Make sure the /static working properly. (#2675)

server/index.js

@@ -171,12 +171,20 @@ export default class Server {
         await renderScript(req, res, page, this.renderOpts)
       },
 
-      '/_next/:path?': async (req, res, params) => {
+      // It's very important keep this route's param optional.
+      // (but it should support as many as params, seperated by '/')
+      // Othewise this will lead to a pretty simple DOS attack.
+      // See more: https://github.com/zeit/next.js/issues/2617
+      '/_next/:path*': async (req, res, params) => {
         const p = join(__dirname, '..', 'client', ...(params.path || []))
         await this.serveStatic(req, res, p)
       },
 
-      '/static/:path?': async (req, res, params) => {
+      // It's very important keep this route's param optional.
+      // (but it should support as many as params, seperated by '/')
+      // Othewise this will lead to a pretty simple DOS attack.
+      // See more: https://github.com/zeit/next.js/issues/2617
+      '/static/:path*': async (req, res, params) => {
         const p = join(this.dir, 'static', ...(params.path || []))
         await this.serveStatic(req, res, p)
       }

test/integration/production/static/data/item.txt

@@ -0,0 +1 @@
+item

test/integration/production/test/index.test.js

@@ -77,4 +77,15 @@ describe('Production Usage', () => {
       browser.close()
     })
   })
+
+  describe('Misc', () => {
+    it('should allow to access /static/ and /_next/', async () => {
+      // This is a test case which prevent the following issue happening again.
+      // See: https://github.com/zeit/next.js/issues/2617
+      await renderViaHTTP(appPort, '/_next/')
+      await renderViaHTTP(appPort, '/static/')
+      const data = await renderViaHTTP(appPort, '/static/data/item.txt')
+      expect(data).toBe('item')
+    })
+  })
 })