dinou 4.0.9 → 4.0.11

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.0.11]
+
+### Fixed
+
+- Security: Fix server functions endpoint vulnerability and add improvements.
+
+## [4.0.10]
+
+### Fixed
+
+- Server Functions endpoint vulnerability.
+
 ## [4.0.9]
 
 ### Changed

package/dinou/core/server.js

@@ -752,7 +752,7 @@ function isOriginAllowed(req) {
   try {
     // Parse to ignore protocol (http/https) and port if they differ subtly
     const originHost = new URL(origin).host;
-    const serverHost = req.headers.host;
+    const serverHost = req.headers["x-forwarded-host"] || req.headers.host;
 
     // Compare host (domain:port)
     return originHost === serverHost;
@@ -782,7 +782,7 @@ app.post("/____server_function____", async (req, res) => {
 
     // 1. Check Origin (Prevent calls from other domains)
     const origin = req.headers.origin;
-    const host = req.headers.host;
+    const host = req.headers["x-forwarded-host"] || req.headers.host;
 
     // Note: Locally sometimes origin is undefined or null, allow in dev if necessary
     if (!isDevelopment && origin && !origin.includes(host)) {
@@ -851,10 +851,15 @@ app.post("/____server_function____", async (req, res) => {
 
     // Extract relativePath and normalize (remove 'file://' and potential '/')
     let relativePath = fileUrl.replace(/^file:\/\/\/?/, "").trim();
-    if (relativePath.startsWith("/") || relativePath.includes("..")) {
+    const normalizedRelative = relativePath.replace(/\\/g, "/");
+    if (
+      normalizedRelative.startsWith("/") ||
+      normalizedRelative.includes("..") ||
+      normalizedRelative.includes(":")
+    ) {
       return res
         .status(400)
-        .json({ error: "Invalid path: no absolute or traversal allowed" });
+        .json({ error: "Invalid path: no absolute, traversal, or drive letter allowed" });
     }
     // console.log("relPath", relativePath);
     // Restrict to 'src/' folder: prepend 'src/' if missing, and resolve absolutePath
@@ -881,6 +886,11 @@ app.post("/____server_function____", async (req, res) => {
       // Prod: use manifest (relativePath is already normalized)
       allowedExports = serverFunctionsManifest[relativePath];
     } else {
+      if (!isDevelopment) {
+        return res
+          .status(403)
+          .json({ error: "Access denied: Manifest missing in production" });
+      }
       const fileContent = readFileSync(absolutePath, "utf8"); // Reads only once
       if (!useServerRegex.test(fileContent)) {
         return res
@@ -895,7 +905,8 @@ app.post("/____server_function____", async (req, res) => {
     // Validate exportName against allowedExports
     if (
       !exportName ||
-      (exportName !== "default" && !allowedExports.has(exportName))
+      !allowedExports ||
+      !allowedExports.has(exportName)
     ) {
       return res.status(400).json({ error: "Invalid export name" });
     }

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "4.0.9",
+  "version": "4.0.11",
   "main": "index.js",
   "private": true,
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "4.0.9",
+  "version": "4.0.11",
   "description": "Full-Stack React 19 framework with React Server Components, Server Functions, and Streaming SSR.",
   "main": "index.js",
   "bin": {