vinext 0.0.42 → 0.0.44

package/dist/server/app-route-handler-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-route-handler-response.js","names":[],"sources":["../../src/server/app-route-handler-response.ts"],"sourcesContent":["import type { CachedRouteValue } from \"../shims/cache.js\";\nimport { mergeMiddlewareResponseHeaders } from \"./middleware-response-headers.js\";\n\nexport type RouteHandlerMiddlewareContext = {\n  headers: Headers | null;\n  status: number | null;\n};\n\nexport type BuildRouteHandlerCachedResponseOptions = {\n  cacheState: \"HIT\" | \"STALE\";\n  isHead: boolean;\n  revalidateSeconds: number;\n};\n\nexport type FinalizeRouteHandlerResponseOptions = {\n  pendingCookies: string[];\n  draftCookie?: string | null;\n  isHead: boolean;\n};\n\nfunction buildRouteHandlerCacheControl(\n  cacheState: BuildRouteHandlerCachedResponseOptions[\"cacheState\"],\n  revalidateSeconds: number,\n): string {\n  if (cacheState === \"STALE\") {\n    return \"s-maxage=0, stale-while-revalidate\";\n  }\n\n  return `s-maxage=${revalidateSeconds}, stale-while-revalidate`;\n}\n\nexport function applyRouteHandlerMiddlewareContext(\n  response: Response,\n  middlewareContext: RouteHandlerMiddlewareContext,\n): Response {\n  if (!middlewareContext.headers && middlewareContext.status == null) {\n    return response;\n  }\n\n  const responseHeaders = new Headers(response.headers);\n  mergeMiddlewareResponseHeaders(responseHeaders, middlewareContext.headers);\n\n  return new Response(response.body, {\n    status: middlewareContext.status ?? response.status,\n    statusText: response.statusText,\n    headers: responseHeaders,\n  });\n}\n\nexport function buildRouteHandlerCachedResponse(\n  cachedValue: CachedRouteValue,\n  options: BuildRouteHandlerCachedResponseOptions,\n): Response {\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(cachedValue.headers)) {\n    if (Array.isArray(value)) {\n      for (const entry of value) {\n        headers.append(key, entry);\n      }\n    } else {\n      headers.set(key, value);\n    }\n  }\n  headers.set(\"X-Vinext-Cache\", options.cacheState);\n  headers.set(\n    \"Cache-Control\",\n    buildRouteHandlerCacheControl(options.cacheState, options.revalidateSeconds),\n  );\n\n  return new Response(options.isHead ? null : cachedValue.body, {\n    status: cachedValue.status,\n    headers,\n  });\n}\n\nexport function applyRouteHandlerRevalidateHeader(\n  response: Response,\n  revalidateSeconds: number,\n): void {\n  response.headers.set(\"cache-control\", buildRouteHandlerCacheControl(\"HIT\", revalidateSeconds));\n}\n\nexport function markRouteHandlerCacheMiss(response: Response): void {\n  response.headers.set(\"X-Vinext-Cache\", \"MISS\");\n}\n\nexport async function buildAppRouteCacheValue(response: Response): Promise<CachedRouteValue> {\n  const body = await response.arrayBuffer();\n  const headers: CachedRouteValue[\"headers\"] = {};\n\n  response.headers.forEach((value, key) => {\n    if (key === \"set-cookie\" || key === \"x-vinext-cache\" || key === \"cache-control\") return;\n    headers[key] = value;\n  });\n  const setCookies = response.headers.getSetCookie?.() ?? [];\n  if (setCookies.length > 0) {\n    headers[\"set-cookie\"] = setCookies;\n  }\n\n  return {\n    kind: \"APP_ROUTE\",\n    body,\n    status: response.status,\n    headers,\n  };\n}\n\nexport function finalizeRouteHandlerResponse(\n  response: Response,\n  options: FinalizeRouteHandlerResponseOptions,\n): Response {\n  const { pendingCookies, draftCookie, isHead } = options;\n  if (pendingCookies.length === 0 && !draftCookie && !isHead) {\n    return response;\n  }\n\n  const headers = new Headers(response.headers);\n  for (const cookie of pendingCookies) {\n    headers.append(\"Set-Cookie\", cookie);\n  }\n  if (draftCookie) {\n    headers.append(\"Set-Cookie\", draftCookie);\n  }\n\n  return new Response(isHead ? null : response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n"],"mappings":";;AAoBA,SAAS,8BACP,YACA,mBACQ;AACR,KAAI,eAAe,QACjB,QAAO;AAGT,QAAO,YAAY,kBAAkB;;AAGvC,SAAgB,mCACd,UACA,mBACU;AACV,KAAI,CAAC,kBAAkB,WAAW,kBAAkB,UAAU,KAC5D,QAAO;CAGT,MAAM,kBAAkB,IAAI,QAAQ,SAAS,QAAQ;AACrD,gCAA+B,iBAAiB,kBAAkB,QAAQ;AAE1E,QAAO,IAAI,SAAS,SAAS,MAAM;EACjC,QAAQ,kBAAkB,UAAU,SAAS;EAC7C,YAAY,SAAS;EACrB,SAAS;EACV,CAAC;;AAGJ,SAAgB,gCACd,aACA,SACU;CACV,MAAM,UAAU,IAAI,SAAS;AAC7B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,YAAY,QAAQ,CAC5D,KAAI,MAAM,QAAQ,MAAM,CACtB,MAAK,MAAM,SAAS,MAClB,SAAQ,OAAO,KAAK,MAAM;KAG5B,SAAQ,IAAI,KAAK,MAAM;AAG3B,SAAQ,IAAI,kBAAkB,QAAQ,WAAW;AACjD,SAAQ,IACN,iBACA,8BAA8B,QAAQ,YAAY,QAAQ,kBAAkB,CAC7E;AAED,QAAO,IAAI,SAAS,QAAQ,SAAS,OAAO,YAAY,MAAM;EAC5D,QAAQ,YAAY;EACpB;EACD,CAAC;;AAGJ,SAAgB,kCACd,UACA,mBACM;AACN,UAAS,QAAQ,IAAI,iBAAiB,8BAA8B,OAAO,kBAAkB,CAAC;;AAGhG,SAAgB,0BAA0B,UAA0B;AAClE,UAAS,QAAQ,IAAI,kBAAkB,OAAO;;AAGhD,eAAsB,wBAAwB,UAA+C;CAC3F,MAAM,OAAO,MAAM,SAAS,aAAa;CACzC,MAAM,UAAuC,EAAE;AAE/C,UAAS,QAAQ,SAAS,OAAO,QAAQ;AACvC,MAAI,QAAQ,gBAAgB,QAAQ,oBAAoB,QAAQ,gBAAiB;AACjF,UAAQ,OAAO;GACf;CACF,MAAM,aAAa,SAAS,QAAQ,gBAAgB,IAAI,EAAE;AAC1D,KAAI,WAAW,SAAS,EACtB,SAAQ,gBAAgB;AAG1B,QAAO;EACL,MAAM;EACN;EACA,QAAQ,SAAS;EACjB;EACD;;AAGH,SAAgB,6BACd,UACA,SACU;CACV,MAAM,EAAE,gBAAgB,aAAa,WAAW;AAChD,KAAI,eAAe,WAAW,KAAK,CAAC,eAAe,CAAC,OAClD,QAAO;CAGT,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;AAC7C,MAAK,MAAM,UAAU,eACnB,SAAQ,OAAO,cAAc,OAAO;AAEtC,KAAI,YACF,SAAQ,OAAO,cAAc,YAAY;AAG3C,QAAO,IAAI,SAAS,SAAS,OAAO,SAAS,MAAM;EACjD,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB;EACD,CAAC"}
