From f5e518716d65def85a9ee6b1dae13335cd7491d3 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 16:51:48 -0600 Subject: [PATCH 01/11] feat: Add `dangerZone` config --- packages/kit/src/core/config/index.spec.js | 3 +++ packages/kit/src/core/config/options.js | 4 ++++ packages/kit/types/index.d.ts | 10 ++++++++++ 3 files changed, 17 insertions(+) diff --git a/packages/kit/src/core/config/index.spec.js b/packages/kit/src/core/config/index.spec.js index 6fc1066b1279..8fbe60c5ae2c 100644 --- a/packages/kit/src/core/config/index.spec.js +++ b/packages/kit/src/core/config/index.spec.js @@ -69,6 +69,9 @@ const get_defaults = (prefix = '') => ({ csrf: { checkOrigin: true }, + dangerZone: { + trackServerFetchesPotentiallyExposingSecrets: false + }, embedded: false, env: { dir: process.cwd(), diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js index e039060cc17c..5a811bd6df59 100644 --- a/packages/kit/src/core/config/options.js +++ b/packages/kit/src/core/config/options.js @@ -111,6 +111,10 @@ const options = object( checkOrigin: boolean(true) }), + dangerZone: object({ + trackServerFetchesPotentiallyExposingSecrets: boolean(false) + }), + embedded: boolean(false), env: object({ diff --git a/packages/kit/types/index.d.ts b/packages/kit/types/index.d.ts index 55c4589ec8a4..d5ae656e9b42 100644 --- a/packages/kit/types/index.d.ts +++ b/packages/kit/types/index.d.ts @@ -340,6 +340,16 @@ export interface KitConfig { */ checkOrigin?: boolean; }; + /** + * Here be dragons. Enable at your peril. + */ + dangerZone?: { + /** + * Automatically add server-side `fetch`ed URLs to the `dependencies` map of `load` functions. This will expose secrets + * to the client if your URL contains them. + */ + trackServerFetchesPotentiallyExposingSecrets?: boolean; + }; /** * Whether or not the app is embedded inside a larger app. If `true`, SvelteKit will add its event listeners related to navigation etc on the parent of `%sveltekit.body%` instead of `window`, and will pass `params` from the server rather than inferring them from `location.pathname`. * @default false From fb1a7c0b97e0db12136b6463e581793074cbee34 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 17:12:34 -0600 Subject: [PATCH 02/11] breaking: Don't implicitly track deps in server-side fetch --- packages/kit/src/core/config/options.js | 1 + packages/kit/src/runtime/server/data/index.js | 4 +++- packages/kit/src/runtime/server/page/index.js | 4 +++- .../kit/src/runtime/server/page/load_data.js | 23 +++++++++++++------ .../runtime/server/page/respond_with_error.js | 4 +++- packages/kit/types/internal.d.ts | 1 + 6 files changed, 27 insertions(+), 10 deletions(-) diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js index 5a811bd6df59..4c97370ab221 100644 --- a/packages/kit/src/core/config/options.js +++ b/packages/kit/src/core/config/options.js @@ -112,6 +112,7 @@ const options = object( }), dangerZone: object({ + // TODO 2.0: Remove this trackServerFetchesPotentiallyExposingSecrets: boolean(false) }), diff --git a/packages/kit/src/runtime/server/data/index.js b/packages/kit/src/runtime/server/data/index.js index 1fbec114a26d..3737fd0e8f22 100644 --- a/packages/kit/src/runtime/server/data/index.js +++ b/packages/kit/src/runtime/server/data/index.js @@ -76,7 +76,9 @@ export async function render_data( } } return data; - } + }, + track_server_fetches_potentially_exposing_secrets: + options.track_server_fetches_potentially_exposing_secrets }); } catch (e) { aborted = true; diff --git a/packages/kit/src/runtime/server/page/index.js b/packages/kit/src/runtime/server/page/index.js index fdf7713be962..3ec744427309 100644 --- a/packages/kit/src/runtime/server/page/index.js +++ b/packages/kit/src/runtime/server/page/index.js @@ -150,7 +150,9 @@ export async function render_page(event, page, options, manifest, state, resolve if (parent) Object.assign(data, await parent.data); } return data; - } + }, + track_server_fetches_potentially_exposing_secrets: + options.track_server_fetches_potentially_exposing_secrets }); } catch (e) { load_error = /** @type {Error} */ (e); diff --git a/packages/kit/src/runtime/server/page/load_data.js b/packages/kit/src/runtime/server/page/load_data.js index 5db45afdc673..2422c0131290 100644 --- a/packages/kit/src/runtime/server/page/load_data.js +++ b/packages/kit/src/runtime/server/page/load_data.js @@ -10,10 +10,18 @@ import { validate_depends } from '../../shared.js'; * state: import('types').SSRState; * node: import('types').SSRNode | undefined; * parent: () => Promise>; + * track_server_fetches_potentially_exposing_secrets: boolean; * }} opts * @returns {Promise} */ -export async function load_server_data({ event, state, node, parent }) { +export async function load_server_data({ + event, + state, + node, + parent, + // TODO 2.0: Remove this + track_server_fetches_potentially_exposing_secrets +}) { if (!node?.server) return null; let done = false; @@ -51,7 +59,10 @@ export async function load_server_data({ event, state, node, parent }) { ); } - uses.dependencies.add(url.href); + // TODO 2.0: Remove this + if (track_server_fetches_potentially_exposing_secrets) { + uses.dependencies.add(url.href); + } return event.fetch(info, init); }, @@ -200,11 +211,9 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts) /** @type {import('types').PrerenderDependency} */ let dependency; - if (same_origin) { - if (state.prerendering) { - dependency = { response, body: null }; - state.prerendering.dependencies.set(url.pathname, dependency); - } + if (same_origin && state.prerendering) { + dependency = { response, body: null }; + state.prerendering.dependencies.set(url.pathname, dependency); } else { // simulate CORS errors and "no access to body in no-cors mode" server-side for consistency with client-side behaviour const mode = input instanceof Request ? input.mode : init?.mode ?? 'cors'; diff --git a/packages/kit/src/runtime/server/page/respond_with_error.js b/packages/kit/src/runtime/server/page/respond_with_error.js index 10607a09d8ad..3d17dc62c6dc 100644 --- a/packages/kit/src/runtime/server/page/respond_with_error.js +++ b/packages/kit/src/runtime/server/page/respond_with_error.js @@ -44,7 +44,9 @@ export async function respond_with_error({ event, state, node: default_layout, - parent: async () => ({}) + parent: async () => ({}), + track_server_fetches_potentially_exposing_secrets: + options.track_server_fetches_potentially_exposing_secrets }); const server_data = await server_data_promise; diff --git a/packages/kit/types/internal.d.ts b/packages/kit/types/internal.d.ts index c2dce68abcd4..9c77b9c88eb4 100644 --- a/packages/kit/types/internal.d.ts +++ b/packages/kit/types/internal.d.ts @@ -333,6 +333,7 @@ export interface SSROptions { app_template_contains_nonce: boolean; csp: ValidatedConfig['kit']['csp']; csrf_check_origin: boolean; + track_server_fetches_potentially_exposing_secrets: boolean; embedded: boolean; env_public_prefix: string; hooks: ServerHooks; From 4a328610432b57dde2785fbd9b87d060feb893e4 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 17:14:57 -0600 Subject: [PATCH 03/11] changeset --- .changeset/shaggy-moons-sort.md | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .changeset/shaggy-moons-sort.md diff --git a/.changeset/shaggy-moons-sort.md b/.changeset/shaggy-moons-sort.md new file mode 100644 index 000000000000..27aa5690bdee --- /dev/null +++ b/.changeset/shaggy-moons-sort.md @@ -0,0 +1,5 @@ +--- +'@sveltejs/kit': minor +--- + +security: Stop implicitly tracking URLs as