test(rsc-mf): harden manifest fallback URL resolution

Author: cursoragent

tests/integration/rsc-mf/host/server/modern.server.ts

@@ -36,6 +36,14 @@ const toCanonicalChunkName = (filePath: string) =>
     ?.replace(/\.(js|css)$/i, '')
     .replace(EXPOSE_CHUNK_HASH_SUFFIX_PATTERN, '');
 
+const toNormalizedManifestAssetPath = (assetPath: string) => {
+  try {
+    return new URL(assetPath).pathname.replace(/^\/+/, '');
+  } catch {
+    return assetPath.replace(/^[./]+/, '').split(/[?#]/, 1)[0];
+  }
+};
+
 const collectManifestAssetPaths = (manifest: RemoteManifestShape) => {
   const entries = [...(manifest.shared || []), ...(manifest.exposes || [])];
   const assetPaths = new Set<string>();
@@ -74,13 +82,51 @@ const resolveManifestFallbackAssetPath = (
     : 'static/js/async/';
   const manifestAssets = collectManifestAssetPaths(manifest);
   return manifestAssets.find(assetPath => {
-    if (!assetPath.startsWith(requestedAssetDirectory)) {
+    const normalizedAssetPath = toNormalizedManifestAssetPath(assetPath);
+    if (!normalizedAssetPath.startsWith(requestedAssetDirectory)) {
       return false;
     }
-    return toCanonicalChunkName(assetPath) === canonicalRequestedChunkName;
+    return (
+      toCanonicalChunkName(normalizedAssetPath) === canonicalRequestedChunkName
+    );
   });
 };
 
+const createManifestFallbackAssetUrl = ({
+  remoteOrigin,
+  fallbackAssetPath,
+  requestSearch,
+}: {
+  remoteOrigin: string;
+  fallbackAssetPath: string;
+  requestSearch: string;
+}) => {
+  let fallbackAssetUrl: URL;
+  try {
+    fallbackAssetUrl = new URL(fallbackAssetPath, `${remoteOrigin}/`);
+  } catch {
+    return undefined;
+  }
+
+  if (fallbackAssetUrl.origin !== new URL(remoteOrigin).origin) {
+    return undefined;
+  }
+
+  if (!requestSearch) {
+    return fallbackAssetUrl.toString();
+  }
+
+  const mergedSearchParams = new URLSearchParams(fallbackAssetUrl.search);
+  const requestSearchParams = new URLSearchParams(requestSearch);
+  for (const [key, value] of requestSearchParams.entries()) {
+    mergedSearchParams.set(key, value);
+  }
+  const mergedSearch = mergedSearchParams.toString();
+  fallbackAssetUrl.search = mergedSearch ? `?${mergedSearch}` : '';
+
+  return fallbackAssetUrl.toString();
+};
+
 const fetchRemoteManifestFallbackAsset = async ({
   remoteOrigin,
   pathname,
@@ -121,7 +167,14 @@ const fetchRemoteManifestFallbackAsset = async ({
     return undefined;
   }
 
-  const fallbackAssetUrl = `${remoteOrigin}/${fallbackAssetPath}${search}`;
+  const fallbackAssetUrl = createManifestFallbackAssetUrl({
+    remoteOrigin,
+    fallbackAssetPath,
+    requestSearch: search,
+  });
+  if (!fallbackAssetUrl) {
+    return undefined;
+  }
   const fallbackAssetResponse = await fetch(fallbackAssetUrl).catch(
     (): undefined => undefined,
   );

tests/integration/rsc-mf/tests/modernServerConfig.test.ts

@@ -651,6 +651,117 @@ describe('rsc-mf host modern.server middleware contracts', () => {
     await expect(context.res?.text()).resolves.toBe('query-fallback-hit');
   });
 
+  it('supports absolute manifest fallback asset URLs and merges request query params', async () => {
+    const handler = getProxyMiddlewareHandler();
+    const next = jest.fn(async (): Promise<void> => undefined);
+    const fetchMock = installFetchMock(
+      jest
+        .fn()
+        .mockResolvedValueOnce(new Response('not-found', { status: 404 }))
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              exposes: [
+                {
+                  assets: {
+                    js: {
+                      sync: [
+                        'http://127.0.0.1:3999/static/js/async/__federation_expose_RemoteClientCounter.7745fe5f0a.js?manifest=1',
+                      ],
+                      async: [],
+                    },
+                    css: {
+                      sync: [],
+                      async: [],
+                    },
+                  },
+                },
+              ],
+            }),
+            {
+              status: 200,
+              headers: {
+                'content-type': 'application/json',
+              },
+            },
+          ),
+        )
+        .mockResolvedValueOnce(
+          new Response('absolute-query-fallback-hit', {
+            status: 200,
+            headers: {
+              'content-type': 'application/javascript',
+            },
+          }),
+        ),
+    );
+    const context: { req: { url: string }; res?: Response } = {
+      req: {
+        url: 'http://127.0.0.1:3007/static/js/async/__federation_expose_RemoteClientCounter.js?cache=1',
+      },
+    };
+
+    await withRemotePort('3999', () => handler(context, next));
+
+    expect(fetchMock).toHaveBeenNthCalledWith(
+      3,
+      'http://127.0.0.1:3999/static/js/async/__federation_expose_RemoteClientCounter.7745fe5f0a.js?manifest=1&cache=1',
+    );
+    expect(next).not.toHaveBeenCalled();
+    await expect(context.res?.text()).resolves.toBe(
+      'absolute-query-fallback-hit',
+    );
+  });
+
+  it('falls through when manifest fallback asset URL points to another origin', async () => {
+    const handler = getProxyMiddlewareHandler();
+    const next = jest.fn(async (): Promise<void> => undefined);
+    const fetchMock = installFetchMock(
+      jest
+        .fn()
+        .mockResolvedValueOnce(new Response('not-found', { status: 404 }))
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              exposes: [
+                {
+                  assets: {
+                    js: {
+                      sync: [
+                        'https://cdn.example.com/static/js/async/__federation_expose_RemoteClientCounter.7745fe5f0a.js',
+                      ],
+                      async: [],
+                    },
+                    css: {
+                      sync: [],
+                      async: [],
+                    },
+                  },
+                },
+              ],
+            }),
+            {
+              status: 200,
+              headers: {
+                'content-type': 'application/json',
+              },
+            },
+          ),
+        ),
+    );
+    const context: { req: { url: string }; res?: Response } = {
+      req: {
+        url: 'http://127.0.0.1:3007/static/js/async/__federation_expose_RemoteClientCounter.js',
+      },
+    };
+
+    await withRemotePort('3999', () => handler(context, next));
+
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    expect(next).toHaveBeenCalledTimes(1);
+    expect(context.res).toBeUndefined();
+  });
+
   it('matches fallback chunks when manifest hash suffix includes non-hex characters', async () => {
     const handler = getProxyMiddlewareHandler();
     const next = jest.fn(async (): Promise<void> => undefined);