@nuxt/scripts 1.3.3 → 1.3.4

package/dist/runtime/registry/posthog.js

@@ -31,7 +31,12 @@ export function useScriptPostHog(_options) {
           return { posthog };
         }
       },
-      clientInit: import.meta.server ? void 0 : async () => {
+      clientInit: import.meta.server ? void 0 : async (ctx) => {
+        const throwIfAborted = () => {
+          if (ctx?.signal.aborted)
+            throw ctx.signal.reason || new Error("Loading PostHog was aborted");
+        };
+        throwIfAborted();
         if (window.__posthogInitPromise || window.posthog)
           return;
         if (!options?.apiKey) {
@@ -43,6 +48,7 @@ export function useScriptPostHog(_options) {
         if (apiHost.startsWith("/"))
           apiHost = window.location.origin + apiHost;
         window.__posthogInitPromise = import("posthog-js").then(({ default: posthog }) => {
+          throwIfAborted();
           const config = {
             api_host: apiHost,
             ...options?.config
@@ -72,9 +78,11 @@ export function useScriptPostHog(_options) {
           }
           return window.posthog;
         }).catch((e) => {
-          logger.error("Failed to load posthog-js:", e);
+          if (!ctx?.signal.aborted)
+            logger.error("Failed to load posthog-js:", e);
           delete window._posthogQueue;
-          return void 0;
+          delete window.__posthogInitPromise;
+          throw e;
         });
         return window.__posthogInitPromise;
       }

package/dist/runtime/registry/speedcurve.js

@@ -8,6 +8,8 @@ const LUX_USER_CONFIG_KEYS = Object.keys(SpeedCurveOptions.entries).filter(
   (k) => k !== "id" && k !== "autoTrackSpaNavigations" && k !== "spaMode"
 );
 let luxWired = false;
+let teardownAutoTracker = () => {
+};
 export function useScriptSpeedCurve(_options) {
   return useRegistryScript("speedcurve", (options) => ({
     scriptInput: {
@@ -60,7 +62,7 @@ export function installAutoTracker(options) {
   const nuxt = useNuxtApp();
   let pendingInitial = nuxt.payload?.serverRendered === false;
   const label = options?.label === false ? null : typeof options?.label === "function" ? options.label : (to) => String(to.name ?? to.path);
-  router.beforeEach((to) => {
+  const stopBeforeEach = router.beforeEach((to) => {
     const lux = window.LUX;
     if (!lux)
       return;
@@ -80,7 +82,7 @@ export function installAutoTracker(options) {
         lux.label = nextLabel;
     }
   });
-  router.afterEach((_to, _from, failure) => {
+  const stopAfterEach = router.afterEach((_to, _from, failure) => {
     if (!failure)
       return;
     const lux = window.LUX;
@@ -89,7 +91,34 @@ export function installAutoTracker(options) {
     lux.markLoadTime();
     lux.addData("luxNavFailed", "1");
   });
-  nuxt.hook("page:finish", () => {
-    afterNextPaint(() => window.LUX?.markLoadTime());
+  const pendingPaints = /* @__PURE__ */ new Set();
+  const stopPageFinish = nuxt.hook("page:finish", () => {
+    const pending = { cancel: () => {
+    } };
+    pendingPaints.add(pending);
+    pending.cancel = afterNextPaint(() => {
+      pendingPaints.delete(pending);
+      window.LUX?.markLoadTime();
+    });
   });
+  let stopAppUnmount = () => {
+  };
+  const cleanup = () => {
+    if (!luxWired)
+      return;
+    luxWired = false;
+    stopBeforeEach();
+    stopAfterEach();
+    stopPageFinish();
+    stopAppUnmount();
+    for (const pending of pendingPaints)
+      pending.cancel();
+    pendingPaints.clear();
+    teardownAutoTracker = () => {
+    };
+  };
+  stopAppUnmount = nuxt.hook("app:unmount", cleanup);
+  teardownAutoTracker = cleanup;
 }
+if (import.meta.hot)
+  import.meta.hot.dispose(() => teardownAutoTracker());