+{"version":3,"file":"app-route-handler-response.js","names":[],"sources":["../../src/server/app-route-handler-response.ts"],"sourcesContent":["import type { CachedRouteValue } from \"../shims/cache.js\";\nimport { mergeMiddlewareResponseHeaders } from \"./middleware-response-headers.js\";\n\nexport type RouteHandlerMiddlewareContext = {\n  headers: Headers | null;\n  status: number | null;\n};\n\nexport type BuildRouteHandlerCachedResponseOptions = {\n  cacheState: \"HIT\" | \"STALE\";\n  isHead: boolean;\n  revalidateSeconds: number;\n};\n\nexport type FinalizeRouteHandlerResponseOptions = {\n  pendingCookies: string[];\n  draftCookie?: string | null;\n  isHead: boolean;\n};\n\n// Matches Next.js's getCacheControlHeader for revalidate === 0.\n// See .nextjs-ref/packages/next/src/server/lib/cache-control.ts.\nconst NEVER_CACHE_CONTROL = \"private, no-cache, no-store, max-age=0, must-revalidate\";\n\nfunction buildRouteHandlerCacheControl(\n  cacheState: BuildRouteHandlerCachedResponseOptions[\"cacheState\"],\n  revalidateSeconds: number,\n): string {\n  if (revalidateSeconds === 0) {\n    // A cached response is never produced for revalidate = 0 (the ISR write\n    // path skips it), so only the HIT/STALE->fresh rewrite can arrive here\n    // with a 0 value, via applyRouteHandlerRevalidateHeader. In all such\n    // cases the author opted out of caching entirely.\n    return NEVER_CACHE_CONTROL;\n  }\n\n  if (cacheState === \"STALE\") {\n    return \"s-maxage=0, stale-while-revalidate\";\n  }\n\n  return `s-maxage=${revalidateSeconds}, stale-while-revalidate`;\n}\n\nexport function applyRouteHandlerMiddlewareContext(\n  response: Response,\n  middlewareContext: RouteHandlerMiddlewareContext,\n): Response {\n  if (!middlewareContext.headers && middlewareContext.status == null) {\n    return response;\n  }\n\n  const responseHeaders = new Headers(response.headers);\n  mergeMiddlewareResponseHeaders(responseHeaders, middlewareContext.headers);\n\n  return new Response(response.body, {\n    status: middlewareContext.status ?? response.status,\n    statusText: response.statusText,\n    headers: responseHeaders,\n  });\n}\n\nexport function buildRouteHandlerCachedResponse(\n  cachedValue: CachedRouteValue,\n  options: BuildRouteHandlerCachedResponseOptions,\n): Response {\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(cachedValue.headers)) {\n    if (Array.isArray(value)) {\n      for (const entry of value) {\n        headers.append(key, entry);\n      }\n    } else {\n      headers.set(key, value);\n    }\n  }\n  headers.set(\"X-Vinext-Cache\", options.cacheState);\n  headers.set(\n    \"Cache-Control\",\n    buildRouteHandlerCacheControl(options.cacheState, options.revalidateSeconds),\n  );\n\n  return new Response(options.isHead ? null : cachedValue.body, {\n    status: cachedValue.status,\n    headers,\n  });\n}\n\nexport function applyRouteHandlerRevalidateHeader(\n  response: Response,\n  revalidateSeconds: number,\n): void {\n  response.headers.set(\"cache-control\", buildRouteHandlerCacheControl(\"HIT\", revalidateSeconds));\n}\n\nexport function markRouteHandlerCacheMiss(response: Response): void {\n  response.headers.set(\"X-Vinext-Cache\", \"MISS\");\n}\n\nexport async function buildAppRouteCacheValue(response: Response): Promise<CachedRouteValue> {\n  const body = await response.arrayBuffer();\n  const headers: CachedRouteValue[\"headers\"] = {};\n\n  response.headers.forEach((value, key) => {\n    if (key === \"set-cookie\" || key === \"x-vinext-cache\" || key === \"cache-control\") return;\n    headers[key] = value;\n  });\n  const setCookies = response.headers.getSetCookie?.() ?? [];\n  if (setCookies.length > 0) {\n    headers[\"set-cookie\"] = setCookies;\n  }\n\n  return {\n    kind: \"APP_ROUTE\",\n    body,\n    status: response.status,\n    headers,\n  };\n}\n\nexport function finalizeRouteHandlerResponse(\n  response: Response,\n  options: FinalizeRouteHandlerResponseOptions,\n): Response {\n  const { pendingCookies, draftCookie, isHead } = options;\n  if (pendingCookies.length === 0 && !draftCookie && !isHead) {\n    return response;\n  }\n\n  const headers = new Headers(response.headers);\n  for (const cookie of pendingCookies) {\n    headers.append(\"Set-Cookie\", cookie);\n  }\n  if (draftCookie) {\n    headers.append(\"Set-Cookie\", draftCookie);\n  }\n\n  return new Response(isHead ? null : response.body, {\n    status: response.status,\n    statusText: response.statusText,\n    headers,\n  });\n}\n"],"mappings":";;AAsBA,MAAM,sBAAsB;AAE5B,SAAS,8BACP,YACA,mBACQ;AACR,KAAI,sBAAsB,EAKxB,QAAO;AAGT,KAAI,eAAe,QACjB,QAAO;AAGT,QAAO,YAAY,kBAAkB;;AAGvC,SAAgB,mCACd,UACA,mBACU;AACV,KAAI,CAAC,kBAAkB,WAAW,kBAAkB,UAAU,KAC5D,QAAO;CAGT,MAAM,kBAAkB,IAAI,QAAQ,SAAS,QAAQ;AACrD,gCAA+B,iBAAiB,kBAAkB,QAAQ;AAE1E,QAAO,IAAI,SAAS,SAAS,MAAM;EACjC,QAAQ,kBAAkB,UAAU,SAAS;EAC7C,YAAY,SAAS;EACrB,SAAS;EACV,CAAC;;AAGJ,SAAgB,gCACd,aACA,SACU;CACV,MAAM,UAAU,IAAI,SAAS;AAC7B,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,YAAY,QAAQ,CAC5D,KAAI,MAAM,QAAQ,MAAM,CACtB,MAAK,MAAM,SAAS,MAClB,SAAQ,OAAO,KAAK,MAAM;KAG5B,SAAQ,IAAI,KAAK,MAAM;AAG3B,SAAQ,IAAI,kBAAkB,QAAQ,WAAW;AACjD,SAAQ,IACN,iBACA,8BAA8B,QAAQ,YAAY,QAAQ,kBAAkB,CAC7E;AAED,QAAO,IAAI,SAAS,QAAQ,SAAS,OAAO,YAAY,MAAM;EAC5D,QAAQ,YAAY;EACpB;EACD,CAAC;;AAGJ,SAAgB,kCACd,UACA,mBACM;AACN,UAAS,QAAQ,IAAI,iBAAiB,8BAA8B,OAAO,kBAAkB,CAAC;;AAGhG,SAAgB,0BAA0B,UAA0B;AAClE,UAAS,QAAQ,IAAI,kBAAkB,OAAO;;AAGhD,eAAsB,wBAAwB,UAA+C;CAC3F,MAAM,OAAO,MAAM,SAAS,aAAa;CACzC,MAAM,UAAuC,EAAE;AAE/C,UAAS,QAAQ,SAAS,OAAO,QAAQ;AACvC,MAAI,QAAQ,gBAAgB,QAAQ,oBAAoB,QAAQ,gBAAiB;AACjF,UAAQ,OAAO;GACf;CACF,MAAM,aAAa,SAAS,QAAQ,gBAAgB,IAAI,EAAE;AAC1D,KAAI,WAAW,SAAS,EACtB,SAAQ,gBAAgB;AAG1B,QAAO;EACL,MAAM;EACN;EACA,QAAQ,SAAS;EACjB;EACD;;AAGH,SAAgB,6BACd,UACA,SACU;CACV,MAAM,EAAE,gBAAgB,aAAa,WAAW;AAChD,KAAI,eAAe,WAAW,KAAK,CAAC,eAAe,CAAC,OAClD,QAAO;CAGT,MAAM,UAAU,IAAI,QAAQ,SAAS,QAAQ;AAC7C,MAAK,MAAM,UAAU,eACnB,SAAQ,OAAO,cAAc,OAAO;AAEtC,KAAI,YACF,SAAQ,OAAO,cAAc,YAAY;AAG3C,QAAO,IAAI,SAAS,SAAS,OAAO,SAAS,MAAM;EACjD,QAAQ,SAAS;EACjB,YAAY,SAAS;EACrB;EACD,CAAC"}

package/dist/server/app-router-entry.js

@@ -1,4 +1,5 @@
 import { runWithExecutionContext } from "../shims/request-context.js";
+import { isOpenRedirectShaped } from "./request-pipeline.js";
 import { resolveStaticAssetSignal } from "./worker-utils.js";
 import rscHandler from "virtual:vinext-rsc-entry";
 //#region src/server/app-router-entry.ts
@@ -16,7 +17,13 @@ import rscHandler from "virtual:vinext-rsc-entry";
 *   cloudflare({ viteEnvironment: { name: "rsc", childEnvironments: ["ssr"] } })
 */
 var app_router_entry_default = { async fetch(request, env, ctx) {
-	if (new URL(request.url).pathname.replaceAll("\\", "/").startsWith("//")) return new Response("404 Not Found", { status: 404 });
