GHSA-3cmx-xjww-583x — i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query…

Affected: npm: i18next-http-backend

### Summary

The URL-segment check added for GHSA-q89c-q3h5-w34g blocks `?`, `#`, `%`, `:`, `/` and `@` in `lng`, but not `&` or `=`, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form `/locales/resources.json?lng=de+en&ns=ns1+ns2`. With a template like that, an attacker who controls the language value can add or override query parameters on the request the backend sends. By default the language comes from `?lng=`, a cookie or `Accept-Language`. This is the "query-string injection" impact described in GHSA-q89c; only the `?` form was closed.

Server side (Express + i18next-http-middleware, default options), `GET /?lng=de%26ns%3Dprivate%26admin%3Dtrue` makes the application request `…?lng=de&ns=private&admin=true&ns=common` from its own translations API.

### Details

The checks are in `lib/utils.js`. The base check (https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/utils.js#L26-L44) rejects:

- empty or >128-character values and prototype keys; - `..` and `\`; - `/[?#%:\s]/`; - control characters.

`isSafeLangUrlSegment` (https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/utils.js#L51-L55) adds only `/` and `@`. **Neither function rejects `&` or `=`.**

```js if (/[?#%:\s]/.test(v)) return false // utils.js L40, no & or = ```

`interpolateUrl` then splits on `+`, checks each segment, and joins the **raw** segments into the template, with no encoding (https://github.com/i18next/i1…

Most recent entries from all

GHSA-3cmx-xjww-583x — i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query…