next-intl 4.9.0 → 4.9.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -186,9 +186,17 @@ function getLocaleAsPrefix(locale) {
|
|
|
186
186
|
}
|
|
187
187
|
function sanitizePathname(pathname) {
|
|
188
188
|
// Sanitize malicious URIs, e.g.:
|
|
189
|
-
// '/en/\\example.org
|
|
190
|
-
// '/en
|
|
191
|
-
|
|
189
|
+
// '/en/\\example.org' → '/en/%5Cexample.org' (backslash → %5C)
|
|
190
|
+
// '/en/\t/example.org' → '/en/example.org' (WHATWG-stripped TAB)
|
|
191
|
+
// '/en/\n/example.org' → '/en/example.org' (WHATWG-stripped LF)
|
|
192
|
+
// '/en/\r/example.org' → '/en/example.org' (WHATWG-stripped CR)
|
|
193
|
+
// '/en////example.org' → '/en/example.org' (consecutive slashes)
|
|
194
|
+
//
|
|
195
|
+
// U+0009/000A/000D are silently stripped by the WHATWG URL parser
|
|
196
|
+
// (https://url.spec.whatwg.org/#concept-url-parser). Without removing
|
|
197
|
+
// them here, a decoded TAB in a segment separator position causes
|
|
198
|
+
// new URL("/\t/host", base) to collapse to "//host" → open redirect.
|
|
199
|
+
return pathname.replace(/\\/g, '%5C').replace(/[\t\n\r]/g, '').replace(/\/+/g, '/');
|
|
192
200
|
}
|
|
193
201
|
|
|
194
202
|
export { applyBasePath, formatPathname, formatPathnameTemplate, formatTemplatePathname, getBestMatchingDomain, getHost, getInternalTemplate, getLocaleAsPrefix, getLocalePrefixes, getNormalizedPathname, getPathnameMatch, getRouteParams, isLocaleSupportedOnDomain, sanitizePathname };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import{normalizeTrailingSlash as e,getSortedPathnames as t,matchesPathname as n,prefixPathname as r,getLocalePrefix as o,templateToRegex as c,getLocalizedTemplate as i}from"../shared/utils.js";function s(e,r,o){const c=t(Object.keys(e));for(const t of c){const c=e[t];if("string"==typeof c){if(n(c,r))return[void 0,t]}else{const s=Object.entries(c),f=s.findIndex((([e])=>e===o));f>0&&s.unshift(s.splice(f,1)[0]);for(const[o]of s){const c=i(e[t],o,t);if(n(c,r))return[o,t]}}}for(const t of Object.keys(e))if(n(t,r))return[void 0,t];return[void 0,void 0]}function f(t,n,r,o){let c="";return c+=
|
|
1
|
+
import{normalizeTrailingSlash as e,getSortedPathnames as t,matchesPathname as n,prefixPathname as r,getLocalePrefix as o,templateToRegex as c,getLocalizedTemplate as i}from"../shared/utils.js";function s(e,r,o){const c=t(Object.keys(e));for(const t of c){const c=e[t];if("string"==typeof c){if(n(c,r))return[void 0,t]}else{const s=Object.entries(c),f=s.findIndex((([e])=>e===o));f>0&&s.unshift(s.splice(f,1)[0]);for(const[o]of s){const c=i(e[t],o,t);if(n(c,r))return[o,t]}}}for(const t of Object.keys(e))if(n(t,r))return[void 0,t];return[void 0,void 0]}function f(t,n,r,o){let c="";return c+=p(r,d(n,t)),c=e(c),c}function l(t,n,r){t.endsWith("/")||(t+="/");const o=u(n,r),c=new RegExp(`^(${o.map((([,e])=>e.replaceAll("/","\\/"))).join("|")})/(.