Skip to content

Harden astro-island export resolution#16422

Merged
matthewp merged 1 commit intomainfrom
semgrep-astro-island-hardening
Apr 21, 2026
Merged

Harden astro-island export resolution#16422
matthewp merged 1 commit intomainfrom
semgrep-astro-island-hardening

Conversation

@matthewp
Copy link
Copy Markdown
Contributor

Changes

  • Validates dot-separated component-export paths inside astro-island and rejects unsafe property names before traversing module exports.
  • Keeps the hydration runtime behavior the same otherwise, and regenerates the prebuilt island script from the updated source.

Testing

  • Installed dependencies in a fresh worktree to validate the split branch in isolation.
  • Ran Biome on the touched files and reran the packages/astro prebuild to verify the updated astro-island source still compiles to the prebuilt runtime.

Docs

  • No docs update needed, because this only hardens an internal runtime path.

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 20, 2026

🦋 Changeset detected

Latest commit: 73c1e87

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@codspeed-hq
Copy link
Copy Markdown

codspeed-hq Bot commented Apr 20, 2026

Merging this PR will not alter performance

✅ 18 untouched benchmarks


Comparing semgrep-astro-island-hardening (73c1e87) with main (a002540)1

Open in CodSpeed

Footnotes

  1. No successful run was found on main (32b361d) during the generation of this report, so a002540 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report.

@github-actions github-actions Bot added the pkg: astro Related to the core `astro` package (scope) label Apr 20, 2026
Copy link
Copy Markdown
Member

@ematipico ematipico left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would like to see some tests for this change

@matthewp matthewp merged commit a3951d7 into main Apr 21, 2026
44 of 45 checks passed
@matthewp matthewp deleted the semgrep-astro-island-hardening branch April 21, 2026 17:55
@astrobot-houston astrobot-houston mentioned this pull request Apr 21, 2026
dadezzz pushed a commit to dadezzz/university_notes that referenced this pull request Apr 26, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [astro](https://astro.build) ([source](https://github.com/withastro/astro/tree/HEAD/packages/astro)) | [`6.1.8` → `6.1.9`](https://renovatebot.com/diffs/npm/astro/6.1.8/6.1.9) | ![age](https://developer.mend.io/api/mc/badges/age/npm/astro/6.1.9?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/astro/6.1.8/6.1.9?slim=true) |

---

### Release Notes

<details>
<summary>withastro/astro (astro)</summary>

### [`v6.1.9`](https://github.com/withastro/astro/blob/HEAD/packages/astro/CHANGELOG.md#619)

[Compare Source](https://github.com/withastro/astro/compare/[email protected]@6.1.9)

##### Patch Changes

- [#&#8203;16448](withastro/astro#16448) [`99464ed`](withastro/astro@99464ed) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Updates vite, picomatch, and unstorage to latest patch versions

- [#&#8203;16422](withastro/astro#16422) [`a3951d7`](withastro/astro@a3951d7) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens `astro-island` export resolution and hydration error handling for malformed component metadata

- [#&#8203;16420](withastro/astro#16420) [`e21de1d`](withastro/astro@e21de1d) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens Astro's error overlay and server logging paths to avoid unsafe HTML insertion and format-string interpolation

- [#&#8203;16419](withastro/astro#16419) [`f3485c3`](withastro/astro@f3485c3) Thanks [@&#8203;matthewp](https://github.com/matthewp)! - Hardens nested object and package metadata lookups to ignore prototype keys in content handling and project scaffolding

- [#&#8203;16022](withastro/astro#16022) [`a002540`](withastro/astro@a002540) Thanks [@&#8203;mathieumaf](https://github.com/mathieumaf)! - Fixes an issue where i18n domains would return 404 when `trailingSlash` is set to `never`.

- Updated dependencies \[[`99464ed`](withastro/astro@99464ed), [`f3485c3`](withastro/astro@f3485c3)]:
  - [@&#8203;astrojs/internal-helpers](https://github.com/astrojs/internal-helpers)@&#8203;0.9.0
  - [@&#8203;astrojs/markdown-remark](https://github.com/astrojs/markdown-remark)@&#8203;7.1.1

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMzIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEzMi4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants