@faststore/core 3.100.4 → 3.100.6

package/.turbo/turbo-build.log

@@ -1,23 +1,23 @@
 
-> @faststore/core@3.100.3 prebuild /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 prebuild /home/runner/work/faststore/faststore/packages/core
 > na run partytown && na run generate
 
 
-> @faststore/core@3.100.3 partytown /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 partytown /home/runner/work/faststore/faststore/packages/core
 > partytown copylib ./public/~partytown
 
 Partytown lib copied to: /home/runner/work/faststore/faststore/packages/core/public/~partytown
 
-> @faststore/core@3.100.3 generate /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 generate /home/runner/work/faststore/faststore/packages/core
 > na run generate:schema && na run generate:codegen && na run format:generated
 
 
-> @faststore/core@3.100.3 generate:schema /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 generate:schema /home/runner/work/faststore/faststore/packages/core
 > tsx src/server/generator/generateGraphQLSchemaFile.ts
 
 Schema GraphQL file generated successfully
 
-> @faststore/core@3.100.3 generate:codegen /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 generate:codegen /home/runner/work/faststore/faststore/packages/core
 > graphql-codegen
 
 [STARTED] Parse Configuration
@@ -37,11 +37,11 @@ Running lifecycle hook "afterStart" scripts...
 [CLI] Loading Documents
 [CLI] Generating output
 
-> @faststore/core@3.100.3 format:generated /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 format:generated /home/runner/work/faststore/faststore/packages/core
 > prettier --write "@generated/**/*.{ts,js,tsx,jsx,json}" --loglevel error
 
 
-> @faststore/core@3.100.3 build /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 build /home/runner/work/faststore/faststore/packages/core
 > next build
 
 ⚠ No build cache found. Please configure build caching for faster rebuilds. Read more: https://nextjs.org/docs/messages/no-cache
@@ -58,7 +58,7 @@ Browserslist: caniuse-lite is outdated. Please run:
    Creating an optimized production build ...
    Disabled SWC as replacement for Babel because of custom Babel configuration ".babelrc.js" https://nextjs.org/docs/messages/swc-disabled
    Using external babel configuration from /home/runner/work/faststore/faststore/packages/core/.babelrc.js
-Browserslist: browsers data (caniuse-lite) is 19 months old. Please run:
+Browserslist: browsers data (caniuse-lite) is 21 months old. Please run:
   npx update-browserslist-db@latest
   Why you should do it regularly: https://github.com/browserslist/update-db#readme
 <w> [webpack.cache.PackFileCacheStrategy] Skipped not serializable cache item 'Compilation/modules|/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/css-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[1]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/postcss-loader/src/index.js??ruleSet[1].rules[7].oneOf[9].use[2]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/build/webpack/loaders/resolve-url-loader/index.js??ruleSet[1].rules[7].oneOf[9].use[3]!/home/runner/work/faststore/faststore/node_modules/.pnpm/next@13.5.11_@babel+core@7.26.7_@opentelemetry+api@1.4.1_react-dom@18.3.1_react@18.3.1__react@18.3.1_sass@1.83.4/node_modules/next/dist/compiled/sass-loader/cjs.js??ruleSet[1].rules[7].oneOf[9].use[4]!/home/runner/work/faststore/faststore/packages/core/src/components/common/Toast/section.module.scss': No serializer registered for Warning
@@ -83,7 +83,7 @@ Learn more: https://nextjs.org/docs/api-reference/edge-runtime
 
 Import trace for requested module:
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
-../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
 ./src/server/password-protection-service.ts
 
@@ -93,7 +93,7 @@ Learn more: https://nextjs.org/docs/api-reference/edge-runtime
 
 Import trace for requested module:
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/lib/deflate.js
-../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js
+../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js
 ../../node_modules/.pnpm/jose@6.2.3/node_modules/jose/dist/webapi/index.js
 ./src/server/password-protection-service.ts
 
@@ -101,8 +101,8 @@ Import trace for requested module:
    Generating static pages (0/8) ...
 
