@reckona/mreact-router 0.0.137 → 0.0.139

package/src/client.ts

@@ -2240,6 +2240,7 @@ export async function buildClientRouteEntrySource(
   },
   fetchRevalidationInstalled: false,
   installed: false,
+  prefetchedUrls: new Set(),
   prefetchedScripts: new Set(),
   reloadNextNavigationFetch: false,
   routePrefetchManifest: undefined,
@@ -2593,6 +2594,12 @@ export async function __mreactPrefetch(url) {
     return false;
   }
 
+  if (__mreactNavigationState.prefetchedUrls.has(href)) {
+    return true;
+  }
+
+  __mreactNavigationState.prefetchedUrls.add(href);
+
   const script = __mreactRouteScriptForNavigationUrl(href);
 
   if (script === undefined) {
@@ -2690,6 +2697,10 @@ export async function __mreactNavigate(url, options = {}) {
 
   try {
     const cachedHtml = __mreactCachedNavigationHtml(href);
+    const script = __mreactRouteScriptForNavigationUrl(href);
+    if (script !== undefined) {
+      void __mreactPrefetchRouteScript(script);
+    }
     const html = cachedHtml ?? await __mreactFetchNavigationHtml(href);
 
     if (typeof html !== "string") {
@@ -2842,12 +2853,14 @@ export function __mreactInvalidateNavigationCache(path) {
   for (const href of Array.from(__mreactNavigationState.cache.keys())) {
     if (__mreactNormalizeNavigationPath(href) === normalizedPath) {
       __mreactNavigationState.cache.delete(href);
+      __mreactNavigationState.prefetchedUrls.delete(href);
     }
   }
 }
 
 function __mreactInvalidateAllNavigationCache() {
   __mreactNavigationState.cache.clear();
+  __mreactNavigationState.prefetchedUrls.clear();
 }
 
 function __mreactFetchNavigationHtml(href) {
@@ -2903,11 +2916,19 @@ function __mreactNormalizeNavigationPath(path) {
 }
 
 export function __mreactRestoreHistoryState(state) {
-  if (state === null || state === undefined || state.__mreact !== true || typeof state.html !== "string") {
+  if (state === null || state === undefined || state.__mreact !== true) {
     return false;
   }
 
-  const applied = __mreactApplyNavigationHtml(state.html, state.url);
+  const html = typeof state.html === "string"
+    ? state.html
+    : typeof state.url === "string" ? __mreactNavigationState.cache.get(state.url) : undefined;
+
+  if (typeof html !== "string") {
+    return false;
+  }
+
+  const applied = __mreactApplyNavigationHtml(html, state.url);
 
   if (!applied) {
     return false;
@@ -3120,15 +3141,14 @@ function __mreactSyncRouteDataScripts(root, currentRouteId, nextRouteId) {
     return;
   }
 
-  for (const element of Array.from(document.querySelectorAll(__mreactRouteDataScriptSelector()))) {
-    if (managedIds.has(element.id)) {
-      element.remove();
-    }
-  }
+  for (const id of managedIds) {
+    document.getElementById(id)?.remove();
+    const next = typeof root.getElementById === "function"
+      ? root.getElementById(id)
+      : root.querySelector(\`#\${id}\`);
 
-  for (const element of Array.from(root.querySelectorAll(__mreactRouteDataScriptSelector()))) {
-    if (managedIds.has(element.id)) {
-      document.body.appendChild(element);
+    if (next !== null && next !== undefined) {
+      document.body.appendChild(next);
     }
   }
 }
@@ -3155,13 +3175,29 @@ function __mreactRouteDataScriptSelector() {
 function __mreactCurrentHistoryState(url) {
   return {
     __mreact: true,
-    html: document.body.innerHTML,
+    html: __mreactCurrentDocumentRouteHtml(),
     scrollX: Number(globalThis.scrollX ?? 0),
     scrollY: Number(globalThis.scrollY ?? 0),
     url,
   };
 }
 
