Fix security vulnerabilities

dist/functions/server/server-post-build-fn.js

@@ -40,9 +40,9 @@ export default async function serverPostBuildFn(params) {
             }
             continue;
         }
-        const mock_req = target_artifact.req_url
-            ? new Request(target_artifact.req_url, {})
-            : new Request(controller.page_url);
+        // Re-render with this tab's own URL and cookie, never another
+        // client's request.
+        const mock_req = new Request(controller.page_url);
         if (controller.page_cookie) {
             mock_req.headers.set("cookie", controller.page_cookie);
         }
@@ -59,7 +59,9 @@ export default async function serverPostBuildFn(params) {
         }
         const { serverRes } = page_component || {};
         const final_artifact = {
-            ..._.omit(controller, ["controller"]),
+            // `page_cookie` holds the raw Cookie header (incl. HttpOnly
+            // cookies), so it must never be sent back to page JS.
+            ..._.omit(controller, ["controller", "page_cookie", "page_url"]),
             target_map: target_artifact,
         };
         if (!target_artifact) {