fix(cache): protect cache function references (#3385)

* fix(cache): protect cache function references

* fix(actions): preserve production reference ownership

* fix(actions): allow hoisted default references

* test(cache): expand opaque reference coverage

* fix(actions): preserve aliased dev references

* fix(actions): match opaque reference shape

Author: james-elicx

packages/cloudflare/tests/response-store-adapter.e2e.test.ts

@@ -475,6 +475,18 @@ describe("Cloudflare Workers Response Store adapter", () => {
     const firstPage = await cacheStatus("/use-cache");
     const firstData = htmlValue(firstPage.body, "use-cache-value");
     const firstPageRenders = Number(htmlValue(firstPage.body, "use-cache-route-renders"));
+    const entries = (await metadataEntries()).flat() as Array<{
+      revalidator?: { args?: unknown[]; id?: unknown };
+    }>;
+    const cacheFunctionEntry = entries.find(
+      (entry) => entry.revalidator?.id === "vinext:cache-function",
+    );
+    assert.ok(cacheFunctionEntry);
+    const serializedInvocation = cacheFunctionEntry.revalidator?.args?.[1];
+    assert.ok(typeof serializedInvocation === "string");
+    const invocation = JSON.parse(serializedInvocation) as { referenceId?: unknown };
+    assert.ok(typeof invocation.referenceId === "string");
+    assert.match(invocation.referenceId, /^[0-9a-f]{12}#\$\$vinext_cache_[0-9a-f]{64}$/);
 
     await new Promise((resolve) => setTimeout(resolve, 1_100));
 

packages/vinext/src/plugins/use-cache-callable.ts

@@ -1,3 +1,4 @@
+import { createHmac, randomBytes } from "node:crypto";
 import { createRequire } from "node:module";
 import path from "pathslash";
 import { pathToFileURL } from "node:url";
@@ -166,6 +167,30 @@ function hasFunctionDirective(
   );
 }
 
+function getFunctionDirectiveExportNames(
+  transforms: RscTransforms,
+  ast: Program,
+  directive: string,
+): Set<string> {
+  const names = new Set<string>();
+  for (const group of transforms.scanModuleExports(ast)) {
+    const entries =
+      group.type === "declaration"
+        ? [group.export]
+        : group.type === "variable-declaration"
+          ? group.declarators.flatMap((declarator) => declarator.exports)
+          : group.type === "specifiers"
+            ? group.exports
+            : group.type === "default"
+              ? [{ exportName: "default", meta: group.meta }]
+              : [];
+    for (const entry of entries) {
+      if (hasFunctionDirective(entry.meta, directive)) names.add(entry.exportName);
+    }
+  }
+  return names;
+}
+
 function getCacheWrapperOptions(
   options: Options,
   id: string,
@@ -193,6 +218,13 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
     pathToFileURL(rscModulePath).href
   );
   const transforms: RscTransforms = await import(pathToFileURL(transformsPath).href);
+  // Cache functions use React's server-reference transport when they are passed
+  // to Client Components or invoked by the Response Store. The upstream RSC
+  // plugin's reference key is a public, deterministic module-path hash, so the
+  // original export name must not also be the remotely addressable name. A
+  // per-plugin secret keeps aliases stable across every environment/build pass
+  // in one Vite build without making sibling exports derivable from each other.
+  const referenceSecret = randomBytes(32);
   let manager: RscPluginManager | undefined;
 
   return {
@@ -241,6 +273,13 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
         }
 
         const reference = manager.serverReferences.resolve(id, "rsc");
+        const relativeImportId = manager.toRelativeId(reference.importId);
+        const secureExportName = (name: string) =>
+          `$$vinext_cache_${createHmac("sha256", referenceSecret)
+            .update(relativeImportId)
+            .update("\0")
+            .update(name)
+            .digest("hex")}`;
         const isRsc = this.environment.name === "rsc";
 
         if (!isRsc) {
@@ -263,6 +302,11 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
             return;
           }
 