+	const url = new URL(request.url);
+	if (isOpenRedirectShaped(url.pathname)) return new Response("404 Not Found", { status: 404 });
+	try {
+		decodeURIComponent(url.pathname);
+	} catch {
+		return new Response("Bad Request", { status: 400 });
+	}
 	const handleFn = () => rscHandler(request, ctx);
 	const result = await (ctx ? runWithExecutionContext(ctx, handleFn) : handleFn());
 	if (result instanceof Response) {

package/dist/server/app-router-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-router-entry.js","names":[],"sources":["../../src/server/app-router-entry.ts"],"sourcesContent":["/**\n * Default Cloudflare Worker entry point for vinext App Router.\n *\n * Use this directly in wrangler.jsonc:\n *   \"main\": \"vinext/server/app-router-entry\"\n *\n * Or import and delegate to it from a custom worker:\n *   import handler from \"vinext/server/app-router-entry\";\n *   return handler.fetch(request, env, ctx);\n *\n * This file runs in the RSC environment. Configure the Cloudflare plugin with:\n *   cloudflare({ viteEnvironment: { name: \"rsc\", childEnvironments: [\"ssr\"] } })\n */\n\n// @ts-expect-error — virtual module resolved by vinext\nimport rscHandler from \"virtual:vinext-rsc-entry\";\nimport { runWithExecutionContext, type ExecutionContextLike } from \"../shims/request-context.js\";\nimport { resolveStaticAssetSignal } from \"./worker-utils.js\";\n\ntype WorkerAssetEnv = {\n  ASSETS?: {\n    fetch(request: Request): Promise<Response> | Response;\n  };\n};\n\nexport default {\n  async fetch(\n    request: Request,\n    env?: WorkerAssetEnv,\n    ctx?: ExecutionContextLike,\n  ): Promise<Response> {\n    const url = new URL(request.url);\n\n    // Normalize backslashes (browsers treat /\\ as //) before any other checks.\n    const rawPathname = url.pathname.replaceAll(\"\\\\\", \"/\");\n\n    // Block protocol-relative URL open redirects (//evil.com/ or /\\evil.com/).\n    // Check rawPathname BEFORE decode so the guard fires before normalization.\n    if (rawPathname.startsWith(\"//\")) {\n      return new Response(\"404 Not Found\", { status: 404 });\n    }\n\n    // Validate that percent-encoding is well-formed. The RSC handler performs\n    // the actual decode + normalize; we only check here to return a clean 400\n    // instead of letting a malformed sequence crash downstream.\n    try {\n      decodeURIComponent(rawPathname);\n    } catch {\n      // Malformed percent-encoding (e.g. /%E0%A4%A) — return 400 instead of throwing.\n      return new Response(\"Bad Request\", { status: 400 });\n    }\n\n    // Do NOT decode/normalize the pathname here. The RSC handler\n    // (virtual:vinext-rsc-entry) is the single point of decoding — it calls\n    // decodeURIComponent + normalizePath on the incoming URL. Decoding here\n    // AND in the handler would double-decode, causing inconsistent path\n    // matching between middleware and routing.\n\n    // Delegate to RSC handler (which decodes + normalizes the pathname itself),\n    // wrapping in the ExecutionContext ALS scope so downstream code can reach\n    // ctx.waitUntil() without having ctx threaded through every call site.\n    const handleFn = () => rscHandler(request, ctx);\n    const result = await (ctx ? runWithExecutionContext(ctx, handleFn) : handleFn());\n\n    if (result instanceof Response) {\n      if (env?.ASSETS) {\n        const assetResponse = await resolveStaticAssetSignal(result, {\n          fetchAsset: (path) =>\n            Promise.resolve(env.ASSETS!.fetch(new Request(new URL(path, request.url)))),\n        });\n        if (assetResponse) return assetResponse;\n      }\n      return result;\n    }\n\n    if (result === null || result === undefined) {\n      return new Response(\"Not Found\", { status: 404 });\n    }\n\n    return new Response(String(result), { status: 200 });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;AAyBA,IAAA,2BAAe,EACb,MAAM,MACJ,SACA,KACA,KACmB;AAQnB,KAPY,IAAI,IAAI,QAAQ,IAAI,CAGR,SAAS,WAAW,MAAM,IAAI,CAItC,WAAW,KAAK,CAC9B,QAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,KAAK,CAAC;CAsBvD,MAAM,iBAAiB,WAAW,SAAS,IAAI;CAC/C,MAAM,SAAS,OAAO,MAAM,wBAAwB,KAAK,SAAS,GAAG,UAAU;AAE/E,KAAI,kBAAkB,UAAU;AAC9B,MAAI,KAAK,QAAQ;GACf,MAAM,gBAAgB,MAAM,yBAAyB,QAAQ,EAC3D,aAAa,SACX,QAAQ,QAAQ,IAAI,OAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,CAAC,CAAC,EAC9E,CAAC;AACF,OAAI,cAAe,QAAO;;AAE5B,SAAO;;AAGT,KAAI,WAAW,QAAQ,WAAW,KAAA,EAChC,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AAGnD,QAAO,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,QAAQ,KAAK,CAAC;GAEvD"}
+{"version":3,"file":"app-router-entry.js","names":[],"sources":["../../src/server/app-router-entry.ts"],"sourcesContent":["/**\n * Default Cloudflare Worker entry point for vinext App Router.\n *\n * Use this directly in wrangler.jsonc:\n *   \"main\": \"vinext/server/app-router-entry\"\n *\n * Or import and delegate to it from a custom worker:\n *   import handler from \"vinext/server/app-router-entry\";\n *   return handler.fetch(request, env, ctx);\n *\n * This file runs in the RSC environment. Configure the Cloudflare plugin with:\n *   cloudflare({ viteEnvironment: { name: \"rsc\", childEnvironments: [\"ssr\"] } })\n */\n\n// @ts-expect-error — virtual module resolved by vinext\nimport rscHandler from \"virtual:vinext-rsc-entry\";\nimport { runWithExecutionContext, type ExecutionContextLike } from \"../shims/request-context.js\";\nimport { resolveStaticAssetSignal } from \"./worker-utils.js\";\nimport { isOpenRedirectShaped } from \"./request-pipeline.js\";\n\ntype WorkerAssetEnv = {\n  ASSETS?: {\n    fetch(request: Request): Promise<Response> | Response;\n  };\n};\n\nexport default {\n  async fetch(\n    request: Request,\n    env?: WorkerAssetEnv,\n    ctx?: ExecutionContextLike,\n  ): Promise<Response> {\n    const url = new URL(request.url);\n\n    // Block protocol-relative URL open redirects (//evil.com/, /\\evil.com/,\n    // /%5Cevil.com/, /%2F/evil.com/). Check BEFORE decode so both literal and\n    // percent-encoded variants are caught — encoded forms survive segment-wise\n    // decoding and would otherwise reach trailing-slash redirect emitters.