package/dist/runtime/registry/usercentrics.js

@@ -1,5 +1,7 @@
 import { useHead } from "@unhead/vue";
+import { useNuxtApp } from "nuxt/app";
 import { useRegistryScript } from "../utils.js";
+import { attachUsercentricsConsent } from "../utils/usercentrics-consent.js";
 import { UsercentricsOptions } from "./schemas.js";
 export { UsercentricsOptions };
 export function useScriptUsercentrics(_options) {
@@ -29,26 +31,7 @@ export function useScriptUsercentrics(_options) {
       }
     };
   }, _options);
-  if (import.meta.client && !instance.consent) {
-    const whenReady = () => new Promise((resolve) => {
-      const onReady = () => {
-        window.removeEventListener("UC_CMP_API_READY", onReady);
-        resolve(window.__ucCmp);
-      };
-      window.addEventListener("UC_CMP_API_READY", onReady);
-    });
-    instance.consent = {
-      whenReady,
-      onConsentChange(cb) {
-        const handler = (e) => cb(e.detail, e);
-        window.addEventListener("UC_UI_CMP_EVENT", handler);
-        return () => window.removeEventListener("UC_UI_CMP_EVENT", handler);
-      },
-      showFirstLayer: () => window.__ucCmp?.showFirstLayer?.(),
-      showSecondLayer: () => window.__ucCmp?.showSecondLayer?.(),
-      acceptAll: () => window.__ucCmp?.acceptAllConsents?.(),
-      denyAll: () => window.__ucCmp?.denyAllConsents?.()
-    };
-  }
+  if (import.meta.client)
+    attachUsercentricsConsent(instance, window, (callback) => useNuxtApp().hooks.hook("app:unmount", callback));
   return instance;
 }

package/dist/runtime/registry/youtube-player.js

@@ -1,8 +1,10 @@
 import { useHead } from "@unhead/vue";
 import { watch } from "vue";
 import { useRegistryScript } from "../utils.js";
+import { armYouTubeReadiness, useYouTubeReadinessState } from "../utils/youtube-readiness.js";
+const cleanupDecoration = Symbol("nuxt-scripts:youtube-cleanup");
+const readinessDecoration = Symbol("nuxt-scripts:youtube-readiness");
 export function useScriptYouTubePlayer(_options) {
-  let readyPromise = Promise.resolve();
   const instance = useRegistryScript("youtubePlayer", () => ({
     scriptInput: {
       src: "https://www.youtube.com/iframe_api",
@@ -11,19 +13,28 @@ export function useScriptYouTubePlayer(_options) {
     },
     scriptOptions: {
       use() {
+        const readiness = useYouTubeReadinessState();
         return {
-          YT: window.YT || readyPromise.then(() => {
+          YT: window.YT || readiness.promise.then(() => {
             return window.YT;
           })
         };
       }
     },
     clientInit: import.meta.server ? void 0 : () => {
-      readyPromise = new Promise((resolve) => {
-        window.onYouTubeIframeAPIReady = resolve;
-      });
+      armYouTubeReadiness(useYouTubeReadinessState());
     }
   }), _options);
+  const clientInstance = import.meta.server || typeof window === "undefined" ? void 0 : instance;
+  if (clientInstance && !clientInstance[cleanupDecoration]) {
+    clientInstance[cleanupDecoration] = true;
+    clientInstance[readinessDecoration] = useYouTubeReadinessState();
+    const originalRemove = instance.remove;
+    instance.remove = () => {
+      clientInstance[readinessDecoration]?.controller?.abort();
+      return originalRemove();
+    };
+  }
   if (import.meta.client) {
     const _ = watch(instance.status, (status) => {
       if (status === "loading") {

