react-router 7.18.2 → 7.18.4

package/dist/production/{chunk-SJTG3J2Q.mjs → chunk-G2MPF4YY.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -32,6 +32,7 @@ import {
   decodeRouteErrorResponseDigest,
   decodeViaTurboStream,
   encode,
+  escapeAttribute,
   escapeHtml,
   getManifestPath,
   getStaticContextFromError,
@@ -55,7 +56,7 @@ import {
   withComponentProps,
   withErrorBoundaryProps,
   withHydrateFallbackProps
-} from "./chunk-YBLPXYCV.mjs";
+} from "./chunk-Q34X6AWR.mjs";
 
 // lib/dom/ssr/server.tsx
 import * as React from "react";
@@ -747,18 +748,25 @@ function prependCookies(parentHeaders, childHeaders) {
 function throwIfPotentialCSRFAttack(request, allowedActionOrigins) {
   let originHeader = request.headers.get("origin");
   let originDomain = null;
+  let originUrl = null;
   try {
-    originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+    if (typeof originHeader === "string" && originHeader !== "null") {
+      originUrl = new URL(originHeader);
+      originDomain = originUrl.host;
+    } else {
+      originDomain = originHeader;
+    }
   } catch {
     throw new Error(
       `\`origin\` header is not a valid URL. Aborting the action.`
     );
   }
-  let host = new URL(request.url).host;
-  if (originDomain && originDomain !== host) {
+  let requestUrl = new URL(request.url);
+  let originMatchesRequest = originUrl ? originUrl.origin === requestUrl.origin : originDomain === requestUrl.host;
+  if (originDomain && !originMatchesRequest) {
     if (!isAllowedOrigin(originDomain, allowedActionOrigins)) {
       throw new Error(
-        "The `request.url` host does not match `origin` header from a forwarded action request. Aborting the action."
+        "The `request.url` origin does not match `origin` header from a forwarded action request. Aborting the action."
       );
     }
   }
@@ -2190,7 +2198,7 @@ async function routeRSCServerRequest({
           }
           controller.enqueue(
             new TextEncoder().encode(
-              `<meta http-equiv="refresh" content="0;url=${escapeHtml(renderRedirect.location)}"/>`
+              `<meta http-equiv="refresh" content="0;url=${escapeAttribute(renderRedirect.location)}"/>`
             )
           );
         }
@@ -2310,7 +2318,7 @@ async function routeRSCServerRequest({
             }
             controller.enqueue(
               new TextEncoder().encode(
-                `<meta http-equiv="refresh" content="0;url=${escapeHtml(retryRedirect.location)}"/>`
+                `<meta http-equiv="refresh" content="0;url=${escapeAttribute(retryRedirect.location)}"/>`
               )
             );
           }

package/dist/production/{chunk-YBLPXYCV.mjs → chunk-Q34X6AWR.mjs}

@@ -1,5 +1,5 @@
 /**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -784,13 +784,16 @@ function matchPathImpl(pattern, pathname, matcher, compiledParams) {
   let match = pathname.match(matcher);
   if (!match) return null;
   let matchedPathname = match[0];
-  let pathnameBase = matchedPathname.replace(/(.)\/+$/, "$1");
+  let pathnameBase = removeTrailingSlash(matchedPathname, 1);
   let captureGroups = match.slice(1);
   let params = compiledParams.reduce(
     (memo2, { paramName, isOptional }, index) => {
       if (paramName === "*") {
         let splatValue = captureGroups[index] || "";
-        pathnameBase = matchedPathname.slice(0, matchedPathname.length - splatValue.length).replace(/(.)\/+$/, "$1");
+        pathnameBase = removeTrailingSlash(
+          matchedPathname.slice(0, matchedPathname.length - splatValue.length),
+          1
+        );
       }
       const value = captureGroups[index];
       if (isOptional && !value) {
@@ -880,7 +883,7 @@ function resolvePath(to, fromPathname = "/") {
   let pathname;
   if (toPathname) {
     toPathname = removeDoubleSlashes(toPathname);
-    if (toPathname.startsWith("/")) {
+    if (toPathname.startsWith("/") || toPathname.startsWith("\\")) {
       pathname = resolvePathname(toPathname.substring(1), "/");
     } else {
       pathname = resolvePathname(toPathname, fromPathname);
@@ -968,7 +971,13 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
 }
 var removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 var joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
-var removeTrailingSlash = (path) => path.replace(/\/+$/, "");
+function removeTrailingSlash(path, minLength = 0) {
+  let end = path.length;
+  while (end > minLength && path.charCodeAt(end - 1) === 47) {
+    end--;
+  }
+  return end === path.length ? path : path.slice(0, end);
+}
 var normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
 var normalizeSearch = (search) => !search || search === "?" ? "" : search.startsWith("?") ? search : "?" + search;
 var normalizeHash = (hash) => !hash || hash === "#" ? "" : hash.startsWith("#") ? hash : "#" + hash;
@@ -1341,6 +1350,51 @@ function isPlainObject(thing) {
   return proto === Object.prototype || proto === null || Object.getOwnPropertyNames(proto).sort().join("\0") === objectProtoNames;
 }
 
