@salesforce/pwa-kit-runtime 3.17.0 → 3.17.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/pwa-kit-runtime",
-  "version": "3.17.0",
+  "version": "3.17.1",
   "description": "The PWAKit Runtime",
   "homepage": "https://github.com/SalesforceCommerceCloud/pwa-kit/tree/develop/packages/pwa-kit-runtime#readme",
   "bugs": {
@@ -48,11 +48,11 @@
   },
   "devDependencies": {
     "@loadable/component": "^5.15.3",
-    "@salesforce/pwa-kit-dev": "3.17.0",
+    "@salesforce/pwa-kit-dev": "3.17.1",
     "@serverless/event-mocks": "^1.1.1",
     "aws-lambda-mock-context": "^3.2.1",
     "fs-extra": "^11.1.1",
-    "internal-lib-build": "3.17.0",
+    "internal-lib-build": "3.17.1",
     "nock": "^13.3.0",
     "nodemon": "^2.0.22",
     "sinon": "^13.0.2",
@@ -60,7 +60,7 @@
     "supertest": "^4.0.2"
   },
   "peerDependencies": {
-    "@salesforce/pwa-kit-dev": "3.17.0"
+    "@salesforce/pwa-kit-dev": "3.17.1"
   },
   "peerDependenciesMeta": {
     "@salesforce/pwa-kit-dev": {
@@ -74,5 +74,5 @@
   "publishConfig": {
     "directory": "dist"
   },
-  "gitHead": "6d0cfd2308b9f25d8badd722469074889bd3b891"
+  "gitHead": "d09ed57f84432913ab3e55e3073802d319c5dc3c"
 }

package/ssr/server/build-remote-server.js

@@ -27,6 +27,7 @@ var _loggerInstance = _interopRequireDefault(require("../../utils/logger-instanc
 var _httpProxyMiddleware = require("http-proxy-middleware");
 var _hybridProxy = require("../../utils/ssr-server/hybrid-proxy");
 var _convertExpressRoute = require("../../utils/ssr-server/convert-express-route");
+var _ssrConfig = require("../../utils/ssr-config");
 var _serverlessAdapter = require("@h4ad/serverless-adapter");
 var _default = require("@h4ad/serverless-adapter/lib/handlers/default");
 var _callback = require("@h4ad/serverless-adapter/lib/resolvers/callback");
@@ -445,6 +446,7 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
    * @private
    */
   _setupBasePathMiddleware(app) {
+    var _getConfig, _getConfig$app, _getConfig$app$url;
     // Cache the express route regexes to avoid re-calculating them on every request.
     let expressRouteRegexes;
 
@@ -490,11 +492,19 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
      * If the server receives a request containing the base path, remove it before allowing
      * the request through to the other express endpoints
      *
-     * We scope base path removal to /mobify routes and routes defined by the express app
-     * (For example /callback or /worker.js)
+     * We scope base path removal to /mobify routes, /__pwa-kit routes (when showBasePath
+     * is false), and routes defined by the express app (For example /callback or /worker.js).
      * This is to avoid affecting React Router routes where a site id or locale might be present
      * that is equal to the base path.
      *
+     * /__pwa-kit routes are a special case. These are internal PWA Kit routes
+     * (e.g. /__pwa-kit/refresh) that are registered as React Router routes and are invoked
+     * by the Storefront Preview code on Runtime Admin (which always appends a base path if set).
+     * When showBasePath is false, React Router has no basename, so we redirect to the clean
+     * URL (without base path) so the browser navigates to a path that React Router can match
+     * and hydrate correctly on the client.
+     * When showBasePath is true, React Router handles the base path via its basename prop.
+     *
      * For example, if you have a base path of /us and a site id of /us we don't want
      * to remove the /us from www.example.com/us/en-US/category/... as this route is handled by
      * React Router and the PWA multisite implementation.
@@ -502,6 +512,7 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
      * @param req {express.req} the incoming request - modified in-place
      * @private
      */
+    const showBasePath = ((_getConfig = (0, _ssrConfig.getConfig)()) === null || _getConfig === void 0 ? void 0 : (_getConfig$app = _getConfig.app) === null || _getConfig$app === void 0 ? void 0 : (_getConfig$app$url = _getConfig$app.url) === null || _getConfig$app$url === void 0 ? void 0 : _getConfig$app$url.showBasePath) === true;
     const removeBasePathMiddleware = (req, res, next) => {
       const basePath = (0, _ssrNamespacePaths.getEnvBasePath)();
 
