@bakery-framework/core 2.4.2 → 2.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/core",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "Bakery framework core: handlers, router, config, session, caches, logger, compiler.",
   "keywords": [
     "bakery",

package/src/client/utils.ts

@@ -333,9 +333,13 @@ if (typeof document !== 'undefined') {
     // A `source: 'document'` rule with href_matches '/*' and eager eagerness
     // ignored the exclusions above and fully loaded (and ran the JS of) every
     // same-origin link, including things like /logout or a destructive GET.
+    //
+    // Prefetch waits for intent too. With no eagerness a list rule fetches at
+    // once, so a sidebar of 32 links asked for all 32 pages at every load (1.5 s
+    // and 6 MB on one app); moderate asked for none at load and one on a hover.
     const urlList = Array.from(urls)
     specScript.textContent = JSON.stringify({
-      prefetch: [{ source: 'list', urls: urlList }],
+      prefetch: [{ source: 'list', urls: urlList, eagerness: 'moderate' }],
       prerender: [{ source: 'list', urls: urlList, eagerness: 'moderate' }],
     })
 

package/src/handlers/assets/google-font.ts

@@ -42,12 +42,16 @@ const GF_MAX_GSTATIC_PATH = 256
  * A path under `fonts.gstatic.com`, as the rewritten CSS references it:
  * `s/roboto/v47/KFOmCnqEu92Fr1Mu4mxK.woff2`.
  *
- * Every segment must start with an alphanumeric, which is what rules out `..`
- * and an empty segment (`//`) without a second pass over the string, and the
- * extension list keeps this to font payloads.
+ * Every segment must start with something other than a dot, which is what
+ * rules out `..`, `.` and a dot-file, and must hold at least that one
+ * character, which rules out an empty segment (`//`), all without a second
+ * pass over the string. The first character may be `_` or `-` because file
+ * names are base64url: Figtree v9's are `_Xms-HUzqDCFdgfMm4q9DbZs.woff2` and
+ * `_Xms-HUzqDCFdgfMm4S9DQ.woff2`, and an alphanumeric-only start answered both
+ * with a 404. The extension list keeps this to font payloads.
  */
 const GF_GSTATIC_PATH =
-  /^[a-zA-Z0-9][a-zA-Z0-9._-]*(?:\/[a-zA-Z0-9][a-zA-Z0-9._-]*)*\.(?:woff2?|ttf|otf|eot|svg)$/
+  /^[a-zA-Z0-9_-][a-zA-Z0-9._-]*(?:\/[a-zA-Z0-9_-][a-zA-Z0-9._-]*)*\.(?:woff2?|ttf|otf|eot|svg)$/
 
 /**
  * How many distinct upstream assets this handler will keep on disk.
@@ -123,6 +127,39 @@ function canonicalQuery(search: string): string | null {
   return `?${pairs.sort().join('&')}`
 }
 
+/**
+ * A `&text=` subset's address, as the CSS endpoint writes it:
+ * `l/font?kit=neILzCirqoswsqX9_oC0MuFXPPo&skey=7ed805a363b4659c&v=v32`.
+ *
+ * It has no extension and names its font in the query alone, so it cannot pass
+ * `GF_GSTATIC_PATH`, and every such request answered 404. The three parameters
+ * are the only ones allowed through, in a canonical order, and a kit is free
+ * text in the way a family name is: `GF_MAX_ENTRIES` is what bounds them.
+ */
+const GF_SUBSET_PATH = 'l/font'
+const GF_SUBSET_PARAMS = new Set(['kit', 'skey', 'v'])
+const GF_SUBSET_VALUE = /^[a-zA-Z0-9_-]+$/
+
+/** The subset's query in canonical order, or `null` if it is not one. */
+function subsetQuery(search: string): string | null {
+  const raw = search.startsWith('?') ? search.slice(1) : search
+  if (!raw || raw.length > GF_MAX_GSTATIC_PATH) return null
+
+  const pairs = raw.split('&')
+  const names = new Set<string>()
+  for (const pair of pairs) {
+    const [name, value, extra] = pair.split('=')
+    if (!GF_SUBSET_PARAMS.has(name) || names.has(name)) return null
+    if (extra !== undefined || !value || !GF_SUBSET_VALUE.test(value)) {
+      return null
+    }
+    names.add(name)
+  }
+  if (!names.has('kit')) return null
+
+  return `?${pairs.sort().join('&')}`
+}
+
 export class GoogleFontHandler extends Handler {
   static get cacheDir() {
     return fs.resolve(Bakery.cacheDir, 'gf_cache')
@@ -134,7 +171,7 @@ export class GoogleFontHandler extends Handler {
 
