react-router 7.17.0 → 7.18.0

package/dist/{production/chunk-5TQZEVD5.mjs → development/chunk-E4MTK73K.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.17.0
+ * react-router v7.18.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -35,6 +35,7 @@ import {
   escapeHtml,
   getManifestPath,
   getStaticContextFromError,
+  hasInvalidProtocol,
   instrumentHandler,
   isDataWithResponseInit,
   isMutationMethod,
@@ -54,7 +55,7 @@ import {
   withComponentProps,
   withErrorBoundaryProps,
   withHydrateFallbackProps
-} from "./chunk-OSYEOCBT.mjs";
+} from "./chunk-4ZMWKKQ3.mjs";
 
 // lib/dom/ssr/server.tsx
 import * as React from "react";
@@ -104,6 +105,7 @@ function ServerRouter({
         ssr: context.ssr,
         isSpaMode: context.isSpaMode,
         routeDiscovery: context.routeDiscovery,
+        nonce,
         serializeError: context.serializeError,
         renderMeta: context.renderMeta
       }
@@ -466,33 +468,6 @@ function serializeError(error, serverMode) {
     stack: sanitized.stack
   };
 }
-function serializeErrors(errors, serverMode) {
-  if (!errors) return null;
-  let entries = Object.entries(errors);
-  let serialized = {};
-  for (let [key, val] of entries) {
-    if (isRouteErrorResponse(val)) {
-      serialized[key] = { ...val, __type: "RouteErrorResponse" };
-    } else if (val instanceof Error) {
-      let sanitized = sanitizeError(val, serverMode);
-      serialized[key] = {
-        message: sanitized.message,
-        stack: sanitized.stack,
-        __type: "Error",
-        // If this is a subclass (i.e., ReferenceError), send up the type so we
-        // can re-create the same type during hydration.  This will only apply
-        // in dev mode since all production errors are sanitized to normal
-        // Error instances
-        ...sanitized.name !== "Error" ? {
-          __subType: sanitized.name
-        } : {}
-      };
-    } else {
-      serialized[key] = val;
-    }
-  }
-  return serialized;
-}
 
 // lib/server-runtime/invariant.ts
 function invariant(value, message) {
@@ -769,8 +744,8 @@ function prependCookies(parentHeaders, childHeaders) {
 }
 
 // lib/actions.ts
-function throwIfPotentialCSRFAttack(headers, allowedActionOrigins) {
-  let originHeader = headers.get("origin");
+function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
+  let originHeader = request.headers.get("origin");
   let originDomain = null;
   try {
     originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
@@ -779,18 +754,12 @@ function throwIfPotentialCSRFAttack(headers, allowedActionOrigins) {
       `\`origin\` header is not a valid URL. Aborting the action.`
     );
   }
-  let host = parseHostHeader(headers);
-  if (originDomain && (!host || originDomain !== host.value)) {
+  let host = new URL(request.url).host;
+  if (originDomain && originDomain !== host) {
     if (!isAllowedOrigin(originDomain, allowedActionOrigins)) {
-      if (host) {
-        throw new Error(
-          `${host.type} header does not match \`origin\` header from a forwarded action request. Aborting the action.`
-        );
-      } else {
-        throw new Error(
-          "`x-forwarded-host` or `host` headers are not provided. One of these is needed to compare the `origin` header from a forwarded action request. Aborting the action."
-        );
-      }
+      throw new Error(
+        "The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action."
+      );
     }
   }
 }
@@ -838,18 +807,6 @@ function isAllowedOrigin(originDomain, allowedActionOrigins = []) {
     (allowedOrigin) => allowedOrigin && (allowedOrigin === originDomain || matchWildcardDomain(originDomain, allowedOrigin))
   );
 }
-function parseHostHeader(headers) {
-  let forwardedHostHeader = headers.get("x-forwarded-host");
-  let forwardedHostValue = forwardedHostHeader?.split(",")[0]?.trim();
-  let hostHeader = headers.get("host");
-  return forwardedHostValue ? {
-    type: "x-forwarded-host",
-    value: forwardedHostValue
-  } : hostHeader ? {
-    type: "host",
-    value: hostHeader
-  } : void 0;
-}
 