package/dist/runtime/server/bluesky-embed.js

@@ -1,19 +1,28 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
-import { createCachedJsonFetch } from "./utils/cached-upstream.js";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
+import { createCachedJsonFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
 import { rewriteBlueskyPostImages } from "./utils/embed-rewriters.js";
 import { withSigning } from "./utils/withSigning.js";
 const BSKY_POST_URL_RE = /^https:\/\/bsky\.app\/profile\/([^/]+)\/post\/([^/?]+)$/;
 const EMBED_BSKY_SUFFIX_RE = /\/embed\/bluesky$/;
+const allowBlueskyApiUrl = (url) => isSafeHttpsUrl(url) && url.hostname === "public.api.bsky.app";
 const cachedProfileFetch = createCachedJsonFetch(
   "nuxt-scripts-bsky-profile",
   86400,
-  (url) => url
+  (url) => url,
+  {
+    allowUrl: allowBlueskyApiUrl,
+    contentTypePrefixes: ["application/json"]
+  }
 );
 const cachedPostFetch = createCachedJsonFetch(
   "nuxt-scripts-bsky-post",
   600,
-  (url) => url
+  (url) => url,
+  {
+    allowUrl: allowBlueskyApiUrl,
+    contentTypePrefixes: ["application/json"]
+  }
 );
 export default withSigning(defineEventHandler(async (event) => {
   const query = getQuery(event);
@@ -70,7 +79,7 @@ export default withSigning(defineEventHandler(async (event) => {
   const handlerPath = event.path?.split("?")[0] || "";
   const prefix = handlerPath.replace(EMBED_BSKY_SUFFIX_RE, "") || "/_scripts";
   const imagePath = `${prefix}/embed/bluesky-image`;
-  const secret = useRuntimeConfig(event)["nuxt-scripts"]?.proxySecret;
+  const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
   rewriteBlueskyPostImages(post, imagePath, secret);
   setHeader(event, "Content-Type", "application/json");
   setHeader(event, "Cache-Control", "public, max-age=600, s-maxage=600");

package/dist/runtime/server/google-maps-geocode-proxy.js

@@ -1,12 +1,17 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
-import { createCachedJsonFetch } from "./utils/cached-upstream.js";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
+import { createCachedJsonFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
+import { stripProxyAuthQuery } from "./utils/proxy-query.js";
 import { withSigning } from "./utils/withSigning.js";
 const cachedGeocodeFetch = createCachedJsonFetch(
   "nuxt-scripts-geocode",
   2592e3,
-  (url) => url
+  (url) => url,
+  {
+    allowUrl: (url) => isSafeHttpsUrl(url) && url.hostname === "maps.googleapis.com",
+    contentTypePrefixes: ["application/json"]
+  }
 );
 export default withSigning(defineEventHandler(async (event) => {
   const runtimeConfig = useRuntimeConfig();
@@ -18,7 +23,7 @@ export default withSigning(defineEventHandler(async (event) => {
       statusMessage: "Google Maps API key not configured for geocode proxy"
     });
   }
-  const query = getQuery(event);
+  const query = stripProxyAuthQuery(getQuery(event));
   const { key: _clientKey, ...safeQuery } = query;
   const geocodeUrl = withQuery("https://maps.googleapis.com/maps/api/geocode/json", {
     ...safeQuery,

