@timber-js/app 0.2.0-alpha.78 → 0.2.0-alpha.79
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -13,6 +13,16 @@
|
|
|
13
13
|
import { type ProxyExport } from './proxy.js';
|
|
14
14
|
import { type MiddlewareFn } from './middleware-runner.js';
|
|
15
15
|
import type { SegmentNode } from '../routing/types.js';
|
|
16
|
+
/**
|
|
17
|
+
* Shallow merge that skips prototype-polluting keys.
|
|
18
|
+
*
|
|
19
|
+
* Used instead of Object.assign when the source object comes from
|
|
20
|
+
* user-authored codec output (segmentParams.parse), which could
|
|
21
|
+
* contain __proto__, constructor, or prototype keys.
|
|
22
|
+
*
|
|
23
|
+
* See TIM-655, design/13-security.md
|
|
24
|
+
*/
|
|
25
|
+
export declare function safeMerge(target: Record<string, unknown>, source: Record<string, unknown>): void;
|
|
16
26
|
/** Result of matching a canonical pathname against the route tree. */
|
|
17
27
|
export interface RouteMatch {
|
|
18
28
|
/** The matched segment chain from root to leaf. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/server/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAY,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAoC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../../src/server/pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAY,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAoC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOvD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMhG;AAID,sEAAsE;AACtE,MAAM,WAAW,UAAU;IACzB,mDAAmD;IACnD,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACjD,oEAAoE;IACpE,eAAe,EAAE,YAAY,EAAE,CAAC;CACjC;AAED,6DAA6D;AAC7D,MAAM,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,UAAU,GAAG,IAAI,CAAC;AAEnE,sEAAsE;AACtE,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,MAAM,KACb,OAAO,oBAAoB,EAAE,kBAAkB,GAAG,IAAI,CAAC;AAE5D,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,UAAU,EACjB,eAAe,EAAE,OAAO,EACxB,oBAAoB,EAAE,OAAO,EAC7B,YAAY,CAAC,EAAE,mBAAmB,KAC/B,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElC,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG,CAC9B,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,KACrB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAI1B,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,OAAO,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACtD,qEAAqE;IACrE,UAAU,EAAE,YAAY,CAAC;IACzB,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C,kEAAkE;IAClE,MAAM,EAAE,aAAa,CAAC;IACtB,kEAAkE;IAClE,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzF,kFAAkF;IAClF,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,yGAAyG;IACzG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,4BAA4B,EAAE,mBAAmB,EAAE,CAAC;IAClF;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,CAAC;IAC5C;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACpE;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,CACpB,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,OAAO,KACrB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnC;AAID;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1E;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAsb1F"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@timber-js/app",
|
|
3
|
-
"version": "0.2.0-alpha.
|
|
3
|
+
"version": "0.2.0-alpha.79",
|
|
4
4
|
"description": "Vite-native React framework built for Servers and Serverless Platforms — correct HTTP semantics, real status codes, pages that work without JavaScript",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"cloudflare-workers",
|
package/src/server/pipeline.ts
CHANGED
|
@@ -51,6 +51,28 @@ import { findInterceptionMatch } from './pipeline-interception.js';
|
|
|
51
51
|
import type { MiddlewareContext } from './types.js';
|
|
52
52
|
import type { SegmentNode } from '../routing/types.js';
|
|
53
53
|
|
|
54
|
+
// ─── Prototype-Pollution-Safe Merge ────────────────────────────────────────
|
|
55
|
+
|
|
56
|
+
/** Keys that must never be merged via Object.assign — they pollute Object.prototype. */
|
|
57
|
+
const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
|
|
58
|
+
|
|
59
|
+
/**
|
|
60
|
+
* Shallow merge that skips prototype-polluting keys.
|
|
61
|
+
*
|
|
62
|
+
* Used instead of Object.assign when the source object comes from
|
|
63
|
+
* user-authored codec output (segmentParams.parse), which could
|
|
64
|
+
* contain __proto__, constructor, or prototype keys.
|
|
65
|
+
*
|
|
66
|
+
* See TIM-655, design/13-security.md
|
|
67
|
+
*/
|
|
68
|
+
export function safeMerge(target: Record<string, unknown>, source: Record<string, unknown>): void {
|
|
69
|
+
for (const key of Object.keys(source)) {
|
|
70
|
+
if (!DANGEROUS_KEYS.has(key)) {
|
|
71
|
+
target[key] = source[key];
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
}
|
|
75
|
+
|
|
54
76
|
// ─── Route Match Result ────────────────────────────────────────────────────
|
|
55
77
|
|
|
56
78
|
/** Result of matching a canonical pathname against the route tree. */
|
|
@@ -200,8 +222,9 @@ export async function coerceSegmentParams(match: RouteMatch): Promise<void> {
|
|
|
200
222
|
|
|
201
223
|
try {
|
|
202
224
|
const coerced = segmentParamsDef.parse(match.segmentParams);
|
|
203
|
-
// Merge coerced values back
|
|
204
|
-
|
|
225
|
+
// Merge coerced values back — use safeMerge to prevent prototype pollution
|
|
226
|
+
// from malicious/buggy codec output. See TIM-655.
|
|
227
|
+
safeMerge(match.segmentParams, coerced as Record<string, unknown>);
|
|
205
228
|
} catch (err) {
|
|
206
229
|
throw new ParamCoercionError(err instanceof Error ? err.message : String(err));
|
|
207
230
|
}
|