Merge pull request #163 from JoviDeCroock/codex/propose-fix-for-node-isg-vulnerability

Author: JoviDeCroock

.changeset/fair-mails-jump.md

@@ -0,0 +1,5 @@
+---
+"@pracht/adapter-node": patch
+---
+
+Harden ISG stale background regeneration so it no longer reuses request context that can carry per-user data into shared cached HTML.

docs/ADAPTERS.md

@@ -145,7 +145,8 @@ that manifest.
   pages and writes updated HTML to disk. Route-state requests (`x-pracht-route-state-request`
   and `?_data=1`) bypass the cached HTML path so client navigation still reaches
   `handlePrachtRequest()`. Background regeneration uses a clean HTML request
-  instead of replaying the triggering user's cookies/authorization headers.
+  instead of replaying the triggering user's cookies/authorization headers, and
+  skips app `createContext()` to avoid per-request context in shared ISG output.
   Static and ISG files are streamed, and static responses support `ETag` /
   `Last-Modified` conditional revalidation.
 - **Vite manifest**: reads `.vite/manifest.json` to inject correct `<script>` and

packages/adapter-node/src/node-handler.ts

@@ -264,9 +264,11 @@ async function serveISGEntry<TContext>(
   }
 
   if (isStale) {
-    regenerateISGPage(options, pathname, htmlPath, contextArgs).catch((err) => {
-      console.error(`ISG regeneration failed for ${pathname}:`, err);
-    });
+    regenerateISGPage(options, pathname, htmlPath, { request: contextArgs.request }).catch(
+      (err) => {
+        console.error(`ISG regeneration failed for ${pathname}:`, err);
+      },
+    );
   }
 
   return true;

packages/adapter-node/src/node-isg.ts

@@ -3,21 +3,21 @@ import { dirname } from "node:path";
 import { handlePrachtRequest } from "@pracht/core/server";
 import type { NodeAdapterContextArgs, NodeAdapterOptions } from "./node-handler.ts";
 
+export interface ISGRegenerationContextArgs {
+  request?: NodeAdapterContextArgs["request"];
+}
+
 export async function regenerateISGPage<TContext>(
   options: NodeAdapterOptions<TContext>,
   pathname: string,
   htmlPath: string,
-  contextArgs?: NodeAdapterContextArgs,
+  contextArgs?: ISGRegenerationContextArgs,
 ): Promise<void> {
   const request = createISGRegenerationRequest(pathname, contextArgs?.request);
-  const context =
-    options.createContext && contextArgs
-      ? await options.createContext({ ...contextArgs, request })
-      : undefined;
 
   const response = await handlePrachtRequest({
     app: options.app,
-    context,
+    context: undefined,
     registry: options.registry,
     request,
     clientEntryUrl: options.clientEntryUrl,

packages/adapter-node/test/index.test.ts

@@ -190,7 +190,7 @@ describe("createNodeRequestHandler", () => {
     ]);
   });
 
-  it("reuses createContext during stale ISG regeneration with a clean request", async () => {
+  it("does not reuse createContext during stale ISG regeneration", async () => {
     const staticDir = makeTempDir();
     const htmlDir = join(staticDir, "isg");
     const htmlPath = join(htmlDir, "index.html");
@@ -252,7 +252,7 @@ describe("createNodeRequestHandler", () => {
 
     await waitFor(() => readFileSync(htmlPath, "utf-8").includes("missing"));
 
-    expect(createContextCalls).toEqual(["missing"]);
+    expect(createContextCalls).toEqual([]);
     expect(readFileSync(htmlPath, "utf-8")).toContain("missing");
   });
 });