Fix security vulnerabilities and request handling bugs
- Move page cache out of the publicly served .bunext/public dir and hash cache keys - Skip caching credentialed requests, non-2xx and Set-Cookie responses; cap entries - Enforce API body size limit while reading; keep req body readable for handlers - Hide error messages from clients in production - Escape inline script JSON; strip cookies from HMR payloads - Only trust X-Forwarded-Proto with trust_proxy config - Fix console race in SSR, dotted page paths, middleware rewrites, excluded path status, encoded static file names, symlinked dirs - Upgrade vulnerable deps, remove micromatch, pin bun versions, delete dead code Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Claude Opus 5.5
+24
-18
@@ -1,11 +1,17 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import grabCacheNames from "../../../functions/cache/grab-cache-names";
|
||||
|
||||
const sha256 = (s: string) =>
|
||||
new Bun.CryptoHasher("sha256").update(s).digest("hex");
|
||||
|
||||
describe("grabCacheNames", () => {
|
||||
it("returns cache_name and cache_meta_name for a simple key", () => {
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({ key: "home" });
|
||||
expect(cache_name).toBe("home.res.html");
|
||||
expect(cache_meta_name).toBe("home.meta.json");
|
||||
it("returns hashed cache_name and cache_meta_name for a simple key", () => {
|
||||
const { cache_name, cache_meta_name, cache_id } = grabCacheNames({
|
||||
key: "home",
|
||||
});
|
||||
expect(cache_id).toBe(sha256("home"));
|
||||
expect(cache_name).toBe(`${sha256("home")}.res.html`);
|
||||
expect(cache_meta_name).toBe(`${sha256("home")}.meta.json`);
|
||||
});
|
||||
|
||||
it("defaults paradigm to html", () => {
|
||||
@@ -15,22 +21,22 @@ describe("grabCacheNames", () => {
|
||||
|
||||
it("uses json paradigm when specified", () => {
|
||||
const { cache_name } = grabCacheNames({ key: "api-data", paradigm: "json" });
|
||||
expect(cache_name).toBe("api-data.res.json");
|
||||
expect(cache_name).toBe(`${sha256("api-data")}.res.json`);
|
||||
});
|
||||
|
||||
it("URL-encodes the key", () => {
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({
|
||||
key: "/blog/hello world",
|
||||
});
|
||||
const encoded = encodeURIComponent("/blog/hello world");
|
||||
expect(cache_name).toBe(`${encoded}.res.html`);
|
||||
expect(cache_meta_name).toBe(`${encoded}.meta.json`);
|
||||
});
|
||||
|
||||
it("handles keys with special characters", () => {
|
||||
const key = "page?id=1&sort=asc";
|
||||
it("produces fixed-length, path-safe names for long or special keys", () => {
|
||||
const key = "/blog/hello world?q=" + "x".repeat(1000) + "&a=../../etc";
|
||||
const { cache_name } = grabCacheNames({ key });
|
||||
expect(cache_name).toBe(`${encodeURIComponent(key)}.res.html`);
|
||||
expect(cache_name).toMatch(/^[0-9a-f]{64}\.res\.html$/);
|
||||
});
|
||||
|
||||
it("uses cache_id as-is when given", () => {
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({
|
||||
cache_id: "abc",
|
||||
paradigm: "json",
|
||||
});
|
||||
expect(cache_name).toBe("abc.res.json");
|
||||
expect(cache_meta_name).toBe("abc.meta.json");
|
||||
});
|
||||
|
||||
it("cache_meta_name always uses .meta.json regardless of paradigm", () => {
|
||||
@@ -38,6 +44,6 @@ describe("grabCacheNames", () => {
|
||||
key: "test",
|
||||
paradigm: "json",
|
||||
});
|
||||
expect(cache_meta_name).toBe("test.meta.json");
|
||||
expect(cache_meta_name).toBe(`${sha256("test")}.meta.json`);
|
||||
});
|
||||
});
|
||||
|
||||
@@ -27,7 +27,10 @@ mock.module("../../../../src/functions/server/handle-public", () => ({
|
||||
}));
|
||||
|
||||
mock.module("../../../../src/functions/server/handle-files", () => ({
|
||||
default: async () => new Response("files")
|
||||
default: async ({ req }: any) =>
|
||||
new URL(req.url).pathname.includes("john.doe")
|
||||
? new Response("missing", { status: 404 })
|
||||
: new Response("files")
|
||||
}));
|
||||
|
||||
mock.module("../../../../src/functions/server/web-pages/handle-web-pages", () => ({
|
||||
@@ -42,10 +45,13 @@ describe("bunext-req-handler", () => {
|
||||
if (url.pathname === "/blocked") {
|
||||
return new Response("Blocked by middleware", { status: 403 });
|
||||
}
|
||||
if (url.pathname === "/rewrite-me") {
|
||||
return new Request("http://localhost/api/rewritten");
|
||||
}
|
||||
return undefined;
|
||||
}
|
||||
},
|
||||
RouteIgnorePatterns: [],
|
||||
RouteIgnorePatterns: [/\/\(/],
|
||||
} as any;
|
||||
});
|
||||
|
||||
@@ -93,4 +99,26 @@ describe("bunext-req-handler", () => {
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(await res.text()).toBe("web-pages");
|
||||
});
|
||||
|
||||
test("excluded paths return 404", async () => {
|
||||
const req = new Request("http://localhost/(group)/page");
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(res.status).toBe(404);
|
||||
});
|
||||
|
||||
test("routes using the request returned by middleware", async () => {
|
||||
const req = new Request("http://localhost/rewrite-me");
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(await res.text()).toBe("api-routes");
|
||||
});
|
||||
|
||||
test("falls back to pages for dotted paths that are not files", async () => {
|
||||
global.BUNEXT_ROUTER = {
|
||||
match: (p: string) =>
|
||||
p === "/users/john.doe" ? { filePath: "/users/[id].tsx" } : null,
|
||||
} as any;
|
||||
const req = new Request("http://localhost/users/john.doe");
|
||||
const res = await bunextRequestHandler({ req });
|
||||
expect(await res.text()).toBe("web-pages");
|
||||
});
|
||||
});
|
||||
|
||||
@@ -21,11 +21,12 @@ describe("grabDirNames", () => {
|
||||
);
|
||||
});
|
||||
|
||||
it("nests BUNEXT_CACHE_DIR under .bunext/public/cache", () => {
|
||||
it("keeps BUNEXT_CACHE_DIR outside the publicly served directory", () => {
|
||||
const dirs = grabDirNames();
|
||||
expect(dirs.BUNEXT_CACHE_DIR).toBe(
|
||||
path.join(dirs.BUNX_CWD_DIR, "public", "cache"),
|
||||
);
|
||||
expect(dirs.BUNEXT_CACHE_DIR).toBe(path.join(dirs.BUNX_CWD_DIR, "cache"));
|
||||
expect(
|
||||
dirs.BUNEXT_CACHE_DIR.startsWith(dirs.BUNEXT_PUBLIC_DIR + path.sep),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("places map JSON file inside HYDRATION_DST_DIR", () => {
|
||||
|
||||
@@ -0,0 +1,48 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import grabRouteParams from "../../utils/grab-route-params";
|
||||
import { RequestBodyTooLargeError } from "../../utils/read-request-body";
|
||||
|
||||
describe("grabRouteParams", () => {
|
||||
it("parses a JSON body and keeps the request body readable", async () => {
|
||||
const req = new Request("http://localhost/api/test?x=1", {
|
||||
method: "POST",
|
||||
headers: { "content-type": "application/json" },
|
||||
body: JSON.stringify({ a: 1 }),
|
||||
});
|
||||
|
||||
const params = await grabRouteParams({ req, max_body_bytes: 1000 });
|
||||
|
||||
expect(params.body).toEqual({ a: 1 });
|
||||
expect(params.query.x).toBe("1");
|
||||
expect(await params.req.text()).toBe('{"a":1}');
|
||||
});
|
||||
|
||||
it("returns an empty body object for non-JSON bodies", async () => {
|
||||
const req = new Request("http://localhost/api/test", {
|
||||
method: "POST",
|
||||
body: "raw text",
|
||||
});
|
||||
|
||||
const params = await grabRouteParams({ req, max_body_bytes: 1000 });