\n    if (isOpenRedirectShaped(url.pathname)) {\n      return new Response(\"404 Not Found\", { status: 404 });\n    }\n\n    // Validate that percent-encoding is well-formed. The RSC handler performs\n    // the actual decode + normalize; we only check here to return a clean 400\n    // instead of letting a malformed sequence crash downstream.\n    try {\n      decodeURIComponent(url.pathname);\n    } catch {\n      // Malformed percent-encoding (e.g. /%E0%A4%A) — return 400 instead of throwing.\n      return new Response(\"Bad Request\", { status: 400 });\n    }\n\n    // Do NOT decode/normalize the pathname here. The RSC handler\n    // (virtual:vinext-rsc-entry) is the single point of decoding — it calls\n    // decodeURIComponent + normalizePath on the incoming URL. Decoding here\n    // AND in the handler would double-decode, causing inconsistent path\n    // matching between middleware and routing.\n\n    // Delegate to RSC handler (which decodes + normalizes the pathname itself),\n    // wrapping in the ExecutionContext ALS scope so downstream code can reach\n    // ctx.waitUntil() without having ctx threaded through every call site.\n    const handleFn = () => rscHandler(request, ctx);\n    const result = await (ctx ? runWithExecutionContext(ctx, handleFn) : handleFn());\n\n    if (result instanceof Response) {\n      if (env?.ASSETS) {\n        const assetResponse = await resolveStaticAssetSignal(result, {\n          fetchAsset: (path) =>\n            Promise.resolve(env.ASSETS!.fetch(new Request(new URL(path, request.url)))),\n        });\n        if (assetResponse) return assetResponse;\n      }\n      return result;\n    }\n\n    if (result === null || result === undefined) {\n      return new Response(\"Not Found\", { status: 404 });\n    }\n\n    return new Response(String(result), { status: 200 });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;AA0BA,IAAA,2BAAe,EACb,MAAM,MACJ,SACA,KACA,KACmB;CACnB,MAAM,MAAM,IAAI,IAAI,QAAQ,IAAI;AAMhC,KAAI,qBAAqB,IAAI,SAAS,CACpC,QAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,KAAK,CAAC;AAMvD,KAAI;AACF,qBAAmB,IAAI,SAAS;SAC1B;AAEN,SAAO,IAAI,SAAS,eAAe,EAAE,QAAQ,KAAK,CAAC;;CAYrD,MAAM,iBAAiB,WAAW,SAAS,IAAI;CAC/C,MAAM,SAAS,OAAO,MAAM,wBAAwB,KAAK,SAAS,GAAG,UAAU;AAE/E,KAAI,kBAAkB,UAAU;AAC9B,MAAI,KAAK,QAAQ;GACf,MAAM,gBAAgB,MAAM,yBAAyB,QAAQ,EAC3D,aAAa,SACX,QAAQ,QAAQ,IAAI,OAAQ,MAAM,IAAI,QAAQ,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,CAAC,CAAC,EAC9E,CAAC;AACF,OAAI,cAAe,QAAO;;AAE5B,SAAO;;AAGT,KAAI,WAAW,QAAQ,WAAW,KAAA,EAChC,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AAGnD,QAAO,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,QAAQ,KAAK,CAAC;GAEvD"}

package/dist/server/app-ssr-entry.js

@@ -4,6 +4,7 @@ import { runWithNavigationContext } from "../shims/navigation-state.js";
 import { withScriptNonce } from "../shims/script-nonce-context.js";
 import { createInlineScriptTag, createNonceAttribute, escapeHtmlAttr, safeJsonStringify } from "./html.js";
 import { ElementsContext, Slot } from "../shims/slot.js";
+import { isOpenRedirectShaped } from "./request-pipeline.js";
 import { createRscEmbedTransform, createTickBufferedTransform } from "./app-ssr-stream.js";
 import { Fragment, createElement, use } from "react";
 import { renderToReadableStream, renderToStaticMarkup } from "react-dom/server.edge";
@@ -97,7 +98,7 @@ async function handleSsr(rscStream, navContext, fontData, options) {
 	});
 }
 var app_ssr_entry_default = { async fetch(request) {
-	if (new URL(request.url).pathname.startsWith("//")) return new Response("404 Not Found", { status: 404 });
+	if (isOpenRedirectShaped(new URL(request.url).pathname)) return new Response("404 Not Found", { status: 404 });
 	const result = await (await import.meta.viteRsc.loadModule("rsc", "index")).default(request);
 	if (result instanceof Response) return result;
 	if (result == null) return new Response("Not Found", { status: 404 });

package/dist/server/app-ssr-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-ssr-entry.js","names":["createReactElement"],"sources":["../../src/server/app-ssr-entry.ts"],"sourcesContent":["/// <reference types=\"@vitejs/plugin-rsc/types\" />\n\nimport type { ReactNode } from \"react\";\nimport { Fragment, createElement as createReactElement, use } from \"react\";\nimport { createFromReadableStream } from \"@vitejs/plugin-rsc/ssr\";\nimport { renderToReadableStream, renderToStaticMarkup } from \"react-dom/server.edge\";\nimport * as clientReferences from \"virtual:vite-rsc/client-references\";\nimport type { NavigationContext } from \"../shims/navigation.js\";\nimport {\n  ServerInsertedHTMLContext,\n  clearServerInsertedHTML,\n  flushServerInsertedHTML,\n  setNavigationContext,\n  useServerInsertedHTML,\n} from \"../shims/navigation.js\";\nimport { runWithNavigationContext } from \"../shims/navigation-state.js\";\nimport { withScriptNonce } from \"../shims/script-nonce-context.js\";\nimport {\n  createInlineScriptTag,\n  createNonceAttribute,\n  escapeHtmlAttr,\n  safeJsonStringify,\n} from \"./html.js\";\nimport { createRscEmbedTransform, createTickBufferedTransform } from \"./app-ssr-stream.js\";\nimport {\n  normalizeAppElements,\n  readAppElementsMetadata,\n  type AppWireElements,\n} from \"./app-elements.js\";\nimport { ElementsContext, Slot } from \"../shims/slot.js\";\n\nexport type FontPreload = {\n  href: string;\n  type: string;\n};\n\nexport type FontData = {\n  links?: string[];\n  styles?: string[];\n  preloads?: FontPreload[];\n};\n\ntype ClientRequire = (id: string) => Promise<unknown>;\n\nlet clientRefsPreloaded = false;\n\nfunction getClientReferenceRequire(): ClientRequire | undefined {\n  return (\n    globalThis as typeof globalThis & {\n      __vite_rsc_client_require__?: ClientRequire;\n    }\n  ).__vite_rsc_client_require__;\n}\n\nasync function preloadClientReferences(): Promise<void> {\n  if (clientRefsPreloaded) return;\n\n  const refs = (clientReferences as { default?: Record<string, unknown> }).default;\n  const clientRequire = getClientReferenceRequire();\n  if (!refs || !clientRequire) return;\n\n  await Promise.all(\n    Object.keys(refs).map((id) =>\n      clientRequire(id).catch((error) => {\n        if (process.env.NODE_ENV !