 // lib/server-runtime/urls.ts
 function getNormalizedPath(request, basename, future) {
@@ -895,7 +852,7 @@ async function singleFetchAction(build, serverMode, staticHandler, request, hand
   try {
     try {
       throwIfPotentialCSRFAttack(
-        request.headers,
+        request,
         Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []
       );
     } catch (e) {
@@ -1225,7 +1182,7 @@ function derive(build, mode) {
       }
       if (build.prerender.length === 0) {
         isSpaMode = true;
-      } else if (!build.prerender.includes(decodedPath) && !build.prerender.includes(decodedPath + "/")) {
+      } else if (!build.prerender.includes(decodedPath.replace(/\/$/, "")) && !build.prerender.includes(decodedPath.replace(/[^/]$/, "/"))) {
         if (requestUrl.pathname.endsWith(".data")) {
           errorHandler(
             new ErrorResponseImpl(
@@ -1386,6 +1343,12 @@ var createRequestHandler = (build, mode) => {
   };
 };
 async function handleManifestRequest(build, dataRoutes, branches, url) {
+  if (url.toString().length > URL_LIMIT) {
+    return new Response(null, {
+      statusText: "Bad Request",
+      status: 400
+    });
+  }
   if (build.assets.version !== url.searchParams.get("version")) {
     return new Response(null, {
       status: 204,
@@ -1394,28 +1357,14 @@ async function handleManifestRequest(build, dataRoutes, branches, url) {
       }
     });
   }
-  if (url.toString().length > URL_LIMIT) {
-    return new Response(null, {
-      statusText: "Bad Request",
-      status: 400
-    });
-  }
   let patches = {};
   if (url.searchParams.has("paths")) {
-    let paths = /* @__PURE__ */ new Set();
     let pathParam = url.searchParams.get("paths") || "";
-    let requestedPaths = pathParam.split(",").filter(Boolean);
-    requestedPaths.forEach((path) => {
+    let paths = new Set(pathParam.split(",").filter(Boolean));
+    for (let path of paths) {
       if (!path.startsWith("/")) {
         path = `/${path}`;
       }
-      let segments = path.split("/").slice(1);
-      segments.forEach((_, i) => {
-        let partialPath = segments.slice(0, i + 1).join("/");
-        paths.add(`/${partialPath}`);
-      });
-    });
-    for (let path of paths) {
       let matches = matchServerRoutes(
         build.routes,
         dataRoutes,
@@ -1468,7 +1417,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
     if (isMutationMethod(request.method)) {
       try {
         throwIfPotentialCSRFAttack(
-          request.headers,
+          request,
           Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []
         );
       } catch (e) {
@@ -1516,7 +1465,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
     let state = {
       loaderData: context.loaderData,
       actionData: context.actionData,
-      errors: serializeErrors(context.errors, serverMode)
+      errors: context.errors
     };
     let baseServerHandoff = {
       basename: build.basename,
@@ -1582,7 +1531,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
       let state2 = {
         loaderData: context.loaderData,
         actionData: context.actionData,
-        errors: serializeErrors(context.errors, serverMode)
+        errors: context.errors
       };
       entryContext = {
         ...entryContext,
@@ -2178,6 +2127,9 @@ async function routeRSCServerRequest({
       detectRedirectResponse.body
     );
     if (serverResponse.status === SINGLE_FETCH_REDIRECT_STATUS && payload.type === "redirect") {
+      if (hasInvalidProtocol(payload.location)) {
+        throw new Error("Invalid redirect location");
+      }
       const headers2 = new Headers(serverResponse.headers);
       headers2.delete("Content-Encoding");
       headers2.delete("Content-Length");
@@ -2221,6 +2173,9 @@ async function routeRSCServerRequest({
     }
     headers.set("Content-Type", "text/html; charset=utf-8");
     if (renderRedirect) {
+      if (hasInvalidProtocol(renderRedirect.location)) {
+        throw new Error("Invalid redirect location");
+      }
       headers.set("Location", renderRedirect.location);
       return new Response(html, {
         status: renderRedirect.status,
@@ -2230,6 +2185,9 @@ async function routeRSCServerRequest({
     const redirectTransform = new TransformStream({
       flush(controller) {
         if (renderRedirect) {
+          if (hasInvalidProtocol(renderRedirect.location)) {
+            return;
+          }
           controller.enqueue(
             new TextEncoder().encode(
               `<meta http-equiv="refresh" content="0;url=${escapeHtml(renderRedirect.location)}"/>`
@@ -2259,6 +2217,9 @@ async function routeRSCServerRequest({
       return error;
     }
     if (renderRedirect) {
+      if (hasInvalidProtocol(renderRedirect.location)) {
+        throw new Error("Invalid redirect location");
+      }
       return new Response(`Redirect: ${renderRedirect.location}`, {
         status: renderRedirect.status,
         headers: {
@@ -2332,6 +2293,9 @@ async function routeRSCServerRequest({
       }
       headers.set("Content-Type", "text/html; charset=utf-8");
       if (retryRedirect) {
+        if (hasInvalidProtocol(retryRedirect.location)) {
+          throw new Error("Invalid redirect location");
+        }
         headers.set("Location", retryRedirect.location);
         return new Response(html, {
           status: retryRedirect.status,
@@ -2341,6 +2305,9 @@ async function routeRSCServerRequest({
       const retryRedirectTransform = new TransformStream({
         flush(controller) {
           if (retryRedirect) {
+            if (hasInvalidProtocol(retryRedirect.location)) {
+              return;
+            }
             controller.enqueue(
               new TextEncoder().encode(
                 `<meta http-equiv="refresh" content="0;url=${escapeHtml(retryRedirect.location)}"/>`
@@ -2374,6 +2341,9 @@ function RSCStaticRouter({ getPayload }) {
   const decoded = getPayload();
   const payload = useSafe(decoded);
   if (payload.type === "redirect") {
+    if (hasInvalidProtocol(payload.location)) {
+      throw new Error("Invalid redirect location");
+    }
     throw new Response(null, {
       status: payload.status,
       headers: {
@@ -2491,43 +2461,6 @@ function isManifestRequest(url) {
   return url.pathname.endsWith(".manifest");
 }
 
