[PR #94] [MERGED] fix: validate module paths during client-side navigation #305

New issue

Closed

opened 2026-05-06 12:39:04 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:39:04 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/94
Author: @southpolesteve
Created: 2/26/2026
Status: ✅ Merged
Merged: 2/26/2026
Merged by: @southpolesteve

Base: main ← Head: fix/validate-module-path

📝 Commits (1)

834f3c8 fix: validate module paths during client-side navigation

📊 Changes

4 files changed (+107 additions, -18 deletions)

View changed files

📝 packages/vinext/src/client/entry.ts (+1 -12)
➕ packages/vinext/src/client/validate-module-path.ts (+25 -0)
📝 packages/vinext/src/shims/router.ts (+19 -6)
📝 tests/shims.test.ts (+62 -0)

📄 Description

Summary

Applies the existing isValidModulePath() guard to navigateClient() in the Pages Router client and fixes it to also reject protocol-relative paths.

Extracts isValidModulePath() from entry.ts into a shared validate-module-path.ts module
Adds a check for protocol-relative URLs (//...) that the original inline version missed
Guards both pageModuleUrl and appModuleUrl in navigateClient() before calling import(), falling back to full page navigation on invalid paths

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/94 **Author:** [@southpolesteve](https://github.com/southpolesteve) **Created:** 2/26/2026 **Status:** ✅ Merged **Merged:** 2/26/2026 **Merged by:** [@southpolesteve](https://github.com/southpolesteve) **Base:** `main` ← **Head:** `fix/validate-module-path` --- ### 📝 Commits (1) - [`834f3c8`](https://github.com/cloudflare/vinext/commit/834f3c8a170cd06e17a935f2e1c96a7d72e1d8d4) fix: validate module paths during client-side navigation ### 📊 Changes **4 files changed** (+107 additions, -18 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/client/entry.ts` (+1 -12) ➕ `packages/vinext/src/client/validate-module-path.ts` (+25 -0) 📝 `packages/vinext/src/shims/router.ts` (+19 -6) 📝 `tests/shims.test.ts` (+62 -0) </details> ### 📄 Description ## Summary Applies the existing `isValidModulePath()` guard to `navigateClient()` in the Pages Router client and fixes it to also reject protocol-relative paths. - Extracts `isValidModulePath()` from `entry.ts` into a shared `validate-module-path.ts` module - Adds a check for protocol-relative URLs (`//...`) that the original inline version missed - Guards both `pageModuleUrl` and `appModuleUrl` in `navigateClient()` before calling `import()`, falling back to full page navigation on invalid paths --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>