fix: use request.url instead of req.headers.host in revalidation patch

Author: Ashutosh0x

.changeset/fix-host-header-revalidation.md

@@ -0,0 +1,10 @@
+---
+"@opennextjs/cloudflare": patch
+---
+
+fix: use request.url instead of req.headers.host in revalidation patch
+
+The `res.revalidate()` patch now derives the host and protocol from `request.url`
+(set by the Cloudflare Workers runtime) instead of `req.headers.host` (user-controllable
+HTTP header). This prevents host header injection in the `WORKER_SELF_REFERENCE.fetch()`
+call used for Pages Router revalidation.

packages/cloudflare/src/cli/build/patches/plugins/res-revalidate.spec.ts

@@ -95,7 +95,7 @@ describe("patchResRevalidate", () => {
       -                method: 'HEAD',
       -                headers: revalidateHeaders
       -            });
-      +            const res = await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`\${req.headers.host.includes("localhost") ? "http":"https" }://\${req.headers.host}\${urlPath}\`,{method:'HEAD', headers:revalidateHeaders});
+      +            const res = await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`\${new URL(req.url).protocol}//\${new URL(req.url).host}\${urlPath}\`,{method:'HEAD', headers:revalidateHeaders});
                    // we use the cache header to determine successful revalidate as
                    // a non-200 status code can be returned from a successful revalidate
                    // e.g. notFound: true returns 404 status code but is successful

packages/cloudflare/src/cli/build/patches/plugins/res-revalidate.ts

@@ -53,7 +53,7 @@ rule:
                       has:
                         kind: identifier
 
-fix: await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`\${$REQ.headers.host.includes("localhost") ? "http":"https" }://\${$REQ.headers.host}$URL_PATH\`,{method:'HEAD', headers:$HEADERS})
+fix: await (await import("@opennextjs/cloudflare")).getCloudflareContext().env.WORKER_SELF_REFERENCE.fetch(\`\${new URL($REQ.url).protocol}//\${new URL($REQ.url).host}$URL_PATH\`,{method:'HEAD', headers:$HEADERS})
 `;
 
 export const patchResRevalidate: CodePatcher = {