@@ -515,8 +526,20 @@ const RemoteServerFactory = exports.RemoteServerFactory = {
         return next();
       }
 
-      // For other routes, only proceed if path actually starts with base path
-      if (!req.path.startsWith(basePath)) {
+      // /__pwa-kit routes: when showBasePath is false, the browser URL still has the
+      // base path but client-side React Router has no basename, so hydration would fail.
+      // Redirect to the clean URL so the browser navigates to a path React Router matches.
+      if (!showBasePath && req.path.startsWith(`${basePath}/__pwa-kit`)) {
+        const cleanPath = removeBasePathFromPath(req.path);
+        const {
+          search
+        } = (0, _ssrServer.parseRequestUrl)(req);
+        return res.redirect(302, cleanPath + search);
+      }
+
+      // For other routes, only proceed if path equals basePath or path starts with basePath + '/'
+      const pathMatchesBasePath = req.path === basePath || req.path.startsWith(basePath + '/');
+      if (!pathMatchesBasePath) {
         return next();
       }
 

package/ssr/server/express.test.js

@@ -13,6 +13,7 @@ var _ssrCache = require("../../utils/ssr-cache");
 var _ssrServer = require("../../utils/ssr-server");
 var ssrServerUtils = _interopRequireWildcard(require("../../utils/ssr-server/utils"));
 var ssrConfig = _interopRequireWildcard(require("../../utils/ssr-config"));
+var ssrNamespacePaths = _interopRequireWildcard(require("../../utils/ssr-namespace-paths"));
 var _buildRemoteServer = require("./build-remote-server");
 var _constants = require("./constants");
 var _express2 = require("./express");
@@ -1191,10 +1192,16 @@ describe('SLAS private client proxy', () => {
   }));
 });
 describe('Base path tests', () => {
+  beforeEach(() => {
+    // Re-establish the getConfig mock that afterEach's restoreAllMocks clears.
+    // _setupBasePathMiddleware reads getConfig() at setup time.
+    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({});
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
   test('Base path is removed from /mobify request path and still gets through to /mobify endpoint', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
     return (0, _supertest.default)(app).get('/basepath/mobify/ping').then(response => {
       expect(response.status).toBe(200);
@@ -1202,9 +1209,7 @@ describe('Base path tests', () => {
   }), 15000);
   test('should not remove base path from non /mobify non-express routes', /*#__PURE__*/_asyncToGenerator(function* () {
     // Set base path to something that might also be a site id used by react router routes
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/us'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/us');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
 
     // Add a middleware to capture the request path after base path processing
@@ -1221,9 +1226,7 @@ describe('Base path tests', () => {
     });
   }), 15000);
   test('should remove base path from routes with path parameters', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
     app.get('/api/users/:id', (req, res) => {
       res.status(200).json({
@@ -1236,9 +1239,7 @@ describe('Base path tests', () => {
     });
   }), 15000);
   test('should remove base path from routes defined with regex', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
     app.get(/\/api\/users\/\d+/, (req, res) => {
       // Extract the user ID from the URL path since regex routes don't create req.params automatically
@@ -1253,25 +1254,8 @@ describe('Base path tests', () => {
       expect(response.body.userId).toBe('123');
     });
   }), 15000);
-  test('remove base path can handle multi-part base paths', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/my/base/path'
-    });
-    const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
-    app.get('/api/test', (req, res) => {
-      res.status(200).json({
-        message: 'test'
-      });
-    });
-    return (0, _supertest.default)(app).get('/my/base/path/api/test').then(response => {
-      expect(response.status).toBe(200);
-      expect(response.body.message).toBe('test');
-    });
-  }), 15000);
   test('should handle optional characters in route pattern', /*#__PURE__*/_asyncToGenerator(function* () {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/basepath'
-    });
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
     const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
 