|
||||
|
||||
expect(params.body).toEqual({});
|
||||
expect(await params.req.text()).toBe("raw text");
|
||||
});
|
||||
|
||||
it("leaves the body undefined for GET requests", async () => {
|
||||
const req = new Request("http://localhost/api/test");
|
||||
const params = await grabRouteParams({ req, max_body_bytes: 1000 });
|
||||
expect(params.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("throws when the body is larger than the limit", async () => {
|
||||
const req = new Request("http://localhost/api/test", {
|
||||
method: "POST",
|
||||
body: "x".repeat(2000),
|
||||
});
|
||||
|
||||
expect(
|
||||
grabRouteParams({ req, max_body_bytes: 1000 }),
|
||||
).rejects.toBeInstanceOf(RequestBodyTooLargeError);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,52 @@
|
||||
import { describe, it, expect, beforeAll, afterAll } from "bun:test";
|
||||
import { mkdtempSync, mkdirSync, rmSync, symlinkSync, writeFileSync } from "fs";
|
||||
import os from "os";
|
||||
import path from "path";
|
||||
import isSafePath from "../../utils/is-safe-path";
|
||||
|
||||
let tmp: string;
|
||||
let real_public: string;
|
||||
let linked_public: string;
|
||||
|
||||
beforeAll(() => {
|
||||
tmp = mkdtempSync(path.join(os.tmpdir(), "bunext-safe-path-"));
|
||||
real_public = path.join(tmp, "real", "public");
|
||||
mkdirSync(real_public, { recursive: true });
|
||||
writeFileSync(path.join(real_public, "file name.txt"), "ok");
|
||||
writeFileSync(path.join(tmp, "secret.txt"), "secret");
|
||||
symlinkSync(path.join(tmp, "real"), path.join(tmp, "link"));
|
||||
linked_public = path.join(tmp, "link", "public");
|
||||
});
|
||||
|
||||
afterAll(() => {
|
||||
rmSync(tmp, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
describe("isSafePath", () => {
|
||||
it("allows files inside the directory", () => {
|
||||
expect(
|
||||
isSafePath({
|
||||
filePath: path.join(real_public, "file name.txt"),
|
||||
allowedDir: real_public,
|
||||
}),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
it("rejects traversal outside the directory", () => {
|
||||
expect(
|
||||
isSafePath({
|
||||
filePath: path.join(real_public, "..", "..", "secret.txt"),
|
||||
allowedDir: real_public,
|
||||
}),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("allows files when the directory itself is under a symlink", () => {
|
||||
expect(
|
||||
isSafePath({
|
||||
filePath: path.join(linked_public, "file name.txt"),
|
||||
allowedDir: linked_public,
|
||||
}),
|
||||
).toBe(true);
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,60 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import readRequestBody, {
|
||||
RequestBodyTooLargeError,
|
||||
} from "../../utils/read-request-body";
|
||||
|
||||
function chunkedRequest(chunks: string[]) {
|
||||
const stream = new ReadableStream({
|
||||
start(controller) {
|
||||
for (const chunk of chunks) {
|
||||
controller.enqueue(new TextEncoder().encode(chunk));
|
||||
}
|
||||
controller.close();
|
||||
},
|
||||
});
|
||||
|
||||
return new Request("http://localhost/api/test", {
|
||||
method: "POST",
|
||||
body: stream,
|
||||
});
|
||||
}
|
||||
|
||||
describe("readRequestBody", () => {
|
||||
it("returns undefined for GET requests", async () => {
|
||||
const req = new Request("http://localhost/");
|
||||
expect(await readRequestBody({ req, max_bytes: 10 })).toBeUndefined();
|
||||
});
|
||||
|
||||
it("returns the body bytes", async () => {
|
||||
const req = new Request("http://localhost/", {
|
||||
method: "POST",
|
||||
body: "hello",
|
||||
});
|
||||
const body = await readRequestBody({ req, max_bytes: 10 });
|
||||
expect(new TextDecoder().decode(body)).toBe("hello");
|
||||
});
|
||||
|
||||
it("rejects a too-large Content-Length without reading the body", async () => {
|
||||
const req = new Request("http://localhost/", {
|
||||
method: "POST",
|
||||
headers: { "content-length": "2000000" },
|
||||
body: "x",
|
||||
});
|
||||
expect(readRequestBody({ req, max_bytes: 1000 })).rejects.toBeInstanceOf(
|
||||
RequestBodyTooLargeError,
|
||||
);
|
||||
});
|
||||
|
||||
it("enforces the limit on chunked bodies without a Content-Length", async () => {
|
||||
const req = chunkedRequest(["x".repeat(600), "x".repeat(600)]);
|
||||
expect(readRequestBody({ req, max_bytes: 1000 })).rejects.toBeInstanceOf(
|
||||
RequestBodyTooLargeError,
|
||||
);
|
||||
});
|
||||
|
||||
it("reads chunked bodies within the limit", async () => {
|
||||
const req = chunkedRequest(['{"a":', "1}"]);
|
||||
const body = await readRequestBody({ req, max_bytes: 1000 });
|
||||
expect(new TextDecoder().decode(body)).toBe('{"a":1}');
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,24 @@
|
||||
import { describe, it, expect } from "bun:test";
|
||||
import serializeForScript from "../../utils/serialize-for-script";
|
||||
|
||||
describe("serializeForScript", () => {
|
||||
it("escapes sequences that could break out of a script tag", () => {
|
||||
const out = serializeForScript({
|
||||
a: "</script><script>alert(1)</script>",
|
||||
b: "<!--",
|
||||
c: "&",
|
||||
d: "
",
|
||||
});
|
||||
|
||||
expect(out).not.toContain("<");
|
||||
expect(out).not.toContain(">");
|
||||
expect(out).not.toContain("&");
|
||||
expect(out).not.toContain("
");
|
||||
expect(out).not.toContain("
");
|
||||
});
|
||||
|
||||
it("round-trips through JSON.parse", () => {
|
||||
const value = { a: "</script><!--", b: [1, "&"], c: "
" };
|
||||
expect(JSON.parse(serializeForScript(value))).toEqual(value);
|
||||
});
|
||||
});
|
||||
@@ -1,5 +1,6 @@
|
||||
export const AppData = {
|
||||
DefaultCacheExpiryTimeSeconds: 60 * 60,
|
||||
DefaultMaxCacheEntries: 1000,
|
||||
DefaultCronInterval: 30000,
|
||||
BunextStaticFilesCacheExpiry: 60 * 60 * 24 * 7,
|
||||
ClientHMRPath: "__bunext_client_hmr__",
|
||||
|
||||
@@ -1,171 +0,0 @@
|
||||
import path from "path";
|
||||
import ts from "typescript";
|
||||
|
||||
type Params = {
|
||||
txt_code: string;
|
||||
file_path: string;
|
||||
};
|
||||
|
||||
export default function stripServerSideLogic({ txt_code, file_path }: Params) {
|
||||
const file_dir_name = path.dirname(file_path);
|
||||
|
||||
// 1. Initial Parse of the source
|
||||
const sourceFile = ts.createSourceFile(
|
||||
"file.tsx",
|
||||
txt_code,
|
||||
ts.ScriptTarget.Latest,
|
||||
true,
|
||||
ts.ScriptKind.TSX,
|
||||
);
|
||||
const printer = ts.createPrinter();
|
||||
|
||||
/**
|
||||
* PASS 1: Remove 'server' export and resolve absolute paths
|
||||
*/
|
||||
const stripTransformer: ts.TransformerFactory<ts.SourceFile> =
|
||||
(context) => (rootNode) => {
|
||||
const visitor = (node: ts.Node): ts.Node | undefined => {
|
||||
// Remove 'export const server'
|
||||
if (
|
||||
ts.isVariableStatement(node) &&
|
||||
node.modifiers?.some(
|
||||
(m) => m.kind === ts.SyntaxKind.ExportKeyword,
|
||||
)
|
||||
) {
|
||||
if (
|
||||
node.declarationList.declarations.some(
|
||||
(d) =>
|
||||
ts.isIdentifier(d.name) &&
|
||||
d.name.text === "server",
|
||||
)
|
||||
) {
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
// Convert relative imports to absolute
|
||||
if (ts.isImportDeclaration(node)) {
|
||||
const specifier = node.moduleSpecifier;
|
||||
if (
|
||||
ts.isStringLiteral(specifier) &&
|
||||
specifier.text.startsWith(".")
