@reckona/mreact-router 0.0.138 → 0.0.140

package/src/native-route-matcher.ts

@@ -52,22 +52,43 @@ export function createNativeRouteMatcher(
 
   return {
     match(pathname): MatchedRoute | undefined {
-      const output = matcher.matchRoute(pathname);
+      return matchNativeRoute(matcher, sortedRoutes, pathname);
+    },
+  };
+}
 
-      if (output == null) {
-        return undefined;
-      }
+export function __matchNativeRouteForTesting(
+  matcher: NativeRouteMatcherInstance,
+  sortedRoutes: readonly AppRoute[],
+  pathname: string,
+): MatchedRoute | undefined {
+  return matchNativeRoute(matcher, sortedRoutes, pathname);
+}
 
-      const route = sortedRoutes[output.index];
+function matchNativeRoute(
+  matcher: NativeRouteMatcherInstance,
+  sortedRoutes: readonly AppRoute[],
+  pathname: string,
+): MatchedRoute | undefined {
+  let output: NativeMatchOutput | null | undefined;
+  try {
+    output = matcher.matchRoute(pathname);
+  } catch {
+    return undefined;
+  }
 
-      return route === undefined
-        ? undefined
-        : {
-            route,
-            params: normalizeNativeParams(route, output.params),
-          };
-    },
-  };
+  if (output == null) {
+    return undefined;
+  }
+
+  const route = sortedRoutes[output.index];
+
+  return route === undefined
+    ? undefined
+    : {
+        route,
+        params: normalizeNativeParams(route, output.params),
+      };
 }
 
 export function normalizeNativeParams(

package/src/navigation.ts

@@ -57,6 +57,10 @@ function throwUnsafeRedirect(location: string): never {
   );
 }
 
+function throwUnsafeRewrite(location: string): never {
+  throw new TypeError(`unsafe rewrite target: ${JSON.stringify(location)}`);
+}
+
 export function redirect(location: string, options: RedirectOptions = {}): never {
   if (!isSafeInternalRedirect(location)) {
     throwUnsafeRedirect(location);
@@ -134,6 +138,10 @@ export function next(): MiddlewareNext {
 }
 
 export function rewrite(location: string, init: ResponseInit = {}): Response {
+  if (!isSafeInternalRedirect(location)) {
+    throwUnsafeRewrite(location);
+  }
+
   const response = new Response(null, {
     ...init,
     status: init.status ?? 200,
@@ -198,10 +206,11 @@ export function cookies(request: Request): RequestCookies {
 
 export function rewriteLocation(response: Response): string | undefined {
   const marked = (response as { [rewriteLocationSymbol]?: unknown })[rewriteLocationSymbol];
-
-  return typeof marked === "string"
+  const candidate = typeof marked === "string"
     ? marked
     : response.headers.get(rewriteHeaderName) ?? undefined;
+
+  return candidate !== undefined && isSafeInternalRedirect(candidate) ? candidate : undefined;
 }
 
 export function isRedirectError(error: unknown): error is Error & { location: string; status: number } {