|
| 1 | +import expect from 'expect.js' |
| 2 | +import { dirname } from 'path' |
| 3 | +import { fileURLToPath } from 'url' |
| 4 | +const __dirname = dirname(fileURLToPath(import.meta.url)) |
| 5 | +import i18next from 'i18next' |
| 6 | +import Backend from '../index.js' |
| 7 | +import { isSafePathSegment, interpolate, interpolatePath } from '../lib/utils.js' |
| 8 | + |
| 9 | +// Security tests for fixes shipped in the 2.6.x patch release. |
| 10 | +// See CHANGELOG for associated GHSA advisory. |
| 11 | + |
| 12 | +describe('security', () => { |
| 13 | + describe('isSafePathSegment', () => { |
| 14 | + it('accepts arbitrary language-code shapes', () => { |
| 15 | + expect(isSafePathSegment('en')).to.be(true) |
| 16 | + expect(isSafePathSegment('de-DE')).to.be(true) |
| 17 | + expect(isSafePathSegment('en_US')).to.be(true) |
| 18 | + expect(isSafePathSegment('zh-Hant-HK')).to.be(true) |
| 19 | + expect(isSafePathSegment('pirate-speak')).to.be(true) |
| 20 | + expect(isSafePathSegment('my-custom.ns')).to.be(true) |
| 21 | + }) |
| 22 | + |
| 23 | + it('rejects path-traversal / separator / control-char payloads', () => { |
| 24 | + expect(isSafePathSegment('../etc/passwd')).to.be(false) |
| 25 | + expect(isSafePathSegment('..')).to.be(false) |
| 26 | + expect(isSafePathSegment('foo/bar')).to.be(false) |
| 27 | + expect(isSafePathSegment('foo\\bar')).to.be(false) |
| 28 | + expect(isSafePathSegment('en\r\n')).to.be(false) |
| 29 | + expect(isSafePathSegment('en\u0000')).to.be(false) |
| 30 | + expect(isSafePathSegment('__proto__')).to.be(false) |
| 31 | + expect(isSafePathSegment('')).to.be(false) |
| 32 | + expect(isSafePathSegment('a'.repeat(200))).to.be(false) |
| 33 | + }) |
| 34 | + }) |
| 35 | + |
| 36 | + describe('interpolate', () => { |
| 37 | + it('skips __proto__ key lookups in the data object', () => { |
| 38 | + const out = interpolate('x {{__proto__}} y', { __proto__: { polluted: true } }) |
| 39 | + expect(out).to.equal('x {{__proto__}} y') |
| 40 | + expect(({}).polluted).to.be(undefined) |
| 41 | + }) |
| 42 | + it('substitutes normal keys', () => { |
| 43 | + expect(interpolate('{{lng}}/{{ns}}.json', { lng: 'en', ns: 'common' })) |
| 44 | + .to.equal('en/common.json') |
| 45 | + }) |
| 46 | + }) |
| 47 | + |
| 48 | + describe('interpolatePath', () => { |
| 49 | + it('accepts plain codes', () => { |
| 50 | + expect(interpolatePath('/locales/{{lng}}/{{ns}}.json', { lng: 'en', ns: 'common' })) |
| 51 | + .to.equal('/locales/en/common.json') |
| 52 | + }) |
| 53 | + it('accepts + joins (multi-language)', () => { |
| 54 | + expect(interpolatePath('/locales/{{lng}}/{{ns}}.json', { lng: 'en+de', ns: 'a' })) |
| 55 | + .to.equal('/locales/en+de/a.json') |
| 56 | + }) |
| 57 | + it('returns null for path traversal', () => { |
| 58 | + expect(interpolatePath('/locales/{{lng}}/{{ns}}.json', { lng: '../etc/passwd', ns: 'x' })) |
| 59 | + .to.equal(null) |
| 60 | + expect(interpolatePath('/locales/{{lng}}/{{ns}}.json', { lng: 'en', ns: '..' })) |
| 61 | + .to.equal(null) |
| 62 | + }) |
| 63 | + it('returns null for path separators', () => { |
| 64 | + expect(interpolatePath('/locales/{{lng}}/{{ns}}.json', { lng: 'en/../', ns: 'x' })) |
| 65 | + .to.equal(null) |
| 66 | + expect(interpolatePath('/locales/{{lng}}/{{ns}}.json', { lng: 'en\\x', ns: 'x' })) |
| 67 | + .to.equal(null) |
| 68 | + }) |
| 69 | + it('returns null when a segment of a + join is unsafe', () => { |
| 70 | + expect(interpolatePath('/locales/{{lng}}.json', { lng: 'en+../etc/passwd' })) |
| 71 | + .to.equal(null) |
| 72 | + }) |
| 73 | + }) |
| 74 | + |
| 75 | + describe('Backend.read refuses unsafe lng/ns', () => { |
| 76 | + let backend |
| 77 | + before(() => { |
| 78 | + i18next.init({ fallbackLng: 'en', ns: 'test' }) |
| 79 | + const connector = i18next.services.backendConnector |
| 80 | + backend = new Backend(i18next.services, { |
| 81 | + loadPath: `${__dirname}/locales/{{lng}}/{{ns}}.json`, |
| 82 | + addPath: `${__dirname}/locales/{{lng}}/{{ns}}.json` |
| 83 | + }, connector.allOptions || {}) |
| 84 | + }) |
| 85 | + |
| 86 | + it('does not read outside the locale directory on lng=../../etc/passwd', (done) => { |
| 87 | + backend.read('../../etc/passwd', 'test', (err, data) => { |
| 88 | + expect(err).to.be.an(Error) |
| 89 | + expect(err.message).to.contain('unsafe lng/ns') |
| 90 | + expect(data).to.be(false) |
| 91 | + done() |
| 92 | + }) |
| 93 | + }) |
| 94 | + |
| 95 | + it('does not read when ns contains a slash', (done) => { |
| 96 | + backend.read('en', '../../etc/passwd', (err, data) => { |
| 97 | + expect(err).to.be.an(Error) |
| 98 | + expect(err.message).to.contain('unsafe lng/ns') |
| 99 | + expect(data).to.be(false) |
| 100 | + done() |
| 101 | + }) |
| 102 | + }) |
| 103 | + |
| 104 | + it('still reads legitimate languages (regression guard)', (done) => { |
| 105 | + backend.read('en', 'test', (err, data) => { |
| 106 | + // No assertion on data (file may or may not exist in this suite) — |
| 107 | + // the key point is that the safety guard did NOT reject a legit value. |
| 108 | + if (err && /unsafe lng\/ns/.test(err.message)) { |
| 109 | + done(new Error('safety guard rejected a legitimate input')) |
| 110 | + return |
| 111 | + } |
| 112 | + done() |
| 113 | + }) |
| 114 | + }) |
| 115 | + }) |
| 116 | +}) |
0 commit comments