Skip to content

Commit aecf19d

Browse files
ztannerztanner
committed
separate the tests
1 parent 32eaab5 commit aecf19d

File tree

2 files changed

+278
-103
lines changed

2 files changed

+278
-103
lines changed

‎test/development/basic/allowed-dev-origins.test.ts

+277
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,277 @@
1+
import http from 'http'
2+
import { join } from 'path'
3+
import webdriver from 'next-webdriver'
4+
import { createNext, FileRef } from 'e2e-utils'
5+
import { NextInstance } from 'e2e-utils'
6+
import { fetchViaHTTP, findPort, retry } from 'next-test-utils'
7+
8+
describe.each([['', '/docs']])(
9+
'allowed-dev-origins, basePath: %p',
10+
(basePath: string) => {
11+
let next: NextInstance
12+
13+
describe('warn mode', () => {
14+
beforeAll(async () => {
15+
next = await createNext({
16+
files: {
17+
pages: new FileRef(join(__dirname, 'misc/pages')),
18+
public: new FileRef(join(__dirname, 'misc/public')),
19+
},
20+
nextConfig: {
21+
basePath,
22+
},
23+
})
24+
25+
await retry(async () => {
26+
// make sure host server is running
27+
const asset = await fetchViaHTTP(
28+
next.appPort,
29+
'/_next/static/chunks/pages/_app.js'
30+
)
31+
expect(asset.status).toBe(200)
32+
})
33+
})
34+
afterAll(() => next.destroy())
35+
36+
it('should warn about WebSocket from cross-site', async () => {
37+
let server = http.createServer((req, res) => {
38+
res.end(`
39+
<html>
40+
<head>
41+
<title>testing cross-site</title>
42+
</head>
43+
<body></body>
44+
</html>
45+
`)
46+
})
47+
try {
48+
const port = await findPort()
49+
await new Promise<void>((res) => {
50+
server.listen(port, () => res())
51+
})
52+
const websocketSnippet = `(() => {
53+
const statusEl = document.createElement('p')
54+
statusEl.id = 'status'
55+
document.querySelector('body').appendChild(statusEl)
56+
57+
const ws = new WebSocket("${next.url}/_next/webpack-hmr")
58+
59+
ws.addEventListener('error', (err) => {
60+
statusEl.innerText = 'error'
61+
})
62+
ws.addEventListener('open', () => {
63+
statusEl.innerText = 'connected'
64+
})
65+
})()`
66+
67+
// ensure direct port with mismatching port is blocked
68+
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
69+
await browser.eval(websocketSnippet)
70+
await retry(async () => {
71+
expect(await browser.elementByCss('#status').text()).toBe(
72+
'connected'
73+
)
74+
})
75+
76+
// ensure different host is blocked
77+
await browser.get(`https://example.vercel.sh/`)
78+
await browser.eval(websocketSnippet)
79+
await retry(async () => {
80+
expect(await browser.elementByCss('#status').text()).toBe(
81+
'connected'
82+
)
83+
})
84+
85+
expect(next.cliOutput).toContain('Cross origin request detected from')
86+
} finally {
87+
server.close()
88+
}
89+
})
90+
91+
it('should not allow loading scripts from cross-site', async () => {
92+
let server = http.createServer((req, res) => {
93+
res.end(`
94+
<html>
95+
<head>
96+
<title>testing cross-site</title>
97+
</head>
98+
<body></body>
99+
</html>
100+
`)
101+
})
102+
try {
103+
const port = await findPort()
104+
await new Promise<void>((res) => {
105+
server.listen(port, () => res())
106+
})
107+
const scriptSnippet = `(() => {
108+
const statusEl = document.createElement('p')
109+
statusEl.id = 'status'
110+
document.querySelector('body').appendChild(statusEl)
111+
112+
const script = document.createElement('script')
113+
script.src = "${next.url}/_next/static/chunks/pages/_app.js"
114+
115+
script.onerror = (err) => {
116+
statusEl.innerText = 'error'
117+
}
118+
script.onload = () => {
119+
statusEl.innerText = 'connected'
120+
}
121+
document.querySelector('body').appendChild(script)
122+
})()`
123+
124+
// ensure direct port with mismatching port is blocked
125+
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
126+
await browser.eval(scriptSnippet)
127+
128+
await retry(async () => {
129+
expect(await browser.elementByCss('#status').text()).toBe(
130+
'connected'
131+
)
132+
})