|
||||
) {
|
||||
const absolutePath = path.resolve(
|
||||
file_dir_name,
|
||||
specifier.text,
|
||||
);
|
||||
return ts.factory.updateImportDeclaration(
|
||||
node,
|
||||
node.modifiers,
|
||||
node.importClause,
|
||||
ts.factory.createStringLiteral(absolutePath),
|
||||
node.attributes,
|
||||
);
|
||||
}
|
||||
}
|
||||
return ts.visitEachChild(node, visitor, context);
|
||||
};
|
||||
return ts.visitNode(rootNode, visitor) as ts.SourceFile;
|
||||
};
|
||||
|
||||
const step1Result = ts.transform(sourceFile, [stripTransformer]);
|
||||
const intermediateCode = printer.printFile(step1Result.transformed[0]);
|
||||
|
||||
// 2. Re-parse to get a "Clean Slate" AST
|
||||
const cleanSource = ts.createSourceFile(
|
||||
"clean.tsx",
|
||||
intermediateCode,
|
||||
ts.ScriptTarget.Latest,
|
||||
true,
|
||||
ts.ScriptKind.TSX,
|
||||
);
|
||||
|
||||
/**
|
||||
* PASS 2: Collect all used Identifiers and Prune Imports
|
||||
*/
|
||||
const usedIdentifiers = new Set<string>();
|
||||
|
||||
function walkAndFindUsages(node: ts.Node) {
|
||||
if (ts.isIdentifier(node)) {
|
||||
// We only care about identifiers that AREN'T the names in the import statements themselves
|
||||
const parent = node.parent;
|
||||
const isImportName =
|
||||
ts.isImportSpecifier(parent) ||
|
||||
ts.isImportClause(parent) ||
|
||||
ts.isNamespaceImport(parent);
|
||||
if (!isImportName) {
|
||||
usedIdentifiers.add(node.text);
|
||||
}
|
||||
}
|
||||
ts.forEachChild(node, walkAndFindUsages);
|
||||
}
|
||||
walkAndFindUsages(cleanSource);
|
||||
|
||||
const cleanupTransformer: ts.TransformerFactory<ts.SourceFile> =
|
||||
(context) => (rootNode) => {
|
||||
const visitor = (node: ts.Node): ts.Node | undefined => {
|
||||
if (ts.isImportDeclaration(node)) {
|
||||
const clause = node.importClause;
|
||||
if (!clause) return node;
|
||||
|
||||
// 1. Clean Named Imports: { A, B }
|
||||
if (
|
||||
clause.namedBindings &&
|
||||
ts.isNamedImports(clause.namedBindings)
|
||||
) {
|
||||
const activeElements =
|
||||
clause.namedBindings.elements.filter((el) =>
|
||||
usedIdentifiers.has(el.name.text),
|
||||
);
|
||||
|
||||
// If no named imports are used and there is no default import, nix the whole line
|
||||
if (activeElements.length === 0 && !clause.name)
|
||||
return undefined;
|
||||
|
||||
// If we have some named imports left, update the node
|
||||
return ts.factory.updateImportDeclaration(
|
||||
node,
|
||||
node.modifiers,
|
||||
ts.factory.updateImportClause(
|
||||
clause,
|
||||
clause.isTypeOnly,
|
||||
// Only keep default import if it's used
|
||||
clause.name &&
|
||||
usedIdentifiers.has(clause.name.text)
|
||||
? clause.name
|
||||
: undefined,
|
||||
ts.factory.createNamedImports(activeElements),
|
||||
),
|
||||
node.moduleSpecifier,
|
||||
node.attributes,
|
||||
);
|
||||
}
|
||||
|
||||
// 2. Clean Default Imports: import X from '...'
|
||||
if (clause.name && !usedIdentifiers.has(clause.name.text)) {
|
||||
// If there are no named bindings attached, nix the whole line
|
||||
if (!clause.namedBindings) return undefined;
|
||||
|
||||
// Otherwise, just strip the default name and keep the named bindings
|
||||
return ts.factory.updateImportDeclaration(
|
||||
node,
|
||||
node.modifiers,
|
||||
ts.factory.updateImportClause(
|
||||
clause,
|
||||
clause.isTypeOnly,
|
||||
undefined,
|
||||
clause.namedBindings,
|
||||
),
|
||||
node.moduleSpecifier,
|
||||
node.attributes,
|
||||
);
|
||||
}
|
||||
}
|
||||
return ts.visitEachChild(node, visitor, context);
|
||||
};
|
||||
return ts.visitNode(rootNode, visitor) as ts.SourceFile;
|
||||
};
|
||||
|
||||
const finalResult = ts.transform(cleanSource, [cleanupTransformer]);
|
||||
return printer.printFile(finalResult.transformed[0]);
|
||||
}
|
||||
+17
-4
@@ -1,12 +1,25 @@
|
||||
type Params = {
|
||||
key: string;
|
||||
key?: string;
|
||||
/**
|
||||
* Hashed key, as found in cache file names. Used when the original
|
||||
* key is no longer known (e.g. when trimming from a directory listing).
|
||||
*/
|
||||
cache_id?: string;
|
||||
paradigm?: "html" | "json";
|
||||
};
|
||||
|
||||
export default function grabCacheNames({ key, paradigm = "html" }: Params) {
|
||||
const parsed_key = encodeURIComponent(key);
|
||||
export default function grabCacheNames({
|
||||
key,
|
||||
cache_id,
|
||||
paradigm = "html",
|
||||
}: Params) {
|
||||
// Hashing keeps file names short and fixed-length no matter how long
|
||||
// the request path or query string is.
