@lovrozagar/flare 0.1.1 → 0.2.0

package/src/middleware/builtins/cdn-proxy.ts

@@ -18,6 +18,23 @@ interface CdnProxyConfig<TEnv = unknown> {
 	pathPrefix: string;
 }
 
+const NOSNIFF = { "X-Content-Type-Options": "nosniff" } as const;
+
+function isNavigableExecutable(contentType: string): boolean {
+	const mime = contentType.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+	return (
+		mime === "application/xhtml+xml" ||
+		mime === "application/xml" ||
+		mime === "image/svg+xml" ||
+		mime === "text/html" ||
+		mime === "text/xml"
+	);
+}
+
+function bypassText(ctx: MiddlewareContext, body: string, status: number) {
+	return ctx.bypass(new Response(body, { headers: NOSNIFF, status }));
+}
+
 export function cdnProxy<TEnv = unknown>(config: CdnProxyConfig<TEnv>): FlareMiddleware<TEnv> {
 	const defaultCacheControl = config.cacheControl ?? "public, max-age=31536000, immutable";
 
@@ -30,27 +47,31 @@ export function cdnProxy<TEnv = unknown>(config: CdnProxyConfig<TEnv>): FlareMid
 		try {
 			key = decodeURIComponent(rawKey);
 		} catch {
-			return ctx.bypass(new Response("Bad Request", { status: 400 }));
+			return bypassText(ctx, "Bad Request", 400);
 		}
 		/* Reject path traversal, null bytes, backslashes, and CRLF */
 		if (key.includes("..") || key.includes("\0") || key.includes("\\") || key.includes("\r") || key.includes("\n")) {
-			return ctx.bypass(new Response("Bad Request", { status: 400 }));
+			return bypassText(ctx, "Bad Request", 400);
 		}
 		const bucket = config.bucket({ env: ctx.env });
 		const object = await bucket.get(key);
 
 		if (!object) {
-			return ctx.bypass(new Response("Not Found", { status: 404 }));
+			return bypassText(ctx, "Not Found", 404);
 		}
 
 		const headers: Record<string, string> = {
 			"Cache-Control": defaultCacheControl,
 			"Content-Length": String(object.size),
 			ETag: object.etag,
+			"X-Content-Type-Options": "nosniff",
 		};
 
 		if (object.httpMetadata?.contentType) {
 			headers["Content-Type"] = object.httpMetadata.contentType;
+			if (isNavigableExecutable(object.httpMetadata.contentType)) {
+				headers["Content-Disposition"] = "attachment";
+			}
 		}
 
 		return ctx.bypass(new Response(object.body, { headers }));

package/src/middleware/builtins/i18n.ts

@@ -2,6 +2,8 @@ import { match as cldrMatch } from "@formatjs/intl-localematcher";
 import { isbot } from "isbot";
 import Negotiator from "negotiator";
 import type { FlareMiddleware } from "..";
+import { formatLocaleCookie } from "../../locale/cookie.ts";
+import { HEADER_DATA, HEADER_FLAG, HEADER_PRERENDER, HEADER_PREFETCH, INTERNAL_PATH_PREFIX } from "../../protocol.ts";
 import { matchRoute, toLocaleMatch } from "../../router-primitives/tree.ts";
 
 /**
@@ -68,6 +70,13 @@ function getLocaleFromAcceptLanguage(request: Request, locales: readonly string[
 	return defaultLocale;
 }
 
