fix(router): scope loader request state

[Varixo]

Motivation

• Prevent cross-route loader cache poisoning by ensuring loader-scoped cache keys cannot be mismatched with full-route state that loaders can still read.
• The previous change used a loader-scoped RequestEvent for cache keys but left request, originalUrl, and params inherited from the root event, enabling an attacker to prime a cache for one full path and have it served for another.

Description

• In getLoaderRequestEvent() create a new Request for the loader-scoped URL and override request, originalUrl, and params in the per-loader event in addition to the existing pathname, query, and url overrides so all URL-bearing fields are consistent with the scoped cache key.
• Update unit tests in packages/qwik-router/src/middleware/request-handler/handlers/loader-request-event.unit.ts and packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.unit.ts to assert that request.url, originalUrl, and params are scoped to the loader view.
• Add a patch changeset for @qwik.dev/router documenting the fix.

Testing

• pnpm build.core.dev completed successfully.
• pnpm vitest run packages/qwik-router/src/middleware/request-handler/handlers/loader-request-event.unit.ts packages/qwik-router/src/middleware/request-handler/handlers/loader-handler.unit.ts passed (all tests in those files passed).
• pnpm vitest run packages/qwik-router/src/middleware/request-handler/etag.unit.ts packages/qwik-router/src/runtime/src/route-loaders.unit.ts passed (all tests in those files passed).

---

Codex Task

[changeset-bot]

🦋 Changeset detected

Latest commit: b8a86d0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@qwik.dev/router	Patch
eslint-plugin-qwik	Patch
@qwik.dev/core	Patch
create-qwik	Patch
@qwik.dev/react	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@qwik.dev/core

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/core@8856

@qwik.dev/router

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/router@8856

eslint-plugin-qwik

npm i https://pkg.pr.new/QwikDev/qwik/eslint-plugin-qwik@8856

create-qwik

npm i https://pkg.pr.new/QwikDev/qwik/create-qwik@8856

@qwik.dev/optimizer

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/optimizer@8856

@qwik.dev/devtools

npm i https://pkg.pr.new/QwikDev/qwik/@qwik.dev/devtools@8856

commit: b8a86d0

[github-actions]

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name	Status	Preview	Last Commit
qwik-docs	✅ Ready (View Log)	Visit Preview	b8a86d0