@pylonsync/functions 0.3.310 → 0.3.311

package/dist/ssr-runtime.d.ts

@@ -101,6 +101,7 @@ export interface SsrCookieOptions {
     expires?: Date | string;
     /** Defaults to true (secure default). Pass false for a client-readable cookie. */
     httpOnly?: boolean;
+    /** Defaults to true in prod / false in dev. Forced true when sameSite="none". */
     secure?: boolean;
     /** Defaults to "lax". */
     sameSite?: "strict" | "lax" | "none";
@@ -341,6 +342,14 @@ export declare function applyAutoSocialImages(component: string, headers: Record
  * marker + probe are in place before the deferred client entry boots the sync
  * engine. `<` is escaped so the JSON can't break out of the script.
  */
+/**
+ * Escape a JSON string so it can't break out of a `<script>` element: `<`
+ * closes a `</script>` (or `<!--`, `<script`); U+2028/U+2029 are JS statement
+ * terminators (valid in JSON, not in a JS string literal). Applied to every
+ * server-serialized blob embedded in a script tag \u2014 the `application/json`
+ * data blobs AND the executable fallback warning.
+ */
+export declare function escapeScriptJson(json: string): string;
 export declare function buildDevHudChunk(devInfo: Record<string, unknown>): string;
 /**
  * Build the hydration tail appended after React's stream EOFs: the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pylonsync/functions",
-  "version": "0.3.310",
+  "version": "0.3.311",
   "description": "TypeScript function runtime for pylon — defines server-side queries, mutations, and actions.",
   "type": "module",
   "main": "src/index.ts",

package/src/ssr-form-runtime.ts

@@ -19,6 +19,7 @@ import {
   PylonRouteControl,
   finalizeHeaders,
   importModule,
+  isDevMode,
   type ResponseState,
 } from "./ssr-runtime";
 import { buildDbWriter } from "./runtime";
@@ -81,8 +82,9 @@ function makeFormFields(raw: Record<string, string | string[]>): FormFields {
 // the list drives the 405 `Allow` header advertising which a route.ts exports.
 const HANDLER_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE"] as const;
 const b64 = (s: string) => Buffer.from(s, "utf8").toString("base64");
-const isDev = () =>
-  process.env.PYLON_DEV_MODE === "1" || process.env.PYLON_DEV_MODE === "true";
+// Share ONE dev-mode parse with ssr-runtime (case-insensitive "1"/"true") so
+// the form path and the render path never disagree on whether to leak stacks.
+const isDev = isDevMode;
 
 export async function handleForm(
   msg: HandleFormMessage,

package/src/ssr-runtime.test.ts

@@ -15,6 +15,7 @@ import {
   asRouteControl,
   PylonRouteControl,
   finalizeHeaders,
+  escapeScriptJson,
   makeResponseController,
   makeReadTrackingProxy,
   makeRevocableReadTrackingProxy,
@@ -750,3 +751,68 @@ describe("isSafeRedirect — open-redirect guard for response.redirect()", () =>
     expect(isSafeRedirect("https://app.example.com/x", {})).toBe(false);
   });
 });
+
+describe("script-escaping + secure cookies", () => {
+  test("escapeScriptJson neutralizes a </script> breakout", () => {
+    const out = escapeScriptJson(JSON.stringify("</script><script>alert(1)</script>"));
+    expect(out).not.toContain("<");
+    expect(out).toContain("\\u003c");
+  });
+
+  test("buildHydrationTail fallback warn script escapes manifestErr", () => {
+    const tail = buildHydrationTail({
+      component: "app/x/page",
+      layouts: [],
+      props: {},
+      ssrData: {},
+      manifestRoute: null,
+      publicPrefix: "/_pylon/build/",
+      manifestErr: 'no entry for "</script><script>evil</script>"',
+    });
+    const warn = tail.slice(tail.indexOf("console.warn"));
+    // The executable fallback must escape the error — no raw injected tag.
+    expect(warn).not.toContain("<script>evil");
+    expect(warn).toContain("\\u003c");
+  });
+
+  test("serializeCookie: Secure defaults + SameSite=None forces Secure", () => {
+    const mk = () => {
+      const s = { status: 200, headers: {}, cookies: [] as string[] };
+      return { s, r: makeResponseController(s) };
+    };
+    const prev = process.env.PYLON_DEV_MODE;
+    try {
+      // Prod (dev off): Secure defaults ON.
+      delete process.env.PYLON_DEV_MODE;
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1");
+        expect(s.cookies[0]).toContain("; Secure");
+        expect(s.cookies[0]).toContain("; HttpOnly");
+      }
+      // Explicit secure:false (non-None) wins even in prod.
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1", { secure: false });
+        expect(s.cookies[0]).not.toContain("; Secure");
+      }
+      // Dev: Secure defaults OFF so http://localhost keeps the cookie.
+      process.env.PYLON_DEV_MODE = "1";
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1");
+        expect(s.cookies[0]).not.toContain("; Secure");
+      }
+      // SameSite=None forces Secure even in dev (browsers drop it otherwise).
+      {
+        const { s, r } = mk();
+        r.setCookie("a", "1", { sameSite: "none" });
+        expect(s.cookies[0]).toContain("; Secure");
+        expect(s.cookies[0]).toContain("SameSite=None");
+      }
+    } finally {
+      if (prev === undefined) delete process.env.PYLON_DEV_MODE;
+      else process.env.PYLON_DEV_MODE = prev;
+    }
+  });
+});

