i18next-http-middleware 3.9.6 → 3.9.7

package/README.md

@@ -510,7 +510,7 @@ Don't forget: You have to add the name of your detector (`myDetectorsName` in th
 <h3 align='center'>Gold Sponsors</h3>
 
 <p align='center'>
-  <a href='https://locize.com/' target='_blank'>
+  <a href='https://www.locize.com/?utm_source=i18next_http_middleware_readme&utm_medium=github&utm_campaign=readme' target='_blank'>
     <img src='https://raw.githubusercontent.com/i18next/i18next/master/assets/locize_sponsor_240.gif' width='240px'>
   </a>
 </p>

package/cjs/index.js

@@ -285,11 +285,12 @@ function missingKeyHandler(i18next) {
       return options.send(res, 'i18next-express-middleware:: no backend configured');
     }
     var body = options.getBody(req);
+    var keySeparator = i18next.options && i18next.options.keySeparator;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue;
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
       }
     };

package/cjs/utils.js

@@ -7,6 +7,7 @@ exports.UNSAFE_KEYS = void 0;
 exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
+exports.hasUnsafeKeySegment = hasUnsafeKeySegment;
 exports.hasXSS = hasXSS;
 exports.isSafeIdentifier = void 0;
 exports.isSafeLangIdentifier = isSafeLangIdentifier;
@@ -14,6 +15,9 @@ exports.isSafeNsIdentifier = isSafeNsIdentifier;
 exports.removeLngFromUrl = removeLngFromUrl;
 exports.sanitizeHeaderValue = sanitizeHeaderValue;
 exports.setPath = setPath;
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 var UNSAFE_KEYS = exports.UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
 function isSafeIdentifierBase(v) {
   if (typeof v !== 'string') return false;
@@ -33,6 +37,27 @@ function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);
 }
 var isSafeIdentifier = exports.isSafeIdentifier = isSafeLangIdentifier;
+function hasUnsafeKeySegment(key, keySeparator) {
+  if (typeof key !== 'string') return false;
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true;
+  if (keySeparator === false) return false;
+  var sep = keySeparator || '.';
+  if (key.indexOf(sep) < 0) return false;
+  var segments = key.split(sep);
+  var _iterator = _createForOfIteratorHelper(segments),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var s = _step.value;
+      if (UNSAFE_KEYS.indexOf(s) > -1) return true;
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return false;
+}
 function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);

package/esm/index.js

@@ -268,11 +268,12 @@ export function missingKeyHandler(i18next) {
       return options.send(res, 'i18next-express-middleware:: no backend configured');
     }
     var body = options.getBody(req);
+    var keySeparator = i18next.options && i18next.options.keySeparator;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue;
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
       }
     };

package/esm/utils.js

@@ -1,3 +1,6 @@
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 export var UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
 function isSafeIdentifierBase(v) {
   if (typeof v !== 'string') return false;
@@ -17,6 +20,27 @@ export function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);
 }
 export var isSafeIdentifier = isSafeLangIdentifier;
+export function hasUnsafeKeySegment(key, keySeparator) {
+  if (typeof key !== 'string') return false;
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true;
+  if (keySeparator === false) return false;
+  var sep = keySeparator || '.';
+  if (key.indexOf(sep) < 0) return false;
+  var segments = key.split(sep);
+  var _iterator = _createForOfIteratorHelper(segments),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var s = _step.value;
+      if (UNSAFE_KEYS.indexOf(s) > -1) return true;
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return false;
+}
 export function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);

package/lib/index.js

@@ -311,12 +311,15 @@ export function missingKeyHandler (i18next, options = {}) {
     }
 
     const body = options.getBody(req)
+    const keySeparator = i18next.options && i18next.options.keySeparator
 
-    // iterate only over own, non-prototype-polluting keys
+    // iterate only over own, non-prototype-polluting keys. The check also
+    // rejects dotted variants like `__proto__.polluted` whose segments under
+    // the configured keySeparator land on an unsafe key — see utils.js.
     const saveMissingKeys = src => {
       if (!src || typeof src !== 'object') return
       for (const m of Object.keys(src)) {
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m])
       }
     }

package/lib/utils.js

@@ -43,6 +43,27 @@ export function isSafeNsIdentifier (v) {
 // exported this symbol; external callers (if any) get the pre-fix behaviour.
 export const isSafeIdentifier = isSafeLangIdentifier
 
+// Defense-in-depth check for `missingKeyHandler`. The literal-key denylist
+// catches `{"__proto__": ...}` but misses dotted variants like
+// `{"__proto__.polluted": "x"}` — backends that split the missing-key string
+// on a configured keySeparator (e.g. i18next-fs-backend's writeFile()) would
+// hand that key to an unguarded setPath and walk into Object.prototype.
+// Reject any key whose segments — under the configured keySeparator (default
+// `.`) — include an unsafe key. keySeparator === false means "no splitting",
+// in which case only the literal-key check applies.
+export function hasUnsafeKeySegment (key, keySeparator) {
+  if (typeof key !== 'string') return false
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true
+  if (keySeparator === false) return false
+  const sep = keySeparator || '.'
+  if (key.indexOf(sep) < 0) return false
+  const segments = key.split(sep)
+  for (const s of segments) {
+    if (UNSAFE_KEYS.indexOf(s) > -1) return true
+  }
+  return false
+}
+
 export function setPath (object, path, newValue) {
   let stack
   if (typeof path !== 'string') stack = [].concat(path)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.6",
+  "version": "3.9.7",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",