Information disclosure

PoC (conceptual, local setup required): 1) Start a Next.js app using the app directory with a route structure like /[teamSlug]/[projectSlug]. 2) Trigger router prefetch for an encoded child segment (before fix this might leak the placeholder): curl -s http://localhost:3000/vercel/%5BprojectSlug%5D -H "next-router-segment-prefetch: 1" | head 3) Observe the response body or any prefetch-related payload containing the encoded placeholder (e.g., %5BprojectSlug%5D or [projectSlug]). This demonstrates leakage prior to normalization. After applying the fix, the encoded placeholder should be treated as a dynamic parameter, and the prefetch payload should no longer expose the placeholder name. A minimal Node.js PoC you can run against a local server: const fetch = require('node-fetch'); (async () => { const res = await fetch('http://localhost:3000/vercel/%5BprojectSlug%5D', { headers: { 'next-router-segment-prefetch': '1' } }) const text = await res.text() console.log(text) })() Alternatively, a curl version: curl -s http://localhost:3000/vercel/%5BprojectSlug%5D -H "next-router-segment-prefetch: 1"

diff --git a/packages/next/src/server/request/fallback-params.test.ts b/packages/next/src/server/request/fallback-params.test.ts index 9b1187be02cd4..ee4117367fabe 100644 --- a/packages/next/src/server/request/fallback-params.test.ts +++ b/packages/next/src/server/request/fallback-params.test.ts @@ -190,6 +190,24 @@ describe('getFallbackRouteParams', () => { expect(result!.has('projectSlug')).toBe(true) expect(result!.has('teamSlug')).toBe(false) }) + + it('should treat encoded placeholders as dynamic segments', () => { + // Tree: /[teamSlug]/[projectSlug] but page is /vercel/%5BprojectSlug%5D + const loaderTree = createLoaderTree( + '', + {}, + createLoaderTree('[teamSlug]', {}, createLoaderTree('[projectSlug]')) + ) + const routeModule = createMockRouteModule(loaderTree) + const result = getFallbackRouteParams( + '/vercel/%5BprojectSlug%5D', + routeModule + ) + + expect(result).not.toBeNull() + expect(result!.has('projectSlug')).toBe(true) + expect(result!.has('teamSlug')).toBe(false) + }) }) describe('Route Groups', () => { diff --git a/packages/next/src/shared/lib/router/routes/app.ts b/packages/next/src/shared/lib/router/routes/app.ts index 0112713fa0fed..fba29a29041b8 100644 --- a/packages/next/src/shared/lib/router/routes/app.ts +++ b/packages/next/src/shared/lib/router/routes/app.ts @@ -60,6 +60,19 @@ export type NormalizedAppRouteSegment = | StaticAppRouteSegment | DynamicAppRouteSegment +function normalizeEncodedDynamicPlaceholder(segment: string): string { + if (!/%5b|%5d/i.test(segment)) { + return segment + } + + try { + const decodedSegment = decodeURIComponent(segment) + return getSegmentParam(decodedSegment) ? decodedSegment : segment + } catch { + return segment + } +} + export function parseAppRouteSegment(segment: string): AppRouteSegment | null { if (segment === '') { return null @@ -180,8 +193,10 @@ export function parseAppRoute( let interceptedRoute: AppRoute | NormalizedAppRoute | undefined for (const segment of pathnameSegments) { + const normalizedSegment = normalizeEncodedDynamicPlaceholder(segment) + // Parse the segment into an AppSegment. - const appSegment = parseAppRouteSegment(segment) + const appSegment = parseAppRouteSegment(normalizedSegment) if (!appSegment) { continue } diff --git a/test/e2e/app-dir/segment-cache/vary-params/root-params-segment-prefetch.test.ts b/test/e2e/app-dir/segment-cache/vary-params/root-params-segment-prefetch.test.ts new file mode 100644 index 0000000000000..1826252faa96b --- /dev/null +++ b/test/e2e/app-dir/segment-cache/vary-params/root-params-segment-prefetch.test.ts @@ -0,0 +1,61 @@ +import { nextTestSetup } from 'e2e-utils' +import type * as Playwright from 'playwright' +import { createRouterAct } from 'router-act' + +describe('segment cache - root params segment prefetch', () => { + const { next, isNextDev } = nextTestSetup({ + files: __dirname, + }) + + if (isNextDev) { + test('prefetching is disabled in dev mode', () => {}) + return + } + + it('does not encode root param placeholders in segment-prefetch responses', async () => { + let act: ReturnType<typeof createRouterAct> + const segmentPrefetchBodies: Array<Promise<string>> = [] + const browser = await next.browser('/root-params', { + beforePageLoad(p: Playwright.Page) { + act = createRouterAct(p) + p.on('response', (response) => { + const request = response.request() + if (request.headers()['next-router-segment-prefetch']) { + segmentPrefetchBodies.push(response.text().catch(() => '')) + } + }) + }, + }) + + await act( + async () => { + const toggle = await browser.elementByCss( + 'input[data-link-accordion="/aaa"]' + ) + await toggle.click() + }, + { includes: 'Root param page content - param: aaa' } + ) + + await act( + async () => { + const toggle = await browser.elementByCss( + 'input[data-link-accordion="/bbb"]' + ) + await toggle.click() + }, + { includes: 'Root param page content - param: bbb' } + ) + + const settledSegmentPrefetchBodies = await Promise.all( + segmentPrefetchBodies + ) + + expect(settledSegmentPrefetchBodies.length).toBeGreaterThan(0) + expect( + settledSegmentPrefetchBodies.some((body) => + body.includes('%5BrootParam%5D') + ) + ).toBe(false) + }) +})