locizify 9.0.8 → 9.0.10

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+### 9.0.10
+
+Security release — includes upstream fixes from `i18next-locize-backend`, `i18nextify`, and `locize`.
+
+- security: emit a one-time `console.warn` when `?apikey=` or `?projectid=` is read from the URL query string on a non-local host (anything other than `localhost`, `127.0.0.1`, `::1`, `*.localhost`, `*.local`). The feature itself is preserved — an attacker-crafted link on a production host could otherwise silently redirect translations (and `saveMissing` writes) to an attacker-chosen locize project (CWE-522); the warning is there so maintainers notice when it happens and can decide to disable the URL-credential path in their deployment. Prefer configuring credentials via the `<script id="locizify" apikey="…" projectid="…">` attributes, which are not attacker-controllable.
+- chore: bump pinned deps (security releases): `i18next-locize-backend` 9.0.1 → **9.0.2** ([GHSA-mgcp-mfp8-3q45](https://github.com/locize/i18next-locize-backend/security/advisories/GHSA-mgcp-mfp8-3q45)), `i18nextify` 4.0.7 → **4.0.8** ([GHSA-6457-mxpq-4fqq](https://github.com/i18next/i18nextify/security/advisories/GHSA-6457-mxpq-4fqq)), `locize` 4.0.16 → **4.0.21** ([GHSA-w937-fg2h-xhq2](https://github.com/locize/locize/security/advisories/GHSA-w937-fg2h-xhq2)).
+- chore: ignore `.env*` and `*.pem`/`*.key` files in `.gitignore`.
+
+### 9.0.9
+
+- update i18nextify
+
 ### 9.0.8
 
 - update i18nextify

package/dist/commonjs/index.js

@@ -35,6 +35,30 @@ function getQsParameterByName(name, url) {
   if (!results[2]) return '';
   return decodeURIComponent(results[2].replace(/\+/g, ' '));
 }
+
+// Reading credentials from the URL query string is convenient for local
+// development (run `?apikey=...&projectId=...` against a demo page) but is
+// dangerous on deployed sites: an attacker-crafted link would cause the
+// victim's page to send translation data (saveMissing) to the attacker's
+// locize project, or to run against an attacker-chosen backend.
+// The feature is preserved, but a warning is emitted when the URL
+// overrides credential values on hosts that don't look like a local dev
+// environment, so maintainers can notice and decide whether to disable it.
+function isLocalDevHost() {
+  if (typeof window === 'undefined' || !window.location) return false;
+  var h = window.location.hostname;
+  if (!h) return false;
+  return h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h.endsWith('.localhost') || h.endsWith('.local');
+}
+var credentialWarningShown = false;
+function warnIfCredentialFromUrlOnProdHost(attr) {
+  if (isLocalDevHost()) return;
+  if (credentialWarningShown) return; // only once per page
+  credentialWarningShown = true;
+  if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+    console.warn('locizify: reading credential "' + attr + '" from URL query string on a non-local host. ' + 'An attacker-crafted link can replace your locize credentials, redirecting saveMissing writes ' + 'to an attacker-chosen project. Prefer configuring credentials via the ' + '<script id="locizify" apikey="..." projectid="..."> attributes instead.');
+  }
+}
 var originalInit = i18next.init;
 i18next.init = function () {
   var options = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
@@ -70,11 +94,20 @@ i18next.init = function () {
       if (attr.toLowerCase() === 'autopilot' && value === '') value = true;
       if (value !== undefined && value !== null) backend[attr] = value;
       if (!value) {
-        value = getQsParameterByName(attr.toLowerCase());
+        var lc = attr.toLowerCase();
+        value = getQsParameterByName(lc);
         if (value === 'true') value = true;
         if (value === 'false') value = false;
-        if (attr.toLowerCase() === 'autopilot' && value === '') value = true;
-        if (value !== undefined && value !== null) backend[attr] = value;
+        if (lc === 'autopilot' && value === '') value = true;
+        if (value !== undefined && value !== null) {
+          backend[attr] = value;
+          // Credential-bearing attributes via URL on a non-local host is
+          // risky — attacker-crafted links can replace your credentials.
+          // Warn once per page load so maintainers notice.
+          if (lc === 'apikey' || lc === 'projectid') {
+            warnIfCredentialFromUrlOnProdHost(lc);
+          }
+        }
       }
     });
     if (backend.allowedAddOrUpdateHost) {
@@ -90,8 +123,14 @@ i18next.init = function () {
     // call orginal callback
     callback(err, t);
   }
+
+  // Accept `?apikey=` from the URL query string as a fallback. On non-local
+  // hosts this is risky (attacker-crafted links can replace your credentials
+  // and redirect saveMissing writes to an attacker-chosen project), so warn
+  // once when it happens.
   if (!options.backend.apiKey && getQsParameterByName('apikey')) {
     options.backend.apiKey = getQsParameterByName('apikey');
+    warnIfCredentialFromUrlOnProdHost('apikey');
   }
   if (!options.backend.autoPilot || options.backend.autoPilot === 'false') {
     return originalInit.call(i18next, _objectSpread(_objectSpread({}, options), enforce), handleI18nextInitialized);

