nitro 3.0.260415-beta → 3.0.260522-beta

package/dist/runtime/internal/app.mjs

@@ -1,11 +1,8 @@
-import { H3Core, toRequest } from "h3";
+import { toRequest } from "h3";
 import { HookableCore } from "hookable";
-import { nitroAsyncContext } from "./context.mjs";
 
-import errorHandler from "#nitro/virtual/error-handler";
-import { plugins } from "#nitro/virtual/plugins";
-import { findRoute, findRouteRules, globalMiddleware, findRoutedMiddleware } from "#nitro/virtual/routing";
-import { hasRouteRules, hasRoutedMiddleware, hasGlobalMiddleware, hasRoutes, hasHooks, hasPlugins } from "#nitro/virtual/feature-flags";
+import { findRouteRules } from "#nitro/virtual/routing";
+import { createNitroApp, initNitroPlugins } from "#nitro/virtual/app";
 const APP_ID = import.meta.prerender ? "prerender" : "default";
 export function useNitroApp() {
 	let instance = useNitroApp._instance;
@@ -15,9 +12,7 @@ export function useNitroApp() {
 	instance = useNitroApp._instance = createNitroApp();
 	globalThis.__nitro__ = globalThis.__nitro__ || {};
 	globalThis.__nitro__[APP_ID] = instance;
-	if (hasPlugins) {
-		initNitroPlugins(instance);
-	}
+	initNitroPlugins(instance);
 	return instance;
 }
 export function useNitroHooks() {
@@ -53,108 +48,6 @@ export function fetch(resource, init, context) {
 	resource = resource._request || resource;
 	return globalThis.fetch(resource, init);
 }
-function createNitroApp() {
-	const hooks = hasHooks ? new HookableCore() : undefined;
-	const captureError = (error, errorCtx) => {
-		const promise = hasHooks && hooks.callHook("error", error, errorCtx)?.catch?.((hookError) => {
-			console.error("Error while capturing another error", hookError);
-		});
-		if (errorCtx?.event) {
-			const errors = errorCtx.event.req.context?.nitro?.errors;
-			if (errors) {
-				errors.push({
-					error,
-					context: errorCtx
-				});
-			}
-			if (hasHooks && promise && typeof errorCtx.event.req.waitUntil === "function") {
-				errorCtx.event.req.waitUntil(promise);
-			}
-		}
-	};
-	const h3App = createH3App({ onError(error, event) {
-		hasHooks && captureError(error, { event });
-		return errorHandler(error, event);
-	} });
-	if (hasHooks) {
-		h3App.config.onRequest = (event) => {
-			return hooks.callHook("request", event)?.catch?.((error) => {
-				captureError(error, {
-					event,
-					tags: ["request"]
-				});
-			});
-		};
-		h3App.config.onResponse = (res, event) => {
-			return hooks.callHook("response", res, event)?.catch?.((error) => {
-				captureError(error, {
-					event,
-					tags: ["response"]
-				});
-			});
-		};
-	}
-	let appHandler = (req) => {
-		req.context ||= {};
-		req.context.nitro = req.context.nitro || { errors: [] };
-		return h3App.fetch(req);
-	};
-	
-	if (import.meta._asyncContext) {
-		const originalHandler = appHandler;
-		appHandler = (req) => {
-			const asyncCtx = { request: req };
-			return nitroAsyncContext.callAsync(asyncCtx, () => originalHandler(req));
-		};
-	}
-	const app = {
-		fetch: appHandler,
-		h3: h3App,
-		hooks,
-		captureError
-	};
-	return app;
-}
-function initNitroPlugins(app) {
-	for (const plugin of plugins) {
-		try {
-			plugin(app);
-		} catch (error) {
-			app.captureError?.(error, { tags: ["plugin"] });
-			throw error;
-		}
-	}
-	return app;
-}
-function createH3App(config) {
-	
-	const h3App = new H3Core(config);
-	
-	hasRoutes && (h3App["~findRoute"] = (event) => findRoute(event.req.method, event.url.pathname));
-	hasGlobalMiddleware && h3App["~middleware"].push(...globalMiddleware);
-	if (hasRouteRules || hasRoutedMiddleware) {
-		h3App["~getMiddleware"] = (event, route) => {
-			const needsRouting = hasRouteRules || hasRoutedMiddleware;
-			const pathname = needsRouting ? event.url.pathname : undefined;
-			const method = needsRouting ? event.req.method : undefined;
-			const middleware = [];
-			if (hasRouteRules) {
-				const routeRules = getRouteRules(method, pathname);
-				event.context.routeRules = routeRules?.routeRules;
-				if (routeRules?.routeRuleMiddleware.length) {
-					middleware.push(...routeRules.routeRuleMiddleware);
-				}
-			}
-			hasGlobalMiddleware && middleware.push(...h3App["~middleware"]);
-			hasRoutedMiddleware && middleware.push(...findRoutedMiddleware(method, pathname).map((r) => r.data));
-			if (hasRoutes && route?.data?.middleware?.length) {
-				middleware.push(...route.data.middleware);
-			}
-			return middleware;
-		};
-	}
-	return h3App;
-}
 export function getRouteRules(method, pathname) {
 	const m = findRouteRules(method, pathname);
 	if (!m?.length) {

