fix: use constant internal origin instead of req.headers.host in revalidation patch

Author: Ashutosh0x

.changeset/fix-host-header-revalidation.md

@@ -0,0 +1,11 @@
+---
+"@opennextjs/cloudflare": patch
+---
+
+fix: use constant internal origin instead of req.headers.host in revalidation patch
+
+The `res.revalidate()` patch now uses a constant internal origin (`https://self.local`)
+instead of the user-controllable `req.headers.host` for the `WORKER_SELF_REFERENCE.fetch()`
+URL. The service binding routes to the correct worker regardless of the URL host, so the
+host value is only metadata. This eliminates host header injection without affecting
+functionality.

packages/cloudflare/src/cli/build/patches/plugins/res-revalidate.spec.ts

@@ -95,7 +95,7 @@ describe("patchResRevalidate", () => {
       -                method: 'HEAD',
       -                headers: revalidateHeaders
       -            });
-      +            const res = await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`\${req.headers.host.includes("localhost") ? "http":"https" }://\${req.headers.host}\${urlPath}\`,{method:'HEAD', headers:revalidateHeaders});
+      +            const res = await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`https://self.local\${urlPath}\`,{method:'HEAD', headers:revalidateHeaders});
                    // we use the cache header to determine successful revalidate as
                    // a non-200 status code can be returned from a successful revalidate
                    // e.g. notFound: true returns 404 status code but is successful

packages/cloudflare/src/cli/build/patches/plugins/res-revalidate.ts

@@ -53,7 +53,7 @@ rule:
                       has:
                         kind: identifier
 
-fix: await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`\${$REQ.headers.host.includes("localhost") ? "http":"https" }://\${$REQ.headers.host}$URL_PATH\`,{method:'HEAD', headers:$HEADERS})
+fix: await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`https://self.local$URL_PATH\`,{method:'HEAD', headers:$HEADERS})
 `;
 
 export const patchResRevalidate: CodePatcher = {