Skip to content

fix: legacy browser Headers crash, onRequest params merge, baseURL whitespace #553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
productdevbook wants to merge 1 commit into
base: main
Choose a base branch
from
+53 −2
Open

fix: legacy browser Headers crash, onRequest params merge, baseURL whitespace #553

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion src/fetch.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,9 +115,15 @@ export function createFetch(globalOptions: CreateFetchOptions = {}): $Fetch {
if (context.options.baseURL) {
context.request = withBase(context.request, context.options.baseURL);
}
// Merge params into query (params may be set in onRequest hook)
if (context.options.params) {
context.options.query = {
...context.options.query,
...context.options.params,
};
Comment on lines +118 to +123
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 30, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Preserve query precedence when merging params into URL params.

At Line 120-123, merge order currently lets deprecated params override query on key collisions. That is inconsistent with resolveFetchOptions (where query wins) and can generate incorrect final URLs.

Suggested fix 
       if (context.options.params) {
         context.options.query = {
-          ...context.options.query,
-          ...context.options.params,
+          ...context.options.params,
+          ...context.options.query,
         };
       }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
// Merge params into query (params may be set in onRequest hook)
if (context.options.params) {
context.options.query = {
...context.options.query,
...context.options.params,
};
// Merge params into query (params may be set in onRequest hook)
if (context.options.params) {
context.options.query = {
...context.options.params,
...context.options.query,
};
}
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@src/fetch.ts` around lines 118 - 123, The merge currently lets deprecated
context.options.params override context.options.query; change the merge so query
takes precedence (as in resolveFetchOptions) by merging params first and then
query (i.e., produce a combined object with params spread before query) and
ensure you assign the result back to context.options.query so existing code
reads the merged params with query winning on key collisions.

}
if (context.options.query) {
context.request = withQuery(context.request, context.options.query);
delete context.options.query;
}
if ("query" in context.options) {
delete context.options.query;
Expand Down
2 changes: 1 addition & 1 deletion src/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ function mergeHeaders(
Headers: typeof globalThis.Headers
): Headers {
if (!defaults) {
return new Headers(input);
return input ? new Headers(input) : new Headers();
}
const headers = new Headers(defaults);
if (input) {
Expand Down
4 changes: 4 additions & 0 deletions src/utils.url.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,10 @@ export function joinURL(base?: string, path?: string): string {
* Adds the base path to the input path, if it is not already present.
*/
export function withBase(input = "", base = ""): string {
// Trim control characters and whitespace from base URL
// (can happen from .env parsing mistakes)
base = base.trim();

if (!base || base === "/") {
return input;
}
Expand Down
41 changes: 41 additions & 0 deletions test/index.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -524,4 +524,45 @@ describe("ofetch", () => {
timeout: 10_000,
});
});

describe("bugfixes", () => {
it("handles undefined headers without crash (#493)", async () => {
// Should not throw when no headers are provided
const result = await $fetch(getURL("ok"), {});
expect(result).toBe("ok");
});

it("merges params set in onRequest hook (#477)", async () => {
const { path } = await $fetch(getURL("echo"), {
query: { a: 1 },
onRequest(ctx) {
ctx.options.params = { b: 2 };
},
});
const params = Object.fromEntries(new URL(path, "http://_").searchParams);
expect(params).toMatchObject({ a: "1", b: "2" });
});

it("merges query set in onRequest hook", async () => {
const { path } = await $fetch(getURL("echo"), {
onRequest(ctx) {
ctx.options.query = { dynamic: "true" };
},
});
const params = Object.fromEntries(new URL(path, "http://_").searchParams);
expect(params).toMatchObject({ dynamic: "true" });
});

it("trims whitespace from baseURL (#530)", async () => {
const result = await $fetch("/x?foo=123", {
baseURL: getURL("url") + " ",
});
expect(result).toBe("/url/x?foo=123");

const result2 = await $fetch("/x?foo=123", {
baseURL: getURL("url") + "\t",
});
expect(result2).toBe("/url/x?foo=123");
});
});
});