@analogjs/vite-plugin-nitro 2.6.4-beta.2 → 2.6.4-beta.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@analogjs/vite-plugin-nitro",
-  "version": "2.6.4-beta.2",
+  "version": "2.6.4-beta.3",
   "description": "A Vite plugin for adding a nitro API server",
   "type": "module",
   "author": "Brandon Roberts <robertsbt@gmail.com>",

package/src/lib/utils/renderers.d.ts

@@ -1,3 +1,3 @@
 export declare const ssrRenderer = "\nimport { eventHandler, getResponseHeader } from 'h3';\n// @ts-ignore\nimport renderer from '#analog/ssr';\n// @ts-ignore\nimport template from '#analog/index';\n\nexport default eventHandler(async (event) => {\n  const noSSR = getResponseHeader(event, 'x-analog-no-ssr');\n\n  if (noSSR === 'true') {\n    return template;\n  }\n\n  const html = await renderer(event.node.req.url, template, {\n    req: event.node.req,\n    res: event.node.res,\n  });\n\n  return html;\n});";
 export declare const clientRenderer = "\nimport { eventHandler } from 'h3';\n\n// @ts-ignore\nimport template from '#analog/index';\n\nexport default eventHandler(async () => {\n  return template;\n});\n";
-export declare const apiMiddleware = "\nimport { eventHandler, proxyRequest } from 'h3';\nimport { useRuntimeConfig } from '#imports';\n\nexport default eventHandler(async (event) => {\n  const prefix = useRuntimeConfig().prefix;\n  const apiPrefix = `${prefix}/${useRuntimeConfig().apiPrefix}`;\n\n  if (event.node.req.url?.startsWith(apiPrefix)) {\n    const reqUrl = event.node.req.url?.replace(apiPrefix, '');\n\n    if (\n      event.node.req.method === 'GET' &&\n      // in the case of XML routes, we want to proxy the request so that nitro gets the correct headers\n      // and can render the XML correctly as a static asset\n      !event.node.req.url?.endsWith('.xml')\n    ) {\n      return $fetch(reqUrl, { headers: event.node.req.headers });\n    }\n\n    return proxyRequest(event, reqUrl, {\n      // @ts-ignore\n      fetch: $fetch.native,\n    });\n  }\n});";
+export declare const apiMiddleware = "\nimport { createError, eventHandler, proxyRequest } from 'h3';\nimport { useRuntimeConfig } from '#imports';\n\nexport default eventHandler(async (event) => {\n  const prefix = useRuntimeConfig().prefix;\n  const apiPrefix = `${prefix}/${useRuntimeConfig().apiPrefix}`;\n\n  const url = event.node.req.url || '';\n\n  // only match the prefix on a path boundary, otherwise a URL such as\n  // '/apihttp://internal-host' would pass startsWith() and be forwarded verbatim\n  if (\n    url === apiPrefix ||\n    url.startsWith(`${apiPrefix}/`) ||\n    url.startsWith(`${apiPrefix}?`)\n  ) {\n    let reqUrl = url.slice(apiPrefix.length);\n    if (reqUrl === '' || reqUrl.startsWith('?')) {\n      reqUrl = `/${reqUrl}`;\n    }\n\n    // reject absolute and protocol-relative targets to prevent SSRF\n    if (!reqUrl.startsWith('/') || reqUrl.startsWith('//')) {\n      throw createError({ statusCode: 400, statusMessage: 'Invalid API route' });\n    }\n\n    if (\n      event.node.req.method === 'GET' &&\n      // in the case of XML routes, we want to proxy the request so that nitro gets the correct headers\n      // and can render the XML correctly as a static asset\n      !event.node.req.url?.endsWith('.xml')\n    ) {\n      return $fetch(reqUrl, { headers: event.node.req.headers });\n    }\n\n    return proxyRequest(event, reqUrl, {\n      // @ts-ignore\n      fetch: $fetch.native,\n    });\n  }\n});";

package/src/lib/utils/renderers.js

@@ -30,15 +30,31 @@ export default eventHandler(async () => {
 });
 `;
 export const apiMiddleware = `
-import { eventHandler, proxyRequest } from 'h3';
+import { createError, eventHandler, proxyRequest } from 'h3';
 import { useRuntimeConfig } from '#imports';
 
 export default eventHandler(async (event) => {
   const prefix = useRuntimeConfig().prefix;
   const apiPrefix = \`\${prefix}/\${useRuntimeConfig().apiPrefix}\`;
 
-  if (event.node.req.url?.startsWith(apiPrefix)) {
-    const reqUrl = event.node.req.url?.replace(apiPrefix, '');
+  const url = event.node.req.url || '';
+
+  // only match the prefix on a path boundary, otherwise a URL such as
+  // '/apihttp://internal-host' would pass startsWith() and be forwarded verbatim
+  if (
+    url === apiPrefix ||
+    url.startsWith(\`\${apiPrefix}/\`) ||
+    url.startsWith(\`\${apiPrefix}?\`)
+  ) {
+    let reqUrl = url.slice(apiPrefix.length);
+    if (reqUrl === '' || reqUrl.startsWith('?')) {
+      reqUrl = \`/\${reqUrl}\`;
+    }
+
+    // reject absolute and protocol-relative targets to prevent SSRF
+    if (!reqUrl.startsWith('/') || reqUrl.startsWith('//')) {
+      throw createError({ statusCode: 400, statusMessage: 'Invalid API route' });
+    }
 
     if (
       event.node.req.method === 'GET' &&

package/src/lib/utils/renderers.js.map

@@ -1 +1 @@
-{"version":3,"file":"renderers.js","sourceRoot":"","sources":["../../../../../../packages/vite-plugin-nitro/src/lib/utils/renderers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;IAoBvB,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;CAS7B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;IAyBzB,CAAC"}
+{"version":3,"file":"renderers.js","sourceRoot":"","sources":["../../../../../../packages/vite-plugin-nitro/src/lib/utils/renderers.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;IAoBvB,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;CAS7B,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyCzB,CAAC"}