@react-router/node 7.9.3 → 7.9.4-pre.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # `@react-router/node`
 
+## 7.9.4-pre.0
+
+### Patch Changes
+
+- Validate format of incoming session ids ([#14426](https://github.com/remix-run/react-router/pull/14426))
+- Updated dependencies:
+  - `react-router@7.9.4-pre.0`
+
 ## 7.9.3
 
 ### Patch Changes
@@ -28,7 +36,6 @@
 - Stabilize middleware and context APIs. ([#14215](https://github.com/remix-run/react-router/pull/14215))
 
   We have removed the `unstable_` prefix from the following APIs and they are now considered stable and ready for production use:
-
   - [`RouterContextProvider`](https://reactrouter.com/api/utils/RouterContextProvider)
   - [`createContext`](https://reactrouter.com/api/utils/createContext)
   - `createBrowserRouter` [`getContext`](https://reactrouter.com/api/data-routers/createBrowserRouter#optsgetcontext) option
@@ -228,7 +235,6 @@
 - Remove single fetch future flag. ([#11522](https://github.com/remix-run/react-router/pull/11522))
 
 - For Remix consumers migrating to React Router, the `crypto` global from the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) is now required when using cookie and session APIs. This means that the following APIs are provided from `react-router` rather than platform-specific packages: ([#11837](https://github.com/remix-run/react-router/pull/11837))
-
   - `createCookie`
   - `createCookieSessionStorage`
   - `createMemorySessionStorage`
@@ -237,7 +243,6 @@
   For consumers running older versions of Node, the `installGlobals` function from `@remix-run/node` has been updated to define `globalThis.crypto`, using [Node's `require('node:crypto').webcrypto` implementation.](https://nodejs.org/api/webcrypto.html)
 
   Since platform-specific packages no longer need to implement this API, the following low-level APIs have been removed:
-
   - `createCookieFactory`
   - `createSessionStorageFactory`
   - `createCookieSessionStorageFactory`
@@ -645,12 +650,10 @@
 - Introduces the `defer()` API from `@remix-run/router` with support for server-rendering and HTTP streaming. This utility allows you to defer values returned from `loader` functions by returning promises instead of resolved values. This has been refered to as _"sending a promise over the wire"_. ([#4920](https://github.com/remix-run/remix/pull/4920))
 
   Informational Resources:
-
   - <https://gist.github.com/jacob-ebey/9bde9546c1aafaa6bc8c242054b1be26>
   - <https://github.com/remix-run/remix/blob/main/decisions/0004-streaming-apis.md>
 
   Documentation Resources (better docs specific to Remix are in the works):
-
   - <https://reactrouter.com/en/main/utils/defer>
   - <https://reactrouter.com/en/main/components/await>
   - <https://reactrouter.com/en/main/hooks/use-async-value>

package/dist/index.js

@@ -1,5 +1,5 @@
 /**
- * @react-router/node v7.9.3
+ * @react-router/node v7.9.4-pre.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -77,6 +77,9 @@ function createFileSessionStorage({
         let id = Buffer.from(randomBytes).toString("hex");
         try {
           let file = getFile(dir, id);
+          if (!file) {
+            throw new Error("Error generating session");
+          }
           await import_node_fs.promises.mkdir(path.dirname(file), { recursive: true });
           await import_node_fs.promises.writeFile(file, content, { encoding: "utf-8", flag: "wx" });
           return id;
@@ -88,6 +91,9 @@ function createFileSessionStorage({
     async readData(id) {
       try {
         let file = getFile(dir, id);
+        if (!file) {
+          return null;
+        }
         let content = JSON.parse(await import_node_fs.promises.readFile(file, "utf-8"));
         let data = content.data;
         let expires = typeof content.expires === "string" ? new Date(content.expires) : null;
@@ -104,6 +110,9 @@ function createFileSessionStorage({
     async updateData(id, data, expires) {
       let content = JSON.stringify({ data, expires });
       let file = getFile(dir, id);
+      if (!file) {
+        return;
+      }
       await import_node_fs.promises.mkdir(path.dirname(file), { recursive: true });
       await import_node_fs.promises.writeFile(file, content, "utf-8");
     },
@@ -111,8 +120,12 @@ function createFileSessionStorage({
       if (!id) {
         return;
       }
+      let file = getFile(dir, id);
+      if (!file) {
+        return;
+      }
       try {
-        await import_node_fs.promises.unlink(getFile(dir, id));
+        await import_node_fs.promises.unlink(file);
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
       }
@@ -120,6 +133,9 @@ function createFileSessionStorage({
   });
 }
 function getFile(dir, id) {
+  if (!/^[0-9a-f]{16}$/i.test(id)) {
+    return null;
+  }
   return path.join(dir, id.slice(0, 4), id.slice(4));
 }
 

package/dist/index.mjs

@@ -1,5 +1,5 @@
 /**
- * @react-router/node v7.9.3
+ * @react-router/node v7.9.4-pre.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -37,6 +37,9 @@ function createFileSessionStorage({
         let id = Buffer.from(randomBytes).toString("hex");
         try {
           let file = getFile(dir, id);
+          if (!file) {
+            throw new Error("Error generating session");
+          }
           await fsp.mkdir(path.dirname(file), { recursive: true });
           await fsp.writeFile(file, content, { encoding: "utf-8", flag: "wx" });
           return id;
@@ -48,6 +51,9 @@ function createFileSessionStorage({
     async readData(id) {
       try {
         let file = getFile(dir, id);
+        if (!file) {
+          return null;
+        }
         let content = JSON.parse(await fsp.readFile(file, "utf-8"));
         let data = content.data;
         let expires = typeof content.expires === "string" ? new Date(content.expires) : null;
@@ -64,6 +70,9 @@ function createFileSessionStorage({
     async updateData(id, data, expires) {
       let content = JSON.stringify({ data, expires });
       let file = getFile(dir, id);
+      if (!file) {
+        return;
+      }
       await fsp.mkdir(path.dirname(file), { recursive: true });
       await fsp.writeFile(file, content, "utf-8");
     },
@@ -71,8 +80,12 @@ function createFileSessionStorage({
       if (!id) {
         return;
       }
+      let file = getFile(dir, id);
+      if (!file) {
+        return;
+      }
       try {
-        await fsp.unlink(getFile(dir, id));
+        await fsp.unlink(file);
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
       }
@@ -80,6 +93,9 @@ function createFileSessionStorage({
   });
 }
 function getFile(dir, id) {
+  if (!/^[0-9a-f]{16}$/i.test(id)) {
+    return null;
+  }
   return path.join(dir, id.slice(0, 4), id.slice(4));
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@react-router/node",
-  "version": "7.9.3",
+  "version": "7.9.4-pre.0",
   "description": "Node.js platform abstractions for React Router",
   "bugs": {
     "url": "https://github.com/remix-run/react-router/issues"
@@ -52,11 +52,11 @@
     "tsup": "^8.3.0",
     "typescript": "^5.1.6",
     "wireit": "0.14.9",
-    "react-router": "7.9.3"
+    "react-router": "7.9.4-pre.0"
   },
   "peerDependencies": {
     "typescript": "^5.1.0",
-    "react-router": "7.9.3"
+    "react-router": "7.9.4-pre.0"
   },
   "peerDependenciesMeta": {
     "typescript": {