package/dist/runtime/internal/route-rules.d.mts

@@ -8,4 +8,5 @@ export declare const redirect: RouteRuleCtor<"redirect">;
 export declare const proxy: RouteRuleCtor<"proxy">;
 export declare const cache: RouteRuleCtor<"cache">;
 export declare const basicAuth: RouteRuleCtor<"auth">;
+export declare function isPathInScope(pathname: string, base: string): boolean;
 export {};

package/dist/runtime/internal/route-rules.mjs

@@ -1,4 +1,4 @@
-import { proxyRequest, redirect as sendRedirect, requireBasicAuth } from "h3";
+import { HTTPError, proxyRequest, redirect as sendRedirect, requireBasicAuth } from "h3";
 import { joinURL, withQuery, withoutBase } from "ufo";
 import { defineCachedHandler } from "./cache.mjs";
 
@@ -17,7 +17,12 @@ export const redirect = ((m) => function redirectRouteRule(event) {
 		let targetPath = event.url.pathname + event.url.search;
 		const strpBase = m.options._redirectStripBase;
 		if (strpBase) {
+			if (!isPathInScope(event.url.pathname, strpBase)) {
+				throw new HTTPError({ status: 400 });
+			}
 			targetPath = withoutBase(targetPath, strpBase);
+		} else if (targetPath.startsWith("//")) {
+			targetPath = targetPath.replace(/^\/+/, "/");
 		}
 		target = joinURL(target.slice(0, -3), targetPath);
 	} else if (event.url.search) {
@@ -35,7 +40,12 @@ export const proxy = ((m) => function proxyRouteRule(event) {
 		let targetPath = event.url.pathname + event.url.search;
 		const strpBase = m.options._proxyStripBase;
 		if (strpBase) {
+			if (!isPathInScope(event.url.pathname, strpBase)) {
+				throw new HTTPError({ status: 400 });
+			}
 			targetPath = withoutBase(targetPath, strpBase);
+		} else if (targetPath.startsWith("//")) {
+			targetPath = targetPath.replace(/^\/+/, "/");
 		}
 		target = joinURL(target.slice(0, -3), targetPath);
 	} else if (event.url.search) {
@@ -72,3 +82,21 @@ export const basicAuth = /* @__PURE__ */ Object.assign(((m) => async function au
 	await requireBasicAuth(event, m.options);
 	return next();
 }), { order: -1 });
+
+
+
+
+
+
+
+
+export function isPathInScope(pathname, base) {
+	let canonical;
+	try {
+		const pre = pathname.replace(/%2f/gi, "/").replace(/%5c/gi, "\\");
+		canonical = new URL(pre, "http://_").pathname;
+	} catch {
+		return false;
+	}
+	return !base || canonical === base || canonical.startsWith(base + "/");
+}

package/dist/runtime/internal/routes/scalar.mjs

@@ -11,6 +11,7 @@ export default defineHandler((event) => {
 	const scalarConfig = {
 		..._config,
 		url: openAPIEndpoint,
+		// @ts-expect-error
 		spec: {
 			url: openAPIEndpoint,
 			..._config?.spec

package/dist/runtime/virtual/app.d.mts

@@ -0,0 +1,4 @@
+import "./_runtime_warn.mjs";
+import type { NitroApp } from "nitro/types";
+export declare function createNitroApp(): NitroApp;
+export declare function initNitroPlugins(app: NitroApp): NitroApp;

package/dist/runtime/virtual/app.mjs

@@ -0,0 +1,32 @@
+import "./_runtime_warn.mjs";
+import { H3Core } from "h3";
+import errorHandler from "#nitro/virtual/error-handler";
+export function createNitroApp() {
+	const h3App = new H3Core({ onError(error, event) {
+		return errorHandler(error, event);
+	} });
+	const captureError = (error, errorCtx) => {
+		if (errorCtx?.event) {
+			const errors = errorCtx.event.req.context?.nitro?.errors;
+			if (errors) {
+				errors.push({
+					error,
+					context: errorCtx
+				});
+			}
+		}
+	};
+	return {
+		fetch: (req) => {
+			req.context ||= {};
+			req.context.nitro = req.context.nitro || { errors: [] };
+			return h3App.fetch(req);
+		},
+		h3: h3App,
+		hooks: undefined,
+		captureError
+	};
+}
+export function initNitroPlugins(app) {
+	return app;
+}