@ilha/router 0.9.1 → 0.9.2

package/dist/ssr.d.ts

@@ -19,5 +19,14 @@
 export declare const FRAME_ENDPOINT = "/__ilha/frame";
 /** Regular-page server loads: served through the loader-runner slot. */
 export declare const LOADER_ENDPOINT = "/__ilha/loader";
+/** Max request body size — matches the dev middleware cap. */
+export declare const MAX_BODY: number;
+export declare function json(status: number, body: Record<string, unknown>): Response;
+/**
+ * Read a request body as UTF-8, streaming it with a hard byte cap. Returns
+ * `null` when the body exceeds `maxBytes` (the reader is cancelled before the
+ * cap is far exceeded) or when decoding fails.
+ */
+export declare function readBodyBounded(request: Request, maxBytes: number): Promise<string | null>;
 declare function ssr(request: Request): Promise<Response | undefined>;
 export default ssr;

package/dist/ssr.js

@@ -1,5 +1,5 @@
 import { t as runWithIslandRequest } from "./request-scope-C4reU4v0.js";
-import { FrameError, getFrameGuard, getFrameLoaderRunner, renderServerIsland } from "./server-island-registry.js";
+import { FrameError, getFrameAuth, getFrameGuard, getFrameLoaderRunner, getLoaderGuard, isTrustedOrigin, renderServerIsland } from "./server-island-registry.js";
 
