rwsdk 1.5.4 → 1.5.5

package/dist/runtime/lib/stitchDocumentAndAppStreams.js

@@ -19,6 +19,24 @@ function splitStreamOnFirstNonHoistedTag(sourceStream) {
     const decoder = new TextDecoder();
     const encoder = new TextEncoder();
     const nonHoistedTagPattern = /<(?!(?:\/)?(?:title|meta|link|style|base)[\s>\/])(?![!?])/i;
+    // Longest hoistable name is 5 chars (title/style); a match candidate at
+    // index i needs buffer[i..] to have at least 1 (optional "/") + 5 (name)
+    // + 1 (terminating char) = 7 chars of context past "<" before it can be
+    // trusted as final. Otherwise the tag name may be mid-stream-truncated,
+    // causing a false-positive match on e.g. "<t" and severing <title>.
+    const MIN_TRAILING_CONTEXT = 7;
+    function findTrustedMatch(buf, streamDone) {
+        const match = buf.match(nonHoistedTagPattern);
+        if (!match || typeof match.index !== "number")
+            return null;
+        if (streamDone)
+            return match; // no more data coming; trust it
+        // buf.length - match.index counts the "<" itself, so subtract 1 to
+        // get the number of confirmed characters *after* it.
+        if (buf.length - match.index - 1 < MIN_TRAILING_CONTEXT)
+            return null; // ambiguous, wait for more data
+        return match;
+    }
     let sourceReader;
     let appBodyController = null;
     let buffer = "";
@@ -35,7 +53,7 @@ function splitStreamOnFirstNonHoistedTag(sourceStream) {
                     const { done, value } = await sourceReader.read();
                     if (done) {
                         if (buffer) {
-                            const match = buffer.match(nonHoistedTagPattern);
+                            const match = findTrustedMatch(buffer, true);
                             if (match && typeof match.index === "number") {
                                 const hoistedPart = buffer.slice(0, match.index);
                                 controller.enqueue(encoder.encode(hoistedPart));
@@ -52,7 +70,7 @@ function splitStreamOnFirstNonHoistedTag(sourceStream) {
                         return;
                     }
                     buffer += decoder.decode(value, { stream: true });
-                    const match = buffer.match(nonHoistedTagPattern);
+                    const match = findTrustedMatch(buffer, false);
                     if (match && typeof match.index === "number") {
                         const hoistedPart = buffer.slice(0, match.index);
                         const appPart = buffer.slice(match.index);
@@ -76,9 +94,17 @@ function splitStreamOnFirstNonHoistedTag(sourceStream) {
                     }
                     else {
                         const flushIndex = buffer.lastIndexOf("\n");
-                        if (flushIndex !== -1) {
-                            controller.enqueue(encoder.encode(buffer.slice(0, flushIndex + 1)));
-                            buffer = buffer.slice(flushIndex + 1);
+                        // Never flush past a point that could still be part of
+                        // an ambiguous, not-yet-trusted candidate tag. Only
+                        // flush content strictly before the last unresolved
+                        // "<" in the buffer, so a truncated tag name can never
+                        // be split across a flush boundary.
+                        const earliestOpenBracket = buffer.lastIndexOf("<");
+                        const safeFlushLimit = earliestOpenBracket === -1 ? buffer.length : earliestOpenBracket;
+                        const effectiveFlushIndex = Math.min(flushIndex, safeFlushLimit - 1);
+                        if (flushIndex !== -1 && effectiveFlushIndex >= 0) {
+                            controller.enqueue(encoder.encode(buffer.slice(0, effectiveFlushIndex + 1)));
+                            buffer = buffer.slice(effectiveFlushIndex + 1);
                         }
                         await pump();
                     }

package/dist/runtime/lib/stitchDocumentAndAppStreams.test.js

@@ -155,6 +155,60 @@ describe("stitchDocumentAndAppStreams", () => {
             const result = await streamToString(stitchDocumentAndAppStreams(stringToStream(outerHtml), stringToStream(innerHtml), startMarker, endMarker));
             expect(result.trim().startsWith(`<!DOCTYPE html>`)).toBe(true);
         });
+        it("does not split an unclosed title tag across a chunk boundary", async () => {
+            const outerHtml = `<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8" />
+</head>
+<body>
+  ${startMarker}
+  <script src="/client.js"></script>
+</body>
+</html>`;
+            // The ">" of the closing </title> arrives in the next chunk. A naive
+            // regex scan of the first chunk can falsely treat the "</title" as a
+            // non-hoisted tag boundary, leaving the <title> unclosed in <head>.
+            const innerHtmlChunks = [
+                `<title>Page Title</title`,
+                `><div>App content</div>${endMarker}`,
+            ];
+            const result = await streamToString(stitchDocumentAndAppStreams(stringToStream(outerHtml), createChunkedStream(innerHtmlChunks), startMarker, endMarker));
+            expect(result).toContain(`<title>Page Title</title>`);
+            expect(result).toMatch(/<head>[\s\S]*<title>Page Title<\/title>[\s\S]*<\/head>/);
+            expect(result).toContain(`<div>App content</div>`);
+            const titleIndex = result.indexOf(`<title>Page Title</title>`);
+            const headCloseIndex = result.indexOf(`</head>`);
+            const bodyIndex = result.indexOf(`<body>`);
+            expect(titleIndex).toBeLessThan(headCloseIndex);
+            expect(titleIndex).toBeLessThan(bodyIndex);
+        });
+        it("does not truncate a hoisted tag name across a chunk boundary", async () => {
+            const outerHtml = `<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8" />
+</head>
+<body>
+  ${startMarker}
+  <script src="/client.js"></script>
+</body>
+</html>`;
+            // The "<title" tag name is split between chunks. A naive regex scan of
+            // the first chunk (ending at "<t") can falsely treat that "<" as a
+            // non-hoisted tag boundary and fail to hoist the title.
+            const innerHtmlChunks = [
+                `<t`,
+                `itle>Page Title</title><div>App content</div>${endMarker}`,
+            ];
+            const result = await streamToString(stitchDocumentAndAppStreams(stringToStream(outerHtml), createChunkedStream(innerHtmlChunks), startMarker, endMarker));
+            expect(result).toContain(`<title>Page Title</title>`);
+            expect(result).toMatch(/<head>[\s\S]*<title>Page Title<\/title>[\s\S]*<\/head>/);
+            expect(result).toContain(`<div>App content</div>`);
+            const titleIndex = result.indexOf(`<title>Page Title</title>`);
+            const headCloseIndex = result.indexOf(`</head>`);
+            expect(titleIndex).toBeLessThan(headCloseIndex);
+        });
     });
     describe("basic stitching flow", () => {
         it("stitches document head, app shell, and document tail", async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rwsdk",
-  "version": "1.5.4",
+  "version": "1.5.5",
   "description": "Build fast, server-driven webapps on Cloudflare with SSR, RSC, and realtime",
   "type": "module",
   "bin": {