react-router 8.3.0 → 8.3.1

package/dist/production/lib/router/router.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -12,6 +12,7 @@ import { PROTOCOL_RELATIVE_URL_REGEX, normalizeProtocolRelativeUrl } from "./url
 import { createBrowserURLImpl, createLocation, createPath, invariant, parsePath, warning } from "./history.js";
 import { ErrorResponseImpl, RouterContextProvider, convertRouteMatchToUiMatch, convertRoutesToDataRoutes, createDataFunctionUrl, flattenAndRankRoutes, getPathContributingMatches, getResolveToMatches, getRoutePattern, isAbsoluteUrl, isRouteErrorResponse, isUnsupportedLazyRouteFunctionKey, isUnsupportedLazyRouteObjectKey, matchRoutesImpl, prependBasename, removeDoubleSlashes, resolveTo, stripBasename } from "./utils.js";
 import { consumeInstrumentationClientResultMetaReceiver, getRouteInstrumentationUpdates, instrumentClientSideRouter } from "./instrumentation.js";
+import { validateNavigationTarget } from "./navigation.js";
 //#region lib/router/router.ts
 const validMutationMethodsArr = [
 	"POST",
@@ -412,21 +413,27 @@ function createRouter(init) {
 		let instrumentationNavigateMetaReceiver = consumeInstrumentationClientResultMetaReceiver(router);
 		let { path, submission, error } = normalizeNavigateOptions(false, normalizeTo(state.location, state.matches, basename, to, opts?.fromRouteId, opts?.relative), opts);
 		let maskPath;
-		if (opts?.mask) maskPath = {
-			pathname: "",
-			search: "",
-			hash: "",
-			...typeof opts.mask === "string" ? parsePath(opts.mask) : {
+		if (opts?.mask) {
+			let partialPath = typeof opts.mask === "string" ? parsePath(opts.mask) : {
 				...state.location.mask,
 				...opts.mask
-			}
-		};
+			};
+			maskPath = {
+				pathname: partialPath.pathname ?? "",
+				search: partialPath.search ?? "",
+				hash: partialPath.hash ?? ""
+			};
+			if (PROTOCOL_RELATIVE_URL_REGEX.test(maskPath.pathname)) throw new Error("External navigation is not allowed");
+			else if (maskPath.pathname.startsWith("\\")) maskPath.pathname = maskPath.pathname.replace(/^\\+/, "/");
+			validateNavigationTarget(typeof opts.mask === "string" ? opts.mask : createPath(opts.mask), createPath(maskPath), init.history.createURL("/"), "reject");
+		}
 		let currentLocation = state.location;
 		let nextLocation = createLocation(currentLocation, path, opts && opts.state, void 0, maskPath);
 		nextLocation = {
 			...nextLocation,
 			...init.history.encodeLocation(nextLocation)
 		};
+		validateNavigationTarget(to == null ? init.history.createHref(state.location) : typeof to === "string" ? to : createPath(to), init.history.createHref(nextLocation.mask || nextLocation), init.history.createURL("/"), "reject");
 		let userReplace = opts && opts.replace != null ? opts.replace : void 0;
 		let historyAction = "PUSH";
 		if (userReplace === true) historyAction = "REPLACE";
@@ -883,7 +890,10 @@ function createRouter(init) {
 		let abortPendingFetchRevalidations = () => revalidatingFetchers.forEach((rf) => abortFetcher(rf.key));
 		abortController.signal.addEventListener("abort", abortPendingFetchRevalidations);
 		let { loaderResults, fetcherResults } = await callLoadersAndMaybeResolveData(dsMatches, revalidatingFetchers, revalidationRequest, nextLocation, scopedContext);
-		if (abortController.signal.aborted) return;
+		if (abortController.signal.aborted) {
+			if (fetchReloadIds.get(key) === loadId) fetchReloadIds.delete(key);
+			return;
+		}
 		abortController.signal.removeEventListener("abort", abortPendingFetchRevalidations);
 		fetchReloadIds.delete(key);
 		fetchControllers.delete(key);
@@ -1005,7 +1015,10 @@ function createRouter(init) {
 		if (redirect.response.headers.has("X-Remix-Revalidate")) isRevalidationRequired = true;
 		let location = redirect.response.headers.get("Location");
 		invariant(location, "Expected a Location header on the redirect Response");
-		location = normalizeRedirectLocation(location, new URL(request.url), basename, init.history);
+		let originalLocation = location;
+		let currentUrl = new URL(request.url);
+		location = normalizeRedirectLocation(location, currentUrl, basename, init.history);
+		validateNavigationTarget(originalLocation, location, currentUrl, "allow-explicit");
 		let redirectLocation = createLocation(state.location, location, { _isRedirect: true });
 		if (isBrowser) {
 			let isDocumentReload = false;
@@ -1357,6 +1370,7 @@ function createRouter(init) {
 		fetch,
 		revalidate,
 		createHref: (to) => init.history.createHref(to),
+		createURL: (to) => init.history.createURL(to),
 		encodeLocation: (to) => init.history.encodeLocation(to),
 		getFetcher,
 		resetFetcher,
@@ -1876,7 +1890,7 @@ function normalizeNavigateOptions(isFetcher, path, opts) {
 						text: void 0
 					}
 				};
-			} catch (e) {
+			} catch {
 				return getInvalidBodyError();
 			}
 		}
@@ -1899,7 +1913,7 @@ function normalizeNavigateOptions(isFetcher, path, opts) {
 	} else try {
 		searchParams = new URLSearchParams(opts.body);
 		formData = convertSearchParamsToFormData(searchParams);
-	} catch (e) {
+	} catch {
 		return getInvalidBodyError();
 	}
 	let submission = {
@@ -2415,7 +2429,7 @@ async function callDataStrategyImpl(dataStrategyImpl, request, path, matches, fe
 	});
 	try {
 		await Promise.all(matches.flatMap((m) => [m._lazyPromises?.handler, m._lazyPromises?.route]));
-	} catch (e) {}
+	} catch {}
 	return results;
 }
 async function callLoaderOrAction({ request, path, pattern, match, lazyHandlerPromise, lazyRoutePromise, handlerOverride, scopedContext }) {
@@ -2598,7 +2612,7 @@ function normalizeRedirectLocation(location, currentUrl, basename, historyInstan
 	}
 	try {
 		if (hasInvalidProtocol(historyInstance.createURL(location).toString())) throw new Error("Invalid redirect location");
-	} catch (e) {}
+	} catch {}
 	return location;
 }
 function createClientSideRequest(history, location, signal, submission) {
@@ -2948,7 +2962,7 @@ function restoreAppliedTransitions(_window, transitions) {
 			let json = JSON.parse(sessionPositions);
 			for (let [k, v] of Object.entries(json || {})) if (v && Array.isArray(v)) transitions.set(k, new Set(v || []));
 		}
-	} catch (e) {}
+	} catch {}
 }
 function persistAppliedTransitions(_window, transitions) {
 	if (transitions.size > 0) {
@@ -2969,13 +2983,13 @@ function createDeferred() {
 			res(val);
 			try {
 				await promise;
-			} catch (e) {}
+			} catch {}
 		};
 		reject = async (error) => {
 			rej(error);
 			try {
 				await promise;
-			} catch (e) {}
+			} catch {}
 		};
 	});
 	return {