+/** Path-only Location so the document applies Set-Cookie on 3xx (SW fetch() with follow does not). */
+function locationForPath(url: URL, pathname: string): string {
+	const next = new URL(url);
+	next.pathname = pathname;
+	return `${next.pathname}${next.search}${next.hash}`;
+}
+
 function buildCookieHeader(
 	locale: string,
 	cookieName: string,
@@ -75,12 +84,7 @@ function buildCookieHeader(
 	isHttps: boolean,
 	secure?: boolean,
 ): string {
-	/* Defense-in-depth: strip chars that could enable header/cookie injection.
-	 * Primary gate is localeSet.has() before any call site, but this guards
-	 * against future code paths that might bypass that check. */
-	const safe = locale.replace(/[\r\n;\0]/g, "");
-	const secureFlag = (secure ?? isHttps) ? "; Secure" : "";
-	return `${cookieName}=${safe}; Path=/; Max-Age=${maxAge}; SameSite=Lax${secureFlag}`;
+	return formatLocaleCookie(locale, cookieName, { https: isHttps, maxAge, secure });
 }
 
 export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
@@ -102,14 +106,14 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 			cachedCookieName = options?.cookieName ?? ctx.locale.cookieName ?? "flare.locale";
 			cachedMaxAge = options?.cookie?.maxAge ?? 31536000;
 			const skip = options?.skip ?? ctx.locale.skip ?? [];
-			cachedSkipPaths = ["/_fn/", ...skip];
+			cachedSkipPaths = [INTERNAL_PATH_PREFIX, ...skip];
 		}
 
 		const { pathname } = ctx.url;
 		const isHttps = ctx.url.protocol === "https:";
 
 		/* Prerender snapshots the exact expanded URL — do not locale-redirect. */
-		if (ctx.request.headers.get("x-flare-prerender") === "1") {
+		if (ctx.request.headers.get(HEADER_PRERENDER) === HEADER_FLAG) {
 			const prerenderLocale = getLocaleFromPath(pathname, cachedLocaleSet);
 			ctx.serverContext.locale = prerenderLocale ?? defaultLocale;
 			return ctx.next();
@@ -146,9 +150,9 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		if (firstSegment && LOCALE_LIKE_RE.test(firstSegment)) {
 			const lowerSegment = firstSegment.toLowerCase();
 			if (firstSegment !== lowerSegment) {
-				const newUrl = new URL(ctx.url);
-				newUrl.pathname = pathname.replace(firstSegment, lowerSegment);
-				const headers = new Headers({ Location: newUrl.href });
+				const headers = new Headers({
+					Location: locationForPath(ctx.url, pathname.replace(firstSegment, lowerSegment)),
+				});
 				if (cachedLocaleSet.has(lowerSegment)) {
 					headers.set(
 						"Set-Cookie",
@@ -165,9 +169,9 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 
 		/* Invalid/unsupported locale-like segment in path → strip it */
 		if (hasInvalidLocale) {
-			const newUrl = new URL(ctx.url);
-			newUrl.pathname = pathname.replace(`/${firstSegment}`, "") || "/";
-			const headers = new Headers({ Location: newUrl.href });
+			const headers = new Headers({
+				Location: locationForPath(ctx.url, pathname.replace(`/${firstSegment}`, "") || "/"),
+			});
 			headers.set(
 				"Set-Cookie",
 				buildCookieHeader(defaultLocale, cachedCookieName, cachedMaxAge, isHttps, options?.cookie?.secure),
@@ -182,9 +186,7 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 			const canStrip =
 				!ctx.routeTree || matchRoute(ctx.routeTree, strippedPath, false, toLocaleMatch(ctx.locale)) !== null;
 			if (canStrip) {
-				const newUrl = new URL(ctx.url);
-				newUrl.pathname = strippedPath;
-				const headers = new Headers({ Location: newUrl.href });
+				const headers = new Headers({ Location: locationForPath(ctx.url, strippedPath) });
 				headers.set(
 					"Set-Cookie",
 					buildCookieHeader(defaultLocale, cachedCookieName, cachedMaxAge, isHttps, options?.cookie?.secure),
@@ -200,9 +202,7 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		if (!pathLocale && pathname === "/" && !cookieLocale) {
 			const acceptLocale = getLocaleFromAcceptLanguage(ctx.request, locales, defaultLocale);
 			if (acceptLocale !== defaultLocale) {
-				const newUrl = new URL(ctx.url);
-				newUrl.pathname = `/${acceptLocale}`;
-				const headers = new Headers({ Location: newUrl.href });
+				const headers = new Headers({ Location: locationForPath(ctx.url, `/${acceptLocale}`) });
 				headers.set(
 					"Set-Cookie",
 					buildCookieHeader(acceptLocale, cachedCookieName, cachedMaxAge, isHttps, options?.cookie?.secure),
@@ -216,13 +216,11 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		 * Only for full page loads (not NDJSON/prefetch — SPA router handles those).
 		 * e.g. /about with cookie=fr → 302 → /fr/about
 		 */
-		const isDataRequest = ctx.request.headers.get("x-d") === "1";
+		const isDataRequest = ctx.request.headers.get(HEADER_DATA) === HEADER_FLAG;
 		if (!pathLocale && cookieLocale && cookieLocale !== defaultLocale && !isDataRequest) {
-			const newUrl = new URL(ctx.url);
-			newUrl.pathname = `/${cookieLocale}${pathname}`;
 			return ctx.bypass(
 				new Response(null, {
-					headers: new Headers({ Location: newUrl.href }),
+					headers: new Headers({ Location: locationForPath(ctx.url, `/${cookieLocale}${pathname}`) }),
 					status: 302,
 				}),
 			);
@@ -235,7 +233,7 @@ export function i18n(options?: I18nMiddlewareOptions): FlareMiddleware {
 		/* Prefetch requests must not set cookies — SPA prefetches multiple
 		 * locale URLs after hydration, and the last one to complete would
 		 * overwrite the correct cookie from the actual page load. */
-		const isPrefetch = ctx.request.headers.get("x-p") === "1";
+		const isPrefetch = ctx.request.headers.get(HEADER_PREFETCH) === HEADER_FLAG;
 		const needsCookie = !isPrefetch && currentLocale !== cookieLocale;
 		if (needsCookie) {
 			const setCookieHeader = buildCookieHeader(