== \"production\") {\n          console.warn(\"[vinext] failed to preload client ref:\", id, error);\n        }\n      }),\n    ),\n  );\n\n  clientRefsPreloaded = true;\n}\n\nfunction ssrErrorDigest(input: string): string {\n  let hash = 5381;\n  for (let i = input.length - 1; i >= 0; i--) {\n    hash = (hash * 33) ^ input.charCodeAt(i);\n  }\n  return (hash >>> 0).toString();\n}\n\nfunction getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message;\n  if (typeof error === \"string\") return error;\n  return Object.prototype.toString.call(error);\n}\n\nfunction renderInsertedHtml(insertedElements: readonly unknown[]): string {\n  let insertedHTML = \"\";\n\n  for (const element of insertedElements) {\n    try {\n      insertedHTML += renderToStaticMarkup(\n        createReactElement(Fragment, null, element as ReactNode),\n      );\n    } catch {\n      // Ignore individual callback failures so the rest of the page can render.\n    }\n  }\n\n  return insertedHTML;\n}\n\nfunction renderFontHtml(fontData?: FontData, nonce?: string): string {\n  if (!fontData) return \"\";\n\n  let fontHTML = \"\";\n  const nonceAttr = createNonceAttribute(nonce);\n\n  for (const url of fontData.links ?? []) {\n    fontHTML += `<link rel=\"stylesheet\"${nonceAttr} href=\"${escapeHtmlAttr(url)}\" />\\n`;\n  }\n\n  for (const preload of fontData.preloads ?? []) {\n    fontHTML += `<link rel=\"preload\"${nonceAttr} href=\"${escapeHtmlAttr(preload.href)}\" as=\"font\" type=\"${escapeHtmlAttr(preload.type)}\" crossorigin />\\n`;\n  }\n\n  if (fontData.styles && fontData.styles.length > 0) {\n    fontHTML += `<style data-vinext-fonts${nonceAttr}>${fontData.styles.join(\"\\n\")}</style>\\n`;\n  }\n\n  return fontHTML;\n}\n\nfunction extractModulePreloadHtml(bootstrapScriptContent?: string, nonce?: string): string {\n  if (!bootstrapScriptContent) return \"\";\n\n  const match = bootstrapScriptContent.match(/import\\(\"([^\"]+)\"\\)/);\n  if (!match?.[1]) return \"\";\n\n  return `<link rel=\"modulepreload\"${createNonceAttribute(nonce)} href=\"${escapeHtmlAttr(match[1])}\" />\\n`;\n}\n\nfunction buildHeadInjectionHtml(\n  navContext: NavigationContext | null,\n  bootstrapScriptContent: string | undefined,\n  insertedHTML: string,\n  fontHTML: string,\n  scriptNonce?: string,\n): string {\n  const paramsScript = createInlineScriptTag(\n    \"self.__VINEXT_RSC_PARAMS__=\" + safeJsonStringify(navContext?.params ?? {}),\n    scriptNonce,\n  );\n  const navPayload = {\n    pathname: navContext?.pathname ?? \"/\",\n    searchParams: navContext?.searchParams ? [...navContext.searchParams.entries()] : [],\n  };\n  const navScript = createInlineScriptTag(\n    \"self.__VINEXT_RSC_NAV__=\" + safeJsonStringify(navPayload),\n    scriptNonce,\n  );\n\n  return (\n    paramsScript +\n    navScript +\n    extractModulePreloadHtml(bootstrapScriptContent, scriptNonce) +\n    insertedHTML +\n    fontHTML\n  );\n}\n\nexport async function handleSsr(\n  rscStream: ReadableStream<Uint8Array>,\n  navContext: NavigationContext | null,\n  fontData?: FontData,\n  options?: { scriptNonce?: string },\n): Promise<ReadableStream<Uint8Array>> {\n  return runWithNavigationContext(async () => {\n    await preloadClientReferences();\n\n    if (navContext) {\n      setNavigationContext(navContext);\n    }\n\n    clearServerInsertedHTML();\n\n    try {\n      const [ssrStream, embedStream] = rscStream.tee();\n      const rscEmbed = createRscEmbedTransform(embedStream, options?.scriptNonce);\n\n      let flightRoot: PromiseLike<AppWireElements> | null = null;\n\n      function VinextFlightRoot(): ReactNode {\n        if (!flightRoot) {\n          flightRoot = createFromReadableStream<AppWireElements>(ssrStream);\n        }\n        const wireElements = use(flightRoot);\n        const elements = normalizeAppElements(wireElements);\n        const metadata = readAppElementsMetadata(elements);\n        return createReactElement(\n          ElementsContext.Provider,\n          { value: elements },\n          createReactElement(Slot, { id: metadata.routeId }),\n        );\n      }\n\n      const root = createReactElement(VinextFlightRoot);\n      const ssrTree = ServerInsertedHTMLContext\n        ? createReactElement(\n            ServerInsertedHTMLContext.Provider,\n            { value: useServerInsertedHTML },\n            root,\n          )\n        : root;\n      const ssrRoot = withScriptNonce(ssrTree, options?.scriptNonce);\n\n      const bootstrapScriptContent = await import.meta.viteRsc.loadBootstrapScriptContent(\"index\");\n\n      const htmlStream = await renderToReadableStream(ssrRoot, {\n        bootstrapScriptContent,\n        nonce: options?.scriptNonce,\n        onError(error) {\n          if (error && typeof error === \"object\" && \"digest\" in error) {\n            return String(error.digest);\n          }\n\n          if (process.env.NODE_ENV === \"production\" && error) {\n            const message = getErrorMessage(error);\n            const stack = error instanceof Error ? (error.stack ?? \"\") : \"\";\n            return ssrErrorDigest(message + stack);\n          }\n\n          return undefined;\n        },\n      });\n\n      const insertedHTML = renderInsertedHtml(flushServerInsertedHTML());\n      const fontHTML = renderFontHtml(fontData, options?.scriptNonce);\n      const injectHTML = buildHeadInjectionHtml(\n        navContext,\n        bootstrapScriptContent,\n        insertedHTML,\n        fontHTML,\n        options?.scriptNonce,\n      );\n\n      return htmlStream.pipeThrough(createTickBufferedTransform(rscEmbed, injectHTML));\n    } finally {\n      setNavigationContext(null);\n      clearServerInsertedHTML();\n    }\n  }) as Promise<ReadableStream<Uint8Array>>;\n}\n\nexport default {\n  async fetch(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    if (url.pathname.startsWith(\"//\")) {\n      return new Response(\"404 Not Found\", { status: 404 });\n    }\n\n    const rscModule = await import.meta.viteRsc.loadModule<{\n      default(request: Request): Promise<Response | string | null | undefined>;\n    }>(\"rsc\", \"index\");\n    const result = await rscModule.default(request);\n\n    if (result instanceof Response) {\n      return result;\n    }\n\n    if (result == null) {\n      return new Response(\"Not Found\", { status: 404 });\n    }\n\n    return new Response(String(result), { status: 200 });\n  },\n};\n"],"mappings":";;;;;;;;;;;;AA4CA,IAAI,sBAAsB;AAE1B,SAAS,4BAAuD;AAC9D,QACE,WAGA;;AAGJ,eAAe,0BAAyC;AACtD,KAAI,oBAAqB;CAEzB,MAAM,OAAQ,iBAA2D;CACzE,MAAM,gBAAgB,2BAA2B;AACjD,KAAI,CAAC,QAAQ,CAAC,cAAe;AAE7B,OAAM,QAAQ,IACZ,OAAO,KAAK,KAAK,CAAC,KAAK,OACrB,cAAc,GAAG,CAAC,OAAO,UAAU;AACjC,MAAI,QAAQ,IAAI,aAAa,aAC3B,SAAQ,KAAK,0CAA0C,IAAI,MAAM;GAEnE,CACH,CACF;AAED,uBAAsB;;AAGxB,SAAS,eAAe,OAAuB;CAC7C,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,IACrC,QAAQ,OAAO,KAAM,MAAM,WAAW,EAAE;AAE1C,SAAQ,SAAS,GAAG,UAAU;;AAGhC,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAO,OAAO,UAAU,SAAS,KAAK,MAAM;;AAG9C,SAAS,mBAAmB,kBAA8C;CACxE,IAAI,eAAe;AAEnB,MAAK,MAAM,WAAW,iBACpB,KAAI;AACF,kBAAgB,qBACdA,cAAmB,UAAU,MAAM,QAAqB,CACzD;SACK;AAKV,QAAO;;AAGT,SAAS,eAAe,UAAqB,OAAwB;AACnE,KAAI,CAAC,SAAU,QAAO;CAEtB,IAAI,WAAW;CACf,MAAM,YAAY,qBAAqB,MAAM;AAE7C,MAAK,MAAM,OAAO,SAAS,SAAS,EAAE,CACpC,aAAY,yBAAyB,UAAU,SAAS,eAAe,IAAI,CAAC;AAG9E,MAAK,MAAM,WAAW,SAAS,YAAY,EAAE,CAC3C,aAAY,sBAAsB,UAAU,SAAS,eAAe,QAAQ,KAAK,CAAC,oBAAoB,eAAe,QAAQ,KAAK,CAAC;AAGrI,KAAI,SAAS,UAAU,SAAS,OAAO,SAAS,EAC9C,aAAY,2BAA2B,UAAU,GAAG,SAAS,OAAO,KAAK,KAAK,CAAC;AAGjF,QAAO;;AAGT,SAAS,yBAAyB,wBAAiC,OAAwB;AACzF,KAAI,CAAC,uBAAwB,QAAO;CAEpC,MAAM,QAAQ,uBAAuB,MAAM,sBAAsB;AACjE,KAAI,CAAC,QAAQ,GAAI,QAAO;AAExB,QAAO,4BAA4B,qBAAqB,MAAM,CAAC,SAAS,eAAe,MAAM,GAAG,CAAC;;AAGnG,SAAS,uBACP,YACA,wBACA,cACA,UACA,aACQ;AAcR,QAbqB,sBACnB,gCAAgC,kBAAkB,YAAY,UAAU,EAAE,CAAC,EAC3E,YACD,GAKiB,sBAChB,6BAA6B,kBALZ;EACjB,UAAU,YAAY,YAAY;EAClC,cAAc,YAAY,eAAe,CAAC,GAAG,WAAW,aAAa,SAAS,CAAC,GAAG,EAAE;EACrF,CAE2D,EAC1D,YACD,GAKC,yBAAyB,wBAAwB,YAAY,GAC7D,eACA;;AAIJ,eAAsB,UACpB,WACA,YACA,UACA,SACqC;AACrC,QAAO,yBAAyB,YAAY;AAC1C,QAAM,yBAAyB;AAE/B,MAAI,WACF,sBAAqB,WAAW;AAGlC,2BAAyB;AAEzB,MAAI;GACF,MAAM,CAAC,WAAW,eAAe,UAAU,KAAK;GAChD,MAAM,WAAW,wBAAwB,aAAa,SAAS,YAAY;GAE3E,IAAI,aAAkD;GAEtD,SAAS,mBAA8B;AACrC,QAAI,CAAC,WACH,cAAa,yBAA0C,UAAU;IAGnE,MAAM,WAAW,qBADI,IAAI,WAAW,CACe;IACnD,MAAM,WAAW,wBAAwB,SAAS;AAClD,WAAOA,cACL,gBAAgB,UAChB,EAAE,OAAO,UAAU,EACnBA,cAAmB,MAAM,EAAE,IAAI,SAAS,SAAS,CAAC,CACnD;;GAGH,MAAM,OAAOA,cAAmB,iBAAiB;GAQjD,MAAM,UAAU,gBAPA,4BACZA,cACE,0BAA0B,UAC1B,EAAE,OAAO,uBAAuB,EAChC,KACD,GACD,MACqC,SAAS,YAAY;GAE9D,MAAM,yBAAyB,MAAM,OAAO,KAAK,QAAQ,2BAA2B,QAAQ;GAE5F,MAAM,aAAa,MAAM,uBAAuB,SAAS;IACvD;IACA,OAAO,SAAS;IAChB,QAAQ,OAAO;AACb,SAAI,SAAS,OAAO,UAAU,YAAY,YAAY,MACpD,QAAO,OAAO,MAAM,OAAO;AAG7B,SAAI,QAAQ,IAAI,aAAa,gBAAgB,MAG3C,QAAO,eAFS,gBAAgB,MAAM,IACxB,iBAAiB,QAAS,MAAM,SAAS,KAAM,IACvB;;IAK3C,CAAC;GAIF,MAAM,aAAa,uBACjB,YACA,wBAJmB,mBAAmB,yBAAyB,CAAC,EACjD,eAAe,UAAU,SAAS,YAAY,EAM7D,SAAS,YACV;AAED,UAAO,WAAW,YAAY,4BAA4B,UAAU,WAAW,CAAC;YACxE;AACR,wBAAqB,KAAK;AAC1B,4BAAyB;;GAE3B;;AAGJ,IAAA,wBAAe,EACb,MAAM,MAAM,SAAqC;AAE/C,KADY,IAAI,IAAI,QAAQ,IAAI,CACxB,SAAS,WAAW,KAAK,CAC/B,QAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,KAAK,CAAC;CAMvD,MAAM,SAAS,OAHG,MAAM,OAAO,KAAK,QAAQ,WAEzC,OAAO,QAAQ,EACa,QAAQ,QAAQ;AAE/C,KAAI,kBAAkB,SACpB,QAAO;AAGT,KAAI,UAAU,KACZ,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AAGnD,QAAO,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,QAAQ,KAAK,CAAC;GAEvD"}
+{"version":3,"file":"app-ssr-entry.js","names":["createReactElement"],"sources":["../../src/server/app-ssr-entry.ts"],"sourcesContent":["/// <reference types=\"@vitejs/plugin-rsc/types\" />\n\nimport type { ReactNode } from \"react\";\nimport { Fragment, createElement as createReactElement, use } from \"react\";\nimport { createFromReadableStream } from \"@vitejs/plugin-rsc/ssr\";\nimport { renderToReadableStream, renderToStaticMarkup } from \"react-dom/server.edge\";\nimport * as clientReferences from \"virtual:vite-rsc/client-references\";\nimport type { NavigationContext } from \"../shims/navigation.js\";\nimport {\n  ServerInsertedHTMLContext,\n  clearServerInsertedHTML,\n  flushServerInsertedHTML,\n  setNavigationContext,\n  useServerInsertedHTML,\n} from \"../shims/navigation.js\";\nimport { runWithNavigationContext } from \"../shims/navigation-state.js\";\nimport { isOpenRedirectShaped } from \"./request-pipeline.js\";\nimport { withScriptNonce } from \"../shims/script-nonce-context.js\";\nimport {\n  createInlineScriptTag,\n  createNonceAttribute,\n  escapeHtmlAttr,\n  safeJsonStringify,\n} from \"./html.js\";\nimport { createRscEmbedTransform, createTickBufferedTransform } from \"./app-ssr-stream.js\";\nimport {\n  normalizeAppElements,\n  readAppElementsMetadata,\n  type AppWireElements,\n} from \"./app-elements.js\";\nimport { ElementsContext, Slot } from \"../shims/slot.js\";\n\nexport type FontPreload = {\n  href: string;\n  type: string;\n};\n\nexport type FontData = {\n  links?: string[];\n  styles?: string[];\n  preloads?: FontPreload[];\n};\n\ntype ClientRequire = (id: string) => Promise<unknown>;\n\nlet clientRefsPreloaded = false;\n\nfunction getClientReferenceRequire(): ClientRequire | undefined {\n  return (\n    globalThis as typeof globalThis & {\n      __vite_rsc_client_require__?: ClientRequire;\n    }\n  ).__vite_rsc_client_require__;\n}\n\nasync function preloadClientReferences(): Promise<void> {\n  if (clientRefsPreloaded) return;\n\n  const refs = (clientReferences as { default?: Record<string, unknown> }).default;\n  const clientRequire = getClientReferenceRequire();\n  if (!refs || !clientRequire) return;\n\n  await Promise.all(\n    Object.keys(refs).map((id) =>\n      clientRequire(id).catch((error) => {\n        if (process.env.NODE_ENV !