package/dist/production/lib/router/url.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/router/utils.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -480,13 +480,13 @@ function matchPathImpl(pattern, pathname, matcher, compiledParams) {
 	let match = pathname.match(matcher);
 	if (!match) return null;
 	let matchedPathname = match[0];
-	let pathnameBase = matchedPathname.replace(/(.)\/+$/, "$1");
+	let pathnameBase = removeTrailingSlash(matchedPathname, 1);
 	let captureGroups = match.slice(1);
 	return {
 		params: compiledParams.reduce((memo, { paramName, isOptional }, index) => {
 			if (paramName === "*") {
 				let splatValue = captureGroups[index] || "";
-				pathnameBase = matchedPathname.slice(0, matchedPathname.length - splatValue.length).replace(/(.)\/+$/, "$1");
+				pathnameBase = removeTrailingSlash(matchedPathname.slice(0, matchedPathname.length - splatValue.length), 1);
 			}
 			const value = captureGroups[index];
 			if (isOptional && !value) memo[paramName] = void 0;
@@ -555,7 +555,7 @@ function resolvePath(to, fromPathname = "/") {
 	let pathname;
 	if (toPathname) {
 		toPathname = removeDoubleSlashes(toPathname);
-		if (toPathname.startsWith("/")) pathname = resolvePathname(toPathname.substring(1), "/");
+		if (toPathname.startsWith("/") || toPathname.startsWith("\\")) pathname = resolvePathname(toPathname.substring(1), "/");
 		else pathname = resolvePathname(toPathname, fromPathname);
 	} else pathname = fromPathname;
 	return {
@@ -616,7 +616,11 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
 }
 const removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 const joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
-const removeTrailingSlash = (path) => path.replace(/\/+$/, "");
+function removeTrailingSlash(path, minLength = 0) {
+	let end = path.length;
+	while (end > minLength && path.charCodeAt(end - 1) === 47) end--;
+	return end === path.length ? path : path.slice(0, end);
+}
 const normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
 const normalizeSearch = (search) => !search || search === "?" ? "" : search.startsWith("?") ? search : "?" + search;
 const normalizeHash = (hash) => !hash || hash === "#" ? "" : hash.startsWith("#") ? hash : "#" + hash;
@@ -859,7 +863,7 @@ function parseToInfo(_to, basename) {
 		let path = stripBasename(targetUrl.pathname, basename);
 		if (targetUrl.origin === currentUrl.origin && path != null) to = path + targetUrl.search + targetUrl.hash;
 		else isExternal = true;
-	} catch (e) {
+	} catch {
 		warning(false, `<Link to="${to}"> contains an invalid URL which will probably break when clicked - please update to a valid URL path.`);
 	}
 	return {