package/dist/runtime/server/google-static-maps-proxy.js

@@ -1,11 +1,13 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
-import { createCachedBinaryFetch } from "./utils/cached-upstream.js";
-import { PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_PARAM } from "./utils/sign-constants.js";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
+import { createCachedBinaryFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
+import { stripProxyAuthQuery } from "./utils/proxy-query.js";
 import { withSigning } from "./utils/withSigning.js";
-const cachedMapFetch = createCachedBinaryFetch("nuxt-scripts-static-map", 604800);
-const STRIP_PARAMS = /* @__PURE__ */ new Set([SIG_PARAM, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, "key"]);
+const cachedMapFetch = createCachedBinaryFetch("nuxt-scripts-static-map", 604800, {
+  allowContentType: (contentType) => contentType.startsWith("image/") && contentType !== "image/svg+xml",
+  allowUrl: (url) => isSafeHttpsUrl(url) && url.hostname === "maps.googleapis.com"
+});
 export default withSigning(defineEventHandler(async (event) => {
   const runtimeConfig = useRuntimeConfig();
   const publicConfig = runtimeConfig.public["nuxt-scripts"]?.googleStaticMapsProxy;
@@ -23,12 +25,8 @@ export default withSigning(defineEventHandler(async (event) => {
       statusMessage: "Google Maps API key not configured for proxy"
     });
   }
-  const query = getQuery(event);
-  const safeQuery = {};
-  for (const [k, v] of Object.entries(query)) {
-    if (!STRIP_PARAMS.has(k))
-      safeQuery[k] = v;
-  }
+  const query = stripProxyAuthQuery(getQuery(event));
+  const { key: _clientKey, ...safeQuery } = query;
   const googleMapsUrl = withQuery("https://maps.googleapis.com/maps/api/staticmap", {
     ...safeQuery,
     key: apiKey
@@ -41,9 +39,18 @@ export default withSigning(defineEventHandler(async (event) => {
       statusMessage: error.statusMessage || "Failed to fetch static map"
     });
   });
+  const contentType = result.contentType?.split(";", 1)[0]?.trim().toLowerCase();
+  if (!contentType?.startsWith("image/") || contentType === "image/svg+xml") {
+    throw createError({
+      statusCode: 415,
+      statusMessage: "Unsupported upstream content type"
+    });
+  }
   const cacheMaxAge = publicConfig.cacheMaxAge || 3600;
-  setHeader(event, "Content-Type", result.contentType || "image/png");
+  setHeader(event, "Content-Type", result.contentType);
   setHeader(event, "Cache-Control", `public, max-age=${cacheMaxAge}, s-maxage=${cacheMaxAge}`);
   setHeader(event, "Vary", "Accept-Encoding");
+  setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'; base-uri 'none'; form-action 'none'");
+  setHeader(event, "X-Content-Type-Options", "nosniff");
   return result.body;
 }));

package/dist/runtime/server/gravatar-proxy.js

@@ -1,15 +1,29 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
 import { withQuery } from "ufo";
-import { createCachedBinaryFetch } from "./utils/cached-upstream.js";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
+import { createCachedBinaryFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
 import { withSigning } from "./utils/withSigning.js";
