@bleedingdev/modern-js-render 3.8.3-ultramodern.1 → 3.8.3-ultramodern.3

package/dist/esm/0~server.mjs

@@ -1,6 +1,8 @@
+import { injectRSCPayload } from "@modern-js/runtime-extensions/rsc-html-stream";
 const encoder = new TextEncoder();
 const closingTagsPattern = /<\/body>\s*<\/html>\s*$/i;
-function injectRSCPayload(rscStream, { injectClosingTags = true }) {
+function server_injectRSCPayload(rscStream, { injectClosingTags = true }) {
+    if (injectClosingTags) return injectRSCPayload(rscStream);
     const decoder = new TextDecoder();
     let resolveFlightDataPromise;
     const flightDataPromise = new Promise((resolve)=>resolveFlightDataPromise = resolve);
@@ -107,4 +109,4 @@ function injectCSS(cssFiles, { injectClosingTags = true } = {}) {
         }
     });
 }
-export { injectCSS, injectRSCPayload };
+export { injectCSS, server_injectRSCPayload as injectRSCPayload };

package/dist/esm/rsc.mjs

@@ -1,7 +1,9 @@
+import { injectRSCPayload } from "@modern-js/runtime-extensions/rsc-html-stream";
 import { decodeReply as server_node_decodeReply, loadServerAction as server_node_loadServerAction, registerClientReference, registerServerReference, renderToReadableStream } from "react-server-dom-rspack/server.node";
 const server_encoder = new TextEncoder();
 const closingTagsPattern = /<\/body>\s*<\/html>\s*$/i;
-function injectRSCPayload(rscStream, { injectClosingTags = true }) {
+function server_injectRSCPayload(rscStream, { injectClosingTags = true }) {
+    if (injectClosingTags) return injectRSCPayload(rscStream);
     const decoder = new TextDecoder();
     let resolveFlightDataPromise;
     const flightDataPromise = new Promise((resolve)=>resolveFlightDataPromise = resolve);
@@ -123,7 +125,7 @@ const createRenderCSRWithRSC = (renderRsc)=>async (options)=>{
         });
         const stream = htmlStream.pipeThrough(injectCSS(cssFiles, {
             injectClosingTags: false
-        })).pipeThrough(injectRSCPayload(rscPayloadStream, {
+        })).pipeThrough(server_injectRSCPayload(rscPayloadStream, {
             injectClosingTags: true
         }));
         return new Response(stream, {
@@ -133,12 +135,49 @@ const createRenderCSRWithRSC = (renderRsc)=>async (options)=>{
             })
         });
     };
+const MAX_ACTION_BODY_BYTES = 1048576;
+const readBoundedBody = async (req)=>{
+    const reader = req.body?.getReader();
+    if (!reader) return new Uint8Array();
+    const bytes = new Uint8Array(MAX_ACTION_BODY_BYTES);
+    let size = 0;
+    try {
+        while(true){
+            const { done, value } = await reader.read();
+            if (done) return bytes.slice(0, size);
+            if (value.byteLength > MAX_ACTION_BODY_BYTES - size) {
+                reader.cancel().catch(()=>{});
+                return null;
+            }
+            bytes.set(value, size);
+            size += value.byteLength;
+        }
+    } finally{
+        reader.releaseLock();
+    }
+};
 const createHandleAction = ({ decodeReply, loadServerAction, renderRsc })=>async (req)=>{
+        if ('POST' !== req.method) return new Response('Method not allowed', {
+            status: 405,
+            headers: {
+                Allow: 'POST'
+            }
+        });
         try {
             const serverReference = req.headers.get('x-rsc-action');
             if (!serverReference) return new Response('Cannot find server reference', {
                 status: 404
             });
+            const declaredLength = req.headers.get('content-length');
+            if (null !== declaredLength) {
+                const parsedLength = Number(declaredLength);
+                if (!/^\d+$/.test(declaredLength) || !Number.isSafeInteger(parsedLength)) return new Response('Invalid server action request', {
+                    status: 400
+                });
+                if (parsedLength > MAX_ACTION_BODY_BYTES) return new Response('Server action payload too large', {
+                    status: 413
+                });
+            }
             const action = loadServerAction(serverReference);
             if ('function' != typeof action) {
                 console.error('[RSC] Invalid action: server reference is not a function, serverReference:', serverReference);
@@ -149,11 +188,21 @@ const createHandleAction = ({ decodeReply, loadServerAction, renderRsc })=>async
             const contentType = req.headers.get('content-type');
             let args;
             try {
+                const body = await readBoundedBody(req);
+                if (null === body) return new Response('Server action payload too large', {
+                    status: 413
+                });
                 if (contentType?.includes('multipart/form-data')) {
-                    const formData = await req.formData();
+                    const formData = await new Response(body, {
+                        headers: {
+                            'Content-Type': contentType
+                        }
+                    }).formData();
                     args = await decodeReply(formData);
                 } else {
-                    const text = await req.text();
+                    const text = new TextDecoder('utf-8', {
+                        fatal: true
+                    }).decode(body);
                     args = await decodeReply(text);
                 }
             } catch (error) {