-// lib/dom/ssr/errors.ts
-function deserializeErrors(errors) {
-  if (!errors) return null;
-  let entries = Object.entries(errors);
-  let serialized = {};
-  for (let [key, val] of entries) {
-    if (val && val.__type === "RouteErrorResponse") {
-      serialized[key] = new ErrorResponseImpl(
-        val.status,
-        val.statusText,
-        val.data,
-        val.internal === true
-      );
-    } else if (val && val.__type === "Error") {
-      if (val.__subType) {
-        let ErrorConstructor = window[val.__subType];
-        if (typeof ErrorConstructor === "function") {
-          try {
-            let error = new ErrorConstructor(val.message);
-            error.stack = val.stack;
-            serialized[key] = error;
-          } catch (e) {
-          }
-        }
-      }
-      if (serialized[key] == null) {
-        let error = new Error(val.message);
-        error.stack = val.stack;
-        serialized[key] = error;
-      }
-    } else {
-      serialized[key] = val;
-    }
-  }
-  return serialized;
-}
-
 // lib/dom/ssr/hydration.tsx
 function getHydrationData({
   state,
@@ -2580,6 +2513,5 @@ export {
   populateRSCRouteModules,
   routeRSCServerRequest,
   RSCStaticRouter,
-  deserializeErrors,
   getHydrationData
 };