   Generating static pages (2/8) 
 Search not found. Add a new component for this section or remove it from the CMS
-Search not found. Add a new component for this section or remove it from the CMS
 Warning: Dynamic Content not found for the page: home. Refer to the Dynamic Content documentation at https://developers.vtex.com/docs/guides/faststore/dynamic-content-overview for mapping the page and the corresponding data-fetching function.
+Search not found. Add a new component for this section or remove it from the CMS
 
   Generating static pages (4/8) 
 Search not found. Add a new component for this section or remove it from the CMS
 Search not found. Add a new component for this section or remove it from the CMS

package/.turbo/turbo-test.log

@@ -1,21 +1,22 @@
 
-> @faststore/core@3.100.3 test /home/runner/work/faststore/faststore/packages/core
+> @faststore/core@3.100.4 test /home/runner/work/faststore/faststore/packages/core
 > jest
 
-PASS test/utils/clearCookies.test.ts (11.489 s)
-PASS test/utils/cookieCacheBusting.test.ts (13.647 s)
+PASS test/utils/clearCookies.test.ts (13.987 s)
+PASS test/server/password-protection-service.test.ts (18.623 s)
+PASS test/utils/cookieCacheBusting.test.ts (16.597 s)
 PASS test/utils/multipleTemplates.test.ts
-PASS test/server/password-protection-service.test.ts (16.602 s)
 PASS test/sdk/redirects/index.test.ts
+PASS test/utils/trustedForwardedHost.test.ts
 PASS test/utils/validateSessionRefreshToken.test.ts
 PASS test/server/cms/global.test.ts
 PASS test/utils/isLocalHost.test.ts
 PASS test/utils/isLocalHost.browser.test.ts
-PASS test/server/cms/index.test.ts (5.293 s)
-PASS test/server/index.test.ts (10.491 s)
+PASS test/server/cms/index.test.ts (5.82 s)
+PASS test/server/index.test.ts (10.891 s)
 
-Test Suites: 11 passed, 11 total
-Tests:       92 passed, 92 total
+Test Suites: 12 passed, 12 total
+Tests:       119 passed, 119 total
 Snapshots:   0 total
-Time:        27.151 s
+Time:        30.388 s
 Ran all test suites.

package/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.100.6](https://github.com/vtex/faststore/compare/v3.100.5...v3.100.6) (2026-10-07)
+
+### Bug Fixes
+
+- address security & functional concerns from dk review (3.x backport) ([c928a1f](https://github.com/vtex/faststore/commit/c928a1fc04bc3554d83302c4cf760adab0f7e81c))
+- **core:** harden x-forwarded-host handling and drop orderNumber fallback ([55990c1](https://github.com/vtex/faststore/commit/55990c1c6208c06ae482e71816df2035292bf2e9)), closes [#3178](https://github.com/vtex/faststore/issues/3178)
+- **core:** ignore multi-value x-forwarded-host and cover port and case ([81ba26b](https://github.com/vtex/faststore/commit/81ba26b93175878b9cc3e32683f9c13b0abf25e9))
+- **core:** log ignored x-forwarded-host and cover CR/LF hostnames ([e6a326f](https://github.com/vtex/faststore/commit/e6a326f6d0d4a91c75b9f0a10abfdc7c22c897be))
+- **core:** make preview cookies host-only instead of rewriting their domain ([989fc69](https://github.com/vtex/faststore/commit/989fc69c573c980e354d11e3c3d8a719e2833fb2))
+- **core:** reject hostnames that would inject Set-Cookie attributes ([109d819](https://github.com/vtex/faststore/commit/109d81917e1200dd78b9500f4cb81d128c78003d))
+- resolve ValidateCartMutation infinite loop in preview environments (SFS-3034) ([ad7800d](https://github.com/vtex/faststore/commit/ad7800d65493c7477c9fb30119f76925647c40fc)), closes [#3178](https://github.com/vtex/faststore/issues/3178) [#3178](https://github.com/vtex/faststore/issues/3178) [#3190](https://github.com/vtex/faststore/issues/3190) [#3188](https://github.com/vtex/faststore/issues/3188) [#1467584](https://github.com/vtex/faststore/issues/1467584)
+
 ## [3.100.4](https://github.com/vtex/faststore/compare/v3.100.3...v3.100.4) (2026-08-28)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faststore/core",
-  "version": "3.100.4",
+  "version": "3.100.6",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -127,5 +127,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.3.2"
   },
-  "gitHead": "b30af2d573626311c245c445860a45cb26478798"
+  "gitHead": "31df58321c484732bd4a69618e9eb09e6a2c0261"
 }

package/src/pages/api/graphql.ts

@@ -10,6 +10,11 @@ import type { NextApiHandler, NextApiRequest } from 'next'
 import discoveryConfig from 'discovery.config'
 import { getJWTAutCookie } from 'src/utils/getCookie'
 import { isLocalHost } from 'src/utils/isLocalHost'
+import {
+  isHostAllowed,
+  removeCookieDomain,
+  singleForwardedHost,
+} from 'src/utils/trustedForwardedHost'
 import { shouldForceRefreshTokenForValidateSession } from 'src/utils/validateSessionRefreshToken'
 import { execute } from '../../server'
 