+// lib/router/navigation.ts
+var DEFAULT_NAVIGATION_URL = new URL("http://localhost");
+function getNavigatorCurrentUrl(navigator) {
+  if (navigator.createURL) {
+    return navigator.createURL("/");
+  }
+  try {
+    return new URL(navigator.createHref("/"), DEFAULT_NAVIGATION_URL);
+  } catch {
+    return DEFAULT_NAVIGATION_URL;
+  }
+}
+function isSameOrigin(a, b) {
+  return a.origin === b.origin && (a.origin !== "null" || a.protocol === b.protocol && a.host === b.host);
+}
+function isExplicitUrl(destination, target) {
+  if (destination.startsWith("//")) {
+    return true;
+  }
+  let protocol = target.protocol.toLowerCase();
+  if (!destination.toLowerCase().startsWith(protocol)) {
+    return false;
+  }
+  return target.host === "" || destination.slice(protocol.length).startsWith("//");
+}
+function validateNavigationTarget(original, resolved, currentUrl, externalPolicy) {
+  let originalUrl = null;
+  try {
+    originalUrl = original == null ? null : new URL(original, currentUrl);
+  } catch {
+  }
+  let resolvedUrl = new URL(resolved, currentUrl);
+  let originalIsExternal = originalUrl != null && !isSameOrigin(originalUrl, currentUrl);
+  let resolvedIsExternal = !isSameOrigin(resolvedUrl, currentUrl);
+  if (externalPolicy === "reject") {
+    if (originalIsExternal || resolvedIsExternal) {
+      throw new Error("External navigation is not allowed");
+    }
+  } else if (resolvedIsExternal) {
+    if (originalUrl == null || !isExplicitUrl(original, originalUrl) || !isSameOrigin(originalUrl, resolvedUrl)) {
+      throw new Error("External navigation is not allowed");
+    }
+  }
+}
+
 // lib/router/router.ts
 var validMutationMethodsArr = [
   "POST",
@@ -1764,7 +1818,7 @@ function createRouter(init) {
       init.history.replace(location, location.state);
     }
     let viewTransitionOpts;
-    if (pendingAction === "POP" /* Pop */) {
+    if (pendingAction === "POP" /* Pop */ && !isUninterruptedRevalidation && location !== state.location) {
       let priorPaths = appliedViewTransitions.get(state.location.pathname);
       if (priorPaths && priorPaths.has(location.pathname)) {
         viewTransitionOpts = {
@@ -1852,11 +1906,21 @@ function createRouter(init) {
         ...opts.mask
       };
       maskPath = {
-        pathname: "",
-        search: "",
-        hash: "",
-        ...partialPath
+        pathname: partialPath.pathname ?? "",
+        search: partialPath.search ?? "",
+        hash: partialPath.hash ?? ""
       };
+      if (PROTOCOL_RELATIVE_URL_REGEX.test(maskPath.pathname)) {
+        throw new Error("External navigation is not allowed");
+      } else if (maskPath.pathname.startsWith("\\")) {
+        maskPath.pathname = maskPath.pathname.replace(/^\\+/, "/");
+      }
+      validateNavigationTarget(
+        typeof opts.mask === "string" ? opts.mask : createPath(opts.mask),
+        createPath(maskPath),
+        init.history.createURL("/"),
+        "reject"
+      );
     }
     let currentLocation = state.location;
     let nextLocation = createLocation(
@@ -1870,6 +1934,12 @@ function createRouter(init) {
       ...nextLocation,
       ...init.history.encodeLocation(nextLocation)
     };
+    validateNavigationTarget(
+      to == null ? init.history.createHref(state.location) : typeof to === "string" ? to : createPath(to),
+      init.history.createHref(nextLocation.mask || nextLocation),
+      init.history.createURL("/"),
+      "reject"
+    );
     let userReplace = opts && opts.replace != null ? opts.replace : void 0;
     let historyAction = "PUSH" /* Push */;
     if (userReplace === true) {
@@ -2880,12 +2950,20 @@ function createRouter(init) {
     }
     let location = redirect2.response.headers.get("Location");
     invariant(location, "Expected a Location header on the redirect Response");
+    let originalLocation = location;
+    let currentUrl = new URL(request.url);
     location = normalizeRedirectLocation(
       location,
-      new URL(request.url),
+      currentUrl,
       basename,
       init.history
     );
+    validateNavigationTarget(
+      originalLocation,
+      location,
+      currentUrl,
