dinou 4.0.10 → 4.0.12

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.0.12] - 2026-06-28
+
+### Security
+- **Fix DOM XSS / Script Injection Vulnerability:** Replaced inline HTML/Script injection (`<script>` tags executed via `createContextualFragment` in client-side proxies) with a secure, data-driven line-based protocol for active streams and custom HTTP headers/JSON payload signaling for redirects.
+- **CSP (Content Security Policy) Compatibility:** Removed all `'unsafe-inline'` script injections, ensuring full compatibility with strict security policies.
+
+### Fixed
+- **Stream Redirection & Cookie Handling:** Improved robustness and predictability of stream reading in server-function proxies by switching to a line-by-line (`\n` delimited) streaming command parser, eliminating regex-based tag extraction.
+
+## [4.0.11]
+
+### Fixed
+
+- Security: Fix server functions endpoint vulnerability and add improvements.
+
 ## [4.0.10]
 
 ### Fixed

package/dinou/core/server-function-proxy-webpack.js

@@ -30,15 +30,30 @@ function createServerFunctionProxy(id) {
 
       if (!res.ok) throw new Error("Server function failed");
 
+      // Check header first
+      const redirectUrl = res.headers.get("X-Dinou-Redirect");
+      if (redirectUrl) {
+        window.location.href = redirectUrl;
+        return new Promise(() => { });
+      }
+
       const contentType = res.headers.get("content-type") || "";
 
-      // Case 1: Pure HTML (Simple Redirect)
+      // Reject unexpected HTML responses entirely to prevent security bugs
       if (contentType.includes("text/html")) {
         const html = await res.text();
-        const range = document.createRange();
-        const documentFragment = range.createContextualFragment(html);
-        document.body.appendChild(documentFragment);
-        return new Promise(() => { });
+        console.warn("[Dinou] Received unexpected HTML response from server function:", html);
+        throw new Error("Unexpected HTML response from server function");
+      }
+
+      // Check if it's application/json (Scenario A clean redirect or json response)
+      if (contentType.includes("application/json")) {
+        const data = await res.json();
+        if (data && data.redirect) {
+          window.location.href = data.redirect;
+          return new Promise(() => { });
+        }
+        return data;
       }
 
       // Case 2: RSC or Hybrid Stream (Buffered)
@@ -46,7 +61,6 @@ function createServerFunctionProxy(id) {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         const encoder = new TextEncoder();
-        const scriptRegex = /<script>(.*?)<\/script>/gs;
 
         const readableStream = new ReadableStream({
           async start(controller) {
@@ -58,16 +72,20 @@ function createServerFunctionProxy(id) {
                 const { done, value } = await reader.read();
 
                 if (done) {
-                  // If something remains in the buffer upon finishing, we send it (as long as it's not a broken script)
                   if (buffer.length > 0) {
-                    // CHECK: We search for the tag start, whether it has the closing > or not
-                    if (buffer.includes("<script")) {
-                      console.warn(
-                        "[Dinou] Stream ended with incomplete script. Discarding tail.",
-                      );
-                      // We do not enqueue.
+                    if (buffer.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(buffer.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = payload.url;
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line at end:", e);
+                      }
                     } else {
-                      // It is safe content (e.g., "a < b" or a cut JSON that React will handle)
                       controller.enqueue(encoder.encode(buffer));
                     }
                   }
@@ -77,65 +95,46 @@ function createServerFunctionProxy(id) {
                 // 1. ACCUMULATE
                 buffer += decoder.decode(value, { stream: true });
 
-                // 2. PROCESS COMPLETE SCRIPTS
-                // We search for complete pairs of <script>...</script>
-                let match;
-
-                // We execute all complete scripts we find
-                while ((match = scriptRegex.exec(buffer)) !== null) {
-                  const fullMatch = match[0];
-                  const scriptContent = match[1];
+                // 2. PROCESS COMPLETE LINES
+                const lastNewlineIndex = buffer.lastIndexOf("\n");
+                if (lastNewlineIndex !== -1) {
+                  const completeChunk = buffer.slice(0, lastNewlineIndex + 1);
+                  buffer = buffer.slice(lastNewlineIndex + 1);
 
-                  // Detect redirect
-                  if (scriptContent.includes("window.location.href")) {
-                    isRedirecting = true;
-                  }
+                  const lines = completeChunk.split("\n");
+                  let cleanChunk = "";
 
-                  // Inject to DOM
-                  const range = document.createRange();
-                  const fragment = range.createContextualFragment(fullMatch); // fullMatch includes tags for correct context
-                  document.body.appendChild(fragment);
-                }
+                  for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (!line && i === lines.length - 1) {
+                      continue;
+                    }
 