dependencies in server-side `load`s From 78f3d837e47ad31c2a2d784bffcb1f77b423500f Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 18:09:01 -0600 Subject: [PATCH 04/11] bein dumb --- packages/kit/src/runtime/server/page/load_data.js | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/packages/kit/src/runtime/server/page/load_data.js b/packages/kit/src/runtime/server/page/load_data.js index 2422c0131290..c9b20089b5da 100644 --- a/packages/kit/src/runtime/server/page/load_data.js +++ b/packages/kit/src/runtime/server/page/load_data.js @@ -211,9 +211,11 @@ export function create_universal_fetch(event, state, fetched, csr, resolve_opts) /** @type {import('types').PrerenderDependency} */ let dependency; - if (same_origin && state.prerendering) { - dependency = { response, body: null }; - state.prerendering.dependencies.set(url.pathname, dependency); + if (same_origin) { + if (state.prerendering) { + dependency = { response, body: null }; + state.prerendering.dependencies.set(url.pathname, dependency); + } } else { // simulate CORS errors and "no access to body in no-cors mode" server-side for consistency with client-side behaviour const mode = input instanceof Request ? input.mode : init?.mode ?? 'cors'; From 379109d2d4c7fdd58b3822605060ed0396bfcaa0 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 18:35:35 -0600 Subject: [PATCH 05/11] fix: Server load invalidation --- .../kit/test/apps/basics/test/client.test.js | 5 +++-- .../server-fetch-invalidate/+page.server.js | 5 +++++ .../pages/server-fetch-invalidate/+page.svelte | 5 +++++ .../count.json/+server.js | 9 +++++++++ packages/kit/test/apps/options/svelte.config.js | 3 +++ packages/kit/test/apps/options/test/test.js | 17 +++++++++++++++++ 6 files changed, 42 insertions(+), 2 deletions(-) create mode 100644 packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js create mode 100644 packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte create mode 100644 packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js diff --git a/packages/kit/test/apps/basics/test/client.test.js b/packages/kit/test/apps/basics/test/client.test.js index bf8a748c0668..e33c2cc8b404 100644 --- a/packages/kit/test/apps/basics/test/client.test.js +++ b/packages/kit/test/apps/basics/test/client.test.js @@ -456,14 +456,15 @@ test.describe('Invalidation', () => { expect(shared).not.toBe(next_shared); }); - test('fetch in server load can be invalidated', async ({ page, app, request }) => { + test('fetch in server load cannot be invalidated', async ({ page, app, request }) => { + // TODO 2.0: Can remove this test after `dangerZone.trackServerFetchesPotentiallyExposingSecrets` and associated code is removed await request.get('/load/invalidation/server-fetch/count.json?reset'); await page.goto('/load/invalidation/server-fetch'); const selector = '[data-testid="count"]'; expect(await page.textContent(selector)).toBe('1'); await app.invalidate('/load/invalidation/server-fetch/count.json'); - expect(await page.textContent(selector)).toBe('2'); + expect(await page.textContent(selector)).toBe('1'); }); test('+layout.js is re-run when shared dep is invalidated', async ({ page }) => { diff --git a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js new file mode 100644 index 000000000000..9fe91fcff181 --- /dev/null +++ b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js @@ -0,0 +1,5 @@ +/** @type {import('./$types').PageServerLoad} */ +export async function load({ fetch }) { + const res = await fetch('/load/invalidation/server-fetch/count.json'); + return res.json(); +} diff --git a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte new file mode 100644 index 000000000000..6f25f1b70b45 --- /dev/null +++ b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte @@ -0,0 +1,5 @@ + + +

