@cloudflare/pages-shared 0.8.0 → 0.8.2

package/asset-server/rulesEngine.ts

@@ -7,10 +7,11 @@ const escapeRegex = (str: string) => {
 	return str.replace(ESCAPE_REGEX_CHARACTERS, "\\$&");
 };
 
-// Placeholder names must begin with a colon, be alphanumeric and optionally contain underscores.
+// Placeholder names must begin with a colon then a letter, be alphanumeric and optionally contain underscores.
 // e.g. :place_123_holder
-const HOST_PLACEHOLDER_REGEX = /(?<=^https:\\\/\\\/[^/]*?):([^\\]+)(?=\\)/g;
-const PLACEHOLDER_REGEX = /:(\w+)/g;
+const HOST_PLACEHOLDER_REGEX =
+	/(?<=^https:\\\/\\\/[^/]*?):([A-Za-z]\w*)(?=\\)/g;
+const PLACEHOLDER_REGEX = /:([A-Za-z]\w*)/g;
 
 export type Replacements = Record<string, string>;
 
@@ -67,11 +68,22 @@ export const generateRulesMatcher = <T>(
 	][];
 
 	return ({ request }: { request: Request }) => {
-		const { pathname, host } = new URL(request.url);
+		const { pathname, hostname } = new URL(request.url);
 
 		return compiledRules
 			.map(([{ crossHost, regExp }, match]) => {
-				const test = crossHost ? `https://${host}${pathname}` : pathname;
+				// This, rather confusingly, means that although we enforce `https://` protocols in
+				// the rules of `_headers`/`_redirects`, we don't actually respect that at all at runtime.
+				// When processing a request against an absolute URL rule, we rewrite the protocol to `https://`.
+				// This has the benefit of ensuring attackers can't specify a different protocol
+				// to circumvent a developer's security rules (e.g. CORS), but it isn't obvious behavior.
+				// We should consider different syntax in the future for developers when they specify rules.
+				// For example, `*://example.com/path`, `://example.com/path` or `//example.com/`.
+				// Though we'd need to be careful with that last one
+				// as that would currently be read as a relative URL.
+				// Perhaps, if we ever move the `_headers`/`_redirects` files to acting ahead of Functions,
+				// this might be a good time for this change.
+				const test = crossHost ? `https://${hostname}${pathname}` : pathname;
 				const result = regExp.exec(test);
 				if (result) {
 					return replacerFn(match, result.groups || {});

package/metadata-generator/constants.ts

@@ -12,4 +12,4 @@ export const MAX_STATIC_REDIRECT_RULES = 2000;
 export const UNSET_OPERATOR = "! ";
 
 export const SPLAT_REGEX = /\*/g;
-export const PLACEHOLDER_REGEX = /:\w+/g;
+export const PLACEHOLDER_REGEX = /:[A-Za-z]\w*/g;

package/metadata-generator/parseHeaders.ts

@@ -58,7 +58,7 @@ export function parseHeaders(input: string): ParsedHeaders {
 				}
 			}
 
-			const [path, pathError] = validateUrl(line);
+			const [path, pathError] = validateUrl(line, false, true);
 			if (pathError) {
 				invalid.push({
 					line,

package/metadata-generator/parseRedirects.ts

@@ -50,7 +50,7 @@ export function parseRedirects(input: string): ParsedRedirects {
 
 		const [str_from, str_to, str_status = "302"] = tokens as RedirectLine;
 
-		const fromResult = validateUrl(str_from, true, false, false);
+		const fromResult = validateUrl(str_from, true, true, false, false);
 		if (fromResult[0] === undefined) {
 			invalid.push({
 				line,
@@ -88,7 +88,7 @@ export function parseRedirects(input: string): ParsedRedirects {
 			}
 		}
 
-		const toResult = validateUrl(str_to, false, true, true);
+		const toResult = validateUrl(str_to, false, false, true, true);
 		if (toResult[0] === undefined) {
 			invalid.push({
 				line,

package/metadata-generator/validateURL.ts

@@ -11,11 +11,13 @@ export const extractPathname = (
 };
 
 const URL_REGEX = /^https:\/\/+(?<host>[^/]+)\/?(?<path>.*)/;
+const HOST_WITH_PORT_REGEX = /.*:\d+$/;
 const PATH_REGEX = /^\//;
 
 export const validateUrl = (
 	token: string,
 	onlyRelative = false,
+	disallowPorts = false,
 	includeSearch = false,
 	includeHash = false
 ): [undefined, string] | [string, undefined] => {
@@ -27,6 +29,13 @@ export const validateUrl = (
 				`Only relative URLs are allowed. Skipping absolute URL ${token}.`,
 			];
 
+		if (disallowPorts && host.groups.host.match(HOST_WITH_PORT_REGEX)) {
+			return [
+				undefined,
+				`Specifying ports is not supported. Skipping absolute URL ${token}.`,
+			];
+		}
+
 		return [
 			`https://${host.groups.host}${extractPathname(
 				host.groups.path,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@cloudflare/pages-shared",
-	"version": "0.8.0",
+	"version": "0.8.2",
 	"repository": {
 		"type": "git",
 		"url": "https://github.com/cloudflare/workers-sdk.git",
@@ -18,7 +18,7 @@
 		"test:ci": "vitest run"
 	},
 	"dependencies": {
-		"miniflare": "3.20230724.0"
+		"miniflare": "3.20230814.1"
 	},
 	"devDependencies": {
 		"@cloudflare/workers-tsconfig": "*",