Security fixes pass #2

src/functions/server/handle-hmr.ts

@@ -2,8 +2,28 @@ type Params = {
     req: Request;
 };
 
+function removeController(controller: ReadableStreamDefaultController<string>) {
+    const idx = global.HMR_CONTROLLERS.findIndex(
+        (c) => c.controller == controller,
+    );
+    if (typeof idx == "number" && idx >= 0) {
+        global.HMR_CONTROLLERS.splice(idx, 1);
+    }
+}
+
 export default async function ({ req }: Params): Promise<Response> {
-    const referer_url = new URL(req.headers.get("referer") || "");
+    const referer = req.headers.get("referer");
+    if (!referer) {
+        return new Response("Missing Referer Header", { status: 400 });
+    }
+
+    let referer_url: URL;
+    try {
+        referer_url = new URL(referer);
+    } catch {
+        return new Response("Invalid Referer Header", { status: 400 });
+    }
+
     const match = global.ROUTER.match(referer_url.pathname);
 
     const target_map = match?.filePath
@@ -25,21 +45,13 @@ export default async function ({ req }: Params): Promise<Response> {
                     c.enqueue(": keep-alive\n\n");
                 } catch {
                     clearInterval(heartbeat);
+                    removeController(controller);
                 }
             }, 5000);
         },
         cancel() {
             clearInterval(heartbeat);
-            const targetControllerIndex = global.HMR_CONTROLLERS.findIndex(
-                (c) => c.controller == controller,
-            );
-
-            if (
-                typeof targetControllerIndex == "number" &&
-                targetControllerIndex >= 0
-            ) {
-                global.HMR_CONTROLLERS.splice(targetControllerIndex, 1);
-            }
+            removeController(controller);
         },
     });