i18next-http-middleware 3.9.6 → 3.9.8

package/README.md

@@ -510,7 +510,7 @@ Don't forget: You have to add the name of your detector (`myDetectorsName` in th
 <h3 align='center'>Gold Sponsors</h3>
 
 <p align='center'>
-  <a href='https://locize.com/' target='_blank'>
+  <a href='https://www.locize.com/?utm_source=i18next_http_middleware_readme&utm_medium=github&utm_campaign=readme' target='_blank'>
     <img src='https://raw.githubusercontent.com/i18next/i18next/master/assets/locize_sponsor_240.gif' width='240px'>
   </a>
 </p>

package/cjs/LanguageDetector.js

@@ -93,7 +93,7 @@ var LanguageDetector = function () {
           return d !== undefined && d !== null && !utils.hasXSS(d);
         }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
-        });
+        }).filter(utils.isSafeLangIdentifier);
         if (_this.services.languageUtils.getBestMatchFromCodes) {
           found = _this.services.languageUtils.getBestMatchFromCodes(detections);
           if (found) {

package/cjs/index.js

@@ -280,16 +280,21 @@ function missingKeyHandler(i18next) {
       res = _checkForCombinedReqR3.res;
     var lng = options.getParams(req)[options.lngParam || 'lng'];
     var ns = options.getParams(req)[options.nsParam || 'ns'];
+    if (!utils.isSafeLangIdentifier(lng) || !utils.isSafeNsIdentifier(ns)) {
+      options.setStatus(res, 400);
+      return options.send(res, 'i18next-http-middleware:: unsafe lng/ns value');
+    }
     if (!i18next.services.backendConnector) {
       options.setStatus(res, 404);
       return options.send(res, 'i18next-express-middleware:: no backend configured');
     }
     var body = options.getBody(req);
+    var keySeparator = i18next.options && i18next.options.keySeparator;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue;
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
       }
     };

package/cjs/utils.js

@@ -7,6 +7,7 @@ exports.UNSAFE_KEYS = void 0;
 exports.defaults = defaults;
 exports.escape = escape;
 exports.extend = extend;
+exports.hasUnsafeKeySegment = hasUnsafeKeySegment;
 exports.hasXSS = hasXSS;
 exports.isSafeIdentifier = void 0;
 exports.isSafeLangIdentifier = isSafeLangIdentifier;
@@ -14,6 +15,9 @@ exports.isSafeNsIdentifier = isSafeNsIdentifier;
 exports.removeLngFromUrl = removeLngFromUrl;
 exports.sanitizeHeaderValue = sanitizeHeaderValue;
 exports.setPath = setPath;
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 var UNSAFE_KEYS = exports.UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
 function isSafeIdentifierBase(v) {
   if (typeof v !== 'string') return false;
@@ -33,6 +37,27 @@ function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);
 }
 var isSafeIdentifier = exports.isSafeIdentifier = isSafeLangIdentifier;
+function hasUnsafeKeySegment(key, keySeparator) {
+  if (typeof key !== 'string') return false;
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true;
+  if (keySeparator === false) return false;
+  var sep = keySeparator || '.';
+  if (key.indexOf(sep) < 0) return false;
+  var segments = key.split(sep);
+  var _iterator = _createForOfIteratorHelper(segments),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var s = _step.value;
+      if (UNSAFE_KEYS.indexOf(s) > -1) return true;
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return false;
+}
 function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);

package/esm/LanguageDetector.js

@@ -85,7 +85,7 @@ var LanguageDetector = function () {
           return d !== undefined && d !== null && !utils.hasXSS(d);
         }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
-        });
+        }).filter(utils.isSafeLangIdentifier);
         if (_this.services.languageUtils.getBestMatchFromCodes) {
           found = _this.services.languageUtils.getBestMatchFromCodes(detections);
           if (found) {

package/esm/index.js

@@ -263,16 +263,21 @@ export function missingKeyHandler(i18next) {
       res = _checkForCombinedReqR3.res;
     var lng = options.getParams(req)[options.lngParam || 'lng'];
     var ns = options.getParams(req)[options.nsParam || 'ns'];
+    if (!utils.isSafeLangIdentifier(lng) || !utils.isSafeNsIdentifier(ns)) {
+      options.setStatus(res, 400);
+      return options.send(res, 'i18next-http-middleware:: unsafe lng/ns value');
+    }
     if (!i18next.services.backendConnector) {
       options.setStatus(res, 404);
       return options.send(res, 'i18next-express-middleware:: no backend configured');
     }
     var body = options.getBody(req);
+    var keySeparator = i18next.options && i18next.options.keySeparator;
     var saveMissingKeys = function saveMissingKeys(src) {
       if (!src || _typeof(src) !== 'object') return;
       for (var _i = 0, _Object$keys = Object.keys(src); _i < _Object$keys.length; _i++) {
         var m = _Object$keys[_i];
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue;
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue;
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m]);
       }
     };