@@ -20,24 +25,45 @@ const ALLOWED_HOST_SUFFIXES = ['localhost', '.vtex.app', '.localhost']
 // Example: "Set-Cookie: key=value; Domain=example.com; Path=/"
 const MATCH_DOMAIN_REGEXP = /(?:^|;\s*)(?:domain=)([^;]+)/i
 
+const toHostname = (hostHeader: string | undefined) => {
+  const trimmed = hostHeader?.trim()
+  if (!trimmed) {
+    return null
+  }
+
+  try {
+    return new URL(`https://${trimmed}`).hostname
+  } catch {
+    return null
+  }
+}
+
 /**
- * Extracts hostname from the incoming request.
+ * Extracts hostname from the incoming request. The preview ingress forwards a
+ * client-supplied x-forwarded-host as is, so it only decides whether the cookie
+ * Domain is dropped, never which domain is used. A multi-value header is
+ * ignored; a single value is used only if it is on the allowlist.
  */
 const getRequestHostname = ({
   request,
 }: {
   request: NextApiRequest
 }): string | null => {
-  const hostHeader = request.headers.host?.trim()
-  if (!hostHeader) {
-    return null
+  const forwardedHeader = request.headers['x-forwarded-host']
+  const forwardedHostname = toHostname(singleForwardedHost(forwardedHeader))
+  if (forwardedHeader && !forwardedHostname) {
+    // The value is client-controllable, so it is not logged.
+    console.warn('Ignoring multi-value or malformed x-forwarded-host')
   }
 
-  try {
-    return new URL(`https://${hostHeader}`).hostname
-  } catch {
-    return null
+  if (
+    forwardedHostname &&
+    isHostAllowed(forwardedHostname, ALLOWED_HOST_SUFFIXES)
+  ) {
+    return forwardedHostname
   }
+
+  return toHostname(request.headers.host)
 }
 
 /**
@@ -57,22 +83,10 @@ const shouldReplaceCookieDomain = ({
 }
 
 /**
- * Determines if host is eligible for domain normalization.
- */
-const isAllowedHost = ({
-  host,
-  allowList,
-}: {
-  host: string
-  allowList: string[]
-}) => {
-  const normalizedHost = host.toLowerCase()
-
-  return allowList.some((suffix) => normalizedHost.endsWith(suffix))
-}
-
-/**
- * Ensure the cookie domain matches the current host so the browser can store it.
+ * On allowlisted hosts (previews, localhost) the upstream cookie domain does not
+ * match the browser host, so the Domain attribute is dropped and the cookie
+ * becomes host-only. The host is never written into the cookie, so a forged
+ * x-forwarded-host cannot choose the cookie scope.
  */
 const normalizeSetCookieDomain = ({
   request,
@@ -93,13 +107,13 @@ const normalizeSetCookieDomain = ({
   const cookieDomain = domainMatch[1]
 
   if (
-    !isAllowedHost({ host, allowList: ALLOWED_HOST_SUFFIXES }) ||
+    !isHostAllowed(host, ALLOWED_HOST_SUFFIXES) ||
     !shouldReplaceCookieDomain({ cookieDomain, host })
   ) {
     return setCookie
   }
 
-  return setCookie.replace(MATCH_DOMAIN_REGEXP, `; domain=${host}`)
+  return removeCookieDomain(setCookie)
 }
 
 const parseRequest = (request: NextApiRequest) => {

package/src/utils/trustedForwardedHost.ts

@@ -0,0 +1,50 @@
+// The result is written verbatim into a Set-Cookie Domain attribute, so
+// characters such as ";" or spaces would inject cookie attributes.
+const HOSTNAME_PATTERN = /^[a-z0-9.-]+$/
+
+/**
+ * An entry starting with "." matches subdomains only; any other entry matches
+ * the host itself and its subdomains. Matching is anchored on a label boundary,
+ * so "evil-localhost" never matches "localhost".
+ */
+export function isHostAllowed(host: string, allowList: string[]) {
+  const normalizedHost = host.toLowerCase()
+
+  if (!HOSTNAME_PATTERN.test(normalizedHost)) {
+    return false
+  }
+
+  return allowList.some((entry) =>
+    entry.startsWith('.')
+      ? normalizedHost.endsWith(entry)
+      : normalizedHost === entry || normalizedHost.endsWith(`.${entry}`)
+  )
+}
+
+/**
+ * Returns the `x-forwarded-host` value only when exactly one is present.
+ *
+ * Which hop of a proxy chain is trustworthy is not known here: with several
+ * values the leftmost one is whatever the client sent. So a multi-value header
+ * (comma-joined by Node, or an array) is ignored and the caller falls back to
+ * `host`. A single value still assumes the ingress overwrites the header.
+ */
+export function singleForwardedHost(
+  header: string | string[] | undefined
+): string | undefined {
+  if (Array.isArray(header)) {
+    return header.length === 1 ? singleForwardedHost(header[0]) : undefined
+  }
+
+  const value = header?.trim()
+
+  return value && !value.includes(',') ? value : undefined
+}
+
+/**
+ * Drops every Domain attribute so the cookie becomes host-only: the browser
+ * scopes it to the exact host it requested, whatever header picked this path.
+ */
+export function removeCookieDomain(setCookie: string): string {
+  return setCookie.replaceAll(/;\s*domain=[^;]*/gi, '')
+}

