react-router 7.13.0 → 7.13.1-pre.0

package/dist/{development/chunk-4LKRSAEJ.mjs → production/chunk-ROHSFSEU.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.13.0
+ * react-router v7.13.1-pre.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -51,7 +51,7 @@ import {
   withComponentProps,
   withErrorBoundaryProps,
   withHydrateFallbackProps
-} from "./chunk-JZWAC4HX.mjs";
+} from "./chunk-2K4LVAAG.mjs";
 
 // lib/dom/ssr/server.tsx
 import * as React from "react";
@@ -758,7 +758,14 @@ function prependCookies(parentHeaders, childHeaders) {
 // lib/actions.ts
 function throwIfPotentialCSRFAttack(headers, allowedActionOrigins) {
   let originHeader = headers.get("origin");
-  let originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+  let originDomain = null;
+  try {
+    originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+  } catch {
+    throw new Error(
+      `\`origin\` header is not a valid URL. Aborting the action.`
+    );
+  }
   let host = parseHostHeader(headers);
   if (originDomain && (!host || originDomain !== host.value)) {
     if (!isAllowedOrigin(originDomain, allowedActionOrigins)) {
@@ -1049,9 +1056,11 @@ function encodeViaTurboStream(data2, requestSignal, streamTimeout, serverMode) {
     () => controller.abort(new Error("Server Timeout")),
     typeof streamTimeout === "number" ? streamTimeout : 4950
   );
-  requestSignal.addEventListener("abort", () => clearTimeout(timeoutId));
+  let clearStreamTimeout = () => clearTimeout(timeoutId);
+  requestSignal.addEventListener("abort", clearStreamTimeout);
   return encode(data2, {
     signal: controller.signal,
+    onComplete: clearStreamTimeout,
     plugins: [
       (value) => {
         if (value instanceof Error) {