61f56f997c
Some checks failed
Test examples / Test Examples (20) (push) Has been cancelled
Test examples / Test Examples (22) (push) Has been cancelled
Lock Threads / action (push) Has been cancelled
Trigger Release / start (push) Has been cancelled
Stale issue handler / stale (push) Has been cancelled
Update Font Data / create-pull-request (push) Has been cancelled
build-and-deploy / deploy-target (push) Has been cancelled
build-and-deploy / build (push) Has been cancelled
build-and-deploy / stable - aarch64-unknown-linux-musl - node@16 (push) Has been cancelled
build-and-deploy / stable - x86_64-unknown-linux-musl - node@16 (push) Has been cancelled
build-and-deploy / stable - aarch64-unknown-linux-gnu - node@16 (push) Has been cancelled
build-and-deploy / stable - x86_64-unknown-linux-gnu - node@16 (push) Has been cancelled
build-and-deploy / stable - aarch64-pc-windows-msvc - node@16 (push) Has been cancelled
build-and-deploy / stable - x86_64-pc-windows-msvc - node@16 (push) Has been cancelled
build-and-deploy / stable - aarch64-apple-darwin - node@16 (push) Has been cancelled
build-and-deploy / stable - x86_64-apple-darwin - node@16 (push) Has been cancelled
build-and-deploy / build-wasm (nodejs) (push) Has been cancelled
build-and-deploy / build-wasm (web) (push) Has been cancelled
build-and-deploy / Deploy preview tarball (push) Has been cancelled
build-and-deploy / Potentially publish release (push) Has been cancelled
build-and-deploy / publish-turbopack-npm-packages (push) Has been cancelled
build-and-deploy / Deploy examples (push) Has been cancelled
build-and-deploy / thank you, build (push) Has been cancelled
build-and-deploy / Upload Turbopack Bytesize metrics to Datadog (push) Has been cancelled
Rspack Next.js development integration tests / Rspack integration tests (push) Has been cancelled
Rspack Next.js production integration tests / Rspack integration tests (push) Has been cancelled
Turbopack Next.js development integration tests / Next.js integration tests (push) Has been cancelled
Turbopack Next.js production integration tests / Next.js integration tests (push) Has been cancelled
Update Rspack test manifest / Update and upload Rspack development test manifest (push) Has been cancelled
Update Rspack test manifest / Update and upload Rspack production test manifest (push) Has been cancelled
Upload bundler test manifests to areweturboyet.com / Upload test results (push) Has been cancelled
Update React / create-pull-request (push) Has been cancelled
test-e2e-project-reset-cron / reset-test-project (push) Has been cancelled
Notify about the top 15 issues/PRs/feature requests (most reacted) in the last 90 days / run (push) Has been cancelled
367 lines
12 KiB
TypeScript
367 lines
12 KiB
TypeScript
import http from 'http'
|
|
import { join } from 'path'
|
|
import webdriver from 'next-webdriver'
|
|
import { createNext, FileRef } from 'e2e-utils'
|
|
import { NextInstance } from 'e2e-utils'
|
|
import { fetchViaHTTP, findPort, retry } from 'next-test-utils'
|
|
|
|
async function createHostServer() {
|
|
const server = http.createServer((req, res) => {
|
|
res.end(`
|
|
<html>
|
|
<head>
|
|
<title>testing cross-site</title>
|
|
</head>
|
|
<body></body>
|
|
</html>
|
|
`)
|
|
})
|
|
|
|
const port = await findPort()
|
|
await new Promise<void>((res) => {
|
|
server.listen(port, () => res())
|
|
})
|
|
|
|
return {
|
|
server,
|
|
port,
|
|
}
|
|
}
|
|
|
|
describe.each([['', '/docs']])(
|
|
'allowed-dev-origins, basePath: %p',
|
|
(basePath: string) => {
|
|
let next: NextInstance
|
|
|
|
describe('warn mode', () => {
|
|
beforeAll(async () => {
|
|
next = await createNext({
|
|
files: {
|
|
pages: new FileRef(join(__dirname, 'misc/pages')),
|
|
public: new FileRef(join(__dirname, 'misc/public')),
|
|
},
|
|
nextConfig: {
|
|
basePath,
|
|
},
|
|
})
|
|
|
|
// render 404 page to generate
|
|
// "/_next/static/chunks/pages/_app.js"
|
|
// we need this because not found static assets
|
|
// served as plain text 404 instead of HTML.