package/dist/production/lib/rsc/browser.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -11,6 +11,7 @@
 import { PROTOCOL_RELATIVE_URL_REGEX } from "../router/url.js";
 import { createBrowserHistory, createPath, invariant } from "../router/history.js";
 import { ErrorResponseImpl, createContext, resolvePath } from "../router/utils.js";
+import { validateNavigationTarget } from "../router/navigation.js";
 import { createRouter, hasInvalidProtocol, isMutationMethod } from "../router/router.js";
 import { RSCRouterContext } from "../context.js";
 import { RouterProvider } from "../components.js";
@@ -82,6 +83,7 @@ function createCallServer({ createFromReadableStream, createTemporaryReferenceSe
 		React$1.startTransition(() => Promise.resolve(payloadPromise).then(async (payload) => {
 			if (payload.type === "redirect") {
 				let location = normalizeRedirectLocation(payload.location);
+				validateNavigationTarget(payload.location, location, new URL(window.location.href), "allow-explicit");
 				if (payload.reload || isExternalLocation(location)) {
 					if (hasInvalidProtocol(location)) throw new Error("Invalid redirect location");
 					window.location.href = location;
@@ -97,6 +99,7 @@ function createCallServer({ createFromReadableStream, createTemporaryReferenceSe
 			if (rerender && landedActionId < actionId && globalVar.__routerActionID <= actionId) {
 				if (rerender.type === "redirect") {
 					let location = normalizeRedirectLocation(rerender.location);
+					validateNavigationTarget(rerender.location, location, new URL(window.location.href), "allow-explicit");
 					if (rerender.reload || isExternalLocation(location)) {
 						if (hasInvalidProtocol(location)) throw new Error("Invalid redirect location");
 						window.location.href = location;

package/dist/production/lib/rsc/errorBoundaries.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/rsc/html-stream/browser.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/rsc/html-stream/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -73,7 +73,7 @@ async function writeRSCStream(reader, controller, isCancelled, nonce) {
 			const chunk = read.value;
 			try {
 				writeChunk(JSON.stringify(decoder.decode(chunk, { stream: true })), controller, nonce);
-			} catch (e) {
+			} catch {
 				writeChunk(`Uint8Array.from(atob(${JSON.stringify(btoa(String.fromCodePoint(...chunk)))}), m => m.codePointAt(0))`, controller, nonce);
 			}
 		}