   static async handle(path: string, req: Request) {
     if (path.startsWith('/_gf/gstatic/')) {
-      return this.handleGstatic(path)
+      return this.handleGstatic(path, new URL(req.url).search)
     }
 
     const rawPath = path.slice('/_gf'.length)
@@ -185,28 +222,35 @@ export class GoogleFontHandler extends Handler {
     return cached
   }
 
-  private static async handleGstatic(path: string) {
+  private static async handleGstatic(path: string, search: string) {
     const gstaticPath = path.slice('/_gf/gstatic/'.length)
+    const isSubset = gstaticPath === GF_SUBSET_PATH
+    const query = isSubset ? subsetQuery(search) : ''
 
     // Refused before `this.cacheDir` is read, so a rejection costs neither a
     // config lookup nor a path resolution.
     if (
+      query === null ||
       gstaticPath.length > GF_MAX_GSTATIC_PATH ||
-      !GF_GSTATIC_PATH.test(gstaticPath)
+      (!isSubset && !GF_GSTATIC_PATH.test(gstaticPath))
     ) {
       return response.error('Unknown Google Fonts asset', 404)
     }
 
     const cacheDir = fs.resolve(this.cacheDir, 'gstatic')
-    const cacheExt = `${fs.parse(gstaticPath).ext || '.bin'}`
-    const cacheName = `${toHash(gstaticPath)}${cacheExt}`
+    // The CSS endpoint asks as Chrome, so a subset is always a woff2. It has no
+    // extension of its own to read that from.
+    const cacheExt = isSubset
+      ? '.woff2'
+      : `${fs.parse(gstaticPath).ext || '.bin'}`
+    const cacheName = `${toHash(`${gstaticPath}${query}`)}${cacheExt}`
 
     const cached = await fs.getOrCreateCachedFile(
       cacheDir,
       cacheName,
       null,
       async () => {
-        const gfUrl = `https://fonts.gstatic.com/${gstaticPath}`
+        const gfUrl = `https://fonts.gstatic.com/${gstaticPath}${query}`
         const res = await fetch(gfUrl)
 
         if (!res.ok) return null

package/src/utils/fs.ts

@@ -781,7 +781,10 @@ export namespace FileSystem {
     if (content == null) return null
     await mkdir(cacheDir)
     await rawFile.write(content)
-    return built(rawFile)
+    // A new handle: `rawFile` read its size before the file existed, so serving
+    // it answered 200 with `content-length: 0` and no body. Measured on a cold
+    // font, which Chrome then reports as failed; the next request read the file.
+    return built(Bun.file(rawPath))
   }
 
   /**

package/src/utils/http/csrf.ts

@@ -7,6 +7,7 @@
  * arrive with the victim's session attached.
  */
 
+import { Bakery } from '../../core/bakery'
 import { Try } from '../isomorphic/try'
 
 const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
@@ -14,20 +15,47 @@ const SAFE_METHODS = new Set(['GET', 'HEAD', 'OPTIONS'])
 /** `Sec-Fetch-Site` values that mean the request did not come from another site. */
 const SAME_SITE_VALUES = new Set(['same-origin', 'same-site', 'none'])
 