|
|
await next.render('/404')
|
|
|
|
await retry(async () => {
|
|
// make sure host server is running
|
|
const res = await fetchViaHTTP(
|
|
next.appPort,
|
|
'/_next/static/chunks/pages/_app.js'
|
|
)
|
|
expect(res.status).toBe(200)
|
|
})
|
|
})
|
|
afterAll(() => next.destroy())
|
|
|
|
it('should warn about WebSocket from cross-site', async () => {
|
|
const { server, port } = await createHostServer()
|
|
try {
|
|
const websocketSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const ws = new WebSocket("${next.url}/_next/webpack-hmr")
|
|
|
|
ws.addEventListener('error', (err) => {
|
|
statusEl.innerText = 'error'
|
|
})
|
|
ws.addEventListener('open', () => {
|
|
statusEl.innerText = 'connected'
|
|
})
|
|
})()`
|
|
|
|
// ensure direct port with mismatching port is blocked
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
await browser.eval(websocketSnippet)
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe(
|
|
'connected'
|
|
)
|
|
})
|
|
|
|
// ensure different host is blocked
|
|
await browser.get(`https://example.vercel.sh/`)
|
|
await browser.eval(websocketSnippet)
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe(
|
|
'connected'
|
|
)
|
|
})
|
|
|
|
expect(next.cliOutput).toContain('Cross origin request detected from')
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
|
|
it('should warn about loading scripts from cross-site', async () => {
|
|
const { server, port } = await createHostServer()
|
|
|
|
try {
|
|
const scriptSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const script = document.createElement('script')
|
|
script.src = "${next.url}/_next/static/chunks/pages/_app.js"
|
|
|
|
script.onerror = (err) => {
|
|
statusEl.innerText = 'error'
|
|
}
|
|
script.onload = () => {
|
|
statusEl.innerText = 'connected'
|
|
}
|
|
document.querySelector('body').appendChild(script)
|
|
})()`
|
|
|
|
// ensure direct port with mismatching port is blocked
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
await browser.eval(scriptSnippet)
|
|
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe(
|
|
'connected'
|
|
)
|
|
})
|
|
|
|
// ensure different host is blocked
|
|
await browser.get(`https://example.vercel.sh/`)
|
|
await browser.eval(scriptSnippet)
|
|
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe(
|
|
'connected'
|
|
)
|
|
})
|
|
|
|
expect(next.cliOutput).toContain('Cross origin request detected from')
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
|
|
it('should warn about loading internal middleware from cross-site', async () => {
|
|
const { server, port } = await createHostServer()
|
|
try {
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
|
|
const middlewareSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const xhr = new XMLHttpRequest()
|
|
xhr.open('GET', '${next.url}/__nextjs_error_feedback?errorCode=0&wasHelpful=true', true)
|
|
xhr.send()
|
|
|
|
xhr.onload = () => {
|
|
statusEl.innerText = "OK"
|
|
}
|
|
xhr.onerror = () => {
|
|
statusEl.innerText = "Unauthorized"
|
|
}
|
|
})()`
|
|
|
|
await browser.eval(middlewareSnippet)
|
|
|
|
await retry(async () => {
|
|
// TODO: These requests seem to be blocked regardless of our handling only when running with Turbopack
|
|
// Investigate why this is the case
|
|
if (!process.env.IS_TURBOPACK_TEST) {
|
|
expect(await browser.elementByCss('#status').text()).toBe('OK')
|
|
}
|
|
|
|
expect(next.cliOutput).toContain(
|
|
'Cross origin request detected from'
|
|
)
|
|
})
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
})
|
|
|
|
describe('block mode', () => {
|
|
beforeAll(async () => {
|
|
next = await createNext({
|
|
files: {
|
|
pages: new FileRef(join(__dirname, 'misc/pages')),
|
|
public: new FileRef(join(__dirname, 'misc/public')),
|
|
},
|
|
nextConfig: {
|
|
basePath,
|
|
allowedDevOrigins: ['localhost'],
|
|
},
|
|
})
|
|
|
|
// render 404 page to generate
|
|
// "/_next/static/chunks/pages/_app.js"
|
|
// since we haven't built any paths by this point
