fix(request): shadow parsed _url in requestWithURL proxy

pi0 · claude · pi0 · commit d21d93c4a986 · 2026-07-03T22:03:15.000Z
The proxy returned by requestWithURL only overrode the url string, so
the runtime-parsed req._url object (srvx node) leaked through to
consumers. A mounted h3-based fetch handler then reused the original
un-stripped URL instead of re-parsing the overridden url, returning 404
on Node while working on web runtimes.

Co-Authored-By: Claude Fable 5 &lt;noreply@anthropic.com&gt;
diff --git a/src/utils/request.ts b/src/utils/request.ts
@@ -18,7 +18,9 @@ import type { ServerRequest } from "srvx";
  * Avoids cloning the original request (no `new Request()` allocation).
  */
 export function requestWithURL(req: ServerRequest, url: string): ServerRequest {
-  const cache: Record<string | symbol, unknown> = { url };
+  // Shadow `_url` too: the runtime-parsed URL object reflects the original
+  // request URL and consumers must re-parse the overridden `url` instead.
+  const cache: Record<string | symbol, unknown> = { url, _url: undefined };
   return new Proxy(req, {
     get(target, prop) {
       if (prop in cache) return cache[prop];
diff --git a/test/mount.test.ts b/test/mount.test.ts
@@ -29,6 +29,17 @@ describeMatrix("mount", (t, { it, expect, describe }) => {
       expect(res2.status).toBe(403);
     });
 
+    it("strips base for h3-based fetch handlers when runtime provides req._url", async () => {
+      const subApp = new H3();
+      subApp.get("/hello", () => "sub");
+      // Passing the bound fetch function takes the generic fetch-handler path,
+      // so the sub-app re-parses the proxied request instead of sharing routes.
+      t.app.mount("/sub", subApp.fetch);
+      const res = await t.fetch("/sub/hello");
+      expect(res.status).toBe(200);
+      expect(await res.text()).toBe("sub");
+    });
+
     it("works with compat object", async () => {
       t.app.mount("/test", {
         fetch: (req: Request) => new Response(new URL(req.url).pathname),
