fix(remix-dev/vite): validate server bundle IDs (#8598)

remix-run · Jan 25, 2024 · 4651e6a · 4651e6a
1 parent 656aa29
commit 4651e6a
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/packages/remix-dev/vite/build.ts b/packages/remix-dev/vite/build.ts
@@ -155,6 +155,11 @@ async function getServerBuilds(ctx: RemixPluginContext): Promise<{
       if (typeof serverBundleId !== "string") {
         throw new Error(`The "serverBundles" function must return a string`);
       }
+      if (!/^[a-zA-Z0-9-_]+$/.test(serverBundleId)) {
+        throw new Error(
+          `The "serverBundles" function must only return strings containing alphanumeric characters, hyphens and underscores.`
+        );
+      }
       buildManifest.routeIdToServerBundleId[route.id] = serverBundleId;
 
       let relativeServerBundleDirectory = path.relative(