+          const useServerExportNames = getFunctionDirectiveExportNames(
+            transforms,
+            ast,
+            "use server",
+          );
           const result = transforms.transformDirectiveProxyExport(ast, {
             code,
             directive: moduleDirective,
@@ -272,7 +316,7 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
               return true;
             },
             runtime: (name) =>
-              `$$ReactClient.createServerReference(${JSON.stringify(`${reference.referenceKey}#${name}`)},$$ReactClient.callServer,undefined,${this.environment.mode === "dev" ? "$$ReactClient.findSourceMapURL" : "undefined"},${JSON.stringify(name)})`,
+              `$$ReactClient.createServerReference(${JSON.stringify(`${reference.referenceKey}#${useServerExportNames.has(name) ? name : secureExportName(name)}`)},$$ReactClient.callServer,undefined,${this.environment.mode === "dev" ? "$$ReactClient.findSourceMapURL" : "undefined"},${JSON.stringify(name)})`,
           });
           if (!result?.output.hasChanged()) {
             manager.serverReferences.deleteClaim(PLUGIN_NAME, id);
@@ -281,7 +325,9 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
 
           manager.serverReferences.replaceClaim(PLUGIN_NAME, id, {
             ...reference,
-            exportNames: result.exportNames,
+            exportNames: result.exportNames.map((name) =>
+              useServerExportNames.has(name) ? name : secureExportName(name),
+            ),
           });
           const runtimeEnvironment = this.environment.name === "client" ? "browser" : "ssr";
           result.output.prepend(
@@ -290,6 +336,7 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
           return magicStringTransformResult(result.output, { hires: "boundary", source: id });
         }
 
+        const secureExports = new Set<string>();
         const wrap = (
           value: string,
           name: string,
@@ -298,9 +345,11 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
           isModuleDirective: boolean,
         ) => {
           const variant = directiveMatch[1] ?? "";
+          const secureName = secureExportName(name);
+          secureExports.add(secureName);
           const wrapperOptions = {
             ...getCacheWrapperOptions(options, id, name, isModuleDirective, meta),
-            serverReferenceId: `${reference.referenceKey}#${name}`,
+            serverReferenceId: `${reference.referenceKey}#${secureName}`,
           };
           return `$$cacheRuntime.registerCachedFunction(${value}, ${JSON.stringify(`${id}:${name}`)}, ${JSON.stringify(variant)}, ${JSON.stringify(wrapperOptions)})`;
         };
@@ -313,8 +362,9 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
           isModuleDirective: boolean,
         ) => {
           const cached = wrap(value, name, directiveMatch, meta, isModuleDirective);
+          const secureName = secureExportName(name);
           needsReactServer = true;
-          return `$$VinextReactServer.registerServerReference(${cached}, ${JSON.stringify(reference.referenceKey)}, ${JSON.stringify(name)})`;
+          return `(${secureName} = $$VinextReactServer.registerServerReference(${cached}, ${JSON.stringify(reference.referenceKey)}, ${JSON.stringify(secureName)}))`;
         };
 
         const result = moduleDirective
@@ -336,6 +386,7 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
               directive: USE_CACHE_DIRECTIVE_CANDIDATE,
               rejectNonAsyncFunction: true,
               hoistRuntime: true,
+              noExport: true,
               runtime: (value, name, meta) =>
                 runtime(value, name, matchUseCacheDirective(meta.directiveMatch[0]), meta, false),
               encode: (value) => `$$cacheRuntime.encryptCacheCaptures(${value})`,
@@ -348,7 +399,7 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
 
         manager.serverReferences.replaceClaim(PLUGIN_NAME, id, {
           ...reference,
-          exportNames: "names" in result ? result.names : result.exportNames,
+          exportNames: [...secureExports],
         });
         const importPosition =
           ast.body.find((node) => !("directive" in node))?.start ?? code.length;
@@ -358,10 +409,14 @@ export async function createUseCacheCallablePlugin(options: Options): Promise<Pl
             `import * as $$cacheRuntime from ${JSON.stringify(options.cacheRuntime)};`,
             needsReactServer &&
               `import * as $$VinextReactServer from "@vitejs/plugin-rsc/react/rsc/server";`,
+            secureExports.size > 0 && `let ${[...secureExports].join(",")};`,
           ]
             .filter(Boolean)
             .join("\n") + "\n",
         );
+        if (secureExports.size > 0) {
+          result.output.append(`\nexport { ${[...secureExports].join(",")} };\n`);
+        }
         return magicStringTransformResult(result.output, { hires: "boundary", source: id });
       },
     },

packages/vinext/src/server/app-server-action-execution.ts

@@ -852,6 +852,57 @@ function isAppServerActionFunction(action: unknown): action is AppServerActionFu
   return typeof action === "function";
 }
 