package/src/middleware/builtins/keepalive.ts

@@ -1,15 +1,14 @@
 import { error } from "../../logger.ts";
+import { KEEPALIVE_PATH } from "../../protocol.ts";
 import type { FlareMiddleware, MiddlewareContext } from "..";
 
-const PING_PATH = "/_flare/keepalive";
-
 interface KeepaliveConfig<TEnv = unknown> {
 	handler?: (ctx: MiddlewareContext<TEnv>) => Promise<void> | void;
 }
 
 export function keepalive<TEnv = unknown>(config?: KeepaliveConfig<TEnv>): FlareMiddleware<TEnv> {
 	return async (ctx: MiddlewareContext<TEnv>) => {
-		if (ctx.url.pathname !== PING_PATH || ctx.request.method !== "GET") return ctx.next();
+		if (ctx.url.pathname !== KEEPALIVE_PATH || ctx.request.method !== "GET") return ctx.next();
 
 		if (config?.handler) {
 			try {

package/src/mount/index.ts

@@ -41,8 +41,15 @@ export function matchMount<TEnv>(mounts: MountConfig<TEnv>[], pathname: string):
 }
 
 export function buildMountRequest<TEnv>(request: Request, mount: MountConfig<TEnv>, url: URL): Request {
-	const strippedPath = url.pathname.slice(mount.prefix.length) || "/";
+	let strippedPath = url.pathname.slice(mount.prefix.length) || "/";
+	if (!strippedPath.startsWith("/")) strippedPath = `/${strippedPath}`;
+	if (strippedPath.startsWith("//") || strippedPath.includes("\\") || /[\0\r\n]/.test(strippedPath)) {
+		strippedPath = "/";
+	}
 	const target = new URL(strippedPath, url.origin);
+	if (target.origin !== url.origin) {
+		target.href = `${url.origin}/`;
+	}
 	target.search = url.search;
 	target.hash = url.hash;
 	return new Request(target.toString(), {