@remix-run/server-runtime - npm Package Compare versions

Comparing version 2.17.2 to 2.17.3

dist/actions.d.ts

+export declare function throwIfPotentialCSRFAttack(headers: Headers): void;

dist/actions.js

+/**
+ * @remix-run/server-runtime v2.17.3
+ *
+ * Copyright (c) Remix Software Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE.md file in the root directory of this source tree.
+ *
+ * @license MIT
+ */
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+function throwIfPotentialCSRFAttack(headers) {
+  let originHeader = headers.get("origin");
+  let originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+  let host = parseHostHeader(headers);
+  if (originDomain && (!host || originDomain !== host.value)) {
+    if (host) {
+      // This seems to be an CSRF attack. We should not proceed with the action.
+      throw new Error(`${host.type} header does not match \`origin\` header from a forwarded ` + `action request. Aborting the action.`);
+    } else {
+      // This is an attack. We should not proceed with the action.
+      throw new Error("`x-forwarded-host` or `host` headers are not provided. One of these " + "is needed to compare the `origin` header from a forwarded action " + "request. Aborting the action.");
+    }
+  }
+}
+function parseHostHeader(headers) {
+  var _forwardedHostHeader$;
+  let forwardedHostHeader = headers.get("x-forwarded-host");
+  let forwardedHostValue = forwardedHostHeader === null || forwardedHostHeader === void 0 ? void 0 : (_forwardedHostHeader$ = forwardedHostHeader.split(",")[0]) === null || _forwardedHostHeader$ === void 0 ? void 0 : _forwardedHostHeader$.trim();
+  let hostHeader = headers.get("host");
+  return forwardedHostValue ? {
+    type: "x-forwarded-host",
+    value: forwardedHostValue
+  } : hostHeader ? {
+    type: "host",
+    value: hostHeader
+  } : undefined;
+}
+
+exports.throwIfPotentialCSRFAttack = throwIfPotentialCSRFAttack;

dist/esm/actions.js

+/**
+ * @remix-run/server-runtime v2.17.3
+ *
+ * Copyright (c) Remix Software Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE.md file in the root directory of this source tree.
+ *
+ * @license MIT
+ */
+function throwIfPotentialCSRFAttack(headers) {
+  let originHeader = headers.get("origin");
+  let originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+  let host = parseHostHeader(headers);
+  if (originDomain && (!host || originDomain !== host.value)) {
+    if (host) {
+      // This seems to be an CSRF attack. We should not proceed with the action.
+      throw new Error(`${host.type} header does not match \`origin\` header from a forwarded ` + `action request. Aborting the action.`);
+    } else {
+      // This is an attack. We should not proceed with the action.
+      throw new Error("`x-forwarded-host` or `host` headers are not provided. One of these " + "is needed to compare the `origin` header from a forwarded action " + "request. Aborting the action.");
+    }
+  }
+}
+function parseHostHeader(headers) {
+  var _forwardedHostHeader$;
+  let forwardedHostHeader = headers.get("x-forwarded-host");
+  let forwardedHostValue = forwardedHostHeader === null || forwardedHostHeader === void 0 ? void 0 : (_forwardedHostHeader$ = forwardedHostHeader.split(",")[0]) === null || _forwardedHostHeader$ === void 0 ? void 0 : _forwardedHostHeader$.trim();
+  let hostHeader = headers.get("host");
+  return forwardedHostValue ? {
+    type: "x-forwarded-host",
+    value: forwardedHostValue
+  } : hostHeader ? {
+    type: "host",
+    value: hostHeader
+  } : undefined;
+}
+
+export { throwIfPotentialCSRFAttack };

dist/cookies.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/data.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/deprecations.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/dev.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/entry.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/errors.d.ts

@@ -44,3 +44,3 @@ import type { StaticHandlerContext } from "@remix-run/router";
  */
-export declare function sanitizeError<T = unknown>(error: T, serverMode: ServerMode): T | Error;
+export declare function sanitizeError<T = unknown>(error: T, serverMode: ServerMode): Error | T;
 export declare function sanitizeErrors(errors: NonNullable<StaticHandlerContext["errors"]>, serverMode: ServerMode): {};
@@ -47,0 +47,0 @@ export type SerializedError = {

dist/errors.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/cookies.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/data.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/deprecations.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/dev.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/entry.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/errors.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/formData.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/headers.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/index.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/invariant.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/markup.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/mode.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/responses.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/routeMatching.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/routes.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/server.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -24,2 +24,3 @@ * Copyright (c) Remix Software Inc.
 import { resourceRouteJsonWarning } from './deprecations.js';
+import { throwIfPotentialCSRFAttack } from './actions.js';
 
@@ -310,2 +311,5 @@ // Do not include a response body if the status code is one of these,
   try {
+    if (request.method === "POST") {
+      throwIfPotentialCSRFAttack(request.headers);
+    }
     context = await staticHandler.query(request, {
@@ -312,0 +316,0 @@ requestContext: loadContext

dist/esm/serverHandoff.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/sessions.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/sessions/cookieStorage.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/sessions/memoryStorage.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/single-fetch.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -17,2 +17,3 @@ * Copyright (c) Remix Software Inc.
 import { isResponse, isRedirectStatusCode } from './responses.js';
+import { throwIfPotentialCSRFAttack } from './actions.js';
 
@@ -49,2 +50,3 @@ const SingleFetchRedirectSymbol = Symbol("SingleFetchRedirect");
   try {
+    throwIfPotentialCSRFAttack(request.headers);
     let handlerRequest = new Request(handlerUrl, {
@@ -51,0 +53,0 @@ method: request.method,

dist/esm/upload/errors.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/upload/memoryUploadHandler.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/esm/warnings.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/formData.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/headers.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/index.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/invariant.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/markup.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/mode.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/responses.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/routeMatching.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/routes.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/server.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -28,2 +28,3 @@ * Copyright (c) Remix Software Inc.
 var deprecations = require('./deprecations.js');
+var actions = require('./actions.js');
 
@@ -314,2 +315,5 @@ // Do not include a response body if the status code is one of these,
   try {
+    if (request.method === "POST") {
+      actions.throwIfPotentialCSRFAttack(request.headers);
+    }
     context = await staticHandler.query(request, {
@@ -316,0 +320,0 @@ requestContext: loadContext

dist/serverHandoff.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/sessions.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/sessions/cookieStorage.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/sessions/memoryStorage.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/single-fetch.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -21,2 +21,3 @@ * Copyright (c) Remix Software Inc.
 var responses = require('./responses.js');
+var actions = require('./actions.js');
 
@@ -53,2 +54,3 @@ const SingleFetchRedirectSymbol = Symbol("SingleFetchRedirect");
   try {
+    actions.throwIfPotentialCSRFAttack(request.headers);
     let handlerRequest = new Request(handlerUrl, {
@@ -55,0 +57,0 @@ method: request.method,

dist/upload/errors.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/upload/memoryUploadHandler.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

dist/warnings.js

 /**
- * @remix-run/server-runtime v2.17.2
+ * @remix-run/server-runtime v2.17.3
  *
@@ -4,0 +4,0 @@ * Copyright (c) Remix Software Inc.

package.json

 {
   "name": "@remix-run/server-runtime",
-  "version": "2.17.2",
+  "version": "2.17.3",
   "description": "Server runtime for Remix",
@@ -5,0 +5,0 @@ "bugs": {

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

281713

1.47%

Number of package files

89

3.49%

Lines of code

5435

1.7%

No dependency changes