package/esm/utils.js

@@ -1,3 +1,6 @@
+function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t.return || t.return(); } finally { if (u) throw o; } } }; }
+function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
+function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
 export var UNSAFE_KEYS = ['__proto__', 'constructor', 'prototype'];
 function isSafeIdentifierBase(v) {
   if (typeof v !== 'string') return false;
@@ -17,6 +20,27 @@ export function isSafeNsIdentifier(v) {
   return isSafeIdentifierBase(v);
 }
 export var isSafeIdentifier = isSafeLangIdentifier;
+export function hasUnsafeKeySegment(key, keySeparator) {
+  if (typeof key !== 'string') return false;
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true;
+  if (keySeparator === false) return false;
+  var sep = keySeparator || '.';
+  if (key.indexOf(sep) < 0) return false;
+  var segments = key.split(sep);
+  var _iterator = _createForOfIteratorHelper(segments),
+    _step;
+  try {
+    for (_iterator.s(); !(_step = _iterator.n()).done;) {
+      var s = _step.value;
+      if (UNSAFE_KEYS.indexOf(s) > -1) return true;
+    }
+  } catch (err) {
+    _iterator.e(err);
+  } finally {
+    _iterator.f();
+  }
+  return false;
+}
 export function setPath(object, path, newValue) {
   var stack;
   if (typeof path !== 'string') stack = [].concat(path);

package/lib/LanguageDetector.js

@@ -81,9 +81,18 @@ class LanguageDetector {
       if (!detections) return
       if (!Array.isArray(detections)) detections = [detections]
 
+      // Detected languages come from untrusted request input (querystring,
+      // path, cookie, session, header) and are forwarded to
+      // changeLanguage()/loadLanguages(), which hand them to the backend as
+      // a `{{lng}}` path/URL segment. hasXSS only covers markup payloads, so
+      // the identifier check is what blocks directory escape (`..`, `/`,
+      // `\`), control characters and prototype keys. Applied *after*
+      // convertDetectedLanguage so a custom converter cannot reintroduce an
+      // unsafe value; non-string converter output is dropped (fail-closed).
       detections = detections
         .filter((d) => d !== undefined && d !== null && !utils.hasXSS(d))
         .map((d) => this.options.convertDetectedLanguage(d))
+        .filter(utils.isSafeLangIdentifier)
 
       if (this.services.languageUtils.getBestMatchFromCodes) { // new i18next v19.5.0
         found = this.services.languageUtils.getBestMatchFromCodes(detections)

package/lib/index.js

@@ -302,6 +302,19 @@ export function missingKeyHandler (i18next, options = {}) {
     const lng = options.getParams(req)[options.lngParam || 'lng']
     const ns = options.getParams(req)[options.nsParam || 'ns']
 
+    // Same check getResourcesHandler applies, but this is the write path:
+    // these params are forwarded to backendConnector.saveMissing() and end
+    // up as the `{{lng}}`/`{{ns}}` segments of the backend's addPath, so an
+    // unvalidated value is an arbitrary file write on i18next-fs-backend
+    // (route params arrive percent-decoded, e.g. `..%2f..%2ftmp`).
+    if (!utils.isSafeLangIdentifier(lng) || !utils.isSafeNsIdentifier(ns)) {
+      options.setStatus(res, 400)
+      return options.send(
+        res,
+        'i18next-http-middleware:: unsafe lng/ns value'
+      )
+    }
+
     if (!i18next.services.backendConnector) {
       options.setStatus(res, 404)
       return options.send(
@@ -311,12 +324,15 @@ export function missingKeyHandler (i18next, options = {}) {
     }
 
     const body = options.getBody(req)
+    const keySeparator = i18next.options && i18next.options.keySeparator
 
-    // iterate only over own, non-prototype-polluting keys
+    // iterate only over own, non-prototype-polluting keys. The check also
+    // rejects dotted variants like `__proto__.polluted` whose segments under
+    // the configured keySeparator land on an unsafe key — see utils.js.
     const saveMissingKeys = src => {
       if (!src || typeof src !== 'object') return
       for (const m of Object.keys(src)) {
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m])
       }
     }

package/lib/utils.js

@@ -43,6 +43,27 @@ export function isSafeNsIdentifier (v) {
 // exported this symbol; external callers (if any) get the pre-fix behaviour.
 export const isSafeIdentifier = isSafeLangIdentifier
 
+// Defense-in-depth check for `missingKeyHandler`. The literal-key denylist
+// catches `{"__proto__": ...}` but misses dotted variants like
+// `{"__proto__.polluted": "x"}` — backends that split the missing-key string
+// on a configured keySeparator (e.g. i18next-fs-backend's writeFile()) would
+// hand that key to an unguarded setPath and walk into Object.prototype.
+// Reject any key whose segments — under the configured keySeparator (default
+// `.`) — include an unsafe key. keySeparator === false means "no splitting",
+// in which case only the literal-key check applies.
+export function hasUnsafeKeySegment (key, keySeparator) {
+  if (typeof key !== 'string') return false
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true
+  if (keySeparator === false) return false
+  const sep = keySeparator || '.'
+  if (key.indexOf(sep) < 0) return false
+  const segments = key.split(sep)
+  for (const s of segments) {
+    if (UNSAFE_KEYS.indexOf(s) > -1) return true
+  }
+  return false
+}
+
 export function setPath (object, path, newValue) {
   let stack
   if (typeof path !== 'string') stack = [].concat(path)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.6",
+  "version": "3.9.8",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",
@@ -29,7 +29,7 @@
   "module": "./esm/index.js",
   "devDependencies": {
     "@babel/cli": "7.28.6",
-    "@babel/core": "7.29.0",
+    "@babel/core": "7.29.6",
     "@babel/preset-env": "7.29.2",
     "@hapi/hapi": "^21.4.8",
     "@opentelemetry/api": "^1.9.1",
@@ -66,7 +66,7 @@
   "homepage": "https://github.com/i18next/i18next-http-middleware",
   "repository": {
     "type": "git",
-    "url": "git@github.com:i18next/i18next-http-middleware.git"
+    "url": "https://github.com/i18next/i18next-http-middleware.git"
   },
   "bugs": {
     "url": "https://github.com/i18next/i18next-http-middleware/issues"