@tanstack/start-client-core 1.143.9 → 1.144.0

package/src/createServerFn.ts

@@ -1,10 +1,10 @@
-import { isNotFound, isRedirect } from '@tanstack/router-core'
 import { mergeHeaders } from '@tanstack/router-core/ssr/client'
 
+import { isRedirect, parseRedirect } from '@tanstack/router-core'
 import { TSS_SERVER_FUNCTION_FACTORY } from './constants'
 import { getStartOptions } from './getStartOptions'
 import { getStartContextServerOnly } from './getStartContextServerOnly'
-import type { TSS_SERVER_FUNCTION } from './constants'
+import { createNullProtoObject, safeObjectMerge } from './safeObjectMerge'
 import type {
   AnyValidator,
   Constrain,
@@ -16,6 +16,7 @@ import type {
   ValidateSerializableInput,
   Validator,
 } from '@tanstack/router-core'
+import type { TSS_SERVER_FUNCTION } from './constants'
 import type {
   AnyFunctionMiddleware,
   AnyRequestMiddleware,
@@ -112,17 +113,22 @@ export const createServerFn: CreateServerFn<Register> = (options, __opts) => {
       return Object.assign(
         async (opts?: CompiledFetcherFnOptions) => {
           // Start by executing the client-side middleware chain
-          return executeMiddleware(resolvedMiddleware, 'client', {
+          const result = await executeMiddleware(resolvedMiddleware, 'client', {
             ...extractedFn,
             ...newOptions,
             data: opts?.data as any,
             headers: opts?.headers,
             signal: opts?.signal,
-            context: {},
-          }).then((d) => {
-            if (d.error) throw d.error
-            return d.result
+            context: createNullProtoObject(),
           })
+
+          const redirect = parseRedirect(result.error)
+          if (redirect) {
+            throw redirect
+          }
+
+          if (result.error) throw result.error
+          return result.result
         },
         {
           // This copies over the URL, function ID
@@ -133,25 +139,30 @@ export const createServerFn: CreateServerFn<Register> = (options, __opts) => {
             const startContext = getStartContextServerOnly()
             const serverContextAfterGlobalMiddlewares =
               startContext.contextAfterGlobalMiddlewares
+            // Use safeObjectMerge for opts.context which comes from client
             const ctx = {
               ...extractedFn,
               ...opts,
-              context: {
-                ...serverContextAfterGlobalMiddlewares,
-                ...opts.context,
-              },
+              context: safeObjectMerge(
+                serverContextAfterGlobalMiddlewares,
+                opts.context,
+              ),
               signal,
               request: startContext.request,
             }
 
-            return executeMiddleware(resolvedMiddleware, 'server', ctx).then(
-              (d) => ({
-                // Only send the result and sendContext back to the client
-                result: d.result,
-                error: d.error,
-                context: d.sendContext,
-              }),
-            )
+            const result = await executeMiddleware(
+              resolvedMiddleware,
+              'server',
+              ctx,
+            ).then((d) => ({
+              // Only send the result and sendContext back to the client
+              result: d.result,
+              error: d.error,
+              context: d.sendContext,
+            }))
+
+            return result
           },
         },
       ) as any
@@ -173,12 +184,23 @@ export async function executeMiddleware(
   opts: ServerFnMiddlewareOptions,
 ): Promise<ServerFnMiddlewareResult> {
   const globalMiddlewares = getStartOptions()?.functionMiddleware || []
-  const flattenedMiddlewares = flattenMiddlewares([
+  let flattenedMiddlewares = flattenMiddlewares([
     ...globalMiddlewares,
     ...middlewares,
   ])
 
-  const next: NextFn = async (ctx) => {
+  // On server, filter out middlewares that already executed in the request phase
+  // to prevent duplicate execution (issue #5239)
+  if (env === 'server') {
+    const startContext = getStartContextServerOnly({ throwIfNotFound: false })
+    if (startContext?.executedRequestMiddlewares) {
+      flattenedMiddlewares = flattenedMiddlewares.filter(
+        (m) => !startContext.executedRequestMiddlewares.has(m),
+      )
+    }
+  }
+
+  const callNextMiddleware: NextFn = async (ctx) => {
     // Get the next middleware
     const nextMiddleware = flattenedMiddlewares.shift()
 
@@ -187,54 +209,110 @@ export async function executeMiddleware(
       return ctx
     }
 
-    if (
-      'inputValidator' in nextMiddleware.options &&
-      nextMiddleware.options.inputValidator &&
-      env === 'server'
-    ) {
-      // Execute the middleware's input function
-      ctx.data = await execValidator(
-        nextMiddleware.options.inputValidator,
-        ctx.data,
-      )
-    }
+    // Execute the middleware
+    try {
+      if (
+        'inputValidator' in nextMiddleware.options &&
+        nextMiddleware.options.inputValidator &&
+        env === 'server'
+      ) {
+        // Execute the middleware's input function
+        ctx.data = await execValidator(
+          nextMiddleware.options.inputValidator,
+          ctx.data,
+        )
+      }
 