-                // 3. CLEAN PROCESSED SCRIPTS FROM BUFFER
-                // Once executed, we remove them so they don't go to React
-                buffer = buffer.replace(scriptRegex, "");
-
-                // 4. CALCULATE WHAT IS SAFE TO SEND (The anti-cut logic)
-                // We need to know if the buffer ends with something that LOOKS like the start of a script
-                // Dangerous patterns at the end: <, <s, <sc, <scr, <scri, <scrip, <script
-
-                let cutoffIndex = buffer.length; // Default send everything
-
-                // A) If there is an open but not closed <script> in the buffer
-                const openScriptIndex = buffer.indexOf("<script>");
-                if (openScriptIndex !== -1) {
-                  // We keep everything from the <script> onwards
-                  cutoffIndex = openScriptIndex;
-                } else {
-                  // B) If no open script, check if the end looks like a cut tag
-                  // Regex: Looks for '<' optionally followed by s, c, r, i, p, t AT THE END of the string ($)
-                  const partialTagMatch = buffer.match(/<s?c?r?i?p?t?$/);
-
-                  if (partialTagMatch) {
-                    // We save from where the suspicion starts
-                    cutoffIndex = partialTagMatch.index;
+                    if (line.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(line.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = payload.url;
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line:", e);
+                      }
+                    } else {
+                      cleanChunk += line + "\n";
+                    }
                   }
-                }
 
-                // 5. SEND SAFE CONTENT
-                const safeChunk = buffer.slice(0, cutoffIndex);
-                // What remains stays in the buffer for the next loop (chunk)
-                buffer = buffer.slice(cutoffIndex);
-
-                if (safeChunk) {
-                  controller.enqueue(encoder.encode(safeChunk));
+                  if (cleanChunk) {
+                    controller.enqueue(encoder.encode(cleanChunk));
+                  }
                 }
               }
             } catch (err) {
               controller.error(err);
             } finally {
-              // If it is NOT a redirect, we close. If it is a redirect, we leave hanging (your master trick).
               if (!isRedirecting) {
                 controller.close();
               }

package/dinou/core/server-function-proxy.js

@@ -31,15 +31,30 @@ export function createServerFunctionProxy(id) {
 
       if (!res.ok) throw new Error("Server function failed");
 
+      // Check header first
+      const redirectUrl = res.headers.get("X-Dinou-Redirect");
+      if (redirectUrl) {
+        window.location.href = redirectUrl;
+        return new Promise(() => {});
+      }
+
       const contentType = res.headers.get("content-type") || "";
 
-      // Case 1: Pure HTML (Simple Redirect)
+      // Reject unexpected HTML responses entirely to prevent security bugs
       if (contentType.includes("text/html")) {
         const html = await res.text();
-        const range = document.createRange();
-        const documentFragment = range.createContextualFragment(html);
-        document.body.appendChild(documentFragment);
-        return new Promise(() => {});
+        console.warn("[Dinou] Received unexpected HTML response from server function:", html);
+        throw new Error("Unexpected HTML response from server function");
+      }
+
+      // Check if it's application/json (Scenario A clean redirect or json response)
+      if (contentType.includes("application/json")) {
+        const data = await res.json();
+        if (data && data.redirect) {
+          window.location.href = data.redirect;
+          return new Promise(() => {});
+        }
+        return data;
       }
 
       // Case 2: RSC or Hybrid Stream (Buffered)
@@ -47,7 +62,6 @@ export function createServerFunctionProxy(id) {
         const reader = res.body.getReader();
         const decoder = new TextDecoder();
         const encoder = new TextEncoder();
-        const scriptRegex = /<script>(.*?)<\/script>/gs;
 
         const readableStream = new ReadableStream({
           async start(controller) {
@@ -59,16 +73,20 @@ export function createServerFunctionProxy(id) {
                 const { done, value } = await reader.read();
 
                 if (done) {
-                  // If something remains in the buffer upon finishing, we send it (as long as it's not a broken script)
                   if (buffer.length > 0) {
-                    // CHECK: We search for the tag start, whether it has the closing > or not
-                    if (buffer.includes("<script")) {
-                      console.warn(
-                        "[Dinou] Stream ended with incomplete script. Discarding tail.",
-                      );
-                      // We do not enqueue.
+                    if (buffer.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(buffer.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = payload.url;
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line at end:", e);
+                      }
                     } else {
-                      // It is safe content (e.g., "a < b" or a cut JSON that React will handle)
                       controller.enqueue(encoder.encode(buffer));
                     }
                   }
@@ -78,65 +96,46 @@ export function createServerFunctionProxy(id) {
                 // 1. ACCUMULATE
                 buffer += decoder.decode(value, { stream: true });
 
