i18next-http-middleware 3.9.7 → 3.9.8

package/cjs/LanguageDetector.js

@@ -93,7 +93,7 @@ var LanguageDetector = function () {
           return d !== undefined && d !== null && !utils.hasXSS(d);
         }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
-        });
+        }).filter(utils.isSafeLangIdentifier);
         if (_this.services.languageUtils.getBestMatchFromCodes) {
           found = _this.services.languageUtils.getBestMatchFromCodes(detections);
           if (found) {

package/cjs/index.js

@@ -280,6 +280,10 @@ function missingKeyHandler(i18next) {
       res = _checkForCombinedReqR3.res;
     var lng = options.getParams(req)[options.lngParam || 'lng'];
     var ns = options.getParams(req)[options.nsParam || 'ns'];
+    if (!utils.isSafeLangIdentifier(lng) || !utils.isSafeNsIdentifier(ns)) {
+      options.setStatus(res, 400);
+      return options.send(res, 'i18next-http-middleware:: unsafe lng/ns value');
+    }
     if (!i18next.services.backendConnector) {
       options.setStatus(res, 404);
       return options.send(res, 'i18next-express-middleware:: no backend configured');

package/esm/LanguageDetector.js

@@ -85,7 +85,7 @@ var LanguageDetector = function () {
           return d !== undefined && d !== null && !utils.hasXSS(d);
         }).map(function (d) {
           return _this.options.convertDetectedLanguage(d);
-        });
+        }).filter(utils.isSafeLangIdentifier);
         if (_this.services.languageUtils.getBestMatchFromCodes) {
           found = _this.services.languageUtils.getBestMatchFromCodes(detections);
           if (found) {

package/esm/index.js

@@ -263,6 +263,10 @@ export function missingKeyHandler(i18next) {
       res = _checkForCombinedReqR3.res;
     var lng = options.getParams(req)[options.lngParam || 'lng'];
     var ns = options.getParams(req)[options.nsParam || 'ns'];
+    if (!utils.isSafeLangIdentifier(lng) || !utils.isSafeNsIdentifier(ns)) {
+      options.setStatus(res, 400);
+      return options.send(res, 'i18next-http-middleware:: unsafe lng/ns value');
+    }
     if (!i18next.services.backendConnector) {
       options.setStatus(res, 404);
       return options.send(res, 'i18next-express-middleware:: no backend configured');

package/lib/LanguageDetector.js

@@ -81,9 +81,18 @@ class LanguageDetector {
       if (!detections) return
       if (!Array.isArray(detections)) detections = [detections]
 
+      // Detected languages come from untrusted request input (querystring,
+      // path, cookie, session, header) and are forwarded to
+      // changeLanguage()/loadLanguages(), which hand them to the backend as
+      // a `{{lng}}` path/URL segment. hasXSS only covers markup payloads, so
+      // the identifier check is what blocks directory escape (`..`, `/`,
+      // `\`), control characters and prototype keys. Applied *after*
+      // convertDetectedLanguage so a custom converter cannot reintroduce an
+      // unsafe value; non-string converter output is dropped (fail-closed).
       detections = detections
         .filter((d) => d !== undefined && d !== null && !utils.hasXSS(d))
         .map((d) => this.options.convertDetectedLanguage(d))
+        .filter(utils.isSafeLangIdentifier)
 
       if (this.services.languageUtils.getBestMatchFromCodes) { // new i18next v19.5.0
         found = this.services.languageUtils.getBestMatchFromCodes(detections)

package/lib/index.js

@@ -302,6 +302,19 @@ export function missingKeyHandler (i18next, options = {}) {
     const lng = options.getParams(req)[options.lngParam || 'lng']
     const ns = options.getParams(req)[options.nsParam || 'ns']
 
+    // Same check getResourcesHandler applies, but this is the write path:
+    // these params are forwarded to backendConnector.saveMissing() and end
+    // up as the `{{lng}}`/`{{ns}}` segments of the backend's addPath, so an
+    // unvalidated value is an arbitrary file write on i18next-fs-backend
+    // (route params arrive percent-decoded, e.g. `..%2f..%2ftmp`).
+    if (!utils.isSafeLangIdentifier(lng) || !utils.isSafeNsIdentifier(ns)) {
+      options.setStatus(res, 400)
+      return options.send(
+        res,
+        'i18next-http-middleware:: unsafe lng/ns value'
+      )
+    }
+
     if (!i18next.services.backendConnector) {
       options.setStatus(res, 404)
       return options.send(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "i18next-http-middleware",
-  "version": "3.9.7",
+  "version": "3.9.8",
   "private": false,
   "type": "module",
   "main": "./cjs/index.js",
@@ -29,7 +29,7 @@
   "module": "./esm/index.js",
   "devDependencies": {
     "@babel/cli": "7.28.6",
-    "@babel/core": "7.29.0",
+    "@babel/core": "7.29.6",
     "@babel/preset-env": "7.29.2",
     "@hapi/hapi": "^21.4.8",
     "@opentelemetry/api": "^1.9.1",
@@ -66,7 +66,7 @@
   "homepage": "https://github.com/i18next/i18next-http-middleware",
   "repository": {
     "type": "git",
-    "url": "git@github.com:i18next/i18next-http-middleware.git"
+    "url": "https://github.com/i18next/i18next-http-middleware.git"
   },
   "bugs": {
     "url": "https://github.com/i18next/i18next-http-middleware/issues"