package/src/ssr-runtime.ts

@@ -146,6 +146,7 @@ export interface SsrCookieOptions {
   expires?: Date | string;
   /** Defaults to true (secure default). Pass false for a client-readable cookie. */
   httpOnly?: boolean;
+  /** Defaults to true in prod / false in dev. Forced true when sameSite="none". */
   secure?: boolean;
   /** Defaults to "lax". */
   sameSite?: "strict" | "lax" | "none";
@@ -194,8 +195,13 @@ function serializeCookie(
     c += `; Domain=${opts.domain}`;
   }
   if (opts.httpOnly !== false) c += `; HttpOnly`;
-  if (opts.secure) c += `; Secure`;
   const ss = opts.sameSite ?? "lax";
+  // `Secure` defaults ON in prod (mirrors the framework session cookie), OFF in
+  // dev so an http://localhost cookie isn't dropped. `SameSite=None` REQUIRES
+  // `Secure` — browsers silently drop a None cookie without it — so force it
+  // there regardless of the caller / dev mode.
+  const secure = ss === "none" ? true : (opts.secure ?? !isDevMode());
+  if (secure) c += `; Secure`;
   c += `; SameSite=${ss[0].toUpperCase()}${ss.slice(1)}`;
   return c;
 }
@@ -1517,11 +1523,22 @@ function pylonDevHud() {
  * marker + probe are in place before the deferred client entry boots the sync
  * engine. `<` is escaped so the JSON can't break out of the script.
  */
-export function buildDevHudChunk(devInfo: Record<string, unknown>): string {
-  const json = JSON.stringify(devInfo)
+/**
+ * Escape a JSON string so it can't break out of a `<script>` element: `<`
+ * closes a `</script>` (or `<!--`, `<script`); U+2028/U+2029 are JS statement
+ * terminators (valid in JSON, not in a JS string literal). Applied to every
+ * server-serialized blob embedded in a script tag \u2014 the `application/json`
+ * data blobs AND the executable fallback warning.
+ */
+export function escapeScriptJson(json: string): string {
+  return json
     .replace(/</g, "\\u003c")
     .replace(/\u2028/g, "\\u2028")
     .replace(/\u2029/g, "\\u2029");
+}
+
+export function buildDevHudChunk(devInfo: Record<string, unknown>): string {
+  const json = escapeScriptJson(JSON.stringify(devInfo));
   return (
     `<script id="__PYLON_DEV__" type="application/json">${json}</script>` +
     `<script>(${pylonDevHud.toString()})();</script>`
@@ -1661,13 +1678,7 @@ export function buildHydrationTail(args: {
     ssrData: args.ssrData,
   };
   if (args.kind) hydrationPayload.kind = args.kind;
-  // Escape `<` (closes a </script> breakout) + U+2028/U+2029 (JSON-valid but
-  // JS statement terminators). Regex form keeps the separators visible in
-  // source rather than as invisible literals.
-  const json = JSON.stringify(hydrationPayload)
-    .replace(/</g, "\\u003c")
-    .replace(/\u2028/g, "\\u2028")
-    .replace(/\u2029/g, "\\u2029");
+  const json = escapeScriptJson(JSON.stringify(hydrationPayload));
   let tail = `<script id="__PYLON_DATA__" type="application/json">${json}</script>`;
   if (args.manifestRoute) {
     // A cross-origin CDN module (`public_prefix` is an absolute http(s) URL) is
@@ -1677,7 +1688,10 @@ export function buildHydrationTail(args: {
     const co = /^https?:\/\//i.test(args.publicPrefix) ? " crossorigin" : "";
     tail += `<script type="module"${co} src="${args.publicPrefix}${args.manifestRoute.file}"></script>`;
   } else {
-    tail += `<script>console.warn(${JSON.stringify(`[pylon ssr] hydration disabled: ${args.manifestErr}`)})</script>`;
+    // Executable script → the serialized message MUST be script-escaped
+    // (`manifestErr` is server-derived today, but this is the one script sink
+    // that would otherwise skip the `<`-escape every other blob applies).
+    tail += `<script>console.warn(${escapeScriptJson(JSON.stringify(`[pylon ssr] hydration disabled: ${args.manifestErr}`))})</script>`;
   }
   if (isDevMode()) tail += DEV_LIVE_RELOAD_SNIPPET;
   return tail;