@timber-js/app 0.2.0-alpha.131 → 0.2.0-alpha.132

package/dist/server/internal.js

@@ -1615,6 +1615,16 @@ function escapeXml(str) {
 * See design/07-routing.md §"Intercepting Routes"
 */
 /**
+* Check if a pathname starts with a prefix on a segment boundary.
+*
+* Prevents /feed from matching /feed-private — the prefix must be
+* followed by '/' or be an exact match.
+*/
+function hasSegmentPrefix(pathname, prefix) {
+	if (!pathname.startsWith(prefix)) return false;
+	return pathname.length === prefix.length || pathname[prefix.length] === "/";
+}
+/**
 * Check if an intercepting route applies for this soft navigation.
 *
 * Matches the target pathname against interception rewrites, constrained
@@ -1624,7 +1634,7 @@ function escapeXml(str) {
 */
 function findInterceptionMatch(targetPathname, sourceUrl, rewrites) {
 	for (const rewrite of rewrites) {
-		if (!sourceUrl.startsWith(rewrite.interceptingPrefix)) continue;
+		if (!hasSegmentPrefix(sourceUrl, rewrite.interceptingPrefix)) continue;
 		if (pathnameMatchesPattern(targetPathname, rewrite.interceptedPattern)) return { sourcePathname: rewrite.interceptingPrefix };
 	}
 	return null;
@@ -1792,6 +1802,25 @@ async function outcomeToResponse(config, outcome, ctx) {
 * See design/07-routing.md §"Request Lifecycle", design/02-rendering-pipeline.md §"Request Flow".
 */
 /**
+* Validate and canonicalize the X-Timber-URL header value.
+*
+* Returns the canonical pathname if valid, or null if rejected:
+* - Must start with '/' (relative pathname, no scheme/authority)
+* - Must not contain control characters
+* - Must pass canonicalization (no encoded separators, null bytes, etc.)
+*/
+function validateInterceptionHeader(raw, stripTrailingSlash) {
+	if (!raw.startsWith("/")) return null;
+	if (raw.startsWith("//")) return null;
+	for (let i = 0; i < raw.length; i++) {
+		const code = raw.charCodeAt(i);
+		if (code <= 31 || code === 127) return null;
+	}
+	const result = canonicalize(raw, stripTrailingSlash);
+	if (!result.ok) return null;
+	return result.pathname;
+}
+/**
 * Run the proxy.ts phase. Calls user proxy code and uses `handleRequest` as
 * the inner `next()` continuation. The proxy resolver was picked at pipeline
 * construction time so the hot path sees no per-request branching on the
@@ -1976,7 +2005,8 @@ async function handleRequest(config, req, method, path) {
 		if (config.onPipelineError && error instanceof Error) config.onPipelineError(error, "auto-sitemap");
 		return new Response(null, { status: 500 });
 	}
-	if ((req.headers.get("Accept") ?? "").includes("text/x-component")) {
+	const isRscRequest = (req.headers.get("Accept") ?? "").includes("text/x-component");
+	if (isRscRequest) {
 		if (!checkVersionSkew(req).ok) {
 			const reloadHeaders = new Headers();
 			applyReloadHeaders(reloadHeaders);
@@ -1988,14 +2018,17 @@ async function handleRequest(config, req, method, path) {
 	}
 	let match = config.matchRoute(canonicalPathname);
 	let interception;
-	const sourceUrl = req.headers.get("X-Timber-URL");
-	if (sourceUrl && config.interceptionRewrites?.length) {
-		const intercepted = findInterceptionMatch(canonicalPathname, sourceUrl, config.interceptionRewrites);
-		if (intercepted) {
-			const sourceMatch = config.matchRoute(intercepted.sourcePathname);
-			if (sourceMatch) {
-				match = sourceMatch;
-				interception = { targetPathname: canonicalPathname };
+	if (isRscRequest && config.interceptionRewrites?.length) {
+		const rawSourceUrl = req.headers.get("X-Timber-URL");
+		const validatedSourceUrl = rawSourceUrl ? validateInterceptionHeader(rawSourceUrl, stripTrailingSlash) : null;
+		if (validatedSourceUrl) {
+			const intercepted = findInterceptionMatch(canonicalPathname, validatedSourceUrl, config.interceptionRewrites);
+			if (intercepted) {
+				const sourceMatch = config.matchRoute(intercepted.sourcePathname);
+				if (sourceMatch) {
+					match = sourceMatch;
+					interception = { targetPathname: canonicalPathname };
+				}
 			}
 		}
 	}
@@ -2084,13 +2117,26 @@ function createPipeline(config) {
 					}, async () => {
 						const otelIds = await getOtelTraceId();
 						if (otelIds) replaceTraceId(otelIds.traceId, otelIds.spanId);
+						const stripTrailingSlash = config.stripTrailingSlash ?? true;
+						const canonResult = canonicalize(url.pathname, stripTrailingSlash);
+						if (!canonResult.ok) {
+							if (isDebug()) console.warn(`[timber] URL canonicalization rejected ${method} ${url.pathname} — responding with ${canonResult.status}\n  This usually means the URL contains encoded separators (%2f, %5c),\n  null bytes (%00), path traversal (..), or malformed percent-encoding.`);
+							return new Response(null, { status: canonResult.status });
+						}
+						const canonicalPath = canonResult.pathname;
+						let canonicalReq = req;
+						if (url.pathname !== canonicalPath) {
+							const canonicalUrl = new URL(req.url);
+							canonicalUrl.pathname = canonicalPath;
+							canonicalReq = new Request(canonicalUrl.toString(), req);
+						}
 						let result;
-						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, req, method, path), {
-							req,
+						if (proxyResolver) result = await outcomeToResponse(config, await runProxyPhase(config, proxyResolver, canonicalReq, method, canonicalPath), {
+							req: canonicalReq,
 							method,
-							path
+							path: canonicalPath
 						});
-						else result = await handleRequest(config, req, method, path);
+						else result = await handleRequest(config, canonicalReq, method, canonicalPath);
 						await setSpanAttribute("http.response.status_code", result.status);
 						if (serverTiming === "detailed") {
 							const timingHeader = getServerTimingHeader();