@nuxt/nitro-server-nightly 5.0.0-29554128.cf84c6e7 → 5.0.0-29554201.c0bbb6ec

package/dist/index.mjs

@@ -22,7 +22,7 @@ import { ImpoundPlugin } from "impound";
 import { resolveModulePath } from "exsolve";
 import { runtimeDependencies } from "nitropack/runtime/meta";
 //#region package.json
-var version = "5.0.0-29554128.cf84c6e7";
+var version = "5.0.0-29554201.c0bbb6ec";
 //#endregion
 //#region src/utils.ts
 function toArray(value) {

package/dist/runtime/handlers/island.mjs

@@ -1,6 +1,6 @@
 import { useNitroApp } from "nitropack/runtime";
 import { destr } from "destr";
-import { defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
+import { createError, defineEventHandler, getQuery, readBody, setResponseHeaders } from "h3";
 import { resolveUnrefHeadInput } from "@unhead/vue";
 import { getRequestDependencies } from "vue-bundle-renderer/runtime";
 import { getQuery as getURLQuery } from "ufo";
@@ -96,26 +96,37 @@ const handler = defineEventHandler(async (event) => {
 	return islandResponse;
 });
 export default handler;
+const ISLAND_PATH_PREFIX = "/__nuxt_island/";
+const VALID_COMPONENT_NAME_RE = /^[a-z][\w.-]*$/i;
 async function getIslandContext(event) {
-	// TODO: Strict validation for url
 	let url = event.path || "";
 	if (import.meta.prerender && event.path && await islandPropCache.hasItem(event.path)) {
 		// rehydrate props from cache so we can rerender island if cache does not have it any more
 		url = await islandPropCache.getItem(event.path);
 	}
-	const componentParts = url.substring("/__nuxt_island".length + 1).replace(ISLAND_SUFFIX_RE, "").split("_");
+	if (!url.startsWith(ISLAND_PATH_PREFIX)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island request path"
+		});
+	}
+	const componentParts = url.substring(ISLAND_PATH_PREFIX.length).replace(ISLAND_SUFFIX_RE, "").split("_");
 	const hashId = componentParts.length > 1 ? componentParts.pop() : undefined;
 	const componentName = componentParts.join("_");
-	// TODO: Validate context
+	if (!componentName || !VALID_COMPONENT_NAME_RE.test(componentName)) {
+		throw createError({
+			statusCode: 400,
+			statusMessage: "Invalid island component name"
+		});
+	}
 	const context = event.method === "GET" ? getQuery(event) : await readBody(event);
-	const ctx = {
-		url: "/",
-		...context,
+	// Only extract known context fields to prevent arbitrary data injection
+	return {
+		url: typeof context?.url === "string" ? context.url : "/",
 		id: hashId,
 		name: componentName,
 		props: destr(context.props) || {},
 		slots: {},
 		components: {}
 	};
-	return ctx;
 }

package/dist/runtime/handlers/renderer.mjs

@@ -16,7 +16,7 @@ import { renderSSRHeadOptions } from "#internal/unhead.config.mjs";
 // @ts-expect-error virtual file
 import { NUXT_ASYNC_CONTEXT, NUXT_EARLY_HINTS, NUXT_INLINE_STYLES, NUXT_NO_SCRIPTS, NUXT_PAYLOAD_EXTRACTION, NUXT_PAYLOAD_INLINE, NUXT_RUNTIME_PAYLOAD_EXTRACTION, PARSE_ERROR_DATA } from "#internal/nuxt/nitro-config.mjs";
 // @ts-expect-error virtual file
-import { appHead, appTeleportAttrs, appTeleportTag, componentIslands, appManifest as isAppManifestEnabled } from "#internal/nuxt.config.mjs";
+import { appHead, appTeleportAttrs, appTeleportTag, componentIslands } from "#internal/nuxt.config.mjs";
 // @ts-expect-error virtual file
 import entryIds from "#internal/nuxt/entry-ids.mjs";
 // @ts-expect-error virtual file
@@ -185,18 +185,6 @@ const handler = defineRenderHandler(async (event) => {
 			href: payloadURL
 		}] }, headEntryOptions);
 	}
-	if (isAppManifestEnabled && ssrContext["~preloadManifest"] && !NO_SCRIPTS) {
-		ssrContext.head.push({ link: [{
-			rel: "preload",
-			as: "fetch",
-			fetchpriority: "low",
-			crossorigin: "anonymous",
-			href: buildAssetsURL(`builds/meta/${ssrContext.runtimeConfig.app.buildId}.json`)
-		}] }, {
-			...headEntryOptions,
-			tagPriority: "low"
-		});
-	}
 	// 2. Styles
 	if (inlinedStyles.length) {
 		ssrContext.head.push({ style: inlinedStyles });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nuxt/nitro-server-nightly",
-  "version": "5.0.0-29554128.cf84c6e7",
+  "version": "5.0.0-29554201.c0bbb6ec",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nuxt/nuxt.git",
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "@babel/plugin-syntax-typescript": "^7.28.6",
-    "@nuxt/kit": "npm:@nuxt/kit-nightly@5.0.0-29554128.cf84c6e7",
+    "@nuxt/kit": "npm:@nuxt/kit-nightly@5.0.0-29554201.c0bbb6ec",
     "@unhead/vue": "^2.1.12",
     "@vue/shared": "^3.5.30",
     "consola": "^3.4.2",
@@ -58,7 +58,7 @@
   "peerDependencies": {
     "@babel/plugin-proposal-decorators": "^7.25.0",
     "@rollup/plugin-babel": "^6.0.0 || ^7.0.0",
-    "nuxt": "npm:nuxt-nightly@5.0.0-29554128.cf84c6e7"
+    "nuxt": "npm:nuxt-nightly@5.0.0-29554201.c0bbb6ec"
   },
   "peerDependenciesMeta": {
     "@babel/plugin-proposal-decorators": {
@@ -70,9 +70,9 @@
   },
   "devDependencies": {
     "@babel/plugin-proposal-decorators": "7.29.0",
-    "@nuxt/schema": "npm:@nuxt/schema-nightly@5.0.0-29554128.cf84c6e7",
+    "@nuxt/schema": "npm:@nuxt/schema-nightly@5.0.0-29554201.c0bbb6ec",
     "@rollup/plugin-babel": "7.0.0",
-    "nuxt": "npm:nuxt-nightly@5.0.0-29554128.cf84c6e7",
+    "nuxt": "npm:nuxt-nightly@5.0.0-29554201.c0bbb6ec",
     "obuild": "0.4.32",
     "vitest": "4.0.18"
   },