- 
          
- 
                Notifications
    You must be signed in to change notification settings 
- Fork 1.3k
fix: guard against invalid origin header value #5288
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| WalkthroughThe request origin resolution logic in createStartHandler was updated to validate the Origin header as a URL, using a try/catch. If invalid or absent, it now falls back to deriving the origin from the request URL, and finally to a default http://localhost. Changes
 Sequence Diagram(s)sequenceDiagram
  autonumber
  actor Client
  participant Server as Start Handler
  participant Util as getOrigin()
  Client->>Server: Incoming request
  Server->>Util: getOrigin(req)
  alt Origin header present
    Util->>Util: try new URL(Origin)
    alt Valid URL
      Util-->>Server: return Origin
    else Invalid URL (catch)
      Util->>Util: derive from request URL
      alt Derivation succeeds
        Util-->>Server: return derived origin
      else Derivation fails
        Util-->>Server: return "http://localhost"
      end
    end
  else No Origin header
    Util->>Util: derive from request URL
    alt Derivation succeeds
      Util-->>Server: return derived origin
    else Derivation fails
      Util-->>Server: return "http://localhost"
    end
  end
  Server-->>Client: Continue handling with resolved origin
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
 Pre-merge checks and finishing touches❌ Failed checks (1 warning)
 ✅ Passed checks (2 passed)
 ✨ Finishing touches
 🧪 Generate unit tests
 📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
 🧰 Additional context used📓 Path-based instructions (2)**/*.{ts,tsx}📄 CodeRabbit inference engine (AGENTS.md) 
 Files: 
 packages/{*-start,start-*}/**📄 CodeRabbit inference engine (AGENTS.md) 
 Files: 
 ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
 🔇 Additional comments (1)
 Comment  | 
| View your CI Pipeline Execution ↗ for commit 67246e2 
 ☁️ Nx Cloud last updated this comment at  | 
| More templates
 
 @tanstack/arktype-adapter
 @tanstack/directive-functions-plugin
 @tanstack/eslint-plugin-router
 @tanstack/history
 @tanstack/nitro-v2-vite-plugin
 @tanstack/react-router
 @tanstack/react-router-devtools
 @tanstack/react-router-ssr-query
 @tanstack/react-start
 @tanstack/react-start-client
 @tanstack/react-start-server
 @tanstack/router-cli
 @tanstack/router-core
 @tanstack/router-devtools
 @tanstack/router-devtools-core
 @tanstack/router-generator
 @tanstack/router-plugin
 @tanstack/router-ssr-query-core
 @tanstack/router-utils
 @tanstack/router-vite-plugin
 @tanstack/server-functions-plugin
 @tanstack/solid-router
 @tanstack/solid-router-devtools
 @tanstack/solid-start
 @tanstack/solid-start-client
 @tanstack/solid-start-server
 @tanstack/start-client-core
 @tanstack/start-plugin-core
 @tanstack/start-server-core
 @tanstack/start-static-server-functions
 @tanstack/start-storage-context
 @tanstack/valibot-adapter
 @tanstack/virtual-file-routes
 @tanstack/zod-adapter
 commit:  | 
Summary by CodeRabbit