-                // 2. PROCESS COMPLETE SCRIPTS
-                // We search for complete pairs of <script>...</script>
-                let match;
-
-                // We execute all complete scripts we find
-                while ((match = scriptRegex.exec(buffer)) !== null) {
-                  const fullMatch = match[0];
-                  const scriptContent = match[1];
+                // 2. PROCESS COMPLETE LINES
+                const lastNewlineIndex = buffer.lastIndexOf("\n");
+                if (lastNewlineIndex !== -1) {
+                  const completeChunk = buffer.slice(0, lastNewlineIndex + 1);
+                  buffer = buffer.slice(lastNewlineIndex + 1);
 
-                  // Detect redirect
-                  if (scriptContent.includes("window.location.href")) {
-                    isRedirecting = true;
-                  }
+                  const lines = completeChunk.split("\n");
+                  let cleanChunk = "";
 
-                  // Inject to DOM
-                  const range = document.createRange();
-                  const fragment = range.createContextualFragment(fullMatch); // fullMatch includes tags for correct context
-                  document.body.appendChild(fragment);
-                }
+                  for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (!line && i === lines.length - 1) {
+                      continue;
+                    }
 
-                // 3. CLEAN PROCESSED SCRIPTS FROM BUFFER
-                // Once executed, we remove them so they don't go to React
-                buffer = buffer.replace(scriptRegex, "");
-
-                // 4. CALCULATE WHAT IS SAFE TO SEND (The anti-cut logic)
-                // We need to know if the buffer ends with something that LOOKS like the start of a script
-                // Dangerous patterns at the end: <, <s, <sc, <scr, <scri, <scrip, <script
-
-                let cutoffIndex = buffer.length; // Default send everything
-
-                // A) If there is an open but not closed <script> in the buffer
-                const openScriptIndex = buffer.indexOf("<script>");
-                if (openScriptIndex !== -1) {
-                  // We keep everything from the <script> onwards
-                  cutoffIndex = openScriptIndex;
-                } else {
-                  // B) If no open script, check if the end looks like a cut tag
-                  // Regex: Looks for '<' optionally followed by s, c, r, i, p, t AT THE END of the string ($)
-                  const partialTagMatch = buffer.match(/<s?c?r?i?p?t?$/);
-
-                  if (partialTagMatch) {
-                    // We save from where the suspicion starts
-                    cutoffIndex = partialTagMatch.index;
+                    if (line.startsWith("D:")) {
+                      try {
+                        const payload = JSON.parse(line.slice(2));
+                        if (payload.type === "redirect") {
+                          isRedirecting = true;
+                          window.location.href = payload.url;
+                        } else if (payload.type === "cookie") {
+                          document.cookie = payload.cookie;
+                        }
+                      } catch (e) {
+                        console.error("[Dinou] Failed to parse stream command line:", e);
+                      }
+                    } else {
+                      cleanChunk += line + "\n";
+                    }
                   }
-                }
 
-                // 5. SEND SAFE CONTENT
-                const safeChunk = buffer.slice(0, cutoffIndex);
-                // What remains stays in the buffer for the next loop (chunk)
-                buffer = buffer.slice(cutoffIndex);
-
-                if (safeChunk) {
-                  controller.enqueue(encoder.encode(safeChunk));
+                  if (cleanChunk) {
+                    controller.enqueue(encoder.encode(cleanChunk));
+                  }
                 }
               }
             } catch (err) {
               controller.error(err);
             } finally {
-              // If it is NOT a redirect, we close. If it is a redirect, we leave hanging (your master trick).
               if (!isRedirecting) {
                 controller.close();
               }

package/dinou/core/server.js

@@ -380,7 +380,7 @@ function getContextForServerFunctionEndpoint(req, res) {
         }
 
         // SCENARIO B: Streaming active (Headers Sent)
-        // Inject JavaScript.
+        // Send safe stream command.
 
