Just to be sure, sanitize the Content-Language response header. (Even…

…though there is no known/reproducible vulnerability yet #80)
i18next · Dec 24, 2024 · 0640b52 · 0640b52
1 parent 164ec71
commit 0640b52
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,6 @@
+## [v3.7.1](https://github.com/i18next/i18next-http-middleware/compare/v3.7.0...v3.7.1)
+- Just to be sure, sanitize the Content-Language response header. (Eventhough there is no known/reproducible vulnerability yet #80)
+
 ## [v3.7.0](https://github.com/i18next/i18next-http-middleware/compare/v3.6.0...v3.7.0)
 - support i18next v24
 

diff --git a/lib/index.js b/lib/index.js
@@ -55,7 +55,7 @@ export function handle (i18next, options = {}) {
       }
 
       if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-        options.setHeader(res, 'Content-Language', lng)
+        options.setHeader(res, 'Content-Language', utils.escape(lng))
       }
 
       req.languages = i18next.services.languageUtils.toResolveHierarchy(lng)
@@ -73,7 +73,7 @@ export function handle (i18next, options = {}) {
     // set locale
     req.language = req.locale = req.lng = lng
     if (lng && options.getHeader(res, 'Content-Language') !== lng) {
-      options.setHeader(res, 'Content-Language', lng)
+      options.setHeader(res, 'Content-Language', utils.escape(lng))
     }
     req.languages = i18next.services.languageUtils.toResolveHierarchy(lng)
 

diff --git a/lib/utils.js b/lib/utils.js
@@ -58,3 +58,14 @@ export function removeLngFromUrl (url, lookupFromPathIndex) {
 
   return url
 }
+
+export function escape (str) {
+  return (str.replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#x27;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/\//g, '&#x2F;')
+    .replace(/\\/g, '&#x5C;')
+    .replace(/`/g, '&#96;'))
+}