+function normalizeDevServerReferenceId(id: string): string {
+  const exportSeparator = id.indexOf("#");
+  if (exportSeparator === -1) return id;
+  const moduleId = id.slice(0, exportSeparator);
+  // plugin-rsc's dev createServerManifest() appends this HMR-busting tag to
+  // serialized module ids. loadServerAction() removes it before importing, so
+  // compare the registered and requested identities on that same basis.
+  const cacheTag = moduleId.indexOf("$$cache=");
+  return (cacheTag === -1 ? moduleId : moduleId.slice(0, cacheTag)) + id.slice(exportSeparator);
+}
+
+function requiresRegisteredServerReferenceMatch(actionId: string): boolean {
+  const exportSeparator = actionId.indexOf("#");
+  if (exportSeparator === -1) return true;
+  // Production requests are authorized by the generated action-owner manifest
+  // before execution. Dev has no manifest, so its path-based references need
+  // the runtime registration check to prevent arbitrary named-export loading.
+  return !/^[0-9a-f]{12}$/.test(actionId.slice(0, exportSeparator));
+}
+
+function matchesRegisteredServerReference(
+  action: AppServerActionFunction,
+  actionId: string,
+): boolean {
+  const registeredId = Reflect.get(action, "$$id");
+  if (typeof registeredId !== "string") return false;
+
+  const normalizedRegisteredId = normalizeDevServerReferenceId(registeredId);
+  const normalizedActionId = normalizeDevServerReferenceId(actionId);
+  if (normalizedRegisteredId === normalizedActionId) return true;
+
+  // React stores only the most recently registered ID on a function. When one
+  // ordinary Server Action is exported under multiple names, plugin-rsc
+  // registers every alias on the same function object, so `$$id` alone cannot
+  // tell which aliases are valid. Loading any same-module alias still proves
+  // that it resolves to that registered Server Action. Cache references are the
+  // exception: their opaque export deliberately must not authorize a source
+  // export name that happens to resolve to the same wrapper.
+  const registeredSeparator = normalizedRegisteredId.indexOf("#");
+  const actionSeparator = normalizedActionId.indexOf("#");
+  if (registeredSeparator === -1 || actionSeparator === -1) return false;
+  if (
+    normalizedRegisteredId.slice(0, registeredSeparator) !==
+    normalizedActionId.slice(0, actionSeparator)
+  ) {
+    return false;
+  }
+  const registeredExport = normalizedRegisteredId.slice(registeredSeparator + 1);
+  return !/^\$\$vinext_cache_[0-9a-f]{64}$/.test(registeredExport);
+}
+
 function getServerActionFailureMessage(error: unknown): string {
   return error instanceof Error && error.message ? error.message : String(error);
 }
@@ -1222,6 +1273,17 @@ export async function handleProgressiveServerActionRequest(
       return null;
     }
 
+    if (
+      directActionId &&
+      requiresRegisteredServerReferenceMatch(directActionId) &&
+      !matchesRegisteredServerReference(action, directActionId)
+    ) {
+      return createActionNotFoundResponse(directActionId, {
+        clearRequestContext: options.clearRequestContext,
+        getAndClearPendingCookies: options.getAndClearPendingCookies,
+      });
+    }
+
     const decodedActionId = Reflect.get(action, "$$id");
     if (
       typeof decodedActionId === "string" &&
@@ -1515,7 +1577,11 @@ export async function handleServerActionRscRequest<
         throw error;
       }
 
-      if (!isAppServerActionFunction(loadedAction)) {
+      if (
+        !isAppServerActionFunction(loadedAction) ||
+        (requiresRegisteredServerReferenceMatch(options.actionId) &&
+          !matchesRegisteredServerReference(loadedAction, options.actionId))
+      ) {
         return createActionNotFoundResponse(options.actionId, {
           clearRequestContext: options.clearRequestContext,
           getAndClearPendingCookies: options.getAndClearPendingCookies,
@@ -1558,7 +1624,11 @@ export async function handleServerActionRscRequest<
         throw error;
       }
 