+function __mreactCurrentDocumentRouteHtml() {
+  if (typeof document === "undefined") {
+    return undefined;
+  }
+
+  const marker = document.querySelector("[" + __mreactRouteMarkerAttribute + "]");
+  if (marker === null) {
+    return undefined;
+  }
+
+  const routeDataScripts = Array.from(document.querySelectorAll(__mreactRouteDataScriptSelector()))
+    .map((script) => script.outerHTML)
+    .join("");
+  return marker.outerHTML + routeDataScripts;
+}
+
 function __mreactPushHistoryState(url) {
   if (typeof history === "undefined" || url === undefined) {
     return;
@@ -4245,7 +4281,8 @@ export function cell(initial) {
       buildApi.onLoad({ filter: /^devtools$/, namespace: "mreact-devtools-stub" }, () => ({
         contents: `export function emitReactiveDevtoolsEvent() {}
 export function hasReactiveDevtoolsEmitter() { return false; }
-export function currentDevtoolsEmitter() { return undefined; }`,
+export function currentDevtoolsEmitter() { return undefined; }
+export function currentReactiveDevtools() { return undefined; }`,
         loader: "ts",
       }));
       buildApi.onLoad({ filter: /\.(?:mreact\.)?[cm]?[jt]sx$/ }, async (args) => {

package/src/dev-server.ts

@@ -28,6 +28,7 @@ export interface StartDevServerOptions extends AppRouterProjectOptions {
   logger?: AppRouterLogger | undefined;
   routeCache?: AppRouterCache | undefined;
   serverActions?: AppRouterServerActionOptions | undefined;
+  verboseErrors?: boolean | undefined;
   viteConfig?: UserConfig | undefined;
   onUpgrade?: HttpUpgradeHandler | undefined;
 }
@@ -87,7 +88,7 @@ export async function startDevServer(
     }
 
     if (vite === undefined) {
-      sendDevServerError(outgoing, new Error("Vite dev server is not initialized."));
+      sendDevServerError(outgoing, new Error("Vite dev server is not initialized."), options);
       return;
     }
 
@@ -96,7 +97,7 @@ export async function startDevServer(
         if (error instanceof Error) {
           vite?.ssrFixStacktrace(error);
         }
-        sendDevServerError(outgoing, error);
+        sendDevServerError(outgoing, error, options);
         return;
       }
 
@@ -263,8 +264,14 @@ function definedProjectOptions(options: StartDevServerOptions): AppRouterProject
   };
 }
 
-function sendDevServerError(outgoing: ServerResponse, error: unknown): void {
+function sendDevServerError(
+  outgoing: ServerResponse,
+  error: unknown,
+  options: Pick<StartDevServerOptions, "verboseErrors">,
+): void {
   outgoing.statusCode = 500;
   outgoing.setHeader("content-type", "text/plain; charset=utf-8");
-  outgoing.end(error instanceof Error ? error.stack : String(error));
+  outgoing.end(options.verboseErrors === true
+    ? error instanceof Error ? error.stack : String(error)
+    : "Internal Server Error");
 }

package/src/link.ts

@@ -1,4 +1,4 @@
-import { escapeHtmlAttribute } from "@reckona/mreact-shared/html-escape";
+import { escapeHtmlAttribute, escapeHtmlText } from "@reckona/mreact-shared/html-escape";
 import type { HtmlSink } from "@reckona/mreact-shared/compiler-contract";
 import type { ReactCompatElement, ReactCompatNode } from "@reckona/mreact-compat";
 import { safeUrlAttributeValue } from "@reckona/mreact-shared/url-safety";
@@ -87,7 +87,14 @@ function createAnchorElement(props: Record<string, unknown>): HTMLAnchorElement
       continue;
     }
 
-    anchor.setAttribute(attributeName(name), String(value));
+    const attrName = attributeName(name);
+    const safeValue = safeUrlAttributeValue(attrName, String(value));
+
+    if (safeValue === undefined) {
+      continue;
+    }
+
+    anchor.setAttribute(attrName, safeValue);
   }
 
   return anchor;
@@ -164,5 +171,19 @@ function renderChildren(child: LinkChild): string {
     return child.map(renderChildren).join("");
   }
 
