fix(image): reject unrecognized deployment IDs

[NathanDrake2406]

Overview

Goal	Prevent deployment-ID query variants from amplifying equivalent image optimization work and cache entries.
Core change	Accept dpl only when it matches the configured deployment ID in the canonical emitted form.
Key boundary	Reject invalid optimizer query parameters before source asset fetches or transforms.
Expected impact	Arbitrary, percent-encoded, and empty-segment dpl aliases return 400 without consuming image backend work.

Why

The image loader emits deployment IDs as a top-level dpl parameter. The optimizer previously allowlisted that parameter but discarded it when constructing the source and transform tuple. An unauthenticated caller could therefore vary dpl across distinct request URLs while repeating the same fetch and image transform.

The parameter parser owns this decision because every dev, Node, App Router, Pages Router, and configured optimizer path crosses it before image I/O.

What changed

Scenario	Before	After
Canonical configured dpl	Accepted	Accepted
Different deployment ID	Accepted and transformed	Rejected before asset fetch
Percent-encoded alias of the configured ID	Accepted and transformed	Rejected before asset fetch
Empty raw query segments	Ignored by URL parsing	Rejected as non-canonical
Request without dpl	Accepted	Unchanged

Maintainer review path

1. packages/vinext/src/server/image-optimization.ts for the decoded identity and raw canonical-form checks.
2. tests/shims.test.ts for malicious parser inputs and the proof that asset I/O is not reached.
3. tests/image-optimization-parity.test.ts for preserved valid deployment-ID behavior.

Validation

The regression tests were first run against the vulnerable implementation and failed while showing both attacker variants reached fetchAsset. They pass after the fix with zero asset calls.

• vp test run tests/shims.test.ts: 1,271 passed.
• vp test run tests/image-component.test.ts: 65 passed.
• vp test run tests/image-optimization-parity.test.ts: 7 passed across App and Pages Router fixtures.
• vp test run tests/static-image-emission.test.ts -t "preserves managed image URLs under basePath and assetPrefix": passed.
• vp check packages/vinext/src/server/image-optimization.ts tests/shims.test.ts tests/image-optimization-parity.test.ts: format, lint, and types passed.
• vp run vinext#build: passed.
• Pre-commit full check, staged tests, and knip: passed.

Risk / compatibility

• Public API signatures remain compatible. Tests may inject an expected deployment ID through the existing parser options object.
• Generated URLs using the configured deployment ID remain accepted.
• Manually supplied or stale deployment IDs now fail closed with the existing 400 response used for invalid optimizer parameters.
• Query requests without dpl are unchanged.

[NathanDrake2406]

@codex review

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@vinext/cloudflare@2764

npm i https://pkg.pr.new/create-vinext-app@2764

npm i https://pkg.pr.new/@vinext/types@2764

npm i https://pkg.pr.new/vinext@2764

commit: 0341003

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 78f2fad175

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Performance benchmarks

Compared 0341003 against base dc05459 using alternating same-runner rounds. Next.js was unchanged and skipped.

1 improved · 0 regressed · 5 within ±1.5%

Scenario	Framework	Baseline	Current	Change
Client bundle size (gzip)	vinext	134.5 KB	134.5 KB	⚫ -0.0%
Client entry size (gzip)	vinext	122.1 KB	122.1 KB	⚫ -0.0%
Dev server cold start	vinext	2.16 s	2.09 s	🟢 -3.0%
Production build time	vinext	2.25 s	2.28 s	⚫ +1.4%
RSC entry closure size (gzip)	vinext	112.3 KB	112.4 KB	⚫ +0.1%
Server bundle size (gzip)	vinext	189.7 KB	189.8 KB	⚫ +0.0%

View detailed results and traces

_{🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head}

[NathanDrake2406]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: fa33d3cb47

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".