dinou 4.0.12 → 4.0.13

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.0.13] - 2026-06-29
+
+### Added
+- **Universal Redirects**: Full support for redirects on Server Components, `getProps`, Server Actions, and client SPA navigation.
+- **Standard Relative Paths**: Support for relative paths (`../sibling`, `./child`, `?query`, `#hash`) matching directory-first URL resolution.
+- **Absolute Link Hover**: Links now render resolved absolute paths to ensure correct browser previews and right-click behaviors.
+
+### Fixed
+- **RSC Stream Stability**: Resolved socket crashes (`Connection closed`) and duplicate Express header warnings when redirects occur during streamed RSC requests.
+- **SSR Process Leaks**: Render processes are now cleaned up immediately after an HTML redirect is triggered.
+
+### Security
+- **Redirect Sanitization**: Blocked unsafe external domains (`https://...`), protocol-relative URLs (`//...`), and scripting payloads (`javascript:...`).
+
+### Refactored
+- **Shared Helpers**: Unified path resolution logic into a shared module (`url-resolver.js`).
+
 ## [4.0.12] - 2026-06-28
 
 ### Security

package/dinou/core/client-webpack.jsx

@@ -38,7 +38,7 @@ const isHashChangeOnly = (finalPath) => {
   );
 };
 
-const getRSCPayload = (rscKey) => {
+const getRSCPayload = (rscKey, isPrefetch = false) => {
   const url = rscKey.split("::")[0];
   // 1. Check Idempotence (Avoids the infinite loop of React)
   if (cache.has(url)) {
@@ -64,7 +64,21 @@ const getRSCPayload = (rscKey) => {
   }
 
   // 3. Fetch and Cache Storage
-  const promise = createFromFetch(fetch(payloadUrl));
+  const promise = createFromFetch(
+    fetch(payloadUrl).then((res) => {
+      if (res.headers.has("x-rsc-redirect")) {
+        const redirectUrl = res.headers.get("x-rsc-redirect");
+        if (!isPrefetch) {
+          window.location.href = redirectUrl;
+        } else {
+          cache.delete(url);
+        }
+        // Return a promise that never resolves to avoid React Server DOM throwing "Connection closed"
+        return new Promise(() => {});
+      }
+      return res;
+    }),
+  );
   cache.set(url, promise); // <--- KEY TO AVOID LOOP
   return promise;
 };
@@ -84,7 +98,7 @@ function Router() {
     window.__DINOU_PREFETCH__ = (url) => {
       // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
       if (isHashChangeOnly(url)) return;
-      getRSCPayload(url);
+      getRSCPayload(url, true);
     };
 
     // Hydration

package/dinou/core/client.jsx

@@ -39,7 +39,7 @@ const isHashChangeOnly = (finalPath) => {
   );
 };
 
-const getRSCPayload = (rscKey) => {
+const getRSCPayload = (rscKey, isPrefetch = false) => {
   const url = rscKey.split("::")[0];
   // 1. Check Idempotence (Avoids the infinite loop of React)
   if (cache.has(url)) {
@@ -65,7 +65,21 @@ const getRSCPayload = (rscKey) => {
   }
 
   // 3. Fetch and Cache Storage
-  const promise = createFromFetch(fetch(payloadUrl));
+  const promise = createFromFetch(
+    fetch(payloadUrl).then((res) => {
+      if (res.headers.has("x-rsc-redirect")) {
+        const redirectUrl = res.headers.get("x-rsc-redirect");
+        if (!isPrefetch) {
+          window.location.href = redirectUrl;
+        } else {
+          cache.delete(url);
+        }
+        // Return a promise that never resolves to avoid React Server DOM throwing "Connection closed"
+        return new Promise(() => {});
+      }
+      return res;
+    }),
+  );
   cache.set(url, promise); // <--- KEY TO AVOID LOOP
   return promise;
 };
@@ -85,7 +99,7 @@ function Router() {
     window.__DINOU_PREFETCH__ = (url) => {
       // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
       if (isHashChangeOnly(url)) return;
-      getRSCPayload(url);
+      getRSCPayload(url, true);
     };
 