     // This route is intentionally made complex to test the following:
@@ -1289,4 +1273,39 @@ describe('Base path tests', () => {
       expect(response.body.message).toBe('test');
     });
   }), 15000);
+  test('should redirect /__pwa-kit routes to clean URL when showBasePath is false', /*#__PURE__*/_asyncToGenerator(function* () {
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
+    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
+      app: {
+        url: {
+          showBasePath: false
+        }
+      }
+    });
+    const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
+    return (0, _supertest.default)(app).get('/basepath/__pwa-kit/refresh?referrer=/some-page').expect(302).then(response => {
+      // Should redirect to the clean URL without base path
+      expect(response.headers.location).toBe('/__pwa-kit/refresh?referrer=/some-page');
+    });
+  }), 15000);
+  test('should not remove base path from /__pwa-kit routes when showBasePath is true', /*#__PURE__*/_asyncToGenerator(function* () {
+    jest.spyOn(ssrNamespacePaths, 'getEnvBasePath').mockReturnValue('/basepath');
+    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
+      app: {
+        url: {
+          showBasePath: true
+        }
+      }
+    });
+    const app = _buildRemoteServer.RemoteServerFactory._createApp(opts());
+    let capturedPath = null;
+    app.use((req, res, next) => {
+      capturedPath = req.path;
+      next();
+    });
+    return (0, _supertest.default)(app).get('/basepath/__pwa-kit/refresh').then(() => {
+      // Base path should NOT be stripped since React Router handles it via basename
+      expect(capturedPath).toBe('/basepath/__pwa-kit/refresh');
+    });
+  }), 15000);
 });

package/utils/ssr-namespace-paths.js

@@ -4,9 +4,6 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.ssrNamespace = exports.slasPrivateProxyPath = exports.proxyBasePath = exports.healthCheckPath = exports.getEnvBasePath = exports.cachingBasePath = exports.bundleBasePath = void 0;
-var _ssrConfig = require("./ssr-config");
-var _loggerInstance = _interopRequireDefault(require("./logger-instance"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 /*
  * Copyright (c) 2025, salesforce.com, inc.
  * All rights reserved.
@@ -32,35 +29,39 @@ const SLAS_PRIVATE_CLIENT_PROXY_PATH = `${MOBIFY_PATH}/slas/private`;
 
 /*
  * Returns the base path. This is prepended to a /mobify path.
- * Returns an empty string if the base path is not set or is '/'.
+ * Returns an empty string if the base path is not set.
+ * Throws an error if the base path is not valid.
+ *
+ * Use this function if you are working with an express route
+ * (ie. The route is defined in ssr.js).
+ *
+ * Use getRouterBasePath (pwa-kit-react-sdk) if you are working
+ * with a React Router route
+ * (ie. The route is defined in routes.jsx).
  */
 const getEnvBasePath = () => {
-  const config = (0, _ssrConfig.getConfig)();
-  let basePath = (config === null || config === void 0 ? void 0 : config.envBasePath) || '';
-  if (typeof basePath !== 'string') {
-    _loggerInstance.default.warn('Invalid envBasePath configuration. No base path is applied.', {
-      namespace: 'ssr-namespace-paths.getEnvBasePath'
-    });
-    return '';
+  let basePath = '';
+  if (typeof window !== 'undefined') {
+    basePath = window.__MRT_ENV_BASE_PATH__ || '';
+  } else {
+    basePath = process.env.MRT_ENV_BASE_PATH || '';
   }
 
-  // Normalize the base path
-  basePath = basePath.trim().replace(/^\/?/, '/') // Ensure leading slash
-  .replace(/\/+/g, '/') // Normalize multiple slashes
-  .replace(/\/$/, ''); // Remove trailing slash
-
-  // Return empty string for root path or empty result
-  if (basePath === '/' || !basePath) {
+  // Return empty string if no base path is set
+  if (!basePath) {
     return '';
   }
 
-  // only allow simple, safe characters
-  // eslint-disable-next-line no-useless-escape
-  if (!/^\/[a-zA-Z0-9\-_\/]*$/.test(basePath)) {
-    _loggerInstance.default.warn('Invalid envBasePath configuration. Only letters, numbers, hyphens, underscores, and slashes allowed. No base path is applied.', {
-      namespace: 'ssr-namespace-paths.getEnvBasePath'
-    });
-    return '';
+  // MRT will throw an error on bundle upload if the base path does not match
+  // the following regex: /^\/[a-zA-Z0-9_.+$~"'@:-]{1,63}$/
+  // This validates:
+  // - Starts with /
+  // - Followed by 1-63 characters (letters, numbers, and special chars: - _ . + $ ~ " ' @ :)
+  // - No additional slashes (multi-part paths not allowed, no trailing slashes)
+  // - No spaces
+  // - Total max length of 64 characters (1 slash + 63 chars)
+  if (!/^\/[a-zA-Z0-9_.+$~"'@:-]{1,63}$/.test(basePath)) {
+    throw new Error("Invalid envBasePath configuration. Base path must start with '/' followed by 1-63 characters. Only letters, numbers, and the following special characters are allowed: - _ . + $ ~ \" ' @ :");
   }
   return basePath;
 };