|
||||
const parsed_key =
|
||||
cache_id ||
|
||||
new Bun.CryptoHasher("sha256").update(key || "").digest("hex");
|
||||
const cache_name = `${parsed_key}.res.${paradigm}`;
|
||||
const cache_meta_name = `${parsed_key}.meta.json`;
|
||||
|
||||
return { cache_name, cache_meta_name };
|
||||
return { cache_id: parsed_key, cache_name, cache_meta_name };
|
||||
}
|
||||
|
||||
+2
-9
@@ -12,16 +12,9 @@ export default async function trimAllCache() {
|
||||
const cached_item = cached_items[i];
|
||||
if (!cached_item.endsWith(`.meta.json`)) continue;
|
||||
|
||||
const cache_key = decodeURIComponent(cached_item.replace(/\.meta\.json/, ""));
|
||||
const cache_id = cached_item.replace(/\.meta\.json$/, "");
|
||||
|
||||
const trim_key = await trimCacheKey({
|
||||
key: cache_key,
|
||||
});
|
||||
|
||||
if (trim_key.success) {
|
||||
cached_items.splice(i, 1);
|
||||
i--;
|
||||
}
|
||||
await trimCacheKey({ cache_id });
|
||||
}
|
||||
} catch (error) {
|
||||
return undefined;
|
||||
|
||||
+14
-8
@@ -1,4 +1,4 @@
|
||||
import { readFileSync, unlinkSync } from "fs";
|
||||
import { readFileSync, rmSync } from "fs";
|
||||
import grabDirNames from "../../utils/grab-dir-names";
|
||||
import grabCacheNames from "./grab-cache-names";
|
||||
import path from "path";
|
||||
@@ -6,17 +6,17 @@ import type { APIResponseObject, BunextCacheFileMeta } from "../../types";
|
||||
import { AppData } from "../../data/app-data";
|
||||
|
||||
type Params = {
|
||||
key: string;
|
||||
key?: string;
|
||||
cache_id?: string;
|
||||
};
|
||||
|
||||
export default async function trimCacheKey({
|
||||
key,
|
||||
cache_id,
|
||||
}: Params): Promise<APIResponseObject> {
|
||||
try {
|
||||
const { BUNEXT_CACHE_DIR } = grabDirNames();
|
||||
const { cache_name, cache_meta_name } = grabCacheNames({
|
||||
key,
|
||||
});
|
||||
const { cache_meta_name } = grabCacheNames({ key, cache_id });
|
||||
|
||||
const config = global.BUNEXT_CONFIG;
|
||||
|
||||
@@ -27,13 +27,19 @@ export default async function trimCacheKey({
|
||||
const default_expiry_time_milliseconds =
|
||||
default_expiry_time_seconds * 1000;
|
||||
|
||||
const cache_content_path = path.join(BUNEXT_CACHE_DIR, cache_name);
|
||||
const cache_meta_path = path.join(BUNEXT_CACHE_DIR, cache_meta_name);
|
||||
|
||||
const cache_meta: BunextCacheFileMeta = JSON.parse(
|
||||
readFileSync(cache_meta_path, "utf-8"),
|
||||
);
|
||||
|
||||
const { cache_name } = grabCacheNames({
|
||||
key,
|
||||
cache_id,
|
||||
paradigm: cache_meta.paradigm,
|
||||
});
|
||||
const cache_content_path = path.join(BUNEXT_CACHE_DIR, cache_name);
|
||||
|
||||
const expiry_milliseconds = cache_meta.expiry_seconds
|
||||
? cache_meta.expiry_seconds * 1000
|
||||
: default_expiry_time_milliseconds;
|
||||
@@ -45,8 +51,8 @@ export default async function trimCacheKey({
|
||||
};
|
||||
}
|
||||
|
||||
unlinkSync(cache_content_path);
|
||||
unlinkSync(cache_meta_path);
|
||||
rmSync(cache_content_path, { force: true });
|
||||
rmSync(cache_meta_path, { force: true });
|
||||
|
||||
return {
|
||||
success: true,
|
||||
|
||||
Vendored
+18
-2
@@ -1,8 +1,9 @@
|
||||
import { existsSync, writeFileSync } from "fs";
|
||||
import { existsSync, readdirSync, writeFileSync } from "fs";
|
||||
import grabDirNames from "../../utils/grab-dir-names";
|
||||
import grabCacheNames from "./grab-cache-names";
|
||||
import type { APIResponseObject, BunextCacheFileMeta } from "../../types";
|
||||
import path from "path";
|
||||
import { AppData } from "../../data/app-data";
|
||||
|
||||
type Params = {
|
||||
key: string;
|
||||
@@ -34,7 +35,22 @@ export default async function writeCache({
|
||||
};
|
||||
}
|
||||
|
||||
writeFileSync(path.join(target_path), value);
|
||||
const max_entries =
|
||||
global.BUNEXT_CONFIG?.max_cache_entries ||
|
||||
AppData["DefaultMaxCacheEntries"];
|
||||
|
||||
const entries_count = readdirSync(BUNEXT_CACHE_DIR).filter((f) =>
|
||||
f.endsWith(".meta.json"),
|
||||
).length;
|
||||
|
||||
if (entries_count >= max_entries) {
|
||||
return {
|
||||
success: false,
|
||||
msg: `Cache entries limit (${max_entries}) reached`,
|
||||
};
|
||||
}
|
||||
|
||||
writeFileSync(target_path, value);
|
||||
|
||||
const cache_file_meta: BunextCacheFileMeta = {
|
||||
date_created: Date.now(),
|
||||
|
||||
@@ -1,53 +0,0 @@
|
||||
import { spawn } from "bun";
|
||||
|
||||
// Only the "supervisor" respawns. The child sets this env var so it won't respawn itself.
|
||||
const IS_CHILD = process.env.__RESPAWN_CHILD === "1";
|
||||
|
||||
let shuttingDown = false;
|
||||
|
||||
async function cleanup() {
|
||||
// Put real cleanup here: close DB handles, servers, file descriptors, timers, etc.
|
||||
// Must be awaitable — do NOT rely on process.on("exit") for this.
|
||||
}
|
||||
|
||||
function respawn(code: number) {
|
||||
const child = spawn({
|
||||
cmd: [process.execPath, ...process.argv.slice(1)],
|
||||
stdio: ["inherit", "inherit", "inherit"],
|
||||
env: { ...process.env, __RESPAWN_CHILD: "1" },
|
||||
// Detach so the child survives independently and gets its own process group.
|
||||
// Without this, killing the parent's group can take the child with it.
|
||||
});
|
||||
// Let the child live on its own.
|
||||
child.unref?.();
|
||||
}
|
||||
|
||||
async function shutdown(code: number) {
|
||||
if (shuttingDown) return;
|
||||
shuttingDown = true;
|
||||
|
||||
try {
|
||||
await cleanup();
|
||||
} catch (e) {
|
||||
console.error("cleanup failed:", e);
|
||||
}
|
||||
|
||||
// Only the supervisor respawns, and only on abnormal exit.
|
||||
if (!IS_CHILD && code !== 0) {
|
||||
respawn(code);
|
||||
}
|
||||
|
||||
process.exit(code);
|
||||
}
|
||||
|
||||
// Catch the things that actually fire *before* exit, where async works.
|
||||
process.on("SIGINT", () => shutdown(130));
|
||||
process.on("SIGTERM", () => shutdown(143));
|
||||
process.on("uncaughtException", (err) => {
|
||||
console.error(err);
|
||||
shutdown(1);
|
||||
});
|
||||
process.on("unhandledRejection", (err) => {
|
||||
console.error(err);
|
||||
shutdown(1);
|
||||
});
|
||||
@@ -9,6 +9,7 @@ import checkExcludedPatterns from "../../utils/check-excluded-patterns";
|
||||
import { AppData } from "../../data/app-data";
|
||||
import { log } from "../../utils/log";
|
||||
import fullRebuild from "./full-rebuild";
|
||||
import grabRouter from "../../utils/grab-router";
|
||||
|
||||
const HMR_RETRY_COOLDOWN_MS = 5000;
|
||||
let lastHmrRetryTime = 0;
|
||||
@@ -26,10 +27,13 @@ export default async function bunextRequestHandler({
|
||||
let req = initial_req.clone();
|
||||
|
||||
try {
|
||||
const url = new URL(req.url);
|
||||
let url = new URL(req.url);
|
||||
|
||||
if (checkExcludedPatterns({ path: url.pathname })) {
|
||||
return Response.json({ success: false, msg: `Invalid Path` });
|
||||
return Response.json(
|
||||
{ success: false, msg: `Invalid Path` },
|
||||
{ status: 404 },
|
||||
);
|
||||
}
|
||||
|
||||
let response: Response | undefined = undefined;
|
||||
@@ -47,6 +51,7 @@ export default async function bunextRequestHandler({
|
||||
|
||||
if (middleware_res instanceof Request) {
|
||||
req = middleware_res;
|
||||
url = new URL(req.url);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -68,8 +73,16 @@ export default async function bunextRequestHandler({
|
||||
response = await handleRoutes({ req });
|
||||
} else if (url.pathname.startsWith("/public/")) {
|
||||
response = await handlePublic({ req });
|
||||
} else if (url.pathname.match(/\..*$/)) {
|
||||
} else if (url.pathname.match(/\.[^/]+$/)) {
|
||||
response = await handleFiles({ req });
|
||||
|
||||
// Paths like `/users/john.doe` look like files but can be pages.