     // Hydration

package/dinou/core/link.jsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { useRouter } from "./navigation.js";
+import { useRouter, usePathname } from "./navigation.js";
 import { resolveUrl } from "./navigation-utils.js";
 
 export function Link({
@@ -11,12 +11,13 @@ export function Link({
   ...props
 }) {
   const { push } = useRouter();
+  const pathname = usePathname();
+  const resolvedHref = resolveUrl(href, pathname);
 
   const handlePrefetch = () => {
     if (!prefetch || !href || fresh) return;
-    const finalPath = resolveUrl(href, window.location.pathname);
     if (window.__DINOU_PREFETCH__) {
-      window.__DINOU_PREFETCH__(finalPath);
+      window.__DINOU_PREFETCH__(resolvedHref);
     }
   };
 
@@ -29,7 +30,7 @@ export function Link({
 
   return (
     <a
-      href={href}
+      href={resolvedHref}
       onClick={handleClick}
       onMouseEnter={handlePrefetch}
       {...props}

package/dinou/core/navigation-utils.js

@@ -1,13 +1,15 @@
 export function resolveUrl(href, currentPathname) {
+  const origin = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+
   if (href.startsWith("/") || href.includes("://")) {
-    const url = new URL(href, window.location.origin);
+    const url = new URL(href, origin);
     return normalize(url.pathname + url.search + url.hash);
   }
 
   let base = currentPathname;
   if (!base.endsWith("/")) base += "/";
 
-  const resolved = new URL(href, window.location.origin + base);
+  const resolved = new URL(href, origin + base);
   return normalize(resolved.pathname + resolved.search + resolved.hash);
 }
 

package/dinou/core/render-app-to-html.js

@@ -27,6 +27,8 @@ const childExecArgv = ESSENTIAL_NODE_ARGS.concat(loaderArg);
 
 // ----------------------------------------------------
 
+const { resolveRelativeUrl } = require("./url-resolver");
+
 function renderAppToHtml(
   reqPath,
   paramsString,
@@ -82,13 +84,28 @@ function renderAppToHtml(
         if (res.headersSent) {
           // --- REDIRECT (JS Injection) ---
           if (command === "redirect") {
-            const url = args.length === 1 ? args[0] : args[1];
+            const rawUrl = args.length === 1 ? args[0] : args[1];
+            const resolvedUrl = resolveRelativeUrl(rawUrl, reqPath);
             console.log(
-              `[Dinou] Streaming active. Redirecting via JavaScript to: ${url}`,
+              `[Dinou] Streaming active. Redirecting via JavaScript to: ${resolvedUrl}`,
             );
-            const safeUrl = JSON.stringify(url);
+            let finalUrl = "/";
+            if (
+              typeof resolvedUrl === "string" &&
+              resolvedUrl.startsWith("/") &&
+              !resolvedUrl.startsWith("//")
+            ) {
+              finalUrl = resolvedUrl;
+            } else {
+              console.warn(
+                `[Dinou Security] Blocked unsafe streaming redirect to: ${rawUrl}`,
+              );
+            }
+            const safeUrl = JSON.stringify(finalUrl);
             res.write(`<script>window.location.href = ${safeUrl};</script>`);
             res.end();
+            child.stdout.unpipe(res);
+            child.kill();
             return;
           }
 
@@ -186,16 +203,19 @@ function renderAppToHtml(
             rawUrl = args[0];
           }
 