133+
134+
// ensure different host is blocked
135+
await browser.get(`https://example.vercel.sh/`)
136+
await browser.eval(scriptSnippet)
137+
138+
await retry(async () => {
139+
expect(await browser.elementByCss('#status').text()).toBe(
140+
'connected'
141+
)
142+
})
143+
144+
expect(next.cliOutput).toContain('Cross origin request detected from')
145+
} finally {
146+
server.close()
147+
}
148+
})
149+
})
150+
151+
describe('block mode', () => {
152+
beforeAll(async () => {
153+
next = await createNext({
154+
files: {
155+
pages: new FileRef(join(__dirname, 'misc/pages')),
156+
public: new FileRef(join(__dirname, 'misc/public')),
157+
},
158+
nextConfig: {
159+
basePath,
160+
allowedDevOrigins: ['localhost'],
161+
},
162+
})
163+
164+
await retry(async () => {
165+
// make sure host server is running
166+
const asset = await fetchViaHTTP(
167+
next.appPort,
168+
'/_next/static/chunks/pages/_app.js'
169+
)
170+
expect(asset.status).toBe(200)
171+
})
172+
})
173+
afterAll(() => next.destroy())
174+
175+
it('should not allow dev WebSocket from cross-site', async () => {
176+
let server = http.createServer((req, res) => {
177+
res.end(`
178+
<html>
179+
<head>
180+
<title>testing cross-site</title>
181+
</head>
182+
<body></body>
183+
</html>
184+
`)
185+
})
186+
try {
187+
const port = await findPort()
188+
await new Promise<void>((res) => {
189+
server.listen(port, () => res())
190+
})
191+
const websocketSnippet = `(() => {
192+
const statusEl = document.createElement('p')
193+
statusEl.id = 'status'
194+
document.querySelector('body').appendChild(statusEl)
195+
196+
const ws = new WebSocket("${next.url}/_next/webpack-hmr")
197+
198+
ws.addEventListener('error', (err) => {
199+
statusEl.innerText = 'error'
200+
})
201+
ws.addEventListener('open', () => {
202+
statusEl.innerText = 'connected'
203+
})
204+
})()`
205+
206+
// ensure direct port with mismatching port is blocked
207+
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
208+
await browser.eval(websocketSnippet)
209+
await retry(async () => {
210+
expect(await browser.elementByCss('#status').text()).toBe('error')
211+
})
212+
213+
// ensure different host is blocked
214+
await browser.get(`https://example.vercel.sh/`)
215+
await browser.eval(websocketSnippet)
216+
await retry(async () => {
217+
expect(await browser.elementByCss('#status').text()).toBe('error')
218+
})
219+
} finally {
220+
server.close()
221+
}
222+
})
223+
224+
it('should not allow loading scripts from cross-site', async () => {
225+
let server = http.createServer((req, res) => {
226+
res.end(`
227+
<html>
228+
<head>
229+
<title>testing cross-site</title>
230+
</head>
231+
<body></body>
232+
</html>
233+
`)
234+
})
235+
try {
236+
const port = await findPort()
237+
await new Promise<void>((res) => {
238+
server.listen(port, () => res())
239+
})
240+
const scriptSnippet = `(() => {
241+
const statusEl = document.createElement('p')
242+
statusEl.id = 'status'
243+
document.querySelector('body').appendChild(statusEl)
244+
245+
const script = document.createElement('script')
246+
script.src = "${next.url}/_next/static/chunks/pages/_app.js"
247+
248+
script.onerror = (err) => {
249+
statusEl.innerText = 'error'
250+
}
251+
script.onload = () => {
252+
statusEl.innerText = 'connected'
253+
}
254+
document.querySelector('body').appendChild(script)
255+
})()`
256+
257+
// ensure direct port with mismatching port is blocked
258+
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
259+
await browser.eval(scriptSnippet)
260+
await retry(async () => {
261+
expect(await browser.elementByCss('#status').text()).toBe('error')
262+
})
263+
264+
// ensure different host is blocked
265+
await browser.get(`https://example.vercel.sh/`)
266+
await browser.eval(scriptSnippet)
267+
268+
await retry(async () => {
269+
expect(await browser.elementByCss('#status').text()).toBe('error')
270+
})
271+
} finally {
272+
server.close()
273+
}
274+
})
275+
})
276+
}
277+
)