{data.count}

diff --git a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js new file mode 100644 index 000000000000..11116223e5c8 --- /dev/null +++ b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js @@ -0,0 +1,9 @@ +import { json } from '@sveltejs/kit'; + +let count = 0; + +/** @type {import('./$types').RequestHandler} */ +export function GET({ url }) { + if (url.searchParams.has('reset')) count = 0; + return json({ count: count++ }); +} diff --git a/packages/kit/test/apps/options/svelte.config.js b/packages/kit/test/apps/options/svelte.config.js index 63a9e77106aa..e72baa10f281 100644 --- a/packages/kit/test/apps/options/svelte.config.js +++ b/packages/kit/test/apps/options/svelte.config.js @@ -9,6 +9,9 @@ const config = { 'require-trusted-types-for': ['script'] } }, + dangerZone: { + trackServerFetchesPotentiallyExposingSecrets: true + }, files: { assets: 'public', lib: 'source/components', diff --git a/packages/kit/test/apps/options/test/test.js b/packages/kit/test/apps/options/test/test.js index 295985858f70..0c444120308f 100644 --- a/packages/kit/test/apps/options/test/test.js +++ b/packages/kit/test/apps/options/test/test.js @@ -297,3 +297,20 @@ test.describe('Routing', () => { await expect(page.locator('h2')).toHaveText('target: 0'); }); }); + +test.describe('load', () => { + // TODO 2.0: Remove this test + test('fetch in server load can be invalidated when `dangerZone.trackServerFetchesPotentiallyExposingSecrets` is set', async ({ + page, + app, + request + }) => { + await request.get('/server-fetch-invalidate/count.json?reset'); + await page.goto('/server-fetch-invalidate'); + const selector = '[data-testid="count"]'; + + expect(await page.textContent(selector)).toBe('1'); + await app.invalidate('/server-fetch-invalidate/count.json'); + expect(await page.textContent(selector)).toBe('2'); + }); +}); From d1ba74898e7758f47a64f53d6aa25e3919114cb8 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 19:11:26 -0600 Subject: [PATCH 06/11] fix: Write config for server --- packages/kit/src/core/sync/write_server.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/packages/kit/src/core/sync/write_server.js b/packages/kit/src/core/sync/write_server.js index bf119dcfa7ac..79909d2a3e8f 100644 --- a/packages/kit/src/core/sync/write_server.js +++ b/packages/kit/src/core/sync/write_server.js @@ -34,6 +34,9 @@ export const options = { app_template_contains_nonce: ${template.includes('%sveltekit.nonce%')}, csp: ${s(config.kit.csp)}, csrf_check_origin: ${s(config.kit.csrf.checkOrigin)}, + track_server_fetches_potentially_exposing_secrets: ${s( + config.kit.dangerZone.trackServerFetchesPotentiallyExposingSecrets + )} embedded: ${config.kit.embedded}, env_public_prefix: '${config.kit.env.publicPrefix}', hooks: null, // added lazily, via \`get_hooks\` From 64d2ac8b320b98f24789dca542ae975645a12530 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 19:12:29 -0600 Subject: [PATCH 07/11] fix: test --- .../source/pages/server-fetch-invalidate/+page.server.js | 3 ++- .../source/pages/server-fetch-invalidate/+page.svelte | 1 + .../pages/server-fetch-invalidate/count.json/+server.js | 1 + packages/kit/test/apps/options/test/test.js | 6 +++--- 4 files changed, 7 insertions(+), 4 deletions(-) diff --git a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js index 9fe91fcff181..fc6a5abe8eac 100644 --- a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js +++ b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.server.js @@ -1,5 +1,6 @@ +// TODO 2.0: Delete /** @type {import('./$types').PageServerLoad} */ export async function load({ fetch }) { - const res = await fetch('/load/invalidation/server-fetch/count.json'); + const res = await