-    let middlewareFn: MiddlewareFn | undefined = undefined
-    if (env === 'client') {
-      if ('client' in nextMiddleware.options) {
-        middlewareFn = nextMiddleware.options.client as MiddlewareFn | undefined
+      let middlewareFn: MiddlewareFn | undefined = undefined
+      if (env === 'client') {
+        if ('client' in nextMiddleware.options) {
+          middlewareFn = nextMiddleware.options.client as
+            | MiddlewareFn
+            | undefined
+        }
+      }
+      // env === 'server'
+      else if ('server' in nextMiddleware.options) {
+        middlewareFn = nextMiddleware.options.server as MiddlewareFn | undefined
       }
-    }
-    // env === 'server'
-    else if ('server' in nextMiddleware.options) {
-      middlewareFn = nextMiddleware.options.server as MiddlewareFn | undefined
-    }
 
-    if (middlewareFn) {
-      // Execute the middleware
-      return applyMiddleware(middlewareFn, ctx, async (newCtx) => {
-        return next(newCtx).catch((error: any) => {
-          if (isRedirect(error) || isNotFound(error)) {
+      if (middlewareFn) {
+        const userNext = async (
+          userCtx: ServerFnMiddlewareResult | undefined = {} as any,
+        ) => {
+          // Return the next middleware
+          // Use safeObjectMerge for context objects to prevent prototype pollution
+          const nextCtx = {
+            ...ctx,
+            ...userCtx,
+            context: safeObjectMerge(ctx.context, userCtx.context),
+            sendContext: safeObjectMerge(ctx.sendContext, userCtx.sendContext),
+            headers: mergeHeaders(ctx.headers, userCtx.headers),
+            result:
+              userCtx.result !== undefined
+                ? userCtx.result
+                : userCtx instanceof Response
+                  ? userCtx
+                  : (ctx as any).result,
+            error: userCtx.error ?? (ctx as any).error,
+          }
+
+          try {
+            return await callNextMiddleware(nextCtx)
+          } catch (error: any) {
             return {
-              ...newCtx,
+              ...nextCtx,
               error,
             }
           }
+        }
 
-          throw error
-        })
-      })
-    }
+        // Execute the middleware
+        const result = await middlewareFn({
+          ...ctx,
+          next: userNext as any,
+        } as any)
+
+        // If result is NOT a ctx object, we need to return it as
+        // the { result }
+        if (isRedirect(result)) {
+          return {
+            ...ctx,
+            error: result,
+          }
+        }
+
+        if (result instanceof Response) {
+          return {
+            ...ctx,
+            result,
+          }
+        }
 
-    return next(ctx)
+        if (!(result as any)) {
+          throw new Error(
+            'User middleware returned undefined. You must call next() or return a result in your middlewares.',
+          )
+        }
+
+        return result
+      }
+
+      return callNextMiddleware(ctx)
+    } catch (error: any) {
+      return {
+        ...ctx,
+        error,
+      }
+    }
   }
 
   // Start the middleware chain
-  return next({
+  return callNextMiddleware({
     ...opts,
     headers: opts.headers || {},
     sendContext: opts.sendContext || {},
-    context: opts.context || {},
+    context: opts.context || createNullProtoObject(),
   })
 }
 
@@ -571,18 +649,21 @@ export interface ServerFnTypes<
   allOutput: IntersectAllValidatorOutputs<TMiddlewares, TInputValidator>
 }
 
-export function flattenMiddlewares(
-  middlewares: Array<AnyFunctionMiddleware | AnyRequestMiddleware>,
-): Array<AnyFunctionMiddleware | AnyRequestMiddleware> {
-  const seen = new Set<AnyFunctionMiddleware | AnyRequestMiddleware>()
-  const flattened: Array<AnyFunctionMiddleware | AnyRequestMiddleware> = []
+export function flattenMiddlewares<
+  T extends AnyFunctionMiddleware | AnyRequestMiddleware,
+>(middlewares: Array<T>, maxDepth: number = 100): Array<T> {
+  const seen = new Set<T>()
+  const flattened: Array<T> = []
 
-  const recurse = (
-    middleware: Array<AnyFunctionMiddleware | AnyRequestMiddleware>,
-  ) => {
+  const recurse = (middleware: Array<T>, depth: number) => {
+    if (depth > maxDepth) {
+      throw new Error(
+        `Middleware nesting depth exceeded maximum of ${maxDepth}. Check for circular references.`,
+      )
+    }
     middleware.forEach((m) => {
       if (m.options.middleware) {
-        recurse(m.options.middleware)
+        recurse(m.options.middleware as Array<T>, depth + 1)
       }
 
       if (!seen.has(m)) {
@@ -592,7 +673,7 @@ export function flattenMiddlewares(
     })
   }
 
