Fix security vulnerabilities

dist/functions/server/web-pages/grab-page-component.js

@@ -11,6 +11,7 @@ import { existsSync } from "fs";
 import grabDirNames from "../../../utils/grab-dir-names";
 import grabRelativePath from "../../../utils/grab-relative-path";
 import { logBuildErrorsOnce } from "../../../utils/build-error-log";
+import { RequestBodyTooLargeError } from "../../../utils/read-request-body";
 const { BUNX_BUNDLER_ERROR_EXIT_FILE, ROOT_DIR } = grabDirNames();
 class NotFoundError extends Error {
     status = 404;
@@ -24,8 +25,10 @@ export default async function grabPageComponent(params) {
     const url = req?.url ? new URL(req.url) : undefined;
     const router = global.BUNEXT_ROUTER;
     const is_dev = isDevelopment();
-    const forwarded_proto = req?.headers.get("x-forwarded-proto");
-    if (url && forwarded_proto) {
+    const forwarded_proto = global.BUNEXT_CONFIG?.trust_proxy
+        ? req?.headers.get("x-forwarded-proto")?.split(",")[0]?.trim()
+        : undefined;
+    if (url && (forwarded_proto == "http" || forwarded_proto == "https")) {
         url.protocol = forwarded_proto;
     }
     let routeParams = undefined;
@@ -78,9 +81,6 @@ export default async function grabPageComponent(params) {
                 throw new Error(errMsg);
             }
         }
-        if (req && !is_hydration) {
-            global.BUNEXT_BUNDLER_CTX_MAP[relative_file_path].req_url = req.url;
-        }
         if (debug) {
             log.info(`bundledMap:`, bundledMap);
         }
@@ -117,6 +117,9 @@ export default async function grabPageComponent(params) {
         };
     }
     catch (error) {
+        if (error instanceof RequestBodyTooLargeError) {
+            return new Response("Request Body Too Large", { status: 413 });
+        }
         const is404 = error instanceof NotFoundError ||
             error?.name === "NotFoundError" ||
             error?.status === 404;