fetch('/path-base/server-fetch-invalidate/count.json'); return res.json(); } diff --git a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte index 6f25f1b70b45..3cadb6924412 100644 --- a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte +++ b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/+page.svelte @@ -1,4 +1,5 @@ diff --git a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js index 11116223e5c8..443894c3dcf5 100644 --- a/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js +++ b/packages/kit/test/apps/options/source/pages/server-fetch-invalidate/count.json/+server.js @@ -1,3 +1,4 @@ +// TODO 2.0: Delete import { json } from '@sveltejs/kit'; let count = 0; diff --git a/packages/kit/test/apps/options/test/test.js b/packages/kit/test/apps/options/test/test.js index 0c444120308f..4291f8ba7e99 100644 --- a/packages/kit/test/apps/options/test/test.js +++ b/packages/kit/test/apps/options/test/test.js @@ -305,12 +305,12 @@ test.describe('load', () => { app, request }) => { - await request.get('/server-fetch-invalidate/count.json?reset'); - await page.goto('/server-fetch-invalidate'); + await request.get('/path-base/server-fetch-invalidate/count.json?reset'); + await page.goto('/path-base/server-fetch-invalidate'); const selector = '[data-testid="count"]'; expect(await page.textContent(selector)).toBe('1'); - await app.invalidate('/server-fetch-invalidate/count.json'); + await app.invalidate('/path-base/server-fetch-invalidate/count.json'); expect(await page.textContent(selector)).toBe('2'); }); }); From da7ea3d660297faf6e24218dd085bf9b79aca4cc Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 19:29:38 -0600 Subject: [PATCH 08/11] unsurprisingly i am dumb --- packages/kit/src/core/sync/write_server.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/kit/src/core/sync/write_server.js b/packages/kit/src/core/sync/write_server.js index 79909d2a3e8f..9927a78d6cb1 100644 --- a/packages/kit/src/core/sync/write_server.js +++ b/packages/kit/src/core/sync/write_server.js @@ -36,7 +36,7 @@ export const options = { csrf_check_origin: ${s(config.kit.csrf.checkOrigin)}, track_server_fetches_potentially_exposing_secrets: ${s( config.kit.dangerZone.trackServerFetchesPotentiallyExposingSecrets - )} + )}, embedded: ${config.kit.embedded}, env_public_prefix: '${config.kit.env.publicPrefix}', hooks: null, // added lazily, via \`get_hooks\` From 6ceb241e160816d7a989de8116055bc271dd9310 Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 19:44:10 -0600 Subject: [PATCH 09/11] docs: Clarify difference between server `fetch` and universal `fetch` --- documentation/docs/20-core-concepts/20-load.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/documentation/docs/20-core-concepts/20-load.md b/documentation/docs/20-core-concepts/20-load.md index 7a332ae07471..46dd991f7c85 100644 --- a/documentation/docs/20-core-concepts/20-load.md +++ b/documentation/docs/20-core-concepts/20-load.md @@ -537,7 +537,7 @@ Dependency tracking does not apply _after_ the `load` function has returned — ### Manual invalidation -You can also re-run `load` functions that apply to the current page using [`invalidate(url)`](modules#$app-navigation-invalidate), which re-runs all `load` functions that depend on `url`, and [`invalidateAll()`](modules#$app-navigation-invalidateall), which re-runs every `load` function. +You can also re-run `load` functions that apply to the current page using [`invalidate(url)`](modules#$app-navigation-invalidate), which re-runs all `load` functions that depend on `url`, and [`invalidateAll()`](modules#$app-navigation-invalidateall), which re-runs every `load` function. Server load functions will never automatically depend on a fetched `url` to avoid leaking secrets to the client. A `load` function depends on `url` if it calls `fetch(url)` or `depends(url)`. Note that `url` can be a custom identifier that starts with `[a-z]:`: @@ -585,7 +585,7 @@ To summarize, a `load` function will re-run in the following situations: - It references a property of `params` whose value has changed - It references a property of `url` (such as `url.pathname` or `url.search`) whose value has changed. Properties in `request.url` are _not_ tracked - It calls `await parent()` and a parent `load` function re-ran -- It declared a dependency on a specific URL via [`fetch`](#making-fetch-requests) or [`depends`](types#public-types-loadevent), and that URL was marked invalid with [`invalidate(url)`](modules#$app-navigation-invalidate) +- It declared a dependency on a specific URL via [`fetch`](#making-fetch-requests) (universal load only) or [`depends`](types#public-types-loadevent), and that URL was marked invalid with [`invalidate(url)`](modules#$app-navigation-invalidate) - All active `load` functions were forcibly re-run with [`invalidateAll()`](modules#$app-navigation-invalidateall) `params` and `url` can change in response to a `` link click, a [`
` interaction](form-actions#get-vs-post), a [`goto`](modules#$app-navigation-goto) invocation, or a [`redirect`](modules#sveltejs-kit-redirect). From 49a6d8129872375152fac6173a536ba60fbcee6f Mon Sep 17 00:00:00 2001 From: "S. Elliott Johnson" Date: Tue, 16 May 2023 21:03:31 -0600 Subject: [PATCH 10/11] tests --- packages/kit/test/apps/options/test/test.js | 4 +++- packages/kit/test/prerendering/basics/test/tests.spec.js | 4 +--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/kit/test/apps/options/test/test.js b/packages/kit/test/apps/options/test/test.js index 4291f8ba7e99..c17e63ffee13 100644 --- a/packages/kit/test/apps/options/test/test.js +++ b/packages/kit/test/apps/options/test/test.js @@ -303,8 +303,10 @@ test.describe('load', () => { test('fetch in server load can be invalidated when `dangerZone.trackServerFetchesPotentiallyExposingSecrets` is set', async ({ page, app, - request + request, + javaScriptEnabled }) => { + test.skip(!javaScriptEnabled, 'JavaScript is disabled'); await request.get('/path-base/server-fetch-invalidate/count.json?reset'); await page.goto('/path-base/server-fetch-invalidate'); const selector = '[data-testid="count"]'; diff --git a/packages/kit/test/prerendering/basics/test/tests.spec.js b/packages/kit/test/prerendering/basics/test/tests.spec.js index 7a63454c6429..433be62c5b24 100644 --- a/packages/kit/test/prerendering/basics/test/tests.spec.js +++ b/packages/kit/test/prerendering/basics/test/tests.spec.js @@ -170,9 +170,7 @@ test('fetches data from local endpoint', () => { { type: 'data', data: [{ message: 1 }, 'hello'], - uses: { - dependencies: ['http://example.com/origin/message.json'] - } + uses: {} } ] }); From 487aa224add7786d16c080d21e0584ad33826822 Mon Sep 17 00:00:00 2001 From: Rich Harris Date: Wed, 17 May 2023 14:44:20 -0400 Subject: [PATCH 11/11] rename to trackServerFetches --- packages/kit/src/core/config/index.spec.js | 2 +- packages/kit/src/core/config/options.js | 2 +- packages/kit/src/core/sync/write_server.js | 4 +--- packages/kit/src/runtime/server/data/index.js | 3 +-- packages/kit/src/runtime/server/page/index.js | 3 +-- packages/kit/src/runtime/server/page/load_data.js | 6 +++--- packages/kit/src/runtime/server/page/respond_with_error.js | 3 +-- packages/kit/test/apps/basics/test/client.test.js | 2 +- packages/kit/test/apps/options/svelte.config.js | 2 +- packages/kit/test/apps/options/test/test.js | 2 +- packages/kit/types/index.d.ts | 2 +- packages/kit/types/internal.d.ts | 2 +- 12 files changed, 14 insertions(+), 19 deletions(-) diff --git a/packages/kit/src/core/config/index.spec.js