fix: validate locale codes to ensure path segment safety (#4059)

Author: BobbieGoede

src/module.ts

@@ -14,7 +14,7 @@ import { relative } from 'pathe'
 import { generateTemplateNuxtI18nOptions } from './template'
 import { generateI18nTypes, generateLoaderOptions, simplifyLocaleOptions } from './gen'
 import { applyLayerOptions, resolveLayerVueI18nConfigInfo } from './layers'
-import { computeLocaleHashes, filterLocales, getLocaleFilePaths, normalizeDomainLocale, resolveLocales } from './utils'
+import { computeLocaleHashes, filterLocales, getLocaleFilePaths, normalizeDomainLocale, resolveLocales, validateLocaleCodes } from './utils'
 import { isString } from '@intlify/shared'
 
 export * from './types'
@@ -181,6 +181,7 @@ export default defineNuxtModule<NuxtI18nOptions>({
         normalizeDomainLocale(isString(x) ? { code: x, language: x } : x),
       )
       ctx.localeCodes = ctx.normalizedLocales.map(locale => locale.code)
+      validateLocaleCodes(ctx.localeCodes)
       ctx.localeInfo = resolveLocales(nuxt.options.srcDir, ctx.normalizedLocales, nuxt.vfs)
 
       ctx.vueI18nConfigPaths = await resolveLayerVueI18nConfigInfo(ctx)

src/utils.ts

@@ -31,6 +31,19 @@ export function filterLocales(ctx: I18nNuxtContext, nuxt: Nuxt) {
   return ctx.options.locales.filter(x => include.includes(isString(x) ? x : x.code)) as string[] | LocaleObject[]
 }
 
+// locale codes are used as single URL path segments (route prefixes, messages endpoint), in route names and in cookies (#4036)
+const INVALID_LOCALE_CODE_CHAR_RE = /[/\\?#%:\s]/
+
+export function validateLocaleCodes(codes: string[]) {
+  const invalid = codes.filter(code => !code || INVALID_LOCALE_CODE_CHAR_RE.test(code))
+  if (invalid.length) {
+    throw new Error(
+      `[nuxt-i18n] Invalid locale code${invalid.length > 1 ? 's' : ''}: ${invalid.map(x => JSON.stringify(x)).join(', ')}. `
+      + 'Locale codes are used as URL path segments and must not be empty or contain `/ \\ ? # % :` or whitespace.',
+    )
+  }
+}
+
 /**
  * Normalizes the single-domain fields (`domain`/`domainDefault`) into their multi-domain forms
  * (`domains`/`defaultForDomains`) so runtime domain resolution only handles one shape,

test/utils.test.ts

@@ -1,4 +1,4 @@
-import { filterLocales, resolveLocales } from '../src/utils'
+import { filterLocales, resolveLocales, validateLocaleCodes } from '../src/utils'
 import type { LocaleObject, NuxtI18nOptions } from '../src/types'
 import type { I18nNuxtContext } from '../src/context'
 import type { Nuxt, NuxtConfigLayer } from '@nuxt/schema'
@@ -62,6 +62,22 @@ describe('filterLocales', () => {
   })
 })
 
+describe('validateLocaleCodes', () => {
+  test('accepts path-segment-safe codes', () => {
+    expect(() => validateLocaleCodes(['en', 'de-AT', 'zh-Hans', 'pt_BR', 'kr.v2'])).not.toThrow()
+  })
+
+  test.each(['at/de', 'at\\de', 'en us', 'en?', 'en#x', 'en%20', 'en:us', ''])('throws for %j', code => {
+    expect(() => validateLocaleCodes([code])).toThrowError('[nuxt-i18n] Invalid locale code')
+  })
+
+  test('lists all invalid codes', () => {
+    expect(() => validateLocaleCodes(['en', 'at/de', 'at/en'])).toThrowError(
+      /Invalid locale codes: "at\/de", "at\/en"/,
+    )
+  })
+})
+
 test('resolveLocales', async () => {
   const locales = [
     {