|
|
// causing this chunk to not be written to disk yet
|
|
await next.render('/404')
|
|
|
|
await retry(async () => {
|
|
// make sure host server is running
|
|
const res = await fetchViaHTTP(
|
|
next.appPort,
|
|
'/_next/static/chunks/pages/_app.js'
|
|
)
|
|
expect(res.status).toBe(200)
|
|
})
|
|
})
|
|
afterAll(() => next.destroy())
|
|
|
|
it('should not allow dev WebSocket from cross-site', async () => {
|
|
const { server, port } = await createHostServer()
|
|
try {
|
|
const websocketSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const ws = new WebSocket("${next.url}/_next/webpack-hmr")
|
|
|
|
ws.addEventListener('error', (err) => {
|
|
statusEl.innerText = 'error'
|
|
})
|
|
ws.addEventListener('open', () => {
|
|
statusEl.innerText = 'connected'
|
|
})
|
|
})()`
|
|
|
|
// ensure direct port with mismatching port is blocked
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
await browser.eval(websocketSnippet)
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe('error')
|
|
})
|
|
|
|
// ensure different host is blocked
|
|
await browser.get(`https://example.vercel.sh/`)
|
|
await browser.eval(websocketSnippet)
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe('error')
|
|
})
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
|
|
it('should not allow loading scripts from cross-site', async () => {
|
|
const { server, port } = await createHostServer()
|
|
try {
|
|
const scriptSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const script = document.createElement('script')
|
|
script.src = "${next.url}/_next/static/chunks/pages/_app.js"
|
|
|
|
script.onerror = (err) => {
|
|
statusEl.innerText = 'error'
|
|
}
|
|
script.onload = () => {
|
|
statusEl.innerText = 'connected'
|
|
}
|
|
document.querySelector('body').appendChild(script)
|
|
})()`
|
|
|
|
// ensure direct port with mismatching port is blocked
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
await browser.eval(scriptSnippet)
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe('error')
|
|
})
|
|
|
|
// ensure different host is blocked
|
|
await browser.get(`https://example.vercel.sh/`)
|
|
await browser.eval(scriptSnippet)
|
|
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe('error')
|
|
})
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
|
|
it('should not allow loading internal middleware from cross-site', async () => {
|
|
const { server, port } = await createHostServer()
|
|
try {
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
|
|
const middlewareSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const xhr = new XMLHttpRequest()
|
|
xhr.open('GET', '${next.url}/__nextjs_error_feedback?errorCode=0&wasHelpful=true', true)
|
|
xhr.send()
|
|
|
|
xhr.onload = () => {
|
|
statusEl.innerText = "OK"
|
|
}
|
|
xhr.onerror = () => {
|
|
statusEl.innerText = "Unauthorized"
|
|
}
|
|
})()`
|
|
|
|
await browser.eval(middlewareSnippet)
|
|
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe(
|
|
'Unauthorized'
|
|
)
|
|
})
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
|
|
it('should load images regardless of allowed origins', async () => {
|
|
const { server, port } = await createHostServer()
|
|
try {
|
|
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
|
|
|
|
const imageSnippet = `(() => {
|
|
const statusEl = document.createElement('p')
|
|
statusEl.id = 'status'
|
|
document.querySelector('body').appendChild(statusEl)
|
|
|
|
const image = document.createElement('img')
|
|
image.src = "${next.url}/_next/image?url=%2Fimage.png&w=256&q=75"
|
|
document.querySelector('body').appendChild(image)
|
|
image.onload = () => {
|
|
statusEl.innerText = 'OK'
|
|
}
|
|
image.onerror = () => {
|
|
statusEl.innerText = 'Unauthorized'
|
|
}
|
|
})()`
|
|
|
|
await browser.eval(imageSnippet)
|
|
|
|
await retry(async () => {
|
|
expect(await browser.elementByCss('#status').text()).toBe('OK')
|
|
})
|
|
} finally {
|
|
server.close()
|
|
}
|
|
})
|
|
})
|
|
}
|
|
)
|