fix: redact nested and typed underscore-prefixed remote form fields after invalid submissions

.changeset/tidy-forms-redact.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: redact nested and typed underscore-prefixed remote form fields after invalid submissions

packages/kit/src/runtime/app/server/remote/form.js

@@ -4,7 +4,7 @@
 import { get_request_store } from '@sveltejs/kit/internal/server';
 import {
 	create_field_proxy,
-	set_nested_value,
+	split_path,
 	deep_set,
 	normalize_issue,
 	flatten_issues,
@@ -286,15 +286,17 @@ function handle_issues(output, issues, form_data, form_id) {
 		output.input = {};
 
 		for (const field_name of form_data.keys()) {
+			const field = parse_form_key(form_id, field_name);
+			const path = split_path(field.name);
+
 			// redact sensitive fields
-			if (/^[.\]]?_/.test(field_name)) continue;
+			if (path.some((part) => part.startsWith('_'))) continue;
 
 			const values = form_data.getAll(field_name).filter((value) => typeof value === 'string');
-			const field = parse_form_key(form_id, field_name);
 
-			set_nested_value(
+			deep_set(
 				/** @type {Record<string, any>} */ (output.input),
-				field,
+				path,
 				field.is_array ? values : values[0]
 			);
 		}

packages/kit/test/apps/async/src/routes/remote/form/underscore/+page.svelte

@@ -5,6 +5,8 @@
 <form {...register}>
 	<input {...register.fields.username.as('text')} />
 	<input {...register.fields._password.as('password')} />
+	<input {...register.fields._pin.as('number')} />
+	<input {...register.fields.user._password.as('password')} />
 
 	<button>submit</button>
 </form>

packages/kit/test/apps/async/src/routes/remote/form/underscore/form.remote.ts

@@ -4,7 +4,9 @@ import * as v from 'valibot';
 export const register = form(
 	v.object({
 		username: v.pipe(v.string(), v.minLength(8)),
-		_password: v.pipe(v.string(), v.minLength(8))
+		_password: v.pipe(v.string(), v.minLength(8)),
+		_pin: v.number(),
+		user: v.object({ _password: v.string() })
 	}),
 	async (data) => {}
 );

packages/kit/test/apps/async/test/test.js

@@ -801,10 +801,14 @@ test.describe('remote functions', () => {
 
 		await page.fill('input[name^="username"]', 'abcdefg');
 		await page.fill('input[name^="_password"]', 'pqrstuv');
+		await page.fill('input[name^="n:_pin"]', '1234');
+		await page.fill('input[name^="user._password"]', 'nested-secret');
 		await page.locator('button').click();
 
 		await expect(page.locator('input[name^="username"]')).toHaveValue('abcdefg');
 		await expect(page.locator('input[name^="_password"]')).toHaveValue('');
+		await expect(page.locator('input[name^="n:_pin"]')).toHaveValue('');
+		await expect(page.locator('input[name^="user._password"]')).toHaveValue('');
 	});
 
 	test('prerendered entries not called in prod', async ({ page, clicknav }) => {