-  return String(child);
+  if (typeof child === "string" && isPreRenderedSafeHtmlChild(child)) {
+    return child;
+  }
+
+  return escapeHtmlText(child);
+}
+
+function isPreRenderedSafeHtmlChild(value: string): boolean {
+  if (!/[<&]/.test(value)) {
+    return false;
+  }
+
+  return !/(?:<\s*\/?\s*(?:script|style|iframe|object|embed|link|meta|base)\b|\son[a-z]+\s*=|javascript\s*:)/iu.test(
+    value,
+  );
 }

package/src/middleware.ts

@@ -1,3 +1,5 @@
+import { normalizeRoutePath } from "./route-path.js";
+
 export interface RouteMiddlewareControl {
   skip?: boolean | readonly string[];
 }
@@ -133,20 +135,23 @@ export function mergeRouteMiddlewareControls(
 }
 
 function middlewarePatternMatches(pattern: string, pathname: string): boolean {
-  if (pattern === pathname) {
+  const normalizedPattern = normalizeRoutePath(pattern);
+  const normalizedPathname = normalizeRoutePath(pathname);
+
+  if (normalizedPattern === normalizedPathname) {
     return true;
   }
 
-  if (pattern.endsWith("/:path*")) {
-    const prefix = pattern.slice(0, -"/:path*".length);
+  if (normalizedPattern.endsWith("/:path*")) {
+    const prefix = normalizedPattern.slice(0, -"/:path*".length);
 
-    return pathname === prefix || pathname.startsWith(`${prefix}/`);
+    return normalizedPathname === prefix || normalizedPathname.startsWith(`${prefix}/`);
   }
 
-  if (pattern.endsWith("*")) {
-    const prefix = pattern.slice(0, -1);
+  if (normalizedPattern.endsWith("*")) {
+    const prefix = normalizedPattern.slice(0, -1);
 
-    return pathname.startsWith(prefix);
+    return normalizedPathname.startsWith(prefix);
   }
 
   return false;

package/src/multipart.ts

@@ -1,5 +1,6 @@
 export interface MultipartStreamParseOptions {
   fields?: Readonly<Record<string, MultipartStreamFieldOptions>>;
+  maxParts?: number;
   maxBytes?: number;
 }
 
@@ -11,6 +12,7 @@ export interface MultipartStreamFieldOptions {
 export interface MultipartStreamPart {
   name: string;
   filename?: string;
+  safeFilename?: string;
   contentType?: string;
   headers: Headers;
   body: ReadableStream<Uint8Array<ArrayBufferLike>>;
@@ -34,6 +36,8 @@ interface PartWriter {
 const crlf = "\r\n";
 const headerSeparator = "\r\n\r\n";
 const maxHeaderBytes = 64 * 1024;
+export const defaultMultipartMaxBytes = 10 * 1024 * 1024;
+export const defaultMultipartMaxParts = 1_000;
 
 export function parseMultipartStream(
   request: Request,
@@ -73,6 +77,7 @@ async function parseMultipartRequest(
   const keepTailBytes = delimiter.length + 4;
   let buffer: Uint8Array<ArrayBufferLike> = new Uint8Array();
   let totalBytes = 0;
+  let totalParts = 0;
   let started = false;
   let currentPart: PartWriter | undefined;
 
@@ -87,7 +92,7 @@ async function parseMultipartRequest(
 
       if (!next.done) {
         totalBytes += next.value.byteLength;
-        enforceByteLimit("multipart request", totalBytes, options.maxBytes);
+        enforceByteLimit("multipart request", totalBytes, options.maxBytes ?? defaultMultipartMaxBytes);
         buffer = concatBytes(buffer, next.value);
       }
 
@@ -136,6 +141,8 @@ async function parseMultipartRequest(
             break;
           }
 
+          totalParts += 1;
+          enforcePartLimit(totalParts, options.maxParts ?? defaultMultipartMaxParts);
           currentPart = createPartWriter(
             decodeAscii(buffer.slice(0, headerEnd)),
             options,
@@ -266,6 +273,7 @@ function createPart(options: {
 
   if (options.filename !== undefined) {
     part.filename = options.filename;
+    part.safeFilename = sanitizeMultipartFilename(options.filename);
   }
 
   const contentType = options.headers.get("content-type");
@@ -330,6 +338,29 @@ function enforceByteLimit(label: string, bytes: number, maxBytes: number | undef
   }
 }
 