-const cachedGravatarFetch = createCachedBinaryFetch("nuxt-scripts-gravatar", 3600);
+const GRAVATAR_HASH_RE = /^[a-f\d]{64}$/i;
+const GRAVATAR_RATINGS = /* @__PURE__ */ new Set(["g", "pg", "r", "x"]);
+function firstString(value) {
+  return Array.isArray(value) ? typeof value[0] === "string" ? value[0] : void 0 : typeof value === "string" ? value : void 0;
+}
+const cachedGravatarFetch = createCachedBinaryFetch("nuxt-scripts-gravatar", 3600, {
+  allowContentType: (contentType) => contentType.startsWith("image/") && contentType !== "image/svg+xml",
+  allowUrl: (url) => isSafeHttpsUrl(url) && (url.hostname === "gravatar.com" || url.hostname.endsWith(".gravatar.com"))
+});
 export default withSigning(defineEventHandler(async (event) => {
   const runtimeConfig = useRuntimeConfig();
   const proxyConfig = runtimeConfig.public["nuxt-scripts"]?.gravatarProxy;
   const query = getQuery(event);
-  let hash = query.hash;
-  const email = query.email;
+  let hash = firstString(query.hash);
+  const email = firstString(query.email);
+  if (hash && !GRAVATAR_HASH_RE.test(hash)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Hash must be a 64-character SHA-256 hex digest"
+    });
+  }
   if (!hash && email) {
     const encoder = new TextEncoder();
     const data = encoder.encode(email.trim().toLowerCase());
@@ -22,11 +36,24 @@ export default withSigning(defineEventHandler(async (event) => {
       statusMessage: "Either hash or email parameter is required"
     });
   }
-  const size = query.s || "80";
-  const defaultImg = query.d || "mp";
-  const rating = query.r || "g";
+  const rawSize = firstString(query.s) || "80";
+  const size = Number(rawSize);
+  const defaultImg = firstString(query.d) || "mp";
+  const rating = (firstString(query.r) || "g").toLowerCase();
+  if (!Number.isInteger(size) || size < 1 || size > 2048) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Gravatar size must be an integer from 1 to 2048"
+    });
+  }
+  if (!GRAVATAR_RATINGS.has(rating)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Invalid Gravatar rating"
+    });
+  }
   const gravatarUrl = withQuery(`https://www.gravatar.com/avatar/${hash}`, {
-    s: size,
+    s: String(size),
     d: defaultImg,
     r: rating
   });
@@ -39,8 +66,18 @@ export default withSigning(defineEventHandler(async (event) => {
     });
   });
   const cacheMaxAge = proxyConfig?.cacheMaxAge ?? 3600;
-  setHeader(event, "Content-Type", result.contentType || "image/jpeg");
+  const responseContentType = result.contentType;
+  const upstreamContentType = responseContentType?.split(";", 1)[0]?.trim().toLowerCase();
+  if (!responseContentType || !upstreamContentType?.startsWith("image/") || upstreamContentType === "image/svg+xml") {
+    throw createError({
+      statusCode: 415,
+      statusMessage: "Unsupported upstream content type"
+    });
+  }
+  setHeader(event, "Content-Type", responseContentType);
   setHeader(event, "Cache-Control", `public, max-age=${cacheMaxAge}, s-maxage=${cacheMaxAge}`);
+  setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'");
   setHeader(event, "Vary", "Accept-Encoding");
+  setHeader(event, "X-Content-Type-Options", "nosniff");
   return result.body;
 }));