|
||||
if (
|
||||
response.status == 404 &&
|
||||
grabRouter()?.match(url.pathname)?.filePath
|
||||
) {
|
||||
response = await handleWebPages({ req });
|
||||
}
|
||||
} else {
|
||||
response = await handleWebPages({ req });
|
||||
}
|
||||
|
||||
@@ -17,7 +17,10 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
|
||||
const file_path = path.join(
|
||||
BUNEXT_PUBLIC_DIR,
|
||||
url.pathname.replace(/\/\.bunext\/public\//, ""),
|
||||
decodeURIComponent(url.pathname).replace(
|
||||
/\/\.bunext\/public\//,
|
||||
"",
|
||||
),
|
||||
);
|
||||
|
||||
if (!isSafePath({ filePath: file_path, allowedDir: BUNEXT_PUBLIC_DIR })) {
|
||||
|
||||
@@ -14,7 +14,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
try {
|
||||
const is_dev = isDevelopment();
|
||||
const url = new URL(req.url);
|
||||
const file_path = path.join(PUBLIC_DIR, url.pathname);
|
||||
const file_path = path.join(PUBLIC_DIR, decodeURIComponent(url.pathname));
|
||||
|
||||
if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
|
||||
return new Response("Forbidden", { status: 403 });
|
||||
|
||||
@@ -17,7 +17,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
|
||||
const file_path = path.join(
|
||||
PUBLIC_DIR,
|
||||
url.pathname.replace(/^\/public/, ""),
|
||||
decodeURIComponent(url.pathname).replace(/^\/public/, ""),
|
||||
);
|
||||
|
||||
if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
|
||||
|
||||
@@ -12,6 +12,7 @@ import _ from "lodash";
|
||||
import path from "path";
|
||||
import grabDirNames from "../../utils/grab-dir-names";
|
||||
import grabRelativePath from "../../utils/grab-relative-path";
|
||||
import { RequestBodyTooLargeError } from "../../utils/read-request-body";
|
||||
|
||||
const { ROOT_DIR } = grabDirNames();
|
||||
|
||||
@@ -48,11 +49,6 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
);
|
||||
}
|
||||
|
||||
const routeParams: BunxRouteParams = await grabRouteParams({
|
||||
req,
|
||||
query: match.query,
|
||||
});
|
||||
|
||||
let module: any;
|
||||
const now = Date.now();
|
||||
|
||||
@@ -83,69 +79,46 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
|
||||
const contentLength = req.headers.get("content-length");
|
||||
|
||||
if (contentLength) {
|
||||
const size = parseInt(contentLength, 10);
|
||||
if (contentLength && parseInt(contentLength, 10) > maxBodyBytes) {
|
||||
return bodyTooLargeResponse();
|
||||
}
|
||||
|
||||
if (size > maxBodyBytes) {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Request Body Too Large!",
|
||||
},
|
||||
{
|
||||
status: 413,
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
},
|
||||
);
|
||||
}
|
||||
} else if (req.method !== "GET" && req.method !== "HEAD") {
|
||||
const body = await req.arrayBuffer();
|
||||
if (body.byteLength > maxBodyBytes) {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Request Body Too Large!",
|
||||
},
|
||||
{
|
||||
status: 413,
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
},
|
||||
);
|
||||
}
|
||||
let routeParams: BunxRouteParams;
|
||||
|
||||
try {
|
||||
routeParams.body = JSON.parse(
|
||||
new TextDecoder().decode(body) || "{}",
|
||||
);
|
||||
} catch (error: any) {
|
||||
log.error(
|
||||
`Invalid JSON body for ${url.pathname}: ${error?.message}`,
|
||||
);
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Invalid JSON body",
|
||||
},
|
||||
{
|
||||
status: 400,
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
},
|
||||
},
|
||||
);
|
||||
try {
|
||||
routeParams = await grabRouteParams({
|
||||
req,
|
||||
query: match.query,
|
||||
max_body_bytes: maxBodyBytes,
|
||||
});
|
||||
} catch (error) {
|
||||
if (error instanceof RequestBodyTooLargeError) {
|
||||
return bodyTooLargeResponse();
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
|
||||
const target_module = (module["default"] ||
|
||||
module["handler"]) as BunextAPIRouteHandler;
|
||||
module["handler"]) as BunextAPIRouteHandler | undefined;
|
||||
|
||||
if (typeof target_module !== "function") {
|
||||
log.error(
|
||||
`API Route ${url.pathname} has no default or \`handler\` export`,
|
||||
);
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: is_dev
|
||||
? `Route ${url.pathname} has no default or \`handler\` export`
|
||||
: "Internal Server Error",
|
||||
},
|
||||
{ status: 500 },
|
||||
);
|
||||
}
|
||||
|
||||
let res: any;
|
||||
try {
|
||||
res = await target_module?.({
|
||||
res = await target_module({
|
||||
...routeParams,
|
||||
});
|
||||
} catch (error: any) {
|
||||
@@ -155,7 +128,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: `Route handler error: ${error?.message || "Internal Server Error"}`,
|
||||
msg: routeErrorMessage(error),
|
||||
},
|
||||
{
|
||||
status: 500,
|
||||
@@ -205,7 +178,7 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: `Route handler error: ${error?.message || "Internal Server Error"}`,
|
||||
msg: routeErrorMessage(error),
|
||||
},
|
||||
{
|
||||
status: 500,
|
||||
@@ -216,3 +189,25 @@ export default async function ({ req }: Params): Promise<Response> {
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
function bodyTooLargeResponse() {
|
||||
return Response.json(
|
||||
{
|
||||
success: false,
|
||||
msg: "Request Body Too Large!",
|
||||
},
|
||||
{ status: 413 },
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Error details can leak internals, so they are only exposed in
|
||||
* development. They are always logged server-side.
|
||||
*/
|
||||
function routeErrorMessage(error: any) {
|
||||
if (!isDevelopment()) {
|
||||
return "Internal Server Error";
|
||||
}
|
||||
|
||||
return `Route handler error: ${error?.message || "Internal Server Error"}`;
|
||||
}
|
||||
|
||||
@@ -65,9 +65,9 @@ export default async function serverPostBuildFn(params?: Params) {
|
||||
continue;
|
||||
}
|
||||
|
||||
const mock_req = target_artifact.req_url
|
||||
? new Request(target_artifact.req_url, {})
|
||||
: new Request(controller.page_url);
|
||||
// Re-render with this tab's own URL and cookie, never another
|
||||
// client's request.
|
||||
const mock_req = new Request(controller.page_url);
|
||||
|
||||
if (controller.page_cookie) {
|
||||
mock_req.headers.set("cookie", controller.page_cookie);
|
||||
@@ -88,8 +88,13 @@ export default async function serverPostBuildFn(params?: Params) {
|
||||
|
||||
const { serverRes } = page_component || {};
|
||||
|
||||
const final_artifact: Omit<GlobalHMRControllerObject, "controller"> = {
|
||||
..._.omit(controller, ["controller"]),
|
||||
const final_artifact: Omit<
|
||||
GlobalHMRControllerObject,
|
||||
"controller" | "page_cookie" | "page_url"
|
||||
> = {
|
||||
// `page_cookie` holds the raw Cookie header (incl. HttpOnly
|
||||
// cookies), so it must never be sent back to page JS.