+function enforcePartLimit(parts: number, maxParts: number | undefined): void {
+  if (maxParts !== undefined && parts > maxParts) {
+    throw new Error(`multipart request exceeded ${maxParts} parts.`);
+  }
+}
+
+export function sanitizeMultipartFilename(filename: string): string {
+  const leaf = filename.split(/[\\/]/u).at(-1) ?? "";
+  let sanitized = "";
+
+  for (const char of leaf) {
+    sanitized += isControlCharacter(char) ? "_" : char;
+  }
+
+  return sanitized === "" || sanitized === "." || sanitized === ".." ? "upload.bin" : sanitized;
+}
+
+function isControlCharacter(char: string): boolean {
+  const code = char.charCodeAt(0);
+
+  return code < 0x20 || code === 0x7f;
+}
+
 function parseMultipartBoundary(contentType: string | null): string | undefined {
   if (contentType === null) {
     return undefined;

package/src/native-route-matcher.ts

@@ -52,22 +52,43 @@ export function createNativeRouteMatcher(
 
   return {
     match(pathname): MatchedRoute | undefined {
-      const output = matcher.matchRoute(pathname);
+      return matchNativeRoute(matcher, sortedRoutes, pathname);
+    },
+  };
+}
 
-      if (output == null) {
-        return undefined;
-      }
+export function __matchNativeRouteForTesting(
+  matcher: NativeRouteMatcherInstance,
+  sortedRoutes: readonly AppRoute[],
+  pathname: string,
+): MatchedRoute | undefined {
+  return matchNativeRoute(matcher, sortedRoutes, pathname);
+}
 
-      const route = sortedRoutes[output.index];
+function matchNativeRoute(
+  matcher: NativeRouteMatcherInstance,
+  sortedRoutes: readonly AppRoute[],
+  pathname: string,
+): MatchedRoute | undefined {
+  let output: NativeMatchOutput | null | undefined;
+  try {
+    output = matcher.matchRoute(pathname);
+  } catch {
+    return undefined;
+  }
 
-      return route === undefined
-        ? undefined
-        : {
-            route,
-            params: normalizeNativeParams(route, output.params),
-          };
-    },
-  };
+  if (output == null) {
+    return undefined;
+  }
+
+  const route = sortedRoutes[output.index];
+
+  return route === undefined
+    ? undefined
+    : {
+        route,
+        params: normalizeNativeParams(route, output.params),
+      };
 }
 
 export function normalizeNativeParams(

package/src/navigation.ts

@@ -57,6 +57,10 @@ function throwUnsafeRedirect(location: string): never {
   );
 }
 
+function throwUnsafeRewrite(location: string): never {
+  throw new TypeError(`unsafe rewrite target: ${JSON.stringify(location)}`);
+}
+
 export function redirect(location: string, options: RedirectOptions = {}): never {
   if (!isSafeInternalRedirect(location)) {
     throwUnsafeRedirect(location);
@@ -134,6 +138,10 @@ export function next(): MiddlewareNext {
 }
 
 export function rewrite(location: string, init: ResponseInit = {}): Response {
+  if (!isSafeInternalRedirect(location)) {
+    throwUnsafeRewrite(location);
+  }
+
   const response = new Response(null, {
     ...init,
     status: init.status ?? 200,
@@ -198,10 +206,11 @@ export function cookies(request: Request): RequestCookies {
 
 export function rewriteLocation(response: Response): string | undefined {
   const marked = (response as { [rewriteLocationSymbol]?: unknown })[rewriteLocationSymbol];
-
-  return typeof marked === "string"
+  const candidate = typeof marked === "string"
     ? marked
     : response.headers.get(rewriteHeaderName) ?? undefined;
+
+  return candidate !== undefined && isSafeInternalRedirect(candidate) ? candidate : undefined;
 }
 
 export function isRedirectError(error: unknown): error is Error & { location: string; status: number } {