package/dist/production/lib/rsc/route-modules.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/rsc/server.ssr.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -273,7 +273,7 @@ async function routeRSCServerRequest({ request, serverResponse, createFromReadab
 				statusText,
 				headers
 			});
-		} catch (error2) {}
+		} catch {}
 		throw error;
 	}
 }

package/dist/production/lib/server-runtime/cookies.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -95,7 +95,7 @@ function encodeData(value) {
 function decodeData(value) {
 	try {
 		return JSON.parse(decodeURIComponent(myEscape(atob(value))));
-	} catch (e) {
+	} catch {
 		return {};
 	}
 }

package/dist/production/lib/server-runtime/crypto.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -26,7 +26,7 @@ const unsign = async (cookie, secret) => {
 	try {
 		let signature = byteStringToUint8Array(atob(hash));
 		return await crypto.subtle.verify("HMAC", key, signature, data) ? value : false;
-	} catch (e) {
+	} catch {
 		return false;
 	}
 };

package/dist/production/lib/server-runtime/data.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/dev.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -19,7 +19,7 @@ function getDevServerHooks() {
 function getBuildTimeHeader(request, headerName) {
 	if (typeof process !== "undefined") try {
 		if (process.env.hasOwnProperty("IS_RR_BUILD_REQUEST") && process.env.IS_RR_BUILD_REQUEST === "yes") return request.headers.get(headerName);
-	} catch (e) {}
+	} catch {}
 	return null;
 }
 //#endregion

package/dist/production/lib/server-runtime/entry.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/errors.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/headers.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/invariant.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/mode.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/routeMatching.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/routes.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -281,7 +281,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
 			if (isResponse(error)) try {
 				let data = await unwrapResponse(error);
 				errorForSecondRender = new ErrorResponseImpl(error.status, error.statusText, data);
-			} catch (e) {}
+			} catch {}
 			context = getStaticContextFromError(staticHandler.dataRoutes, context, errorForSecondRender);
 			if (context.errors) context.errors = sanitizeErrors(context.errors, serverMode);
 			let state = {

package/dist/production/lib/server-runtime/serverHandoff.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/sessions/cookieStorage.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/sessions/memoryStorage.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/sessions.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/single-fetch.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -23,7 +23,7 @@ async function singleFetchAction(build, serverMode, staticHandler, request, load
 	try {
 		try {
 			throwIfPotentialCSRFAttack(request, Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []);
-		} catch (e) {
+		} catch {
 			return handleQueryError(/* @__PURE__ */ new Error("Bad Request"), 400);
 		}
 		return handleQueryResult(await staticHandler.query(request, {

package/dist/production/lib/server-runtime/urls.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/server-runtime/warnings.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/lib/types/internal.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/vendor/turbo-stream-v2/flatten.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/vendor/turbo-stream-v2/turbo-stream.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -41,7 +41,7 @@ async function decodeInitial(reader) {
 	let line;
 	try {
 		line = JSON.parse(read.value);
-	} catch (reason) {
+	} catch {
 		throw new SyntaxError();
 	}
 	return {
@@ -64,7 +64,7 @@ async function decodeDeferred(reader) {
 				let jsonLine;
 				try {
 					jsonLine = JSON.parse(lineData);
-				} catch (reason) {
+				} catch {
 					throw new SyntaxError();
 				}
 				const value = unflatten.call(this, jsonLine);
@@ -80,7 +80,7 @@ async function decodeDeferred(reader) {
 				let jsonLine;
 				try {
 					jsonLine = JSON.parse(lineData);
-				} catch (reason) {
+				} catch {
 					throw new SyntaxError();
 				}
 				const value = unflatten.call(this, jsonLine);

package/dist/production/vendor/turbo-stream-v2/unflatten.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/vendor/turbo-stream-v2/utils.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.3.1
  *
  * Copyright (c) Remix Software Inc.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "react-router",
   "type": "module",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "description": "Declarative routing for React",
   "keywords": [
     "react",