|
||||
..._.omit(controller, ["controller", "page_cookie", "page_url"]),
|
||||
target_map: target_artifact,
|
||||
};
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
import grabContants from "../../../utils/grab-constants";
|
||||
import EJSON from "../../../utils/ejson";
|
||||
import serializeForScript from "../../../utils/serialize-for-script";
|
||||
import type { LivePageDistGenParams } from "../../../types";
|
||||
import isDevelopment from "../../../utils/is-development";
|
||||
import grabWebPageHydrationScript from "./grab-web-page-hydration-script";
|
||||
@@ -37,10 +37,11 @@ export default async function genWebHTML({
|
||||
throw new Error(`Main Component not found!`);
|
||||
}
|
||||
|
||||
const serializedProps = (EJSON.stringify(pageProps || {}) || "{}").replace(
|
||||
/<\//g,
|
||||
"<\\/",
|
||||
);
|
||||
let serializedProps = "{}";
|
||||
|
||||
try {
|
||||
serializedProps = serializeForScript(pageProps || {});
|
||||
} catch (error) {}
|
||||
|
||||
const page_hydration_script = await grabWebPageHydrationScript();
|
||||
const root_meta = root_module?.meta
|
||||
@@ -106,7 +107,7 @@ export default async function genWebHTML({
|
||||
|
||||
<script
|
||||
dangerouslySetInnerHTML={{
|
||||
__html: `window.${ClientWindowPagePropsName} = ${serializedProps};\nwindow.process = ${JSON.stringify(client_process)}`,
|
||||
__html: `window.${ClientWindowPagePropsName} = ${serializedProps};\nwindow.process = ${serializeForScript(client_process)}`,
|
||||
}}
|
||||
data-bunext-head
|
||||
/>
|
||||
@@ -121,7 +122,7 @@ export default async function genWebHTML({
|
||||
<script
|
||||
type="importmap"
|
||||
dangerouslySetInnerHTML={{
|
||||
__html: JSON.stringify(
|
||||
__html: serializeForScript(
|
||||
global.BUNEXT_REACT_IMPORTS_MAP,
|
||||
),
|
||||
}}
|
||||
@@ -170,19 +171,7 @@ export default async function genWebHTML({
|
||||
|
||||
// const htmlBody = await new Response(stream).text();
|
||||
|
||||
const originalConsole = {
|
||||
log: console.log,
|
||||
warn: console.warn,
|
||||
error: console.error,
|
||||
info: console.info,
|
||||
debug: console.debug,
|
||||
};
|
||||
|
||||
console.log = () => {};
|
||||
console.warn = () => {};
|
||||
console.error = () => {};
|
||||
console.info = () => {};
|
||||
console.debug = () => {};
|
||||
silenceConsole();
|
||||
|
||||
let htmlBody: string;
|
||||
let render_error: any;
|
||||
@@ -198,13 +187,13 @@ export default async function genWebHTML({
|
||||
render_error = error;
|
||||
}
|
||||
|
||||
originalConsole.error(error);
|
||||
original_console.error(error);
|
||||
},
|
||||
});
|
||||
|
||||
htmlBody = await new Response(stream).text();
|
||||
} finally {
|
||||
Object.assign(console, originalConsole);
|
||||
restoreConsole();
|
||||
}
|
||||
|
||||
// A component crash during SSR must surface as a proper error (handled
|
||||
@@ -218,3 +207,41 @@ export default async function genWebHTML({
|
||||
|
||||
return html;
|
||||
}
|
||||
|
||||
let original_console: Pick<
|
||||
Console,
|
||||
"log" | "warn" | "error" | "info" | "debug"
|
||||
> = console;
|
||||
|
||||
let silenced_renders = 0;
|
||||
|
||||
/**
|
||||
* Renders can overlap (each one awaits the stream), so the console is
|
||||
* swapped only by the first active render and restored by the last one.
|
||||
* Otherwise a render could save another render's no-ops as the "original"
|
||||
* console and silence the server for good.
|
||||
*/
|
||||
function silenceConsole() {
|
||||
if (silenced_renders++ > 0) return;
|
||||
|
||||
original_console = {
|
||||
log: console.log,
|
||||
warn: console.warn,
|
||||
error: console.error,
|
||||
info: console.info,
|
||||
debug: console.debug,
|
||||
};
|
||||
|
||||
console.log = () => {};
|
||||
console.warn = () => {};
|
||||
console.error = () => {};
|
||||
console.info = () => {};
|
||||
console.debug = () => {};
|
||||
}
|
||||
|
||||
function restoreConsole() {
|
||||
if (--silenced_renders > 0) return;
|
||||
|
||||
silenced_renders = 0;
|
||||
Object.assign(console, original_console);
|
||||
}
|
||||
|
||||
@@ -29,6 +29,29 @@ export default async function generateWebPageGetCachePage({
|
||||
|
||||
if (cache_page && routeParams?.url) {
|
||||
try {
|
||||
const status = serverRes?.response_options?.status;
|
||||
|
||||
if (status && (status < 200 || status >= 300)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const res_headers = new Headers(
|
||||
serverRes?.response_options?.headers,
|
||||
);
|
||||
|
||||
if (res_headers.has("set-cookie")) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const req_headers = routeParams.req.headers;
|
||||
|
||||
if (
|
||||
!global.BUNEXT_CONFIG?.cache_credentialed_requests &&
|
||||
(req_headers.has("cookie") || req_headers.has("authorization"))
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
const is_cache =
|
||||
typeof cache_page == "boolean"
|
||||
? cache_page
|
||||
|
||||
@@ -16,6 +16,15 @@ export default async function generateWebPageResponseFromComponentReturn({
|
||||
}: GrabPageComponentRes) {
|
||||
const is_dev = isDevelopment();
|
||||
|
||||
if (serverRes?.redirect?.destination) {
|
||||
return Response.redirect(
|
||||
serverRes.redirect.destination,
|
||||
serverRes.redirect.permanent
|
||||
? 301
|
||||
: serverRes.redirect.status_code || 302,
|
||||
);
|
||||
}
|
||||
|
||||
const html = await genWebHTML({
|
||||
component,
|
||||
pageProps: serverRes,
|
||||
@@ -30,15 +39,6 @@ export default async function generateWebPageResponseFromComponentReturn({
|
||||
log.info("html", html);
|
||||
}
|
||||
|
||||
if (serverRes?.redirect?.destination) {
|
||||
return Response.redirect(
|
||||
serverRes.redirect.destination,
|
||||
serverRes.redirect.permanent
|
||||
? 301
|
||||
: serverRes.redirect.status_code || 302,
|
||||
);
|
||||
}
|
||||
|
||||
const res_opts: ResponseInit = {
|
||||
...serverRes?.response_options,
|
||||
headers: {
|
||||
|
||||
@@ -12,6 +12,7 @@ import { existsSync } from "fs";
|
||||
import grabDirNames from "../../../utils/grab-dir-names";
|
||||
import grabRelativePath from "../../../utils/grab-relative-path";
|
||||
import { logBuildErrorsOnce } from "../../../utils/build-error-log";
|
||||
import { RequestBodyTooLargeError } from "../../../utils/read-request-body";
|
||||
|
||||
const { BUNX_BUNDLER_ERROR_EXIT_FILE, ROOT_DIR } = grabDirNames();
|
||||
|
||||
@@ -57,9 +58,11 @@ export default async function grabPageComponent(
|
||||
const router = global.BUNEXT_ROUTER;
|
||||
const is_dev = isDevelopment();
|
||||
|
||||
const forwarded_proto = req?.headers.get("x-forwarded-proto");
|
||||
const forwarded_proto = global.BUNEXT_CONFIG?.trust_proxy
|
||||
? req?.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()
|
||||
: undefined;
|
||||
|
||||
if (url && forwarded_proto) {
|
||||
if (url && (forwarded_proto == "http" || forwarded_proto == "https")) {
|
||||
url.protocol = forwarded_proto;
|
||||
}
|
||||
|
||||
@@ -131,10 +134,6 @@ export default async function grabPageComponent(
|
||||
}
|
||||
}
|
||||
|
||||
if (req && !is_hydration) {
|
||||
global.BUNEXT_BUNDLER_CTX_MAP[relative_file_path].req_url = req.url;
|
||||
}
|
||||
|
||||
if (debug) {
|
||||
log.info(`bundledMap:`, bundledMap);
|
||||
}
|
||||
@@ -176,6 +175,10 @@ export default async function grabPageComponent(
|
||||
success: true,
|
||||
};
|
||||
} catch (error: any) {
|
||||
if (error instanceof RequestBodyTooLargeError) {
|
||||
return new Response("Request Body Too Large", { status: 413 });
|
||||
}
|
||||
|
||||
const is404 =
|
||||
error instanceof NotFoundError ||
|
||||
error?.name === "NotFoundError" ||
|
||||
|
||||
@@ -35,6 +35,11 @@ export default async function grabPageErrorComponent({
|
||||
? BUNX_ROOT_404_PRESET_COMPONENT
|
||||
: BUNX_ROOT_500_PRESET_COMPONENT;
|
||||
|
||||
// 404 messages only contain the requested path. Other error messages can
|
||||
// leak internals, so they are only shown in development.
