@decocms/blocks 7.41.0 → 7.42.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.41.0",
+  "version": "7.42.0",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/cms/renderJson.test.ts

@@ -68,6 +68,33 @@ describe("serializeRenderJson", () => {
     expect(out).toEqual([{ component: "a", props: {} }]);
   });
 
+  it("strips framework-injected keys (__page*, device, isMobile) from props", () => {
+    const out = serializeRenderJson(
+      [
+        {
+          component: "a",
+          props: {
+            title: "keep",
+            __pageUrl: "https://x/y",
+            __pagePath: "/y",
+            device: "mobile",
+            isMobile: true,
+            currentSearchParam: "q",
+          },
+        },
+      ],
+      // no projection → pass-through, but injected keys must still be stripped
+    );
+    expect(out).toEqual([{ component: "a", props: { title: "keep" } }]);
+  });
+
+  it("strips injected keys even when a projection rest-spreads them through", () => {
+    const out = serializeRenderJson([{ component: "a", props: { keep: 1, __pageUrl: "u", device: "d" } }], {
+      getSectionModule: () => ({ renderJson: (p: Record<string, unknown>) => p }), // identity passes __ through
+    });
+    expect(out).toEqual([{ component: "a", props: { keep: 1 } }]);
+  });
+
   it("interleaves deferred sections as { component, lazyUrl } by index", () => {
     const out = serializeRenderJson(
       [

package/src/cms/renderJson.ts

@@ -85,6 +85,28 @@ export interface SerializeOptions {
  * `renderJson === false` (for a deferred section, dropping avoids emitting a
  * lazyUrl the app would fetch for nothing).
  */
+/**
+ * Keys the section loader / mixins inject into props at request time — page
+ * context (`__pageUrl`/`__pagePath`, `runSectionLoaders`) and device
+ * (`device`/`isMobile`/`currentSearchParam`, the withDevice/withMobile/
+ * withSearchParam mixins). They are request-derived framework internals, NOT
+ * content, so they are stripped from the JSON: they would bust the ETag per
+ * request/device and leak internals the mobile app shouldn't cache. Any
+ * `__`-prefixed key is treated as internal by convention (mirrors `__section`).
+ */
+const FRAMEWORK_INJECTED_KEYS = new Set(["device", "isMobile", "currentSearchParam"]);
+
+function stripFrameworkKeys(props: Record<string, unknown>): Record<string, unknown> {
+  let out: Record<string, unknown> | null = null;
+  for (const k of Object.keys(props)) {
+    if (k.startsWith("__") || FRAMEWORK_INJECTED_KEYS.has(k)) {
+      out ??= { ...props };
+      delete out[k];
+    }
+  }
+  return out ?? props;
+}
+
 export function serializeRenderJson(
   sections: SerializableSection[],
   opts: SerializeOptions = {},
@@ -104,7 +126,8 @@ export function serializeRenderJson(
     .filter((s) => !isDropped(s.component))
     .map((section) => {
       const rj = renderJsonOf(section.component);
-      const props = typeof rj === "function" ? rj(section.props ?? {}) : section.props ?? {};
+      const projected = typeof rj === "function" ? rj(section.props ?? {}) : section.props ?? {};
+      const props = stripFrameworkKeys(projected);
       return { index: section.index, out: { component: section.component, props } as SerializedSection };
     });