.forge/issues/567552a1-389b-4856-9e3e-1b320d5f1095/issue.md

.forge/issues/567552a1-389b-4856-9e3e-1b320d5f1095/issue.md 1.7 KiB 38 lines Raw

id: 567552a1-389b-4856-9e3e-1b320d5f1095 title: Pages artifact download policy is invalid (two splats), allowing active HTML/SVG state: closed labels:

kind:security assignees: [] milestone: null created: 2026-10-27T18:39:46.325820585Z updated: 2026-10-27T19:53:10.416654271Z

Problem

The Pages artifact download policy is invalid: Cloudflare _headers allows only one * wildcard per rule, but HEADERS_FILE emits /releases/*/*. Wrangler reports it invalid and skips it, so release artifacts are served as active same-origin HTML/SVG instead of downloads. This means f0rge #97 is still open on Pages even though hu13 serve is fixed.

Verified reproduction

wrangler pages dev 4.154.0 over a dist with .forge/releases/out/v1/evil.html and evil.svg:

Found 1 invalid header rule:
  Only one wildcard is allowed per rule. Use a named placeholder (e.g. :project) instead. Skipping /releases/*/*.
  at dist/_headers:7 | /releases/*/*

Then:

GET /releases/v1/evil.svg      -> 200 image/svg+xml, no Content-Disposition
GET /releases/v1/evil.html     -> 308 Location: /releases/v1/evil
GET /releases/v1/evil          -> 200 text/html, no Content-Disposition

Both artifact bodies are script-bearing and execute in the inbox origin. src/build.rs:1157, docs/cloudflare.md:94, and .forge/wiki/deploy:69 all claim the artifact download policy exists.

Fix candidate

Use /releases/:version/* (one splat plus a placeholder). Verified with Wrangler: it parses as valid, applies Content-Disposition: attachment to extensionless artifact URLs and artifact directory indexes, and leaves /releases/v1 release pages inline. Add a real Wrangler/Pages header test instead of only checking the string.

view raw