‎test/development/basic/misc.test.ts

+1-103
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
import url from 'url'
2-
import http from 'http'
32
import { join } from 'path'
43
import webdriver from 'next-webdriver'
54
import { createNext, FileRef } from 'e2e-utils'
65
import { NextInstance } from 'e2e-utils'
7-
import { fetchViaHTTP, findPort, renderViaHTTP, retry } from 'next-test-utils'
6+
import { fetchViaHTTP, renderViaHTTP } from 'next-test-utils'
87

98
describe.each([[''], ['/docs']])(
109
'misc basic dev tests, basePath: %p',
@@ -43,107 +42,6 @@ describe.each([[''], ['/docs']])(
4342
})
4443

4544
describe('With Security Related Issues', () => {
46-
it('should not allow dev WebSocket from cross-site', async () => {
47-
let server = http.createServer((req, res) => {
48-
res.end(`
49-
<html>
50-
<head>
51-
<title>testing cross-site</title>
52-
</head>
53-
<body></body>
54-
</html>
55-
`)
56-
})
57-
try {
58-
const port = await findPort()
59-
await new Promise<void>((res) => {
60-
server.listen(port, () => res())
61-
})
62-
const websocketSnippet = `(() => {
63-
const statusEl = document.createElement('p')
64-
statusEl.id = 'status'
65-
document.querySelector('body').appendChild(statusEl)
66-
67-
const ws = new WebSocket("${next.url}/_next/webpack-hmr")
68-
69-
ws.addEventListener('error', (err) => {
70-
statusEl.innerText = 'error'
71-
})
72-
ws.addEventListener('open', () => {
73-
statusEl.innerText = 'connected'
74-
})
75-
})()`
76-
77-
// ensure direct port with mismatching port is blocked
78-
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
79-
await browser.eval(websocketSnippet)
80-
await retry(async () => {
81-
expect(await browser.elementByCss('#status').text()).toBe('error')
82-
})
83-
84-
// ensure different host is blocked
85-
await browser.get(`https://example.vercel.sh/`)
86-
await browser.eval(websocketSnippet)
87-
await retry(async () => {
88-
expect(await browser.elementByCss('#status').text()).toBe('error')
89-
})
90-
} finally {
91-
server.close()
92-
}
93-
})
94-
95-
it('should not allow loading scripts from cross-site', async () => {
96-
let server = http.createServer((req, res) => {
97-
res.end(`
98-
<html>
99-
<head>
100-
<title>testing cross-site</title>
101-
</head>
102-
<body></body>
103-
</html>
104-
`)
105-
})
106-
try {
107-
const port = await findPort()
108-
await new Promise<void>((res) => {
109-
server.listen(port, () => res())
110-
})
111-
const scriptSnippet = `(() => {
112-
const statusEl = document.createElement('p')
113-
statusEl.id = 'status'
114-
document.querySelector('body').appendChild(statusEl)
115-
116-
const script = document.createElement('script')
117-
script.src = "${next.url}/_next/static/chunks/pages/_app.js"
118-
119-
script.onerror = (err) => {
120-
statusEl.innerText = 'error'
121-
}
122-
script.onload = () => {
123-
statusEl.innerText = 'connected'
124-
}
125-
document.querySelector('body').appendChild(script)
126-
})()`
127-
128-
// ensure direct port with mismatching port is blocked
129-
const browser = await webdriver(`http://127.0.0.1:${port}`, '/about')
130-
await browser.eval(scriptSnippet)
131-
await retry(async () => {
132-
expect(await browser.elementByCss('#status').text()).toBe('error')
133-
})
134-
135-
// ensure different host is blocked
136-
await browser.get(`https://example.vercel.sh/`)
137-
await browser.eval(scriptSnippet)
138-
139-
await retry(async () => {
140-
expect(await browser.elementByCss('#status').text()).toBe('error')
141-
})
142-
} finally {
143-
server.close()
144-
}
145-
})
146-
14745
it('should not allow accessing files outside .next/static and .next/server directory', async () => {
14846
const pathsToCheck = [
14947
basePath + '/_next/static/../BUILD_ID',

0 commit comments

Comments
 (0)