== \"production\") {\n          console.warn(\"[vinext] failed to preload client ref:\", id, error);\n        }\n      }),\n    ),\n  );\n\n  clientRefsPreloaded = true;\n}\n\nfunction ssrErrorDigest(input: string): string {\n  let hash = 5381;\n  for (let i = input.length - 1; i >= 0; i--) {\n    hash = (hash * 33) ^ input.charCodeAt(i);\n  }\n  return (hash >>> 0).toString();\n}\n\nfunction getErrorMessage(error: unknown): string {\n  if (error instanceof Error) return error.message;\n  if (typeof error === \"string\") return error;\n  return Object.prototype.toString.call(error);\n}\n\nfunction renderInsertedHtml(insertedElements: readonly unknown[]): string {\n  let insertedHTML = \"\";\n\n  for (const element of insertedElements) {\n    try {\n      insertedHTML += renderToStaticMarkup(\n        createReactElement(Fragment, null, element as ReactNode),\n      );\n    } catch {\n      // Ignore individual callback failures so the rest of the page can render.\n    }\n  }\n\n  return insertedHTML;\n}\n\nfunction renderFontHtml(fontData?: FontData, nonce?: string): string {\n  if (!fontData) return \"\";\n\n  let fontHTML = \"\";\n  const nonceAttr = createNonceAttribute(nonce);\n\n  for (const url of fontData.links ?? []) {\n    fontHTML += `<link rel=\"stylesheet\"${nonceAttr} href=\"${escapeHtmlAttr(url)}\" />\\n`;\n  }\n\n  for (const preload of fontData.preloads ?? []) {\n    fontHTML += `<link rel=\"preload\"${nonceAttr} href=\"${escapeHtmlAttr(preload.href)}\" as=\"font\" type=\"${escapeHtmlAttr(preload.type)}\" crossorigin />\\n`;\n  }\n\n  if (fontData.styles && fontData.styles.length > 0) {\n    fontHTML += `<style data-vinext-fonts${nonceAttr}>${fontData.styles.join(\"\\n\")}</style>\\n`;\n  }\n\n  return fontHTML;\n}\n\nfunction extractModulePreloadHtml(bootstrapScriptContent?: string, nonce?: string): string {\n  if (!bootstrapScriptContent) return \"\";\n\n  const match = bootstrapScriptContent.match(/import\\(\"([^\"]+)\"\\)/);\n  if (!match?.[1]) return \"\";\n\n  return `<link rel=\"modulepreload\"${createNonceAttribute(nonce)} href=\"${escapeHtmlAttr(match[1])}\" />\\n`;\n}\n\nfunction buildHeadInjectionHtml(\n  navContext: NavigationContext | null,\n  bootstrapScriptContent: string | undefined,\n  insertedHTML: string,\n  fontHTML: string,\n  scriptNonce?: string,\n): string {\n  const paramsScript = createInlineScriptTag(\n    \"self.__VINEXT_RSC_PARAMS__=\" + safeJsonStringify(navContext?.params ?? {}),\n    scriptNonce,\n  );\n  const navPayload = {\n    pathname: navContext?.pathname ?? \"/\",\n    searchParams: navContext?.searchParams ? [...navContext.searchParams.entries()] : [],\n  };\n  const navScript = createInlineScriptTag(\n    \"self.__VINEXT_RSC_NAV__=\" + safeJsonStringify(navPayload),\n    scriptNonce,\n  );\n\n  return (\n    paramsScript +\n    navScript +\n    extractModulePreloadHtml(bootstrapScriptContent, scriptNonce) +\n    insertedHTML +\n    fontHTML\n  );\n}\n\nexport async function handleSsr(\n  rscStream: ReadableStream<Uint8Array>,\n  navContext: NavigationContext | null,\n  fontData?: FontData,\n  options?: { scriptNonce?: string },\n): Promise<ReadableStream<Uint8Array>> {\n  return runWithNavigationContext(async () => {\n    await preloadClientReferences();\n\n    if (navContext) {\n      setNavigationContext(navContext);\n    }\n\n    clearServerInsertedHTML();\n\n    try {\n      const [ssrStream, embedStream] = rscStream.tee();\n      const rscEmbed = createRscEmbedTransform(embedStream, options?.scriptNonce);\n\n      let flightRoot: PromiseLike<AppWireElements> | null = null;\n\n      function VinextFlightRoot(): ReactNode {\n        if (!flightRoot) {\n          flightRoot = createFromReadableStream<AppWireElements>(ssrStream);\n        }\n        const wireElements = use(flightRoot);\n        const elements = normalizeAppElements(wireElements);\n        const metadata = readAppElementsMetadata(elements);\n        return createReactElement(\n          ElementsContext.Provider,\n          { value: elements },\n          createReactElement(Slot, { id: metadata.routeId }),\n        );\n      }\n\n      const root = createReactElement(VinextFlightRoot);\n      const ssrTree = ServerInsertedHTMLContext\n        ? createReactElement(\n            ServerInsertedHTMLContext.Provider,\n            { value: useServerInsertedHTML },\n            root,\n          )\n        : root;\n      const ssrRoot = withScriptNonce(ssrTree, options?.scriptNonce);\n\n      const bootstrapScriptContent = await import.meta.viteRsc.loadBootstrapScriptContent(\"index\");\n\n      const htmlStream = await renderToReadableStream(ssrRoot, {\n        bootstrapScriptContent,\n        nonce: options?.scriptNonce,\n        onError(error) {\n          if (error && typeof error === \"object\" && \"digest\" in error) {\n            return String(error.digest);\n          }\n\n          if (process.env.NODE_ENV === \"production\" && error) {\n            const message = getErrorMessage(error);\n            const stack = error instanceof Error ? (error.stack ?? \"\") : \"\";\n            return ssrErrorDigest(message + stack);\n          }\n\n          return undefined;\n        },\n      });\n\n      const insertedHTML = renderInsertedHtml(flushServerInsertedHTML());\n      const fontHTML = renderFontHtml(fontData, options?.scriptNonce);\n      const injectHTML = buildHeadInjectionHtml(\n        navContext,\n        bootstrapScriptContent,\n        insertedHTML,\n        fontHTML,\n        options?.scriptNonce,\n      );\n\n      return htmlStream.pipeThrough(createTickBufferedTransform(rscEmbed, injectHTML));\n    } finally {\n      setNavigationContext(null);\n      clearServerInsertedHTML();\n    }\n  }) as Promise<ReadableStream<Uint8Array>>;\n}\n\nexport default {\n  async fetch(request: Request): Promise<Response> {\n    const url = new URL(request.url);\n    // Block protocol-relative URL open redirects (including percent-encoded\n    // variants like /%5Cevil.com/). See request-pipeline.ts for details.\n    if (isOpenRedirectShaped(url.pathname)) {\n      return new Response(\"404 Not Found\", { status: 404 });\n    }\n\n    const rscModule = await import.meta.viteRsc.loadModule<{\n      default(request: Request): Promise<Response | string | null | undefined>;\n    }>(\"rsc\", \"index\");\n    const result = await rscModule.default(request);\n\n    if (result instanceof Response) {\n      return result;\n    }\n\n    if (result == null) {\n      return new Response(\"Not Found\", { status: 404 });\n    }\n\n    return new Response(String(result), { status: 200 });\n  },\n};\n"],"mappings":";;;;;;;;;;;;;AA6CA,IAAI,sBAAsB;AAE1B,SAAS,4BAAuD;AAC9D,QACE,WAGA;;AAGJ,eAAe,0BAAyC;AACtD,KAAI,oBAAqB;CAEzB,MAAM,OAAQ,iBAA2D;CACzE,MAAM,gBAAgB,2BAA2B;AACjD,KAAI,CAAC,QAAQ,CAAC,cAAe;AAE7B,OAAM,QAAQ,IACZ,OAAO,KAAK,KAAK,CAAC,KAAK,OACrB,cAAc,GAAG,CAAC,OAAO,UAAU;AACjC,MAAI,QAAQ,IAAI,aAAa,aAC3B,SAAQ,KAAK,0CAA0C,IAAI,MAAM;GAEnE,CACH,CACF;AAED,uBAAsB;;AAGxB,SAAS,eAAe,OAAuB;CAC7C,IAAI,OAAO;AACX,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,IACrC,QAAQ,OAAO,KAAM,MAAM,WAAW,EAAE;AAE1C,SAAQ,SAAS,GAAG,UAAU;;AAGhC,SAAS,gBAAgB,OAAwB;AAC/C,KAAI,iBAAiB,MAAO,QAAO,MAAM;AACzC,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAO,OAAO,UAAU,SAAS,KAAK,MAAM;;AAG9C,SAAS,mBAAmB,kBAA8C;CACxE,IAAI,eAAe;AAEnB,MAAK,MAAM,WAAW,iBACpB,KAAI;AACF,kBAAgB,qBACdA,cAAmB,UAAU,MAAM,QAAqB,CACzD;SACK;AAKV,QAAO;;AAGT,SAAS,eAAe,UAAqB,OAAwB;AACnE,KAAI,CAAC,SAAU,QAAO;CAEtB,IAAI,WAAW;CACf,MAAM,YAAY,qBAAqB,MAAM;AAE7C,MAAK,MAAM,OAAO,SAAS,SAAS,EAAE,CACpC,aAAY,yBAAyB,UAAU,SAAS,eAAe,IAAI,CAAC;AAG9E,MAAK,MAAM,WAAW,SAAS,YAAY,EAAE,CAC3C,aAAY,sBAAsB,UAAU,SAAS,eAAe,QAAQ,KAAK,CAAC,oBAAoB,eAAe,QAAQ,KAAK,CAAC;AAGrI,KAAI,SAAS,UAAU,SAAS,OAAO,SAAS,EAC9C,aAAY,2BAA2B,UAAU,GAAG,SAAS,OAAO,KAAK,KAAK,CAAC;AAGjF,QAAO;;AAGT,SAAS,yBAAyB,wBAAiC,OAAwB;AACzF,KAAI,CAAC,uBAAwB,QAAO;CAEpC,MAAM,QAAQ,uBAAuB,MAAM,sBAAsB;AACjE,KAAI,CAAC,QAAQ,GAAI,QAAO;AAExB,QAAO,4BAA4B,qBAAqB,MAAM,CAAC,SAAS,eAAe,MAAM,GAAG,CAAC;;AAGnG,SAAS,uBACP,YACA,wBACA,cACA,UACA,aACQ;AAcR,QAbqB,sBACnB,gCAAgC,kBAAkB,YAAY,UAAU,EAAE,CAAC,EAC3E,YACD,GAKiB,sBAChB,6BAA6B,kBALZ;EACjB,UAAU,YAAY,YAAY;EAClC,cAAc,YAAY,eAAe,CAAC,GAAG,WAAW,aAAa,SAAS,CAAC,GAAG,EAAE;EACrF,CAE2D,EAC1D,YACD,GAKC,yBAAyB,wBAAwB,YAAY,GAC7D,eACA;;AAIJ,eAAsB,UACpB,WACA,YACA,UACA,SACqC;AACrC,QAAO,yBAAyB,YAAY;AAC1C,QAAM,yBAAyB;AAE/B,MAAI,WACF,sBAAqB,WAAW;AAGlC,2BAAyB;AAEzB,MAAI;GACF,MAAM,CAAC,WAAW,eAAe,UAAU,KAAK;GAChD,MAAM,WAAW,wBAAwB,aAAa,SAAS,YAAY;GAE3E,IAAI,aAAkD;GAEtD,SAAS,mBAA8B;AACrC,QAAI,CAAC,WACH,cAAa,yBAA0C,UAAU;IAGnE,MAAM,WAAW,qBADI,IAAI,WAAW,CACe;IACnD,MAAM,WAAW,wBAAwB,SAAS;AAClD,WAAOA,cACL,gBAAgB,UAChB,EAAE,OAAO,UAAU,EACnBA,cAAmB,MAAM,EAAE,IAAI,SAAS,SAAS,CAAC,CACnD;;GAGH,MAAM,OAAOA,cAAmB,iBAAiB;GAQjD,MAAM,UAAU,gBAPA,4BACZA,cACE,0BAA0B,UAC1B,EAAE,OAAO,uBAAuB,EAChC,KACD,GACD,MACqC,SAAS,YAAY;GAE9D,MAAM,yBAAyB,MAAM,OAAO,KAAK,QAAQ,2BAA2B,QAAQ;GAE5F,MAAM,aAAa,MAAM,uBAAuB,SAAS;IACvD;IACA,OAAO,SAAS;IAChB,QAAQ,OAAO;AACb,SAAI,SAAS,OAAO,UAAU,YAAY,YAAY,MACpD,QAAO,OAAO,MAAM,OAAO;AAG7B,SAAI,QAAQ,IAAI,aAAa,gBAAgB,MAG3C,QAAO,eAFS,gBAAgB,MAAM,IACxB,iBAAiB,QAAS,MAAM,SAAS,KAAM,IACvB;;IAK3C,CAAC;GAIF,MAAM,aAAa,uBACjB,YACA,wBAJmB,mBAAmB,yBAAyB,CAAC,EACjD,eAAe,UAAU,SAAS,YAAY,EAM7D,SAAS,YACV;AAED,UAAO,WAAW,YAAY,4BAA4B,UAAU,WAAW,CAAC;YACxE;AACR,wBAAqB,KAAK;AAC1B,4BAAyB;;GAE3B;;AAGJ,IAAA,wBAAe,EACb,MAAM,MAAM,SAAqC;AAI/C,KAAI,qBAHQ,IAAI,IAAI,QAAQ,IAAI,CAGH,SAAS,CACpC,QAAO,IAAI,SAAS,iBAAiB,EAAE,QAAQ,KAAK,CAAC;CAMvD,MAAM,SAAS,OAHG,MAAM,OAAO,KAAK,QAAQ,WAEzC,OAAO,QAAQ,EACa,QAAQ,QAAQ;AAE/C,KAAI,kBAAkB,SACpB,QAAO;AAGT,KAAI,UAAU,KACZ,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,CAAC;AAGnD,QAAO,IAAI,SAAS,OAAO,OAAO,EAAE,EAAE,QAAQ,KAAK,CAAC;GAEvD"}

package/dist/server/prod-server.js

@@ -2,6 +2,7 @@ import { normalizePathnameForRouteMatchStrict } from "../routing/utils.js";
 import { applyMiddlewareRequestHeaders, isExternalUrl, matchHeaders, matchRedirect, matchRewrite, proxyExternalRequest, requestContextFromRequest, sanitizeDestination } from "../config/config-matchers.js";
 import { normalizePath } from "./normalize-path.js";
 import { hasBasePath, stripBasePath } from "../utils/base-path.js";
+import { isOpenRedirectShaped } from "./request-pipeline.js";
 import { manifestFileWithBase } from "../utils/manifest-paths.js";
 import { CONTENT_TYPES, StaticFileCache, etagFromFilenameHash } from "./static-file-cache.js";
 import { DEFAULT_DEVICE_SIZES, DEFAULT_IMAGE_SIZES, isSafeImageContentType, parseImageParams } from "./image-optimization.js";
@@ -599,20 +600,21 @@ async function startAppRouterServer(options) {
 	const staticCache = await StaticFileCache.create(clientDir);
 	const server = createServer(async (req, res) => {
 		const rawUrl = req.url ?? "/";
-		const rawPathname = rawUrl.split("?")[0].replaceAll("\\", "/");
+		const rawPathname = rawUrl.split("?")[0];
+		if (isOpenRedirectShaped(rawPathname)) {
+			res.writeHead(404);
+			res.end("404 Not Found");
+			return;
+		}
+		const normalizedRawPathname = rawPathname.replaceAll("\\", "/");
 		let pathname;
 		try {
-			pathname = normalizePath(normalizePathnameForRouteMatchStrict(rawPathname));
+			pathname = normalizePath(normalizePathnameForRouteMatchStrict(normalizedRawPathname));
 		} catch {
 			res.writeHead(400);
 			res.end("Bad Request");
 			return;
 		}
-		if (rawPathname.startsWith("//")) {
-			res.writeHead(404);
-			res.end("404 Not Found");
-			return;
-		}
 		if (pathname === "/__vinext/prerender/static-params" || pathname === "/__vinext/prerender/pages-static-paths") {
 			const secret = req.headers["x-vinext-prerender-secret"];
 			if (!prerenderSecret || secret !== prerenderSecret) {
@@ -735,7 +737,13 @@ async function startPagesRouterServer(options) {
 	const staticCache = await StaticFileCache.create(clientDir);
 	const server = createServer(async (req, res) => {
 		const rawUrl = req.url ?? "/";
-		const rawPagesPathname = rawUrl.split("?")[0].replaceAll("\\", "/");
+		const rawPagesPathnameBeforeNormalize = rawUrl.split("?")[0];
+		if (isOpenRedirectShaped(rawPagesPathnameBeforeNormalize)) {
+			res.writeHead(404);
+			res.end("404 Not Found");
+			return;
+		}
+		const rawPagesPathname = rawPagesPathnameBeforeNormalize.replaceAll("\\", "/");
 		const rawQs = rawUrl.includes("?") ? rawUrl.slice(rawUrl.indexOf("?")) : "";
 		let pathname;
 		try {
@@ -746,11 +754,6 @@ async function startPagesRouterServer(options) {
 			return;
 		}
 		let url = pathname + rawQs;
-		if (rawPagesPathname.startsWith("//")) {
-			res.writeHead(404);
-			res.end("404 Not Found");
-			return;
-		}
 		if (pathname === "/__vinext/prerender/pages-static-paths") {
 			const secret = req.headers["x-vinext-prerender-secret"];
 			if (!prerenderSecret || secret !== prerenderSecret) {