Uh oh!
There was an error while loading. Please reload this page.
fix(google-maps): static maps proxy, color mode, and bug fixes - #587
Conversation
Combined commits: - fix(plausible): use consistent window reference in clientInit stub
The latest updates on your projects. Learn more about Vercel for GitHub.
|
commit: |
Uh oh!
There was an error while loading. Please reload this page.
3b89f35 to
2ebed54Compare- Add googleStaticMapsProxy config for CORS fixes and caching (#380, #83) - API key stored server-side only (not exposed to client) - Referer validation to prevent external abuse - Add mapIds prop for light/dark color mode support (#539) - Fix MarkerClusterer optional peer dep with inline types (#540) - Add PinElement cleanup on unmount - Fix importLibrary cache to retry on failure Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2ebed54 to
b8cac43Compare| const refererUrl = new URL(referer).host | ||
| if (refererUrl !== host) { | ||
| throw createError({ | ||
| statusCode: 403, | ||
| statusMessage: 'Invalid referer', |
There was a problem hiding this comment.
| constrefererUrl=newURL(referer).host | |
| if(refererUrl!==host){ | |
| throwcreateError({ | |
| statusCode: 403, | |
| statusMessage: 'Invalid referer', | |
| try{ | |
| constrefererUrl=newURL(referer).host | |
| if(refererUrl!==host){ | |
| throwcreateError({ | |
| statusCode: 403, | |
| statusMessage: 'Invalid referer', | |
| }) | |
| } | |
| }catch(error){ | |
| // Re-throw Nuxt errors as-is | |
| if(error&&typeoferror==='object'&&'statusCode'inerror){ | |
| throwerror | |
| } | |
| // Handle URL parsing errors | |
| throwcreateError({ | |
| statusCode: 400, | |
| statusMessage: 'Invalid referer URL', |
The referer header URL parsing can throw an uncaught error if the referer is malformed, causing an unhandled exception instead of a proper HTTP error response.
View Details
Analysis
Unhandled URL parsing error in Google Static Maps proxy referer validation
What fails: The google-static-maps-proxy.ts event handler crashes with an unhandled TypeError when the referer header contains a malformed URL.
How to reproduce:
# Send a request with a malformed referer header
curl -H "Referer: this-is-not-a-valid-url" http://localhost:3000/api/google-static-mapsResult: Returns 500 Internal Server Error due to unhandled exception from new URL() constructor throwing TypeError: Invalid URL
Expected: Should return 400 Bad Request with proper error message, consistent with other validation errors in the function that use createError() for HTTP error responses
Details: The referer header can contain any string value from the HTTP request. When new URL(referer) is called without try-catch wrapping (line 31), it throws a TypeError for malformed URLs. According to JavaScript best practices, the new URL() constructor should be wrapped in error handling when parsing untrusted input.
Uh oh!
There was an error while loading. Please reload this page.
🔗 Linked issue
Resolves#380, #83, #539, #540
Supersedes #516
❓ Type of change
📚 Description
Google Maps had several pain points: CORS issues with static map placeholders when using
crossOriginEmbedderPolicy, no way to switch map styles based on color mode, and MarkerClusterer types breaking builds when the package wasn't installed.Added a server-side static maps proxy that serves images from same origin (fixing CORS) with caching to reduce API costs. The proxy keeps the API key server-side only and validates referer headers to prevent abuse. Added
mapIdsprop to switch between light/dark Map IDs reactively when color mode changes. Replaced top-level type imports with inline types so MarkerClusterer is truly optional. Also fixed PinElement memory leak and importLibrary cache not retrying on failure.