 //#region src/ssr.ts
 /**
@@ -34,6 +34,31 @@ function json(status, body) {
 		}
 	});
 }
+/**
+* Read a request body as UTF-8, streaming it with a hard byte cap. Returns
+* `null` when the body exceeds `maxBytes` (the reader is cancelled before the
+* cap is far exceeded) or when decoding fails.
+*/
+async function readBodyBounded(request, maxBytes) {
+	const contentLength = request.headers.get("content-length");
+	if (contentLength !== null && Number(contentLength) > maxBytes) return null;
+	const reader = request.body?.getReader();
+	if (!reader) return "";
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value?.byteLength ?? 0;
+		if (size > maxBytes) {
+			await reader.cancel().catch(() => {});
+			return null;
+		}
+		chunks.push(value);
+	}
+	const decoder = new TextDecoder();
+	return chunks.map((c) => decoder.decode(c, { stream: true })).join("") + decoder.decode();
+}
 async function ssr(request) {
 	let pathname;
 	try {
@@ -42,13 +67,14 @@ async function ssr(request) {
 		return json(400, { error: "frame failed" });
 	}
 	if (pathname !== "/__ilha/frame" && pathname !== "/__ilha/loader") return;
-	const origin = request.headers.get("origin");
-	const host = request.headers.get("host");
-	if (origin && host && origin !== `http://${host}` && origin !== `https://${host}`) return json(403, { error: "frame failed" });
+	const auth = getFrameAuth();
+	if (!isTrustedOrigin(request, auth)) return json(403, { error: "frame failed" });
 	if (pathname === "/__ilha/loader") {
 		if (request.method !== "GET") return json(405, { error: "method not allowed" });
+		const guard = getLoaderGuard() ?? getFrameGuard();
+		if (!guard && (auth?.defaultAction ?? "deny") === "deny") return json(403, { error: "loader failed" });
 		try {
-			const denied = await getFrameGuard()?.(request);
+			const denied = await guard?.(request);
 			if (denied) return denied;
 		} catch {
 			return json(403, { error: "loader failed" });
@@ -60,7 +86,7 @@ async function ssr(request) {
 			message: "not found"
 		});
 		const cl = request.headers.get("content-length");
-		if (cl && Number(cl) > MAX_BODY) return json(413, { error: "frame failed" });
+		if (cl && Number(cl) > 16384) return json(413, { error: "frame failed" });
 		let target = "/";
 		try {
 			target = new URL(request.url).searchParams.get("path") ?? "/";
@@ -71,13 +97,13 @@ async function ssr(request) {
 				message: "bad request"
 			});
 		}
-		if (!target.startsWith("/") || target.includes("//") || target.length > 2048) return json(400, {
+		if (!target.startsWith("/") || target.includes("//") || target.includes("\\") || target.length > 2048) return json(400, {
 			kind: "error",
 			status: 400,
 			message: "bad request"
 		});
 		try {
-			const result = await runner(target);
+			const result = await runWithIslandRequest(request, () => runner(target, request));
 			if (result.kind === "redirect") return json(result.status || 302, {
 				kind: "redirect",
 				to: result.to,
@@ -103,36 +129,51 @@ async function ssr(request) {
 	}
 	if (request.method !== "POST") return json(405, { error: "frame failed" });
 	if (!(request.headers.get("content-type") ?? "").startsWith("application/json")) return json(415, { error: "frame failed" });
+	const guard = getFrameGuard();
+	if (!guard && (auth?.defaultAction ?? "deny") === "deny") return json(403, { error: "frame failed" });
 	try {
-		const denied = await getFrameGuard()?.(request);
+		const denied = await guard?.(request);
 		if (denied) return denied;
 	} catch (error) {
 		console.error("[ilha-router] frame guard failed:", error);
 		return json(403, { error: "frame failed" });
 	}
+	if (auth?.csrf) try {
+		if (!await auth.csrf(request)) return json(403, { error: "frame failed" });
+	} catch {
+		return json(403, { error: "frame failed" });
+	}
 	let id;
 	let path = "/";
 	try {
-		const text = await request.text();
-		if (text.length > MAX_BODY) return json(413, { error: "frame failed" });
+		const text = await readBodyBounded(request, MAX_BODY);
+		if (text === null) return json(413, { error: "frame failed" });
 		const body = JSON.parse(text);
 		id = String(body.id ?? "");
-		if (typeof body.path === "string" && body.path.startsWith("/") && !body.path.includes("//") && body.path.length <= 2048) path = body.path;
+		if (typeof body.path === "string") {
+			if (body.path.startsWith("/") && !body.path.includes("//") && !body.path.includes("\\") && body.path.length <= 2048) path = body.path;
+			else return json(400, { error: "frame failed" });
+		}
 	} catch {
 		return json(400, { error: "frame failed" });
 	}
 	try {
+		let origin;
+		try {
+			origin = new URL(request.url).origin;
+		} catch {
+			return json(400, { error: "frame failed" });
+		}
 		const headers = new Headers();
 		for (const name of [
 			"cookie",
 			"authorization",
-			"user-agent",
-			"x-forwarded-for"
+			"user-agent"
 		]) {
 			const value = request.headers.get(name);
 			if (value !== null) headers.set(name, value);
 		}
-		const scoped = new Request(new URL(path, `http://${host ?? "localhost"}`), {
+		const scoped = new Request(new URL(path, origin), {
 			method: "POST",
 			headers
 		});
@@ -157,4 +198,4 @@ async function ssr(request) {
 ssr.imports = ["ilha:pages/server", "ilha:loaders"];
 
 //#endregion
-export { FRAME_ENDPOINT, LOADER_ENDPOINT, ssr as default };
+export { FRAME_ENDPOINT, LOADER_ENDPOINT, MAX_BODY, ssr as default, json, readBodyBounded };

package/dist/vite.js

@@ -1,4 +1,4 @@
-import { t as ilhaPages } from "./plugin-DogkskcY.js";
+import { t as ilhaPages } from "./plugin-BHuojFhQ.js";
 
 //#region src/vite.ts
 /** Vite plugin — use via `@ilha/router/vite`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ilha/router",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "A tiny SPA router for Ilha",
   "keywords": [
     "frontend",
@@ -76,10 +76,10 @@
     "unplugin": "3.3.0"
   },
   "devDependencies": {
-    "ilha": "0.11.0",
+    "ilha": "0.11.1",
     "vite": "^8.2.2"
   },
   "peerDependencies": {
-    "ilha": ">=0.11.0"
+    "ilha": ">=0.11.1"
   }
 }