fix(rsc-mf): guard fallback helper against invalid origins

Author: cursoragent

tests/integration/rsc-mf/shared/manifestFallback.ts

@@ -103,14 +103,21 @@ export const createManifestFallbackAssetUrl = ({
   requestedAssetDirectory: string;
   requestUrl?: string;
 }) => {
+  let remoteOriginUrl: URL;
+  try {
+    remoteOriginUrl = new URL(remoteOrigin);
+  } catch {
+    return undefined;
+  }
+
   let fallbackAssetUrl: URL;
   try {
-    fallbackAssetUrl = new URL(fallbackAssetPath, `${remoteOrigin}/`);
+    fallbackAssetUrl = new URL(fallbackAssetPath, `${remoteOriginUrl.origin}/`);
   } catch {
     return undefined;
   }
 
-  if (fallbackAssetUrl.origin !== new URL(remoteOrigin).origin) {
+  if (fallbackAssetUrl.origin !== remoteOriginUrl.origin) {
     return undefined;
   }
   const normalizedFallbackPathname = fallbackAssetUrl.pathname.replace(

tests/integration/rsc-mf/tests/manifestFallback.test.ts

@@ -139,6 +139,15 @@ describe('manifest fallback shared helpers', () => {
   });
 
   it('rejects unsafe fallback URLs', () => {
+    expect(
+      createManifestFallbackAssetUrl({
+        remoteOrigin: 'not-a-valid-origin',
+        fallbackAssetPath:
+          'static/js/async/__federation_expose_RemoteClientCounter.7745fe5f0a.js',
+        requestSearch: '',
+        requestedAssetDirectory: 'static/js/async/',
+      }),
+    ).toBeUndefined();
     expect(
       createManifestFallbackAssetUrl({
         remoteOrigin: 'http://127.0.0.1:3999',