package/test/utils/trustedForwardedHost.test.ts

@@ -0,0 +1,103 @@
+import {
+  singleForwardedHost,
+  isHostAllowed,
+  removeCookieDomain,
+} from '../../src/utils/trustedForwardedHost'
+
+const ALLOW_LIST = ['localhost', '.vtex.app', '.localhost']
+
+describe('isHostAllowed', () => {
+  it.each([
+    'localhost',
+    'store.vtex.app',
+    'sfj-1--acc.preview.vtex.app',
+    'a.localhost',
+  ])('allows %s', (host: string) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'evil-localhost',
+    'notlocalhost',
+    'evil-vtex.app',
+    'vtex.app.evil.com',
+    'evil.com',
+  ])('rejects %s', (host: string) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('isHostAllowed normalization', () => {
+  it('is case-insensitive', () => {
+    expect(isHostAllowed('Store.VTEX.app', ALLOW_LIST)).toBe(true)
+    expect(isHostAllowed('LOCALHOST', ALLOW_LIST)).toBe(true)
+  })
+
+  it.each([
+    'x;max-age=0;y.vtex.app',
+    'a b.vtex.app',
+    'x"y.vtex.app',
+    'x=y.vtex.app',
+    'x,y.vtex.app',
+    'x\r\nSet-Cookie: evil=1.vtex.app',
+    'x\ny.vtex.app',
+    'x\ry.vtex.app',
+  ])('rejects %s, which would inject cookie attributes', (host: string) => {
+    expect(isHostAllowed(host, ALLOW_LIST)).toBe(false)
+  })
+
+  it('accepts punycode hostnames', () => {
+    expect(isHostAllowed('xn--lja-bma.vtex.app', ALLOW_LIST)).toBe(true)
+  })
+
+  it('expects a hostname: a port is not stripped here', () => {
+    expect(isHostAllowed('store.vtex.app:8080', ALLOW_LIST)).toBe(false)
+    expect(isHostAllowed('evil.com:vtex.app', ALLOW_LIST)).toBe(false)
+  })
+})
+
+describe('singleForwardedHost', () => {
+  it('returns the value when there is exactly one', () => {
+    expect(singleForwardedHost('a.vtex.app')).toBe('a.vtex.app')
+    expect(singleForwardedHost(' a.vtex.app ')).toBe('a.vtex.app')
+    expect(singleForwardedHost(['a.vtex.app'])).toBe('a.vtex.app')
+  })
+
+  it('returns undefined when missing or empty', () => {
+    expect(singleForwardedHost(undefined)).toBeUndefined()
+    expect(singleForwardedHost('')).toBeUndefined()
+    expect(singleForwardedHost([])).toBeUndefined()
+  })
+
+  it('ignores multi-value headers instead of picking one', () => {
+    expect(singleForwardedHost('a.vtex.app, evil.com')).toBeUndefined()
+    expect(singleForwardedHost('evil.com, a.vtex.app')).toBeUndefined()
+    expect(singleForwardedHost(['a.vtex.app', 'evil.com'])).toBeUndefined()
+  })
+})
+
+describe('removeCookieDomain', () => {
+  it('drops the Domain attribute and keeps the rest', () => {
+    expect(
+      removeCookieDomain(
+        'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; domain=acc.vtexcommercestable.com.br; path=/; secure; samesite=lax; httponly'
+      )
+    ).toBe(
+      'checkout.vtex.com=__ofid=abc; expires=Sun, 04 Apr 2027 18:31:26 GMT; path=/; secure; samesite=lax; httponly'
+    )
+  })
+
+  it('is case-insensitive and removes repeated Domain attributes', () => {
+    expect(removeCookieDomain('a=1; Domain=x.com; DOMAIN=y.com; Path=/')).toBe(
+      'a=1; Path=/'
+    )
+  })
+
+  it('does not touch a cookie whose name is domain', () => {
+    expect(removeCookieDomain('domain=1; path=/')).toBe('domain=1; path=/')
+  })
+
+  it('keeps cookies without a Domain attribute unchanged', () => {
+    expect(removeCookieDomain('a=1; path=/')).toBe('a=1; path=/')
+  })
+})