Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Catch-all route chunks are named `_...404_-<hash>.js`; the `..` trips path-traversal guards and breaks the lazy preload

Ouverte
  • Quelque chose ne va pas ?
#391 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

@everton-dgn y travaille déjà.

Depuis le 3/10/2026.

  • #393 par @everton-dgn — ouverte

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
68/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
typescript, vite
Domaine
build-system, tooling

Piste de recherche

Start by reading the client-build configuration in src/index.ts (config and configEnvironment) and src/ssr/index.ts. Reproduce with the linked solid-v2/fullstack example and inspect the production chunk name for [...404].tsx. Done means client route chunk names no longer contain path-traversal-like dot runs, while a user-supplied sanitizeFileName is preserved.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Summary

A catch-all route file such as [...404].tsx builds to a client chunk named _...404_-<hash>.js. Any server, static host, CDN or WAF whose path-traversal guard rejects URLs containing .. refuses that chunk. The lazy route's module preload then fails, and hydration of that route breaks:

  • Without a <Loading> boundary: the document-root fallback dies with Hydration Mismatch, and the page is dead.
  • With one: the boundary re-imports the chunk, fails again, and the root is replaced by the entry's error UI.

Every [...rest] route is affected, deterministically, in production.

This was split out of solidjs/solid#3338, where it came up as a second, deterministic cause of the reporter's dead-page symptom.

Reproduction

From the reproduction on solidjs/solid#3338: the solid-v2/fullstack template (solid-js / @solidjs/web 2.0.0-rc.6, @solidjs/router 2.0.0-next.21, @solidjs/vite-plugin 3.0.0-next.39), with the fileRoutes() catch-all [...404].tsx, as a production build served by the template's server.js:

$ curl -i http://localhost:3000/assets/_...404_-BW0HgTxD.js
HTTP/1.1 404 Not Found
content-type: text/html; charset=utf-8

The template's server.js refuses any URL containing .., so the chunk request falls through to SSR and comes back as the 404 HTML page. The guard is being fixed in the template separately (resolved-path containment instead of a substring check). But substring .. checks are common in hosts and middleware the plugin doesn't control, so the chunk name itself shouldn't contain ...

For reference, the plugin's own start.node server (src/node-entry/index.ts, staticFile) only rejects path segments that start with ., so it serves this file. The failure shows up behind other guards.

Expected behavior

Client chunk file names emitted for route modules never contain .. (or other dot runs that read as path traversal). For example, [...404].tsx → _404_-<hash>.js or 404-<hash>.js. Hashing keeps the names unique.

Where it likely lives

The plugin doesn't set chunkFileNames or sanitizeFileName for the client build, so the chunk name is the bundler default ([name]-[hash].js). [name] comes from the facade module's file name. As observed above, the default naming turns [...404] into _...404_: the brackets are replaced and the dots are kept. A fix would be a client-build output.sanitizeFileName (or a chunkFileNames function) that collapses dot runs. It belongs where the plugin configures the client environment's build: the config / configEnvironment hooks in src/index.ts, and the Start client build config in src/ssr/index.ts. It should compose with a user-supplied sanitizeFileName rather than overwrite it.

Filed on behalf of @ryansolid. — Claude via Cursor

Langage dominant
TypeScript
Étoiles
522
Forks
72
Merge moyen
20 h 1 min
PR mergées (30 j)
31

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de solidjs/solid-vite-plugin

Toutes les issues de solidjs/solid-vite-plugin

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.