[PR #542] [MERGED] fix: prevent user searchParams from leaking into ISR cache #657

New issue

Closed

opened 2026-05-06 13:09:22 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 13:09:22 +02:00

Owner

📋 Pull Request Information

Original PR: https://github.com/cloudflare/vinext/pull/542
Author: @NathanDrake2406
Created: 3/15/2026
Status: ✅ Merged
Merged: 3/15/2026
Merged by: @james-elicx

Base: main ← Head: fix/isr-searchparams-leak

📝 Commits (1)

3216989 fix: prevent user searchParams from leaking into ISR background regeneration cache

📊 Changes

3 files changed (+37 additions, -14 deletions)

View changed files

📝 packages/vinext/src/entries/app-rsc-entry.ts (+2 -2)
📝 tests/__snapshots__/entry-templates.test.ts.snap (+12 -12)
📝 tests/app-router.test.ts (+23 -0)

📄 Description

Summary

ISR background regeneration was passing the triggering user's url.searchParams into setNavigationContext() and buildPageElement(), causing cached content to reflect one user's query params and be served to all subsequent users
Headers were already correctly sanitized (new Headers(), new Map() for cookies), but searchParams was missed
Replaced url.searchParams with new URLSearchParams() in both the navigation context and page element builder during background regen

Test plan

New test verifying regen callback uses empty URLSearchParams() instead of user's params
All 254 app-router tests pass
All 32 isr-cache tests pass
Snapshot updates are mechanical (only the URLSearchParams substitution)
Typecheck and lint clean

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/cloudflare/vinext/pull/542 **Author:** [@NathanDrake2406](https://github.com/NathanDrake2406) **Created:** 3/15/2026 **Status:** ✅ Merged **Merged:** 3/15/2026 **Merged by:** [@james-elicx](https://github.com/james-elicx) **Base:** `main` ← **Head:** `fix/isr-searchparams-leak` --- ### 📝 Commits (1) - [`3216989`](https://github.com/cloudflare/vinext/commit/3216989bc5c31b6e073cca8495e52585a670c126) fix: prevent user searchParams from leaking into ISR background regeneration cache ### 📊 Changes **3 files changed** (+37 additions, -14 deletions) <details> <summary>View changed files</summary> 📝 `packages/vinext/src/entries/app-rsc-entry.ts` (+2 -2) 📝 `tests/__snapshots__/entry-templates.test.ts.snap` (+12 -12) 📝 `tests/app-router.test.ts` (+23 -0) </details> ### 📄 Description ## Summary - ISR background regeneration was passing the triggering user's `url.searchParams` into `setNavigationContext()` and `buildPageElement()`, causing cached content to reflect one user's query params and be served to all subsequent users - Headers were already correctly sanitized (`new Headers()`, `new Map()` for cookies), but `searchParams` was missed - Replaced `url.searchParams` with `new URLSearchParams()` in both the navigation context and page element builder during background regen ## Test plan - [x] New test verifying regen callback uses empty `URLSearchParams()` instead of user's params - [x] All 254 app-router tests pass - [x] All 32 isr-cache tests pass - [x] Snapshot updates are mechanical (only the `URLSearchParams` substitution) - [x] Typecheck and lint clean --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>