+/**
+ * The origin a browser sees for this request.
+ *
+ * A proxy that ends TLS leaves the request looking like `http://app.example`
+ * while the browser reports `https://app.example`. Under `trustProxy` the
+ * proxy's forwarded scheme and host are believed, as `getHostname` and the
+ * session's `Secure` flag believe them. Without it the request's own URL
+ * decides, since any client could send those headers.
+ */
+export function requestOrigin(req: Request, url: URL): string {
+  if (!Bakery.config.trustProxy) return url.origin
+
+  const forwarded = (name: string) =>
+    req.headers.get(name)?.split(',')[0].trim()
+  const scheme = forwarded('x-forwarded-proto') || url.protocol.slice(0, -1)
+  const host = forwarded('x-forwarded-host') || url.host
+
+  return Try(() => new URL(`${scheme}://${host}`).origin) ?? url.origin
+}
+
 /**
  * Returns a reason string when the request looks cross-site, or `null` when it
  * is safe to process. Requests with neither `Origin` nor `Sec-Fetch-Site` (curl,
  * server-to-server, older clients) are allowed: browsers always send at least
  * one of them on a cross-origin request.
+ *
+ * A same-origin `Sec-Fetch-Site` settles it before `Origin` is read. A browser
+ * sets that header and page script cannot, and it is right behind a proxy that
+ * ends TLS, where `Origin` names a scheme this server never saw: measured, every
+ * browser write there answered 403, with `trustProxy` on or off. A client that
+ * forges the header could forge `Origin` as well, so nothing is lost.
  */
 export function checkSameOrigin(req: Request, url: URL): string | null {
   const fetchSite = req.headers.get('sec-fetch-site')
   if (fetchSite && !SAME_SITE_VALUES.has(fetchSite)) {
     return `cross-site request rejected (Sec-Fetch-Site: ${fetchSite})`
   }
+  if (fetchSite === 'same-origin' || fetchSite === 'none') return null
 
   const origin = req.headers.get('origin')
-  if (origin && origin !== 'null' && origin !== url.origin) {
+  if (origin && origin !== 'null' && origin !== requestOrigin(req, url)) {
     return `cross-origin request rejected (Origin: ${origin})`
   }
 

package/src/utils/http/sse.ts

@@ -13,6 +13,8 @@
  * write after the client has gone throws where nobody is catching.
  */
 
+import { Bakery } from '../../core/bakery'
+
 /** One event. Every field is optional except the payload. */
 export interface SSEMessage {
   /** Serialized with `JSON.stringify` unless it is already a string. */
@@ -105,6 +107,11 @@ export function sse(
   const encoder = new TextEncoder()
   const { keepAlive = 15_000, retry } = options
 
+  // A quiet stream is not a finished one, and `Bun.serve` closes a connection
+  // that stays quiet past its idle timeout. Lifted for this request only: the
+  // stream ends when the client leaves or `close()` runs.
+  Bakery.server?.timeout(req, 0)
+
   let controller: ReadableStreamDefaultController<Uint8Array> | null = null
   let closed = false
   let cleanup: (() => void) | void
@@ -123,16 +130,22 @@ export function sse(
     }
   }
 
-  function finish() {
-    if (closed) return
-    closed = true
-    if (keepAliveTimer) clearInterval(keepAliveTimer)
+  function runCleanup() {
+    const pending = cleanup
+    cleanup = undefined
     try {
-      cleanup?.()
+      pending?.()
     } catch {
       // A producer's cleanup that throws must not prevent the stream closing;
       // the connection is already going away either way.
     }
+  }
+
+  function finish() {
+    if (closed) return
+    closed = true
+    if (keepAliveTimer) clearInterval(keepAliveTimer)
+    runCleanup()
     try {
       controller?.close()
     } catch {
@@ -176,6 +189,9 @@ export function sse(
 
       try {
         cleanup = await producer(stream)
+        // The client can leave during that await. `finish` has then run, found
+        // no cleanup and will not run again, so this one would never be called.
+        if (closed) runCleanup()
       } catch {
         // A producer that throws ends the stream rather than leaving the client
         // hanging on a connection nobody will write to again.