hydrogen icon indicating copy to clipboard operation
hydrogen copied to clipboard

[BUG] Node server ungracefully crashes when given unparsable json for the state (e.g. http://localhost:3000/__rsc?state=invalid{state)

Open nattyg93 opened this issue 3 years ago • 3 comments

Describe the bug When a server request contains a query param which contains a single double quote ("), the server will crash with a JSON parse error.

Edit: As mentioned in https://github.com/Shopify/hydrogen/issues/1863#issuecomment-1201993074 any invalid state given to the __rsc endpoint will cause the node server to ungracefully crash.

To Reproduce Clone and run the following repo: https://github.com/nattyg93/hydrogen-bug-search-param-quote

  1. Run the server
  2. Load the homepage
  3. Click the "Bug Out - step 1" button
  4. If the server hasn't already crashed at this point - click "Bug Out - step 2" (And then click "Bug Out - step 1" again, but it will have crashed by now)

Additional context

  • Hydrogen version: 1.1.0
  • Node version: 16.14.0

nattyg93 avatar Jul 19 '22 04:07 nattyg93

I've tested with Hydrogen 1.2.0 and this issue is still present.

We're keen to upgrade Hydrogen to benefit from #1830, which is currently doubling the load time of navigating between some of our routes.

nattyg93 avatar Aug 01 '22 04:08 nattyg93

@frandiox This looks like it was introduced in #1780

nattyg93 avatar Aug 02 '22 03:08 nattyg93

Further to this, any invalid json in the state param will cause the node server to ungracefully crash. For example, if you visit http://localhost:3000/__rsc?state=invalid{state the node server will crash.

nattyg93 avatar Aug 02 '22 04:08 nattyg93