package/dist/runtime/server/instagram-embed-asset.js

@@ -4,6 +4,6 @@ export default createImageProxyHandler({
   accept: "*/*",
   userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36",
   cacheMaxAge: 86400,
-  contentType: "application/octet-stream",
+  contentTypePrefixes: ["image/", "font/", "application/font", "application/x-font", "application/vnd.ms-fontobject", "application/octet-stream"],
   decodeAmpersands: true
 });

package/dist/runtime/server/instagram-embed.js

@@ -1,59 +1,47 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { defineCachedFunction, useRuntimeConfig } from "nitropack/runtime";
-import { $fetch } from "ofetch";
-import { hash } from "ohash";
-import { ELEMENT_NODE, parse, renderSync, TEXT_NODE, walkSync } from "ultrahtml";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { createCachedJsonFetch } from "./utils/cached-upstream.js";
-import { isEmbedShell, proxyAssetUrl, rewriteUrl, rewriteUrlsInText, RSRC_RE, scopeCss } from "./utils/instagram-embed.js";
+import { isEmbedShell, isSafeInstagramCssUrl, isSafeInstagramEmbedUrl, isSafeInstagramPostUrl, sanitizeInstagramEmbedCss, sanitizeInstagramEmbedHtml } from "./utils/instagram-embed.js";
 import { withSigning } from "./utils/withSigning.js";
 export { proxyAssetUrl, proxyImageUrl, rewriteUrl, rewriteUrlsInText, scopeCss } from "./utils/instagram-embed.js";
 const EMBED_INSTAGRAM_SUFFIX_RE = /\/embed\/instagram$/;
-const SRCSET_SPLIT_RE = /\s+/;
-const cachedEmbedFetch = defineCachedFunction(
-  async (url, headers) => {
-    const html = await $fetch(url, { timeout: 1e4, headers });
-    if (isEmbedShell(html)) {
-      throw createError({
-        statusCode: 502,
-        statusMessage: "Instagram returned an empty embed shell (post unavailable or upstream rate-limiting)"
-      });
-    }
-    return html;
+const cachedEmbedFetch = createCachedJsonFetch(
+  "nuxt-scripts-instagram-embed-v3",
+  600,
+  (url, opts) => {
+    const parts = [url];
+    for (const [key, value] of Object.entries(opts?.headers || {}).sort(([a], [b]) => a.localeCompare(b)))
+      parts.push(`${key}=${value}`);
+    return parts.join("\n");
   },
   {
-    // v2 — bump to evict any v1 entries that cached the empty JS shell
-    // before the shell-detection / UA fix landed.
-    name: "nuxt-scripts-instagram-embed-v2",
-    maxAge: 600,
-    swr: true,
-    staleMaxAge: 600,
-    // Vary on headers too — Instagram's response is UA-dependent, so
-    // different callers (e.g. unit tests, future UA changes) must not
-    // collide on the same key.
-    getKey: (url, headers) => {
-      const parts = [url];
-      for (const [k, v] of Object.entries(headers).sort(([a], [b]) => a.localeCompare(b)))
-        parts.push(`${k}=${v}`);
-      return hash(parts);
+    allowUrl: isSafeInstagramEmbedUrl,
+    responseType: "text",
+    contentTypePrefixes: ["text/html"],
+    validateResponse: (html) => {
+      if (isEmbedShell(html)) {
+        throw createError({
+          statusCode: 502,
+          statusMessage: "Instagram returned an empty embed shell (post unavailable or upstream rate-limiting)"
+        });
+      }
     }
   }
 );
 const cachedCssFetch = createCachedJsonFetch(
   "nuxt-scripts-instagram-css",
   86400,
-  (url) => url
+  (url) => url,
+  {
+    allowUrl: isSafeInstagramCssUrl,
+    responseType: "text",
+    contentTypePrefixes: ["text/css"]
+  }
 );
-function removeNode(node) {
-  node.type = TEXT_NODE;
-  node.value = "";
-  node.name = void 0;
-  node.attributes = {};
-  node.children = [];
-}
 export default withSigning(defineEventHandler(async (event) => {
   const handlerPath = event.path?.split("?")[0] || "";
   const prefix = handlerPath.replace(EMBED_INSTAGRAM_SUFFIX_RE, "") || "/_scripts";
-  const secret = useRuntimeConfig(event)["nuxt-scripts"]?.proxySecret;
+  const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
   const query = getQuery(event);
   const postUrl = query.url;
   const captions = query.captions === "true";
@@ -72,7 +60,7 @@ export default withSigning(defineEventHandler(async (event) => {
       statusMessage: "Invalid postUrl"
     });
   }
-  if (!["instagram.com", "www.instagram.com"].includes(parsedUrl.hostname)) {
+  if (!isSafeInstagramPostUrl(parsedUrl)) {
     throw createError({
       statusCode: 400,
       statusMessage: "Invalid Instagram URL"
@@ -82,71 +70,31 @@ export default withSigning(defineEventHandler(async (event) => {
   const cleanUrl = parsedUrl.origin + pathname;
   const embedUrl = `${cleanUrl}embed/${captions ? "captioned/" : ""}`;
   const html = await cachedEmbedFetch(embedUrl, {
