fix(server): parse url safer in fetch adapter (#5410)

.eslintrc.js

@@ -54,6 +54,7 @@ const config = {
           '\\.d\\.ts$',
           'issue-\\d+-.*\\.test\\.tsx?$',
           '\\.(t|j)sx$',
+          'URL',
         ],
       },
     ],

packages/server/src/adapters/fetch/fetchRequestHandler.ts

@@ -3,6 +3,7 @@ import type { HTTPRequest } from '../../http';
 import { getBatchStreamFormatter } from '../../http';
 import type { HTTPResponse, ResponseChunk } from '../../http/internals/types';
 import { resolveHTTPResponse } from '../../http/resolveHTTPResponse';
+import { toURL } from '../../http/toURL';
 import type { FetchHandlerOptions } from './types';
 
 export type FetchHandlerRequestOptions<TRouter extends AnyRouter> =
@@ -27,7 +28,7 @@ export async function fetchRequestHandler<TRouter extends AnyRouter>(
     return opts.createContext?.({ req: opts.req, resHeaders });
   };
 
-  const url = new URL(opts.req.url);
+  const url = toURL(opts.req.url);
 
   const pathname = trimSlashes(url.pathname);
   const endpoint = trimSlashes(opts.endpoint);

packages/server/src/adapters/standalone.ts

@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-non-null-assertion */
 import http from 'http';
 import type { AnyRouter } from '../core';
+import { toURL } from '../http/toURL';
 import type {
   NodeHTTPCreateContextFnOptions,
   NodeHTTPHandlerOptions,
@@ -19,14 +20,11 @@ export function createHTTPHandler<TRouter extends AnyRouter>(
   opts: CreateHTTPHandlerOptions<TRouter>,
 ) {
   return async (req: http.IncomingMessage, res: http.ServerResponse) => {
-    // if no hostname, set a dummy one
-    const href = req.url!.startsWith('/')
-      ? `http://127.0.0.1${req.url}`
-      : req.url!;
+    const url = toURL(req.url!);
 
     // get procedure path and remove the leading slash
     // /procedure -> procedure
-    const path = new URL(href).pathname.slice(1);
+    const path = url.pathname.slice(1);
 
     await nodeHTTPRequestHandler({
       // FIXME: no typecasting should be needed here

packages/server/src/http/toURL.ts

@@ -0,0 +1,7 @@
+export function toURL(urlOrPathname: string): URL {
+  const url = urlOrPathname.startsWith('/')
+    ? `http://127.0.0.1${urlOrPathname}`
+    : urlOrPathname;
+
+  return new URL(url);
+}