-      if (!isAppServerActionFunction(loadedAction)) {
+      if (
+        !isAppServerActionFunction(loadedAction) ||
+        (requiresRegisteredServerReferenceMatch(options.actionId) &&
+          !matchesRegisteredServerReference(loadedAction, options.actionId))
+      ) {
         return createActionNotFoundResponse(options.actionId, {
           clearRequestContext: options.clearRequestContext,
           getAndClearPendingCookies: options.getAndClearPendingCookies,

packages/vinext/src/shims/cache-runtime.ts

@@ -599,6 +599,12 @@ export function registerCachedFunction<TArgs extends unknown[], TResult>(
 ): (...args: TArgs) => Promise<TResult> {
   const cacheVariant = variant ?? "";
   const omitAppPageSearchParamsFromFirstArg = options.appPageDefaultExport === true;
+  // A replayable entry stores this reference ID for Response Store
+  // regeneration. Keep entries produced with an older build's opaque alias
+  // unreachable if a stable deployment/build ID is reused.
+  const cacheFunctionId = options.serverReferenceId
+    ? JSON.stringify([id, options.serverReferenceId])
+    : id;
 
   // In dev mode, skip the shared cache so code changes are immediately
   // visible after HMR. Without this, the MemoryCacheHandler returns stale
@@ -691,10 +697,10 @@ export function registerCachedFunction<TArgs extends unknown[], TResult>(
           const encoded = await rsc.encodeReply(processedArgs, {
             temporaryReferences: tempRefs,
           });
-          cacheKey = buildUseCacheKey(id, keySeed, await replyToCacheKey(encoded));
+          cacheKey = buildUseCacheKey(cacheFunctionId, keySeed, await replyToCacheKey(encoded));
         } else {
           const argsKey = processedArgs.length > 0 ? stableStringify(processedArgs) : undefined;
-          cacheKey = buildUseCacheKey(id, keySeed, argsKey);
+          cacheKey = buildUseCacheKey(cacheFunctionId, keySeed, argsKey);
         }
       } catch {
         // Non-serializable arguments — run without caching

tests/app-router-dev-server.test.ts

@@ -2170,6 +2170,57 @@ describe("App Router integration", () => {
     expect(res.headers.get("x-nextjs-action-not-found")).toBe("1");
   });
 
+  it("invokes every export alias for the same server action", async () => {
+    for (const exportName of [
+      "firstAliasedAction",
+      "secondAliasedAction",
+      "$$vinext_cache_custom",
+    ]) {
+      const res = await fetch(`${baseUrl}/actions.rsc`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "text/plain",
+          "x-rsc-action": `/app/actions/actions.ts#${exportName}`,
+        },
+        body: JSON.stringify(["proof"]),
+      });
+
+      expect(res.status).toBe(200);
+      expect(await res.text()).toContain("aliased:proof");
+    }
+  });
+
+  it("rejects hidden cache functions' original dev export names", async () => {
+    const anonymous = await fetch(`${baseUrl}/use-cache-hidden-reference?record=victim`);
+    expect(anonymous.status).toBe(200);
+    expect(await anonymous.text()).toContain("FORBIDDEN");
+
+    const defaultVictim = await fetch(
+      `${baseUrl}/use-cache-hidden-reference?record=victim&source=default`,
+      { headers: { Authorization: "Bearer fixture-victim-session" } },
+    );
+    expect(defaultVictim.status).toBe(200);
+    expect(await defaultVictim.text()).toContain("VICTIM_DEFAULT_PRIVATE_RECORD");
+
+    for (const [exportName, secret] of [
+      ["readRecord", "VICTIM_PRIVATE_RECORD"],
+      ["default", "VICTIM_DEFAULT_PRIVATE_RECORD"],
+    ] as const) {
+      const exploit = await fetch(`${baseUrl}/use-cache-hidden-reference.rsc`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "text/plain",
+          "x-rsc-action": `/app/use-cache-hidden-reference/records.ts#${exportName}`,
+        },
+        body: JSON.stringify(["victim"]),
+      });
+
+      expect(exploit.status).toBe(404);
+      expect(exploit.headers.get("x-nextjs-action-not-found")).toBe("1");
+      expect(await exploit.text()).not.toContain(secret);
+    }
+  });
+
   it("returns action-not-found for an MPA form POST to a page with no decodable action", async () => {
     // Ported from Next.js: test/e2e/app-dir/no-server-actions/no-server-actions.test.ts
     // ("should error when triggering an MPA action on an app with no server actions")