-    "Accept": "text/html",
-    // Meta's own crawler UA. Googlebot's UA is also accepted by Instagram
-    // but is IP-verified, so it fails from hosts outside Google's ranges
-    // (e.g. Cloudflare/Vercel) and Instagram serves the JS shell instead
-    // of the SSR'd post.
-    "User-Agent": "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"
+    headers: {
+      "Accept": "text/html",
+      // Meta's own crawler UA. Googlebot's UA is also accepted by Instagram
+      // but is IP-verified, so it fails from hosts outside Google's ranges
+      // (e.g. Cloudflare/Vercel) and Instagram serves the JS shell instead
+      // of the SSR'd post.
+      "User-Agent": "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"
+    }
   }).catch((error) => {
     throw createError({
       statusCode: error.statusCode || 500,
       statusMessage: error.statusMessage || "Failed to fetch Instagram embed"
     });
   });
-  const ast = parse(html);
-  const cssUrls = [];
-  walkSync(ast, (node) => {
-    if (node.type !== ELEMENT_NODE)
-      return;
-    if (node.name === "link" && node.attributes.rel === "stylesheet" && node.attributes.href) {
-      cssUrls.push(node.attributes.href);
-      removeNode(node);
-      return;
-    }
-    if (node.name === "script" || node.name === "noscript" || node.name === "style") {
-      removeNode(node);
-      return;
-    }
-    for (const attr of ["src", "poster"]) {
-      if (node.attributes[attr])
-        node.attributes[attr] = rewriteUrl(node.attributes[attr], prefix, secret);
-    }
-    if (node.attributes.srcset) {
-      node.attributes.srcset = node.attributes.srcset.split(",").map((entry) => {
-        const parts = entry.trim().split(SRCSET_SPLIT_RE);
-        const url = parts[0];
-        const descriptor = parts.slice(1).join(" ");
-        return url ? `${rewriteUrl(url, prefix, secret)}${descriptor ? ` ${descriptor}` : ""}` : entry;
-      }).join(", ");
-    }
-    if (node.attributes.style)
-      node.attributes.style = rewriteUrlsInText(node.attributes.style, prefix, secret);
-  });
-  walkSync(ast, (node) => {
-    if (node.type === TEXT_NODE && node.value)
-      node.value = rewriteUrlsInText(node.value, prefix, secret);
-  });
-  let bodyNode = null;
-  walkSync(ast, (node) => {
-    if (node.type === ELEMENT_NODE && node.name === "body")
-      bodyNode = node;
-  });
-  const bodyHtml = bodyNode ? bodyNode.children.map((child) => renderSync(child)).join("") : renderSync(ast);
+  const { bodyHtml, cssUrls } = sanitizeInstagramEmbedHtml(html, prefix, secret);
   const cssContents = await Promise.all(
     cssUrls.map(
       (url) => cachedCssFetch(url, {
         headers: { Accept: "text/css" }
-      }).catch(() => "")
+      }).catch(() => {
+        return "";
+      })
     )
   );
-  let combinedCss = cssContents.join("\n");
-  combinedCss = combinedCss.replace(
-    RSRC_RE,
-    (_m, path) => `url(${proxyAssetUrl(`https://static.cdninstagram.com/rsrc.php${path}`, prefix, secret)})`
-  );
-  combinedCss = rewriteUrlsInText(combinedCss, prefix, secret);
-  combinedCss = scopeCss(combinedCss, ".instagram-embed-root");
+  const combinedCss = sanitizeInstagramEmbedCss(cssContents.join("\n"), ".instagram-embed-root", prefix, secret);
   const baseStyles = `
     .instagram-embed-root { background: white; max-width: 540px; width: calc(100% - 2px); border-radius: 3px; border: 1px solid rgb(219, 219, 219); display: block; margin: 0px 0px 12px; min-width: 326px; padding: 0px; }
     .instagram-embed-root #splash-screen { display: none !important; }
@@ -157,5 +105,7 @@ export default withSigning(defineEventHandler(async (event) => {
 ${combinedCss}</style>${bodyHtml}</div>`;
   setHeader(event, "Content-Type", "text/html");
   setHeader(event, "Cache-Control", "public, max-age=600, s-maxage=600");
+  setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'");
+  setHeader(event, "X-Content-Type-Options", "nosniff");
   return result;
 }));

package/dist/runtime/server/proxy-handler.d.ts

@@ -1,7 +1,8 @@
 export declare const SKIP_REQUEST_HEADERS: Set<string>;
+export declare function withResponseBodyIdleTimeout(body: ReadableStream<Uint8Array>, timeoutMs: number, onTimeout: () => void): ReadableStream<Uint8Array>;
 /**
  * Privacy-aware proxy handler for first-party script collection endpoints.
  * Routes requests to third-party analytics while protecting user privacy.
  */
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<string | Buffer<ArrayBuffer>>>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void | null>>;
 export default _default;