+          // Resolve relative URL relative to reqPath
+          const resolvedUrl = resolveRelativeUrl(rawUrl, reqPath);
+
           // 2. Security Logic (Safe Redirect)
           // We allow only relative routes starting with '/' but not '//'
           let finalUrl = "/";
 
           if (
-            typeof rawUrl === "string" &&
-            rawUrl.startsWith("/") &&
-            !rawUrl.startsWith("//")
+            typeof resolvedUrl === "string" &&
+            resolvedUrl.startsWith("/") &&
+            !resolvedUrl.startsWith("//")
           ) {
-            finalUrl = rawUrl;
+            finalUrl = resolvedUrl;
           } else {
             console.warn(
               `[Dinou Security] Blocked unsafe redirect to: ${rawUrl}`,
@@ -205,6 +225,8 @@ function renderAppToHtml(
 
           // 3. Execute safe redirect always using (status, url)
           res.redirect.apply(res, [status, finalUrl]);
+          child.stdout.unpipe(res);
+          child.kill();
           return;
         }
 

package/dinou/core/server-function-proxy-webpack.js

@@ -1,5 +1,9 @@
 import { createFromFetch } from "react-server-dom-webpack/client";
 
+function isSafeRedirect(url) {
+  return typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+}
+
 function createServerFunctionProxy(id) {
   return new Proxy(() => { }, {
     apply: async (_target, _thisArg, args) => {
@@ -33,7 +37,7 @@ function createServerFunctionProxy(id) {
       // Check header first
       const redirectUrl = res.headers.get("X-Dinou-Redirect");
       if (redirectUrl) {
-        window.location.href = redirectUrl;
+        window.location.href = isSafeRedirect(redirectUrl) ? redirectUrl : "/";
         return new Promise(() => { });
       }
 
@@ -50,7 +54,7 @@ function createServerFunctionProxy(id) {
       if (contentType.includes("application/json")) {
         const data = await res.json();
         if (data && data.redirect) {
-          window.location.href = data.redirect;
+          window.location.href = isSafeRedirect(data.redirect) ? data.redirect : "/";
           return new Promise(() => { });
         }
         return data;
@@ -78,7 +82,7 @@ function createServerFunctionProxy(id) {
                         const payload = JSON.parse(buffer.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }
@@ -115,7 +119,7 @@ function createServerFunctionProxy(id) {
                         const payload = JSON.parse(line.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }

package/dinou/core/server-function-proxy.js

@@ -1,6 +1,10 @@
 // public/server-function-proxy.js
 import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 
+function isSafeRedirect(url) {
+  return typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+}
+
 export function createServerFunctionProxy(id) {
   return new Proxy(() => {}, {
     apply: async (_target, _thisArg, args) => {
@@ -34,7 +38,7 @@ export function createServerFunctionProxy(id) {
       // Check header first
       const redirectUrl = res.headers.get("X-Dinou-Redirect");
       if (redirectUrl) {
-        window.location.href = redirectUrl;
+        window.location.href = isSafeRedirect(redirectUrl) ? redirectUrl : "/";
         return new Promise(() => {});
       }
 
@@ -51,7 +55,7 @@ export function createServerFunctionProxy(id) {
       if (contentType.includes("application/json")) {
         const data = await res.json();
         if (data && data.redirect) {
-          window.location.href = data.redirect;
+          window.location.href = isSafeRedirect(data.redirect) ? data.redirect : "/";
           return new Promise(() => {});
         }
         return data;
@@ -79,7 +83,7 @@ export function createServerFunctionProxy(id) {
                         const payload = JSON.parse(buffer.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }
@@ -116,7 +120,7 @@ export function createServerFunctionProxy(id) {
                         const payload = JSON.parse(line.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          window.location.href = isSafeRedirect(payload.url) ? payload.url : "/";
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }

package/dinou/core/server.js

@@ -248,20 +248,24 @@ const appUseCookieParser = cookieParser();
 const app = express();
 app.use(appUseCookieParser);
 app.use(express.json());
+const { resolveRelativeUrl } = require("./url-resolver");
 