+      "allow-explicit"
+    );
     let redirectLocation = createLocation(state.location, location, {
       _isRedirect: true
     });
@@ -3404,6 +3482,7 @@ function createRouter(init) {
     // Passthrough to history-aware createHref used by useHref so we get proper
     // hash-aware URLs in DOM paths
     createHref: (to) => init.history.createHref(to),
+    createURL: (to) => init.history.createURL(to),
     encodeLocation: (to) => init.history.encodeLocation(to),
     getFetcher,
     resetFetcher,
@@ -5945,6 +6024,12 @@ function useNavigateUnstable() {
       if (dataRouterContext == null && basename !== "/") {
         path.pathname = path.pathname === "/" ? basename : joinPaths([basename, path.pathname]);
       }
+      validateNavigationTarget(
+        typeof to === "string" ? to : createPath(to),
+        navigator.createHref(path),
+        getNavigatorCurrentUrl(navigator),
+        "reject"
+      );
       (!!options.replace ? navigator.replace : navigator.push)(
         path,
         options.state,
@@ -6186,7 +6271,7 @@ function RSCErrorHandler({
   children,
   error
 }) {
-  let { basename } = React2.useContext(NavigationContext);
+  let { basename, navigator } = React2.useContext(NavigationContext);
   if (typeof error === "object" && error && "digest" in error && typeof error.digest === "string") {
     let redirect2 = decodeRedirectErrorDigest(error.digest);
     if (redirect2) {
@@ -6194,6 +6279,12 @@ function RSCErrorHandler({
       if (existingRedirect) throw existingRedirect;
       let parsed = parseToInfo(redirect2.location, basename);
       let target = parsed.absoluteURL || parsed.to;
+      validateNavigationTarget(
+        redirect2.location,
+        target,
+        getNavigatorCurrentUrl(navigator),
+        "allow-explicit"
+      );
       if (hasInvalidProtocol(target)) {
         throw new Error("Invalid redirect location");
       }
@@ -6871,6 +6962,7 @@ function RouterProvider({
   let navigator = React3.useMemo(() => {
     return {
       createHref: router.createHref,
+      createURL: router.createURL,
       encodeLocation: router.encodeLocation,
       go: (n) => router.navigate(n),
       push: (to, state2, opts) => router.navigate(to, {
@@ -7003,7 +7095,7 @@ function Navigate({
     // the router loaded. We can help them understand how to avoid that.
     `<Navigate> may be used only in the context of a <Router> component.`
   );
-  let { static: isStatic } = React3.useContext(NavigationContext);
+  let { static: isStatic, navigator } = React3.useContext(NavigationContext);
   warning(
     !isStatic,
     `<Navigate> must not be used on the initial render in a <StaticRouter>. This is a no-op, but you should modify your code so the <Navigate> is only ever rendered in response to some user interaction or state change.`
@@ -7017,6 +7109,12 @@ function Navigate({
     locationPathname,
     relative === "path"
   );
+  validateNavigationTarget(
+    typeof to === "string" ? to : createPath(to),
+    navigator.createHref(path),
+    getNavigatorCurrentUrl(navigator),
+    "reject"
+  );
   let jsonPath = JSON.stringify(path);
   React3.useEffect(() => {
     navigate(JSON.parse(jsonPath), { replace: replace2, state, relative });
@@ -8172,6 +8270,9 @@ var ESCAPE_REGEX = /[&><\u2028\u2029]/g;
 function escapeHtml(html) {
   return html.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
 }
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 
 // lib/dom/ssr/invariant.ts
 function invariant2(value, message) {
@@ -10307,7 +10408,7 @@ var isBrowser2 = typeof window !== "undefined" && typeof window.document !== "un
 try {
   if (isBrowser2) {
     window.__reactRouterVersion = // @ts-expect-error
-    "7.18.2";
+    "7.18.4";
   }
 } catch (e) {
 }
@@ -11481,6 +11582,7 @@ export {
   ErrorResponseImpl,
   isRouteErrorResponse,
   instrumentHandler,
+  validateNavigationTarget,
   IDLE_NAVIGATION,
   IDLE_FETCHER,
   IDLE_BLOCKER,
@@ -11551,6 +11653,7 @@ export {
   withErrorBoundaryProps,
   createSearchParams,
   escapeHtml,
+  escapeAttribute,
   encode,
   createRequestInit,
   SingleFetchRedirectSymbol,