package/utils/ssr-namespace-paths.test.js

@@ -1,55 +1,98 @@
 "use strict";
 
 var _ssrNamespacePaths = require("./ssr-namespace-paths");
-var ssrConfig = _interopRequireWildcard(require("./ssr-config"));
-function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-/*
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _defineProperty(e, r, t) { return (r = _toPropertyKey(r)) in e ? Object.defineProperty(e, r, { value: t, enumerable: !0, configurable: !0, writable: !0 }) : e[r] = t, e; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == typeof i ? i : i + ""; }
+function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != typeof i) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); } /*
  * Copyright (c) 2024, Salesforce, Inc.
  * All rights reserved.
  * SPDX-License-Identifier: BSD-3-Clause
  * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/BSD-3-Clause
  */
-
-jest.mock('./ssr-config');
 describe('ssr-namespace-paths tests', () => {
-  test('getEnvBasePath returns base path from config', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/sample'
-    });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
+  const originalEnv = process.env;
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = _objectSpread({}, originalEnv);
+    delete process.env.MRT_ENV_BASE_PATH;
+    // Ensure we're in Node environment (no window)
+    delete global.window;
   });
-  test('getEnvBasePath returns empty string if no base path is set', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({});
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
+  afterEach(() => {
+    process.env = originalEnv;
+    delete global.window;
   });
-  test('getEnvBasePath returns empty string if envBasePath is not a string', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: 123
+  describe('Node environment (process.env)', () => {
+    test('getEnvBasePath returns base path from environment variable', () => {
+      process.env.MRT_ENV_BASE_PATH = '/sample';
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
-  });
-  test('getEnvBasePath removes trailing slash', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/sample/'
+    test('getEnvBasePath returns empty string if no base path is set', () => {
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
-  });
-  test('getEnvBasePath returns empty string if invalid cahracters are detected in envBasePath', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '/sample.*'
+    test('getEnvBasePath throws error for base path with trailing slash', () => {
+      process.env.MRT_ENV_BASE_PATH = '/sample/';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
-  });
-  test('getEnvBasePath normalizes envBasePath', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '  //sample/  '
+    test('getEnvBasePath throws error for just a slash', () => {
+      process.env.MRT_ENV_BASE_PATH = '/';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error if invalid characters are detected in envBasePath', () => {
+      process.env.MRT_ENV_BASE_PATH = '/sample<script>';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for envBasePath with whitespace', () => {
+      process.env.MRT_ENV_BASE_PATH = '  /sample  ';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for multi-part base paths with slashes', () => {
+      process.env.MRT_ENV_BASE_PATH = '/test/sample';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath allows special characters: . + $ ~ " \' @ : -', () => {
+      process.env.MRT_ENV_BASE_PATH = '/a.b+c$d~e"f\'g@h:i-j_k';
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/a.b+c$d~e"f\'g@h:i-j_k');
+    });
+    test('getEnvBasePath throws error if base path exceeds 64 characters', () => {
+      // 65 characters total (1 slash + 64 chars)
+      process.env.MRT_ENV_BASE_PATH = '/' + 'a'.repeat(64);
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath allows base path of exactly 64 characters', () => {
+      // 64 characters total (1 slash + 63 chars)
+      process.env.MRT_ENV_BASE_PATH = '/' + 'a'.repeat(63);
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/' + 'a'.repeat(63));
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
   });
-  test('getEnvBasePath works with multiple part base path', () => {
-    jest.spyOn(ssrConfig, 'getConfig').mockReturnValue({
-      envBasePath: '//test/sample/  '
+  describe('Browser environment (window)', () => {
+    beforeEach(() => {
+      global.window = {};
+    });
+    test('getEnvBasePath returns base path from window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/sample';
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/sample');
+    });
+    test('getEnvBasePath returns empty string if window global is not set', () => {
+      expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('');
+    });
+    test('getEnvBasePath throws error for base path with trailing slash from window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/sample/';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for window global value with whitespace', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '  /sample  ';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error if invalid characters in window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/sample<script>';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
+    });
+    test('getEnvBasePath throws error for multi-part base paths in window global', () => {
+      global.window.__MRT_ENV_BASE_PATH__ = '/test/sample';
+      expect(() => (0, _ssrNamespacePaths.getEnvBasePath)()).toThrow('Invalid envBasePath configuration');
     });
-    expect((0, _ssrNamespacePaths.getEnvBasePath)()).toBe('/test/sample');
   });
 });