*)`,"i"),i=t.match(c);let s=i?"/"+i[2]:t;return"/"!==s&&(s=e(s)),s}function u(e,t,n=!0){const r=e.map((e=>[e,o(e,t)]));return n&&r.sort(((e,t)=>t[1].length-e[1].length)),r}function a(e,t,n,r){const o=u(t,n);r&&o.sort((([e],[t])=>{if(e===r.defaultLocale)return-1;if(t===r.defaultLocale)return 1;const n=r.locales.includes(e),o=r.locales.includes(t);return n&&!o?-1:!n&&o?1:0}));for(const[t,n]of o){let r,o;if(e===n||e.startsWith(n+"/"))r=o=!0;else{const t=e.toLowerCase(),c=n.toLowerCase();(t===c||t.startsWith(c+"/"))&&(r=!1,o=!0)}if(o)return{locale:t,prefix:n,matchedPrefix:e.slice(0,n.length),exact:r}}}function d(t,n){const r=e(n),o=e(t),i=c(o).exec(r);if(!i)return;const s={},f=o.match(/\[([^\]]+)\]/g)??[];for(let e=1;e<i.length;e++){const t=f[e-1];if(!t)continue;const n=t.replace(/[[\]]/g,""),r=i[e]??"";s[n]=r}return s}function p(e,t){if(!t)return e;let n=e=e.replace(/\[\[/g,"[").replace(/\]\]/g,"]");return Object.entries(t).forEach((([e,t])=>{n=n.replace(`[${e}]`,t)})),n}function g(e,t,n){let o=e;return t&&(o=r(t,o)),n&&(o+=n),o}function h(e){return e.get("x-forwarded-host")??e.get("host")??void 0}function x(e,t){return t.defaultLocale===e||t.locales.includes(e)}function m(e,t,n){let r;return e&&x(t,e)&&(r=e),r||(r=n.find((e=>e.defaultLocale===t))),r||(r=n.find((e=>e.locales.includes(t)))),r}function j(t,n){return e(n+t)}function L(e){return`/${e}`}function v(e){return e.replace(/\\/g,"%5C").replace(/[\t\n\r]/g,"").replace(/\/+/g,"/")}export{j as applyBasePath,g as formatPathname,p as formatPathnameTemplate,f as formatTemplatePathname,m as getBestMatchingDomain,h as getHost,s as getInternalTemplate,L as getLocaleAsPrefix,u as getLocalePrefixes,l as getNormalizedPathname,a as getPathnameMatch,d as getRouteParams,x as isLocaleSupportedOnDomain,v as sanitizePathname};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "next-intl",
|
|
3
|
-
"version": "4.9.
|
|
3
|
+
"version": "4.9.1",
|
|
4
4
|
"sideEffects": false,
|
|
5
5
|
"author": "Jan Amann <jan@amann.work>",
|
|
6
6
|
"funding": [
|
|
@@ -127,11 +127,11 @@
|
|
|
127
127
|
"@formatjs/intl-localematcher": "^0.8.1",
|
|
128
128
|
"@parcel/watcher": "^2.4.1",
|
|
129
129
|
"@swc/core": "^1.15.2",
|
|
130
|
-
"icu-minify": "^4.9.
|
|
130
|
+
"icu-minify": "^4.9.1",
|
|
131
131
|
"negotiator": "^1.0.0",
|
|
132
|
-
"next-intl-swc-plugin-extractor": "^4.9.
|
|
132
|
+
"next-intl-swc-plugin-extractor": "^4.9.1",
|
|
133
133
|
"po-parser": "^2.1.1",
|
|
134
|
-
"use-intl": "^4.9.
|
|
134
|
+
"use-intl": "^4.9.1"
|
|
135
135
|
},
|
|
136
136
|
"peerDependencies": {
|
|
137
137
|
"next": "^12.0.0 || ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0",
|
|
@@ -142,5 +142,5 @@
|
|
|
142
142
|
"optional": true
|
|
143
143
|
}
|
|
144
144
|
},
|
|
145
|
-
"gitHead": "
|
|
145
|
+
"gitHead": "b4aa5380c50ad59a80d1dfdbc229590a4e0133a3"
|
|
146
146
|
}
|