         // 🛑 Security: JS cannot write HttpOnly cookies
         if (options && options.httpOnly) {
@@ -404,11 +404,11 @@ function getContextForServerFunctionEndpoint(req, res) {
           if (options.sameSite) cookieStr += `; samesite=${options.sameSite}`;
         }
 
-        // Safe packaging for injection
+        // Safe packaging for stream command
         const safeCookieStr = JSON.stringify(cookieStr);
 
         // Write to stream
-        res.write(`<script>document.cookie = ${safeCookieStr};</script>`);
+        res.write(`D:{"type":"cookie","cookie":${safeCookieStr}}\n`);
       },
 
       clearCookie: (name, options) => {
@@ -421,13 +421,10 @@ function getContextForServerFunctionEndpoint(req, res) {
           return;
         }
 
-        // SCENARIO B: Script Injection
-        const safeName = JSON.stringify(name);
-        const safePath = JSON.stringify(path);
-
-        res.write(
-          `<script>document.cookie = ${safeName} + "=; Max-Age=0; path=" + ${safePath} + ";";</script>`,
-        );
+        // SCENARIO B: Custom stream command
+        const cookieStr = `${name}=; Max-Age=0; path=${path};`;
+        const safeCookieStr = JSON.stringify(cookieStr);
+        res.write(`D:{"type":"cookie","cookie":${safeCookieStr}}\n`);
       },
     },
   };
@@ -752,7 +749,7 @@ function isOriginAllowed(req) {
   try {
     // Parse to ignore protocol (http/https) and port if they differ subtly
     const originHost = new URL(origin).host;
-    const serverHost = req.headers.host;
+    const serverHost = req.headers["x-forwarded-host"] || req.headers.host;
 
     // Compare host (domain:port)
     return originHost === serverHost;
@@ -782,7 +779,7 @@ app.post("/____server_function____", async (req, res) => {
 
     // 1. Check Origin (Prevent calls from other domains)
     const origin = req.headers.origin;
-    const host = req.headers.host;
+    const host = req.headers["x-forwarded-host"] || req.headers.host;
 
     // Note: Locally sometimes origin is undefined or null, allow in dev if necessary
     if (!isDevelopment && origin && !origin.includes(host)) {
@@ -851,10 +848,15 @@ app.post("/____server_function____", async (req, res) => {
 
     // Extract relativePath and normalize (remove 'file://' and potential '/')
     let relativePath = fileUrl.replace(/^file:\/\/\/?/, "").trim();
-    if (relativePath.startsWith("/") || relativePath.includes("..")) {
+    const normalizedRelative = relativePath.replace(/\\/g, "/");
+    if (
+      normalizedRelative.startsWith("/") ||
+      normalizedRelative.includes("..") ||
+      normalizedRelative.includes(":")
+    ) {
       return res
         .status(400)
-        .json({ error: "Invalid path: no absolute or traversal allowed" });
+        .json({ error: "Invalid path: no absolute, traversal, or drive letter allowed" });
     }
     // console.log("relPath", relativePath);
     // Restrict to 'src/' folder: prepend 'src/' if missing, and resolve absolutePath
@@ -881,6 +883,11 @@ app.post("/____server_function____", async (req, res) => {
       // Prod: use manifest (relativePath is already normalized)
       allowedExports = serverFunctionsManifest[relativePath];
     } else {
+      if (!isDevelopment) {
+        return res
+          .status(403)
+          .json({ error: "Access denied: Manifest missing in production" });
+      }
       const fileContent = readFileSync(absolutePath, "utf8"); // Reads only once
       if (!useServerRegex.test(fileContent)) {
         return res
@@ -925,18 +932,17 @@ app.post("/____server_function____", async (req, res) => {
       } catch (err) {
         // 💡 WE INTERCEPT THE REDIRECT
         if (err && err.$$type === "dinou-internal-redirect") {
-          // 1. Always sanitize the URL
           const safeUrl = JSON.stringify(err.url);
-          const script = `<script>window.location.href = ${safeUrl};</script>`;
 
           if (!res.headersSent) {
-            // SCENARIO A: Clean (Content-Type html)
-            res.setHeader("Content-Type", "text/html");
-            return res.send(script); // res.send calls end() and return stops the function
+            // SCENARIO A: Clean (Content-Type application/json)
+            res.setHeader("Content-Type", "application/json");
+            res.setHeader("X-Dinou-Redirect", err.url);
+            return res.status(200).json({ redirect: err.url });
           } else {
-            // SCENARIO B: Dirty/Active Stream (Content-Type already set by clearCookie)
-            // Write the script to the existing stream
-            res.write(script);
+            // SCENARIO B: Dirty/Active Stream
+            // Write a custom line-based stream command
+            res.write(`D:{"type":"redirect","url":${safeUrl}}\n`);
 
             // ⚠️ IMPORTANT:
             // 1. We close the response, since we redirected and there will be no RSC payload.

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "4.0.10",
+  "version": "4.0.12",
   "main": "index.js",
   "private": true,
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "4.0.10",
+  "version": "4.0.12",
   "description": "Full-Stack React 19 framework with React Server Components, Server Functions, and Streaming SSR.",
   "main": "index.js",
   "bin": {