b/packages/kit/src/core/config/index.spec.js index 8fbe60c5ae2c..3388f149b7df 100644 --- a/packages/kit/src/core/config/index.spec.js +++ b/packages/kit/src/core/config/index.spec.js @@ -70,7 +70,7 @@ const get_defaults = (prefix = '') => ({ checkOrigin: true }, dangerZone: { - trackServerFetchesPotentiallyExposingSecrets: false + trackServerFetches: false }, embedded: false, env: { diff --git a/packages/kit/src/core/config/options.js b/packages/kit/src/core/config/options.js index 4c97370ab221..3a6c862267bd 100644 --- a/packages/kit/src/core/config/options.js +++ b/packages/kit/src/core/config/options.js @@ -113,7 +113,7 @@ const options = object( dangerZone: object({ // TODO 2.0: Remove this - trackServerFetchesPotentiallyExposingSecrets: boolean(false) + trackServerFetches: boolean(false) }), embedded: boolean(false), diff --git a/packages/kit/src/core/sync/write_server.js b/packages/kit/src/core/sync/write_server.js index 9927a78d6cb1..647aa5924237 100644 --- a/packages/kit/src/core/sync/write_server.js +++ b/packages/kit/src/core/sync/write_server.js @@ -34,9 +34,7 @@ export const options = { app_template_contains_nonce: ${template.includes('%sveltekit.nonce%')}, csp: ${s(config.kit.csp)}, csrf_check_origin: ${s(config.kit.csrf.checkOrigin)}, - track_server_fetches_potentially_exposing_secrets: ${s( - config.kit.dangerZone.trackServerFetchesPotentiallyExposingSecrets - )}, + track_server_fetches: ${s(config.kit.dangerZone.trackServerFetches)}, embedded: ${config.kit.embedded}, env_public_prefix: '${config.kit.env.publicPrefix}', hooks: null, // added lazily, via \`get_hooks\` diff --git a/packages/kit/src/runtime/server/data/index.js b/packages/kit/src/runtime/server/data/index.js index 3737fd0e8f22..8d38b1e10720 100644 --- a/packages/kit/src/runtime/server/data/index.js +++ b/packages/kit/src/runtime/server/data/index.js @@ -77,8 +77,7 @@ export async function render_data( } return data; }, - track_server_fetches_potentially_exposing_secrets: - options.track_server_fetches_potentially_exposing_secrets + track_server_fetches: options.track_server_fetches }); } catch (e) { aborted = true; diff --git a/packages/kit/src/runtime/server/page/index.js b/packages/kit/src/runtime/server/page/index.js index 3ec744427309..b7009a27b9fe 100644 --- a/packages/kit/src/runtime/server/page/index.js +++ b/packages/kit/src/runtime/server/page/index.js @@ -151,8 +151,7 @@ export async function render_page(event, page, options, manifest, state, resolve } return data; }, - track_server_fetches_potentially_exposing_secrets: - options.track_server_fetches_potentially_exposing_secrets + track_server_fetches: options.track_server_fetches }); } catch (e) { load_error = /** @type {Error} */ (e); diff --git a/packages/kit/src/runtime/server/page/load_data.js b/packages/kit/src/runtime/server/page/load_data.js index c9b20089b5da..ced84ab9918c 100644 --- a/packages/kit/src/runtime/server/page/load_data.js +++ b/packages/kit/src/runtime/server/page/load_data.js @@ -10,7 +10,7 @@ import { validate_depends } from '../../shared.js'; * state: import('types').SSRState; * node: import('types').SSRNode | undefined; * parent: () => Promise>; - * track_server_fetches_potentially_exposing_secrets: boolean; + * track_server_fetches: boolean; * }} opts * @returns {Promise} */ @@ -20,7 +20,7 @@ export async function load_server_data({ node, parent, // TODO 2.0: Remove this - track_server_fetches_potentially_exposing_secrets + track_server_fetches }) { if (!node?.server) return null; @@ -60,7 +60,7 @@ export async function load_server_data({ } // TODO 2.0: Remove this - if (track_server_fetches_potentially_exposing_secrets) { + if (track_server_fetches) { uses.dependencies.add(url.href); } diff --git