|
||||
const error_message =
|
||||
is404 || is_dev ? error?.message : "Internal Server Error";
|
||||
|
||||
const default_server_res = {
|
||||
response_options: {
|
||||
status: is404 ? 404 : 500,
|
||||
@@ -50,7 +55,7 @@ export default async function grabPageErrorComponent({
|
||||
);
|
||||
const Component = default_module.default as FC<any>;
|
||||
const default_jsx: FC = () => {
|
||||
return <Component>{<span>{error.message}</span>}</Component>;
|
||||
return <Component>{<span>{error_message}</span>}</Component>;
|
||||
};
|
||||
|
||||
return {
|
||||
@@ -104,7 +109,7 @@ export default async function grabPageErrorComponent({
|
||||
}}
|
||||
>
|
||||
<h1>{is404 ? "404 Not Found" : "500 Internal Server Error"}</h1>
|
||||
<span>{error.message}</span>
|
||||
<span>{error_message}</span>
|
||||
</div>
|
||||
);
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@ import type {
|
||||
} from "../../../types";
|
||||
import _ from "lodash";
|
||||
import { log } from "../../../utils/log";
|
||||
import isDevelopment from "../../../utils/is-development";
|
||||
|
||||
type Params = {
|
||||
url?: URL;
|
||||
@@ -36,9 +37,7 @@ export default async function grabPageServerRes({
|
||||
"searchParams",
|
||||
"hash",
|
||||
"href",
|
||||
"password",
|
||||
"protocol",
|
||||
"username",
|
||||
]) as any),
|
||||
}
|
||||
: null,
|
||||
@@ -65,8 +64,12 @@ export default async function grabPageServerRes({
|
||||
error,
|
||||
);
|
||||
|
||||
// Error details can leak internals, so only expose them in
|
||||
// development. They are always logged above.
|
||||
return _.merge(default_props, {
|
||||
error: error.message,
|
||||
error: isDevelopment()
|
||||
? error.message
|
||||
: "Internal Server Error",
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
import isDevelopment from "../../../utils/is-development";
|
||||
import * as esbuild from "esbuild";
|
||||
|
||||
type Params = {
|
||||
tsx: string;
|
||||
};
|
||||
|
||||
export default async function grabTsxStringModule<T>({
|
||||
tsx,
|
||||
}: Params): Promise<T> {
|
||||
const dev = isDevelopment();
|
||||
const now = Date.now();
|
||||
|
||||
const final_tsx = dev ? tsx + `\n// v_${now}` : tsx;
|
||||
|
||||
const result = await esbuild.transform(final_tsx, {
|
||||
loader: "tsx",
|
||||
format: "esm",
|
||||
jsx: "automatic",
|
||||
minify: !dev,
|
||||
});
|
||||
|
||||
const blob = new Blob([result.code], { type: "text/javascript" });
|
||||
const url = URL.createObjectURL(blob);
|
||||
const mod = await import(url);
|
||||
|
||||
URL.revokeObjectURL(url);
|
||||
|
||||
return mod as T;
|
||||
}
|
||||
|
||||
// export default async function grabTsxStringModule<T extends any = any>({
|
||||
// tsx,
|
||||
// }: Params): Promise<T> {
|
||||
// const dev = isDevelopment();
|
||||
|
||||
// const now = Date.now();
|
||||
// const { BUNX_CWD_MODULE_CACHE_DIR } = grabDirNames();
|
||||
// const target_cache_file_path = path.join(
|
||||
// BUNX_CWD_MODULE_CACHE_DIR,
|
||||
// `server-render-${now}.js`,
|
||||
// );
|
||||
|
||||
// await esbuild.build({
|
||||
// stdin: {
|
||||
// contents: dev ? tsx + `\n// v_${now}` : tsx,
|
||||
// resolveDir: process.cwd(),
|
||||
// loader: "tsx",
|
||||
// },
|
||||
// bundle: true,
|
||||
// format: "esm",
|
||||
// target: "es2020",
|
||||
// platform: "node",
|
||||
// external: [
|
||||
// "react",
|
||||
// "react-dom",
|
||||
// "react/jsx-runtime",
|
||||
// "react/jsx-dev-runtime",
|
||||
// ],
|
||||
// minify: !dev,
|
||||
// define: {
|
||||
// "process.env.NODE_ENV": JSON.stringify(
|
||||
// dev ? "development" : "production",
|
||||
// ),
|
||||
// },
|
||||
// jsx: "automatic",
|
||||
// outfile: target_cache_file_path,
|
||||
// plugins: [tailwindEsbuildPlugin],
|
||||
// });
|
||||
|
||||
// Loader.registry.delete(target_cache_file_path);
|
||||
// const mod = await import(`${target_cache_file_path}?t=${now}`);
|
||||
|
||||
// return mod as T;
|
||||
// }
|
||||
|
||||
// if (!dev) {
|
||||
// const now = Date.now();
|
||||
|
||||
// const final_tsx = dev ? tsx + `\n// v_${now}` : tsx;
|
||||
|
||||
// const result = await esbuild.transform(final_tsx, {
|
||||
// loader: "tsx",
|
||||
// format: "esm",
|
||||
// jsx: "automatic",
|
||||
// minify: !dev,
|
||||
// });
|
||||
|
||||
// const blob = new Blob([result.code], { type: "text/javascript" });
|
||||
// const url = URL.createObjectURL(blob);
|
||||
// const mod = await import(url);
|
||||
|
||||
// URL.revokeObjectURL(url);
|
||||
|
||||
// return mod as T;
|
||||
// }
|
||||
+17
-1
@@ -63,6 +63,23 @@ export type BunextConfig = {
|
||||
| Request
|
||||
| undefined;
|
||||
default_cache_expiry?: number;
|
||||
/**
|
||||
* Maximum number of cached pages kept on disk. New pages are not
|
||||
* cached once this is reached. Defaults to 1000.
|
||||
*/
|
||||
max_cache_entries?: number;
|
||||
/**
|
||||
* By default, pages are not written to the cache when the request
|
||||
* carries a `Cookie` or `Authorization` header, so one user's page is
|
||||
* never served to everyone. Set this to `true` only if your cached
|
||||
* pages never render per-user content.
|
||||
*/
|
||||
cache_credentialed_requests?: boolean;
|
||||
/**
|
||||
* Trust the `X-Forwarded-Proto` header (set this when running behind a
|
||||
* reverse proxy that sets it). Defaults to `false`.
|
||||
*/
|
||||
trust_proxy?: boolean;
|
||||
websocket?: WebSocketHandler<any>;
|
||||
server_options?: Omit<Bun.Serve.Options<any>, "fetch" | "routes">;
|
||||
/**
|
||||
@@ -354,7 +371,6 @@ export type BundlerCTXMap = {
|
||||
url_path: string;
|
||||
file_name: string;
|
||||
css_path?: string;
|
||||
req_url?: string;
|
||||
};
|
||||
|
||||
export type GlobalHMRControllerObject = {
|
||||
|
||||
@@ -11,7 +11,7 @@ export default function grabConstants() {
|
||||
const MaxBundlerRebuilds = 5;
|
||||
const RouteIgnorePatterns = [/\/\(/];
|
||||
|
||||
if (config.pages_exclude_patterns) {
|
||||
if (config?.pages_exclude_patterns) {
|
||||
RouteIgnorePatterns.push(...config.pages_exclude_patterns);
|
||||
}
|
||||
|
||||
|
||||
@@ -65,7 +65,8 @@ export default function grabDirNames(): DirNames {
|
||||
const BUNEXT_PUBLIC_DIR = path.join(BUNX_CWD_DIR, "public");
|
||||
const HYDRATION_DST_DIR = path.join(BUNEXT_PUBLIC_DIR, "pages");
|
||||
const BUNEXT_VENDOR_DIR = path.join(BUNEXT_PUBLIC_DIR, "vendor");
|
||||
const BUNEXT_CACHE_DIR = path.join(BUNEXT_PUBLIC_DIR, "cache");
|
||||
// Kept outside BUNEXT_PUBLIC_DIR: that directory is served over HTTP.