package/dist/{development/chunk-3UVS743K.js → production/chunk-QURBR4FZ.js}

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }/**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -14,7 +14,7 @@
 
 
 
-var _chunkHHGH3NKSjs = require('./chunk-HHGH3NKS.js');
+var _chunkYNGRUB6Fjs = require('./chunk-YNGRUB6F.js');
 
 // lib/dom/ssr/hydration.tsx
 function getHydrationData({
@@ -29,12 +29,12 @@ function getHydrationData({
     ...state,
     loaderData: { ...state.loaderData }
   };
-  let initialMatches = _chunkHHGH3NKSjs.matchRoutes.call(void 0, routes, location, basename);
+  let initialMatches = _chunkYNGRUB6Fjs.matchRoutes.call(void 0, routes, location, basename);
   if (initialMatches) {
     for (let match of initialMatches) {
       let routeId = match.route.id;
       let routeInfo = getRouteInfo(routeId);
-      if (_chunkHHGH3NKSjs.shouldHydrateRouteLoader.call(void 0, 
+      if (_chunkYNGRUB6Fjs.shouldHydrateRouteLoader.call(void 0, 
         routeId,
         routeInfo.clientLoader,
         routeInfo.hasLoader,
@@ -112,7 +112,7 @@ function RSCDefaultRootErrorBoundaryImpl({
       }
     }
   );
-  if (_chunkHHGH3NKSjs.isRouteErrorResponse.call(void 0, error)) {
+  if (_chunkYNGRUB6Fjs.isRouteErrorResponse.call(void 0, error)) {
     return /* @__PURE__ */ _react2.default.createElement(
       ErrorWrapper,
       {
@@ -120,7 +120,7 @@ function RSCDefaultRootErrorBoundaryImpl({
         title: "Unhandled Thrown Response!"
       },
       /* @__PURE__ */ _react2.default.createElement("h1", { style: { fontSize: "24px" } }, error.status, " ", error.statusText),
-      _chunkHHGH3NKSjs.ENABLE_DEV_WARNINGS ? heyDeveloper : null
+      _chunkYNGRUB6Fjs.ENABLE_DEV_WARNINGS ? heyDeveloper : null
     );
   }
   let errorInstance;
@@ -146,7 +146,7 @@ function RSCDefaultRootErrorBoundaryImpl({
 function RSCDefaultRootErrorBoundary({
   hasRootLayout
 }) {
-  let error = _chunkHHGH3NKSjs.useRouteError.call(void 0, );
+  let error = _chunkYNGRUB6Fjs.useRouteError.call(void 0, );
   if (hasRootLayout === void 0) {
     throw new Error("Missing 'hasRootLayout' prop");
   }