 'ns'] ? options.getParams(req)[options.nsParam || 'ns'].split(' ') : [];
     }
-    languages = languages.filter(utils.isSafeIdentifier);
-    namespaces = namespaces.filter(utils.isSafeIdentifier);
+    languages = languages.filter(utils.isSafeLangIdentifier);
+    namespaces = namespaces.filter(utils.isSafeNsIdentifier);
     namespaces.forEach(function (ns) {
       if (i18next.options.ns && i18next.options.ns.indexOf(ns) < 0) {
         i18next.options.ns.push(ns);

package/esm/utils.js

@@ -1,13 +1,22 @@
 export var UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
-export function isSafeIdentifier(v) {
+function isSafeIdentifierBase(v) {
   if (typeof v !== 'string') return false;
   if (v.length === 0 || v.length > 128) return false;
   if (UNSAFE_KEYS.indexOf(v) > -1) return false;
   if (v.indexOf('..') > -1) return false;
-  if (v.indexOf('/') > -1 || v.indexOf('\\') > -1) return false;
+  if (v.indexOf('\\') > -1) return false;
   if (/[\x00-\x1F\x7F]/.test(v)) return false;
   return true;
 }
+export function isSafeLangIdentifier(v) {
+  if (!isSafeIdentifierBase(v)) return false;
+  if (v.indexOf('/') > -1) return false;
+  return true;
+}
+export function isSafeNsIdentifier(v) {
+  return isSafeIdentifierBase(v);
+}
+export var isSafeIdentifier = isSafeLangIdentifier;
 export function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);

package/lib/index.js

@@ -258,8 +258,12 @@ export function getResourcesHandler (i18next, options = {}) {
     // connector. i18next itself permits arbitrary language codes, so we do
     // not impose a BCP-47 shape — we only block known-dangerous patterns.
     // See: https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted
-    languages = languages.filter(utils.isSafeIdentifier)
-    namespaces = namespaces.filter(utils.isSafeIdentifier)
+    // lng goes through the strict check (rejects `/`); ns goes through
+    // the loose check (allows `/` so nested-namespace layouts like `a/b`
+    // that map to `public/locales/en/a/b.json` keep working). Directory
+    // escape via `..` / `\` / control chars is still blocked on both.
+    languages = languages.filter(utils.isSafeLangIdentifier)
+    namespaces = namespaces.filter(utils.isSafeNsIdentifier)
 
     // extend ns
     namespaces.forEach(ns => {

package/lib/utils.js

@@ -1,25 +1,48 @@
 export const UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype']
 
-// Returns true if `v` can be safely forwarded as a language code or namespace
-// identifier to a backend connector. Denylist approach (i18next permits any
-// language-code shape — https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)
-// that blocks the concrete attack patterns without restricting legitimate use:
-//   - not one of `__proto__` / `constructor` / `prototype` (prototype pollution)
-//   - no path separators `/` or `\` (path traversal / SSRF in fs/http backends)
-//   - no `..` sequence (relative path traversal)
-//   - no control characters (header injection downstream, log forging)
-//   - non-empty, length <= 128
-export function isSafeIdentifier (v) {
+// Shared denylist: the patterns that are always unsafe to forward to a
+// backend connector, regardless of whether the value is a language code
+// or a namespace name. Blocks directory escape (`..`), Windows path
+// separators (`\`), control characters, prototype keys, empty strings,
+// and oversized inputs. The one dimension that differs per-key is whether
+// `/` is allowed — see the two per-key helpers below.
+function isSafeIdentifierBase (v) {
   if (typeof v !== 'string') return false
   if (v.length === 0 || v.length > 128) return false
   if (UNSAFE_KEYS.indexOf(v) > -1) return false
   if (v.indexOf('..') > -1) return false
-  if (v.indexOf('/') > -1 || v.indexOf('\\') > -1) return false
+  if (v.indexOf('\\') > -1) return false
   // eslint-disable-next-line no-control-regex
   if (/[\x00-\x1F\x7F]/.test(v)) return false
   return true
 }
 
+// Strict — also rejects `/`. Applied to `lng`:
+// no legitimate BCP-47 / i18next language-code shape
+// (https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted)
+// contains `/`, so allowing it would only enable attacks.
+export function isSafeLangIdentifier (v) {
+  if (!isSafeIdentifierBase(v)) return false
+  if (v.indexOf('/') > -1) return false
+  return true
+}
+
+// Loose — allows `/`. Applied to `ns`:
+// nested namespace names like `a/b` that map to subfolder locale layouts
+// (`public/locales/en/a/b.json` on fs-backend, `/locales/en/a/b.json`
+// on http-backend) are a documented i18next pattern and were rejected
+// in 3.9.3 as an unintended regression. Directory escape is still
+// prevented — `..` is still blocked, `\` is still blocked — so the
+// security fix remains in force for every concrete attack pattern
+// from the original advisory.
+export function isSafeNsIdentifier (v) {
+  return isSafeIdentifierBase(v)
+}
+
+// Backwards-compatible alias for the strict check. Kept because 3.9.3
+// exported this symbol; external callers (if any) get the pre-fix behaviour.
+export const isSafeIdentifier = isSafeLangIdentifier
+
 export function setPath (object, path, newValue) {
   let stack
   if (typeof path !== 'string') stack = [].concat(path)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.4",
+  "version": "3.9.5",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",