 function getContext(req, res) {
+  let hasRedirected = false;
   // Helper to execute res methods safely
   const safeResCall = (methodName, ...args) => {
+    if (hasRedirected) return;
     if (res.headersSent) {
+      if (methodName === "redirect" && req.path.includes("____rsc_payload")) {
+        return; // Silence streaming redirects during RSC payload requests
+      }
       console.log(
         `[Dinou] res.${methodName} called but headers already sent. Ignoring.`,
       );
-      // console.warn(
-      //   `[Dinou Warning] RSC Stream active. Ignoring res.${methodName}() to avoid crash.`
-      // );
       return; // Exit silently
     }
     if (methodName === "redirect") {
+      hasRedirected = true;
       // 1. Normalize arguments (Status and URL)
       let url = args[0];
       let status = 302; // Default
@@ -272,16 +276,27 @@ function getContext(req, res) {
       }
 
       function safeRedirect(targetUrl) {
-        // Validate it's a string before calling startsWith
+        const resolvedUrl = resolveRelativeUrl(targetUrl, req.path);
+        let finalUrl = "/";
         if (
-          typeof targetUrl === "string" &&
-          targetUrl.startsWith("/") &&
-          !targetUrl.startsWith("//")
+          typeof resolvedUrl === "string" &&
+          resolvedUrl.startsWith("/") &&
+          !resolvedUrl.startsWith("//")
         ) {
-          res.redirect.apply(res, [status, targetUrl]);
+          finalUrl = resolvedUrl;
         } else {
-          res.redirect.apply(res, [status, "/"]);
+          console.warn(
+            `[Dinou Security] Blocked unsafe redirect to: ${targetUrl}`,
+          );
+        }
+
+        if (req.path.includes("____rsc_payload")) {
+          res.setHeader("x-rsc-redirect", finalUrl);
+          res.status(200).end();
+          return;
         }
+
+        res.redirect.apply(res, [status, finalUrl]);
       }
       return safeRedirect(url);
     }
@@ -351,11 +366,31 @@ function getContextForServerFunctionEndpoint(req, res) {
     },
     res: {
       redirect: (urlOrStatus, url) => {
-        const targetUrl = url || urlOrStatus;
+        const rawUrl = url || urlOrStatus;
+        const referer = req.headers["referer"];
+        let refererPath = "/";
+        if (referer) {
+          try {
+            refererPath = new URL(referer).pathname;
+          } catch (e) {}
+        }
+        const resolvedUrl = resolveRelativeUrl(rawUrl, refererPath);
+        let finalUrl = "/";
+        if (
+          typeof resolvedUrl === "string" &&
+          resolvedUrl.startsWith("/") &&
+          !resolvedUrl.startsWith("//")
+        ) {
+          finalUrl = resolvedUrl;
+        } else {
+          console.warn(
+            `[Dinou Security] Blocked unsafe server function redirect to: ${rawUrl}`,
+          );
+        }
         // We throw a special object that the endpoint will intercept
         throw {
           $$type: "dinou-internal-redirect",
-          url: targetUrl,
+          url: finalUrl,
         };
       },
       status: (code) => {
@@ -530,6 +565,11 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
         isNotFound,
         isDevelopment,
       );
+
+      if (res.headersSent) {
+        return;
+      }
+
       const manifest = isDevelopment
         ? JSON.parse(
           readFileSync(

package/dinou/core/url-resolver.js

@@ -0,0 +1,13 @@
+function resolveRelativeUrl(href, currentPathname) {
+  if (href.startsWith("/") || href.includes("://")) {
+    return href;
+  }
+  let base = currentPathname || "/";
+  if (!base.endsWith("/")) {
+    base += "/";
+  }
+  const resolved = new URL(href, "http://localhost" + base);
+  return resolved.pathname + resolved.search + resolved.hash;
+}
+
+module.exports = { resolveRelativeUrl };

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "main": "index.js",
   "private": true,
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "4.0.12",
+  "version": "4.0.13",
   "description": "Full-Stack React 19 framework with React Server Components, Server Functions, and Streaming SSR.",
   "main": "index.js",
   "bin": {