@timber-js/app 0.2.0-alpha.77 → 0.2.0-alpha.79

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/dist/_chunks/{use-params-DrjaGSER.js → use-params-Br9YSUFV.js} +1 -5
  2. package/dist/_chunks/use-params-Br9YSUFV.js.map +1 -0
  3. package/dist/client/index.js +1 -5
  4. package/dist/client/index.js.map +1 -1
  5. package/dist/client/internal.js +1 -1
  6. package/dist/client/link-pending-store.d.ts.map +1 -1
  7. package/dist/client/link.d.ts.map +1 -1
  8. package/dist/client/navigation-root.d.ts.map +1 -1
  9. package/dist/server/internal.js +19 -1
  10. package/dist/server/internal.js.map +1 -1
  11. package/dist/server/pipeline.d.ts +10 -0
  12. package/dist/server/pipeline.d.ts.map +1 -1
  13. package/package.json +1 -1
  14. package/src/client/link-pending-store.ts +1 -8
  15. package/src/client/link.tsx +0 -1
  16. package/src/client/navigation-root.tsx +0 -1
  17. package/src/server/pipeline.ts +25 -2
  18. package/dist/_chunks/use-params-DrjaGSER.js.map +0 -1
package/dist/client/navigation-root.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"navigation-root.d.ts","sourceRoot":"","sources":["../../src/client/navigation-root.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAsD,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAG3F,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAqDlE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAiCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,SAAS,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,GAAG,SAAS,CA0GZ;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAIzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAc5F"}
1
+ {"version":3,"file":"navigation-root.d.ts","sourceRoot":"","sources":["../../src/client/navigation-root.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAsD,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAG3F,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAqDlE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAEtD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAiCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,eAAe,GAChB,EAAE;IACD,OAAO,EAAE,SAAS,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC,GAAG,SAAS,CAyGZ;AAID;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,IAAI,CAIzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,KAAK,IAAI,GAAG,IAAI,CAc5F"}
package/dist/server/internal.js CHANGED
@@ -1632,6 +1632,24 @@ function pathnameMatchesPattern(pathname, pattern) {
1632
1632
  * See design/07-routing.md §"Request Lifecycle", design/02-rendering-pipeline.md §"Request Flow",
1633
1633
  * and design/17-logging.md §"Production Logging"
1634
1634
  */
1635
+ /** Keys that must never be merged via Object.assign — they pollute Object.prototype. */
1636
+ var DANGEROUS_KEYS = new Set([
1637
+ "__proto__",
1638
+ "constructor",
1639
+ "prototype"
1640
+ ]);
1641
+ /**
1642
+ * Shallow merge that skips prototype-polluting keys.
1643
+ *
1644
+ * Used instead of Object.assign when the source object comes from
1645
+ * user-authored codec output (segmentParams.parse), which could
1646
+ * contain __proto__, constructor, or prototype keys.
1647
+ *
1648
+ * See TIM-655, design/13-security.md
1649
+ */
1650
+ function safeMerge(target, source) {
1651
+ for (const key of Object.keys(source)) if (!DANGEROUS_KEYS.has(key)) target[key] = source[key];
1652
+ }
1635
1653
  /**
1636
1654
  * Run segment param coercion on the matched route's segments.
1637
1655
  *
@@ -1656,7 +1674,7 @@ async function coerceSegmentParams(match) {
1656
1674
  if (!segmentParamsDef || typeof segmentParamsDef.parse !== "function") continue;
1657
1675
  try {
1658
1676
  const coerced = segmentParamsDef.parse(match.segmentParams);
1659
- Object.assign(match.segmentParams, coerced);
1677
+ safeMerge(match.segmentParams, coerced);
1660
1678
  } catch (err) {
1661
1679
  throw new ParamCoercionError(err instanceof Error ? err.message : String(err));
1662
1680
  }