Fixes

Author: JoviDeCroock

examples/basic/package.json

@@ -9,6 +9,7 @@
   },
   "devDependencies": {
     "@preact/preset-vite": "^2.9.4",
+    "@viact/cli": "workspace:*",
     "@viact/vite-plugin": "workspace:*",
     "preact": "^10.26.9",
     "preact-render-to-string": "^6.5.13",

examples/basic/src/middleware/auth.ts

@@ -1,5 +1,10 @@
 import type { MiddlewareFn } from "viact";
 
+// ⚠️ NOT FOR PRODUCTION — This is a minimal example only.
+// A real implementation should:
+//   - Verify the session token with a cryptographic signature (e.g. HMAC)
+//   - Check token expiry
+//   - Set cookie attributes: HttpOnly, Secure, SameSite=Lax, Path=/
 export const middleware: MiddlewareFn = async ({ request }) => {
   const hasSession = request.headers.get("cookie")?.includes("session=") ?? false;
 

examples/cloudflare/package.json

@@ -9,6 +9,7 @@
   },
   "devDependencies": {
     "@preact/preset-vite": "^2.9.4",
+    "@viact/cli": "workspace:*",
     "@viact/vite-plugin": "workspace:*",
     "preact": "^10.26.9",
     "preact-render-to-string": "^6.5.13",

packages/adapter-node/src/index.ts

@@ -43,7 +43,17 @@ export function createNodeRequestHandler<TContext = unknown>(
   const staticDir = options.staticDir;
 
   return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {
-    const request = await createWebRequest(req);
+    let request: Request;
+    try {
+      request = await createWebRequest(req);
+    } catch (err) {
+      if (err instanceof Error && err.message === "Request body too large") {
+        res.statusCode = 413;
+        res.end("Payload Too Large");
+        return;
+      }
+      throw err;
+    }
     const url = new URL(request.url);
 
     // --- ISG stale-while-revalidate for GET requests ---
@@ -225,16 +235,20 @@ function createHeaders(headers: IncomingMessage["headers"]): Headers {
   return result;
 }
 
+const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
+
 async function readRequestBody(req: IncomingMessage): Promise<Uint8Array> {
   const chunks: Uint8Array[] = [];
+  let totalSize = 0;
 
   for await (const chunk of req) {
-    if (typeof chunk === "string") {
-      chunks.push(Buffer.from(chunk));
-      continue;
+    const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    totalSize += buf.byteLength;
+    if (totalSize > MAX_BODY_SIZE) {
+      req.destroy();
+      throw new Error("Request body too large");
     }
-
-    chunks.push(chunk);
+    chunks.push(buf);
   }
 
   return Buffer.concat(chunks);

packages/cli/bin/viact.js

@@ -280,7 +280,12 @@ async function preview() {
     }
 
     // Try static file first
-    const filePath = join(clientDir, url);
+    const filePath = resolve(clientDir, "." + url);
+    if (!filePath.startsWith(clientDir + "/") && filePath !== clientDir) {
+      res.statusCode = 403;
+      res.end("Forbidden");
+      return;
+    }
     if (existsSync(filePath) && statSync(filePath).isFile()) {
       const ext = extname(filePath);
       const headers = {

packages/vite-plugin/src/index.ts

@@ -262,7 +262,17 @@ function createDevSSRMiddleware(
         server.ssrLoadModule(VIACT_SERVER_MODULE_ID),
       ]);
 
-      const webRequest = await nodeToWebRequest(req);
+      let webRequest: Request;
+      try {
+        webRequest = await nodeToWebRequest(req);
+      } catch (err) {
+        if (err instanceof Error && err.message === "Request body too large") {
+          res.statusCode = 413;
+          res.end("Payload Too Large");
+          return;
+        }
+        throw err;
+      }
       const response = await framework.handleViactRequest({
         app: serverMod.resolvedApp,
         registry: serverMod.registry,
@@ -322,9 +332,17 @@ async function nodeToWebRequest(req: IncomingMessage): Promise<Request> {
   const init: RequestInit = { method, headers };
 
   if (!BODYLESS_METHODS.has(method.toUpperCase())) {
+    const MAX_BODY_SIZE = 1024 * 1024; // 1 MB
     const chunks: Uint8Array[] = [];
+    let totalSize = 0;
     for await (const chunk of req) {
-      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+      const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+      totalSize += buf.byteLength;
+      if (totalSize > MAX_BODY_SIZE) {
+        req.destroy();
+        throw new Error("Request body too large");
+      }
+      chunks.push(buf);
     }
     const body = Buffer.concat(chunks);
     if (body.byteLength > 0) {