a/packages/kit/src/runtime/server/page/respond_with_error.js b/packages/kit/src/runtime/server/page/respond_with_error.js index 3d17dc62c6dc..2567b7e768e8 100644 --- a/packages/kit/src/runtime/server/page/respond_with_error.js +++ b/packages/kit/src/runtime/server/page/respond_with_error.js @@ -45,8 +45,7 @@ export async function respond_with_error({ state, node: default_layout, parent: async () => ({}), - track_server_fetches_potentially_exposing_secrets: - options.track_server_fetches_potentially_exposing_secrets + track_server_fetches: options.track_server_fetches }); const server_data = await server_data_promise; diff --git a/packages/kit/test/apps/basics/test/client.test.js b/packages/kit/test/apps/basics/test/client.test.js index e33c2cc8b404..b95076c4520e 100644 --- a/packages/kit/test/apps/basics/test/client.test.js +++ b/packages/kit/test/apps/basics/test/client.test.js @@ -457,7 +457,7 @@ test.describe('Invalidation', () => { }); test('fetch in server load cannot be invalidated', async ({ page, app, request }) => { - // TODO 2.0: Can remove this test after `dangerZone.trackServerFetchesPotentiallyExposingSecrets` and associated code is removed + // TODO 2.0: Can remove this test after `dangerZone.trackServerFetches` and associated code is removed await request.get('/load/invalidation/server-fetch/count.json?reset'); await page.goto('/load/invalidation/server-fetch'); const selector = '[data-testid="count"]'; diff --git a/packages/kit/test/apps/options/svelte.config.js b/packages/kit/test/apps/options/svelte.config.js index e72baa10f281..ce787f38d5e9 100644 --- a/packages/kit/test/apps/options/svelte.config.js +++ b/packages/kit/test/apps/options/svelte.config.js @@ -10,7 +10,7 @@ const config = { } }, dangerZone: { - trackServerFetchesPotentiallyExposingSecrets: true + trackServerFetches: true }, files: { assets: 'public', diff --git a/packages/kit/test/apps/options/test/test.js b/packages/kit/test/apps/options/test/test.js index c17e63ffee13..43277cade6bc 100644 --- a/packages/kit/test/apps/options/test/test.js +++ b/packages/kit/test/apps/options/test/test.js @@ -300,7 +300,7 @@ test.describe('Routing', () => { test.describe('load', () => { // TODO 2.0: Remove this test - test('fetch in server load can be invalidated when `dangerZone.trackServerFetchesPotentiallyExposingSecrets` is set', async ({ + test('fetch in server load can be invalidated when `dangerZone.trackServerFetches` is set', async ({ page, app, request, diff --git a/packages/kit/types/index.d.ts b/packages/kit/types/index.d.ts index d5ae656e9b42..7d541a4377f3 100644 --- a/packages/kit/types/index.d.ts +++ b/packages/kit/types/index.d.ts @@ -348,7 +348,7 @@ export interface KitConfig { * Automatically add server-side `fetch`ed URLs to the `dependencies` map of `load` functions. This will expose secrets * to the client if your URL contains them. */ - trackServerFetchesPotentiallyExposingSecrets?: boolean; + trackServerFetches?: boolean; }; /** * Whether or not the app is embedded inside a larger app. If `true`, SvelteKit will add its event listeners related to navigation etc on the parent of `%sveltekit.body%` instead of `window`, and will pass `params` from the server rather than inferring them from `location.pathname`. diff --git a/packages/kit/types/internal.d.ts b/packages/kit/types/internal.d.ts index 9c77b9c88eb4..379328678073 100644 --- a/packages/kit/types/internal.d.ts +++ b/packages/kit/types/internal.d.ts @@ -333,7 +333,7 @@ export interface SSROptions { app_template_contains_nonce: boolean; csp: ValidatedConfig['kit']['csp']; csrf_check_origin: boolean; - track_server_fetches_potentially_exposing_secrets: boolean; + track_server_fetches: boolean; embedded: boolean; env_public_prefix: string; hooks: ServerHooks;