-  recurse(middlewares)
+  recurse(middlewares, 0)
 
   return flattened
 }
@@ -622,41 +703,6 @@ export type MiddlewareFn = (
   },
 ) => Promise<ServerFnMiddlewareResult>
 
-export const applyMiddleware = async (
-  middlewareFn: MiddlewareFn,
-  ctx: ServerFnMiddlewareOptions,
-  nextFn: NextFn,
-) => {
-  return middlewareFn({
-    ...ctx,
-    next: (async (
-      userCtx: ServerFnMiddlewareResult | undefined = {} as any,
-    ) => {
-      // Return the next middleware
-      return nextFn({
-        ...ctx,
-        ...userCtx,
-        context: {
-          ...ctx.context,
-          ...userCtx.context,
-        },
-        sendContext: {
-          ...ctx.sendContext,
-          ...(userCtx.sendContext ?? {}),
-        },
-        headers: mergeHeaders(ctx.headers, userCtx.headers),
-        result:
-          userCtx.result !== undefined
-            ? userCtx.result
-            : userCtx instanceof Response
-              ? userCtx
-              : (ctx as any).result,
-        error: userCtx.error ?? (ctx as any).error,
-      })
-    }) as any,
-  } as any)
-}
-
 export function execValidator(
   validator: AnyValidator,
   input: unknown,

package/src/index.tsx

@@ -2,6 +2,9 @@ export type { JsonResponse } from '@tanstack/router-core/ssr/client'
 
 export { hydrate, json, mergeHeaders } from '@tanstack/router-core/ssr/client'
 
+export { RawStream } from '@tanstack/router-core'
+export type { OnRawStreamCallback } from '@tanstack/router-core'
+
 export {
   createIsomorphicFn,
   createServerOnlyFn,
@@ -72,7 +75,6 @@ export type {
   RequiredFetcher,
 } from './createServerFn'
 export {
-  applyMiddleware,
   execValidator,
   flattenMiddlewares,
   executeMiddleware,
@@ -81,9 +83,17 @@ export {
 export {
   TSS_FORMDATA_CONTEXT,
   TSS_SERVER_FUNCTION,
+  TSS_CONTENT_TYPE_FRAMED,
+  TSS_CONTENT_TYPE_FRAMED_VERSIONED,
+  TSS_FRAMED_PROTOCOL_VERSION,
+  FrameType,
+  FRAME_HEADER_SIZE,
   X_TSS_SERIALIZED,
   X_TSS_RAW_RESPONSE,
+  X_TSS_CONTEXT,
+  validateFramedProtocolVersion,
 } from './constants'
+export type { FrameType as FrameTypeValue } from './constants'
 
 export type * from './serverRoute'
 
@@ -100,3 +110,4 @@ export type { Register } from '@tanstack/router-core'
 export { getRouterInstance } from './getRouterInstance'
 export { getDefaultSerovalPlugins } from './getDefaultSerovalPlugins'
 export { getGlobalStartContext } from './getGlobalStartContext'
+export { safeObjectMerge, createNullProtoObject } from './safeObjectMerge'

package/src/safeObjectMerge.ts

@@ -0,0 +1,38 @@
+function isSafeKey(key: string): boolean {
+  return key !== '__proto__' && key !== 'constructor' && key !== 'prototype'
+}
+
+/**
+ * Merge target and source into a new null-proto object, filtering dangerous keys.
+ */
+export function safeObjectMerge<T extends Record<string, unknown>>(
+  target: T | undefined,
+  source: Record<string, unknown> | null | undefined,
+): T {
+  const result = Object.create(null) as T
+  if (target) {
+    for (const key of Object.keys(target)) {
+      if (isSafeKey(key)) result[key as keyof T] = target[key] as T[keyof T]
+    }
+  }
+  if (source && typeof source === 'object') {
+    for (const key of Object.keys(source)) {
+      if (isSafeKey(key)) result[key as keyof T] = source[key] as T[keyof T]
+    }
+  }
+  return result
+}
+
+/**
+ * Create a null-prototype object, optionally copying from source.
+ */
+export function createNullProtoObject<T extends object>(
+  source?: T,
+): { [K in keyof T]: T[K] } {
+  if (!source) return Object.create(null)
+  const obj = Object.create(null)
+  for (const key of Object.keys(source)) {
+    if (isSafeKey(key)) obj[key] = (source as Record<string, unknown>)[key]
+  }
+  return obj
+}