|
||||
const BUNEXT_CACHE_DIR = path.join(BUNX_CWD_DIR, "cache");
|
||||
const HYDRATION_DST_DIR_MAP_JSON_FILE_NAME = "map.json";
|
||||
const HYDRATION_DST_DIR_MAP_JSON_FILE = path.join(
|
||||
HYDRATION_DST_DIR,
|
||||
|
||||
@@ -1,23 +1,54 @@
|
||||
import _ from "lodash";
|
||||
import type { BunxRouteParams } from "../types";
|
||||
import deserializeQuery from "./deserialize-query";
|
||||
import grabConstants from "./grab-constants";
|
||||
import readRequestBody from "./read-request-body";
|
||||
|
||||
type Params = {
|
||||
req: Request;
|
||||
query?: any;
|
||||
/**
|
||||
* Maximum request body size. Defaults to
|
||||
* `ServerDefaultRequestBodyLimitBytes`.
|
||||
*/
|
||||
max_body_bytes?: number;
|
||||
};
|
||||
|
||||
/**
|
||||
* Throws `RequestBodyTooLargeError` if the body exceeds `max_body_bytes`.
|
||||
*/
|
||||
export default async function grabRouteParams({
|
||||
req,
|
||||
req: initial_req,
|
||||
query: passed_query,
|
||||
max_body_bytes,
|
||||
}: Params): Promise<BunxRouteParams> {
|
||||
const url = new URL(req.url);
|
||||
const url = new URL(initial_req.url);
|
||||
|
||||
const query = deserializeQuery(Object.fromEntries(url.searchParams));
|
||||
|
||||
const body = await (async () => {
|
||||
const raw_body = await readRequestBody({
|
||||
req: initial_req,
|
||||
max_bytes:
|
||||
max_body_bytes || grabConstants().ServerDefaultRequestBodyLimitBytes,
|
||||
});
|
||||
|
||||
// The original body stream is consumed above, so hand handlers a fresh
|
||||
// request over the buffered bytes. This keeps `req.text()`,
|
||||
// `req.formData()`, etc. usable (e.g. for webhook signatures/uploads).
|
||||
const req = raw_body
|
||||
? new Request(initial_req.url, {
|
||||
method: initial_req.method,
|
||||
headers: initial_req.headers,
|
||||
body: raw_body,
|
||||
signal: initial_req.signal,
|
||||
})
|
||||
: initial_req;
|
||||
|
||||
const body = (() => {
|
||||
if (initial_req.method == "GET") return undefined;
|
||||
if (!raw_body) return {};
|
||||
try {
|
||||
return req.method == "GET" ? undefined : await req.json();
|
||||
return JSON.parse(new TextDecoder().decode(raw_body) || "{}");
|
||||
} catch (error) {
|
||||
return {};
|
||||
}
|
||||
|
||||
@@ -8,17 +8,39 @@ export default function isSafePath({
|
||||
filePath: string;
|
||||
allowedDir: string;
|
||||
}): boolean {
|
||||
const allowed = path.resolve(allowedDir);
|
||||
const resolved = path.resolve(filePath);
|
||||
if (!resolved.startsWith(allowedDir + path.sep) && resolved !== allowedDir) {
|
||||
|
||||
if (!isInside(resolved, allowed)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
try {
|
||||
const real = realpathSync(resolved);
|
||||
return (
|
||||
real.startsWith(allowedDir + path.sep) || real === allowedDir
|
||||
);
|
||||
return isInside(realpathSync(resolved), resolveRealDir(allowed));
|
||||
} catch {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
function isInside(target: string, dir: string) {
|
||||
return target === dir || target.startsWith(dir + path.sep);
|
||||
}
|
||||
|
||||
const REAL_DIRS = new Map<string, string>();
|
||||
|
||||
/**
|
||||
* Resolves symlinks in the allowed directory itself (e.g. a project under a
|
||||
* symlinked path), so real file paths inside it still match.
|
||||
*/
|
||||
function resolveRealDir(dir: string) {
|
||||
const cached = REAL_DIRS.get(dir);
|
||||
if (cached) return cached;
|
||||
|
||||
try {
|
||||
const real = realpathSync(dir);
|
||||
REAL_DIRS.set(dir, real);
|
||||
return real;
|
||||
} catch {
|
||||
return dir;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
export class RequestBodyTooLargeError extends Error {
|
||||
status = 413;
|
||||
|
||||
constructor(max_bytes: number) {
|
||||
super(`Request body exceeds ${max_bytes} bytes`);
|
||||
this.name = "RequestBodyTooLargeError";
|
||||
}
|
||||
}
|
||||
|
||||
type Params = {
|
||||
req: Request;
|
||||
max_bytes: number;
|
||||
};
|
||||
|
||||
/**
|
||||
* Reads the whole request body, aborting as soon as it grows past
|
||||
* `max_bytes` so oversized (or chunked, length-less) bodies are never fully
|
||||
* buffered. Returns `undefined` when the request has no body.
|
||||
*/
|
||||
export default async function readRequestBody({
|
||||
req,
|
||||
max_bytes,
|
||||
}: Params): Promise<Uint8Array | undefined> {
|
||||
if (req.method == "GET" || req.method == "HEAD" || !req.body) {
|
||||
return undefined;
|
||||
}
|
||||
|
||||
const content_length = Number(req.headers.get("content-length"));
|
||||
|
||||
if (content_length > max_bytes) {
|
||||
throw new RequestBodyTooLargeError(max_bytes);
|
||||
}
|
||||
|
||||
const reader = req.body.getReader();
|
||||
const chunks: Uint8Array[] = [];
|
||||
let total = 0;
|
||||
|
||||
while (true) {
|
||||
const { done, value } = await reader.read();
|
||||
if (done) break;
|
||||
|
||||
total += value.byteLength;
|
||||
|
||||
if (total > max_bytes) {
|
||||
await reader.cancel();
|
||||
throw new RequestBodyTooLargeError(max_bytes);
|
||||
}
|
||||
|
||||
chunks.push(value);
|
||||
}
|
||||
|
||||
const body = new Uint8Array(total);
|
||||
let offset = 0;
|
||||
|
||||
for (const chunk of chunks) {
|
||||
body.set(chunk, offset);
|
||||
offset += chunk.byteLength;
|
||||
}
|
||||
|
||||
return body;
|
||||
}
|
||||
@@ -0,0 +1,17 @@
|
||||
/**
|
||||
* # Serialize a value as JSON that is safe to embed in an inline `<script>`
|
||||
*
|
||||
* Escapes `<`, `>`, `&`, U+2028 and U+2029 so the payload can never close
|
||||
* the script tag (`</script>`), open an HTML comment (`<!--`) or otherwise
|
||||
* change the HTML parser state.
|
||||
*/
|
||||
export default function serializeForScript(value: any): string {
|
||||
const json = JSON.stringify(value ?? null) ?? "null";
|
||||
|
||||
return json
|
||||
.replace(/</g, "\\u003c")
|
||||
.replace(/>/g, "\\u003e")
|
||||
.replace(/&/g, "\\u0026")
|
||||
.replace(/\u2028/g, "\\u2028")
|
||||
.replace(/\u2029/g, "\\u2029");
|
||||
}
|
||||
Reference in New Issue
Block a user