package/dist/es/index.js

@@ -28,6 +28,30 @@ function getQsParameterByName(name, url) {
   if (!results[2]) return '';
   return decodeURIComponent(results[2].replace(/\+/g, ' '));
 }
+
+// Reading credentials from the URL query string is convenient for local
+// development (run `?apikey=...&projectId=...` against a demo page) but is
+// dangerous on deployed sites: an attacker-crafted link would cause the
+// victim's page to send translation data (saveMissing) to the attacker's
+// locize project, or to run against an attacker-chosen backend.
+// The feature is preserved, but a warning is emitted when the URL
+// overrides credential values on hosts that don't look like a local dev
+// environment, so maintainers can notice and decide whether to disable it.
+function isLocalDevHost() {
+  if (typeof window === 'undefined' || !window.location) return false;
+  var h = window.location.hostname;
+  if (!h) return false;
+  return h === 'localhost' || h === '127.0.0.1' || h === '::1' || h === '0.0.0.0' || h.endsWith('.localhost') || h.endsWith('.local');
+}
+var credentialWarningShown = false;
+function warnIfCredentialFromUrlOnProdHost(attr) {
+  if (isLocalDevHost()) return;
+  if (credentialWarningShown) return; // only once per page
+  credentialWarningShown = true;
+  if (typeof console !== 'undefined' && typeof console.warn === 'function') {
+    console.warn('locizify: reading credential "' + attr + '" from URL query string on a non-local host. ' + 'An attacker-crafted link can replace your locize credentials, redirecting saveMissing writes ' + 'to an attacker-chosen project. Prefer configuring credentials via the ' + '<script id="locizify" apikey="..." projectid="..."> attributes instead.');
+  }
+}
 var originalInit = i18next.init;
 i18next.init = function () {
   var options = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : {};
@@ -63,11 +87,20 @@ i18next.init = function () {
       if (attr.toLowerCase() === 'autopilot' && value === '') value = true;
       if (value !== undefined && value !== null) backend[attr] = value;
       if (!value) {
-        value = getQsParameterByName(attr.toLowerCase());
+        var lc = attr.toLowerCase();
+        value = getQsParameterByName(lc);
         if (value === 'true') value = true;
         if (value === 'false') value = false;
-        if (attr.toLowerCase() === 'autopilot' && value === '') value = true;
-        if (value !== undefined && value !== null) backend[attr] = value;
+        if (lc === 'autopilot' && value === '') value = true;
+        if (value !== undefined && value !== null) {
+          backend[attr] = value;
+          // Credential-bearing attributes via URL on a non-local host is
+          // risky — attacker-crafted links can replace your credentials.
+          // Warn once per page load so maintainers notice.
+          if (lc === 'apikey' || lc === 'projectid') {
+            warnIfCredentialFromUrlOnProdHost(lc);
+          }
+        }
       }
     });
     if (backend.allowedAddOrUpdateHost) {
@@ -83,8 +116,14 @@ i18next.init = function () {
     // call orginal callback
     callback(err, t);
   }
+
+  // Accept `?apikey=` from the URL query string as a fallback. On non-local
+  // hosts this is risky (attacker-crafted links can replace your credentials
+  // and redirect saveMissing writes to an attacker-chosen project), so warn
+  // once when it happens.
   if (!options.backend.apiKey && getQsParameterByName('apikey')) {
     options.backend.apiKey = getQsParameterByName('apikey');
+    warnIfCredentialFromUrlOnProdHost('apikey');
   }
   if (!options.backend.autoPilot || options.backend.autoPilot === 'false') {
     return originalInit.call(i18next, _objectSpread(_objectSpread({}, options), enforce), handleI18nextInitialized);