package/dist/esm/rscWorker.mjs

@@ -1,7 +1,9 @@
 import { decodeReply as server_edge_decodeReply, loadServerAction as server_edge_loadServerAction, registerClientReference, registerServerReference, renderToReadableStream } from "react-server-dom-rspack/server.edge";
+import { injectRSCPayload } from "@modern-js/runtime-extensions/rsc-html-stream";
 const server_encoder = new TextEncoder();
 const closingTagsPattern = /<\/body>\s*<\/html>\s*$/i;
-function injectRSCPayload(rscStream, { injectClosingTags = true }) {
+function server_injectRSCPayload(rscStream, { injectClosingTags = true }) {
+    if (injectClosingTags) return injectRSCPayload(rscStream);
     const decoder = new TextDecoder();
     let resolveFlightDataPromise;
     const flightDataPromise = new Promise((resolve)=>resolveFlightDataPromise = resolve);
@@ -123,7 +125,7 @@ const createRenderCSRWithRSC = (renderRsc)=>async (options)=>{
         });
         const stream = htmlStream.pipeThrough(injectCSS(cssFiles, {
             injectClosingTags: false
-        })).pipeThrough(injectRSCPayload(rscPayloadStream, {
+        })).pipeThrough(server_injectRSCPayload(rscPayloadStream, {
             injectClosingTags: true
         }));
         return new Response(stream, {
@@ -133,12 +135,49 @@ const createRenderCSRWithRSC = (renderRsc)=>async (options)=>{
             })
         });
     };
+const MAX_ACTION_BODY_BYTES = 1048576;
+const readBoundedBody = async (req)=>{
+    const reader = req.body?.getReader();
+    if (!reader) return new Uint8Array();
+    const bytes = new Uint8Array(MAX_ACTION_BODY_BYTES);
+    let size = 0;
+    try {
+        while(true){
+            const { done, value } = await reader.read();
+            if (done) return bytes.slice(0, size);
+            if (value.byteLength > MAX_ACTION_BODY_BYTES - size) {
+                reader.cancel().catch(()=>{});
+                return null;
+            }
+            bytes.set(value, size);
+            size += value.byteLength;
+        }
+    } finally{
+        reader.releaseLock();
+    }
+};
 const createHandleAction = ({ decodeReply, loadServerAction, renderRsc })=>async (req)=>{
+        if ('POST' !== req.method) return new Response('Method not allowed', {
+            status: 405,
+            headers: {
+                Allow: 'POST'
+            }
+        });
         try {
             const serverReference = req.headers.get('x-rsc-action');
             if (!serverReference) return new Response('Cannot find server reference', {
                 status: 404
             });
+            const declaredLength = req.headers.get('content-length');
+            if (null !== declaredLength) {
+                const parsedLength = Number(declaredLength);
+                if (!/^\d+$/.test(declaredLength) || !Number.isSafeInteger(parsedLength)) return new Response('Invalid server action request', {
+                    status: 400
+                });
+                if (parsedLength > MAX_ACTION_BODY_BYTES) return new Response('Server action payload too large', {
+                    status: 413
+                });
+            }
             const action = loadServerAction(serverReference);
             if ('function' != typeof action) {
                 console.error('[RSC] Invalid action: server reference is not a function, serverReference:', serverReference);
@@ -149,11 +188,21 @@ const createHandleAction = ({ decodeReply, loadServerAction, renderRsc })=>async
             const contentType = req.headers.get('content-type');
             let args;
             try {
+                const body = await readBoundedBody(req);
+                if (null === body) return new Response('Server action payload too large', {
+                    status: 413
+                });
                 if (contentType?.includes('multipart/form-data')) {
-                    const formData = await req.formData();
+                    const formData = await new Response(body, {
+                        headers: {
+                            'Content-Type': contentType
+                        }
+                    }).formData();
                     args = await decodeReply(formData);
                 } else {
-                    const text = await req.text();
+                    const text = new TextDecoder('utf-8', {
+                        fatal: true
+                    }).decode(body);
                     args = await decodeReply(text);
                 }
             } catch (error) {

package/package.json

@@ -17,18 +17,19 @@
     "modern",
     "modern.js"
   ],
-  "version": "3.8.3-ultramodern.1",
+  "version": "3.8.3-ultramodern.3",
   "files": [
     "dist",
     "hook.d.ts"
   ],
   "dependencies": {
-    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.8.3-ultramodern.1",
-    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.8.3-ultramodern.1",
+    "@modern-js/runtime-extensions": "npm:@bleedingdev/modern-js-runtime-extensions@3.8.3-ultramodern.3",
+    "@modern-js/types": "npm:@bleedingdev/modern-js-types@3.8.3-ultramodern.3",
+    "@modern-js/utils": "npm:@bleedingdev/modern-js-utils@3.8.3-ultramodern.3",
     "@swc/helpers": "^0.5.23"
   },
   "devDependencies": {
-    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.8.3-ultramodern.1",
+    "@modern-js/server-core": "npm:@bleedingdev/modern-js-server-core@3.8.3-ultramodern.3",
     "@rslib/core": "0.23.2",
     "@scripts/build": "2.66.0",
     "@scripts/rstest-config": "2.66.0",
@@ -91,7 +92,7 @@
   },
   "scripts": {
     "dev": "rslib build --watch",
-    "build": "rslib build && pnpm -w tsgo:dts \"$PWD\"",
+    "build": "rslib build",
     "test": "tsgo --noEmit -p tsconfig.json && rstest --passWithNoTests"
   }
 }