Merge branch 'master' into fix/canary

examples/data-fetch/README.md

@@ -38,6 +38,6 @@ now
 ## The idea behind the example
 
 Next.js was conceived to make it easy to create universal apps. That's why fetching data
-on the server and the client when necessary it's so easy with Next.
+on the server and the client when necessary is so easy with Next.
 
-Using `getInitialProps` we will fetch data in the server for SSR and then in the client only when the component is re-mounted but not in the first paint.
+Using `getInitialProps` fetches data on the server for SSR and then on the client when the component is re-mounted (not on the first paint).

package.json

@@ -1,6 +1,6 @@
 {
   "name": "next",
-  "version": "4.3.0-canary.1",
+  "version": "4.2.3",
   "description": "Minimalistic framework for server-rendered React applications",
   "main": "./dist/server/next.js",
   "license": "MIT",
@@ -29,9 +29,8 @@
     "pretestonly": "taskr pretest",
     "testonly": "cross-env NODE_PATH=test/lib jest \\.test.js",
     "posttestonly": "taskr posttest",
-    "testall": "npm run testonly -- --coverage --forceExit --runInBand --verbose --bail",
     "pretest": "npm run lint",
-    "test": "cross-env npm run testall || npm run testall",
+    "test": "npm run testonly -- --coverage --forceExit --runInBand --verbose --bail",
     "coveralls": "nyc --instrument=false --source-map=false report --temp-directory=./coverage --reporter=text-lcov | coveralls",
     "lint": "standard 'bin/*' 'client/**/*.js' 'examples/**/*.js' 'lib/**/*.js' 'pages/**/*.js' 'server/**/*.js' 'test/**/*.js'",
     "prepublish": "npm run release",
@@ -70,11 +69,10 @@
     "cross-spawn": "5.1.0",
     "del": "3.0.0",
     "etag": "1.8.1",
-    "find-up": "2.1.0",
     "fresh": "0.5.2",
     "friendly-errors-webpack-plugin": "1.6.1",
     "glob": "7.1.2",
-    "glob-promise": "3.3.0",
+    "glob-promise": "3.2.0",
     "hoist-non-react-statics": "2.3.1",
     "htmlescape": "1.1.1",
     "http-status": "1.0.1",
@@ -104,10 +102,10 @@
     "webpack-dev-middleware": "1.12.0",
     "webpack-hot-middleware": "2.19.1",
     "write-file-webpack-plugin": "4.2.0",
-    "xss-filters": "1.2.7",
-    "uglifyjs-webpack-plugin": "^1.1.1"
+    "xss-filters": "1.2.7"
   },
   "devDependencies": {
+    "uglifyjs-webpack-plugin": "^1.1.1"
     "@taskr/babel": "1.1.0",
     "@taskr/clear": "1.1.0",
     "@taskr/esnext": "1.1.0",
@@ -131,8 +129,8 @@
     "node-notifier": "5.1.2",
     "nyc": "11.2.1",
     "portfinder": "1.0.13",
-    "react": "16.2.0",
-    "react-dom": "16.2.0",
+    "react": "16.0.0",
+    "react-dom": "16.0.0",
     "standard": "9.0.2",
     "taskr": "1.1.0",
     "wd": "1.4.1"

server/index.js

@@ -8,7 +8,6 @@ import {
   renderErrorToHTML,
   sendHTML,
   serveStatic,
-  renderScript,
   renderScriptError
 } from './render'
 import Router from './router'
@@ -197,9 +196,9 @@ export default class Server {
 
       '/_next/:buildId/page/:path*': async (req, res, params) => {
         const paths = params.path || ['']
-        // We need to remove `.js` from the page otherwise it won't work with
-        // page rewrites
-        // eg:- we re-write page/index.js into page.js
+        // URL is asks for ${page}.js (to support loading assets from static dirs)
+        // But there's no .js in the actual page.
+        // So, we need to remove .js to get the page name.
         const page = `/${paths.join('/')}`.replace('.js', '')
 
         if (!this.handleBuildId(params.buildId, res)) {
@@ -223,7 +222,8 @@ export default class Server {
           }
         }
 
-        await renderScript(req, res, page, this.renderOpts)
+        const p = join(this.dir, this.dist, 'bundles', 'pages', paths.join('/'))
+        await this.serveStatic(req, res, p)
       },
 
       // It's very important keep this route's param optional.

test/integration/ondemand/test/index.test.js

@@ -30,7 +30,7 @@ describe('On Demand Entries', () => {
   })
 
   it('should compile pages for JSON page requests', async () => {
-    const pageContent = await renderViaHTTP(context.appPort, '/_next/-/page/about')
+    const pageContent = await renderViaHTTP(context.appPort, '/_next/-/page/about.js')
     expect(pageContent.includes('About Page')).toBeTruthy()
   })
 
@@ -39,11 +39,11 @@ describe('On Demand Entries', () => {
     expect(existsSync(indexPagePath)).toBeTruthy()
 
     // Render two pages after the index, since the server keeps at least two pages
-    await renderViaHTTP(context.appPort, '/_next/-/page/about')
+    await renderViaHTTP(context.appPort, '/about')
     await renderViaHTTP(context.appPort, '/_next/on-demand-entries-ping', {page: '/about'})
     const aboutPagePath = resolve(__dirname, '../.next/bundles/pages/about.js')
 
-    await renderViaHTTP(context.appPort, '/_next/-/page/third')
+    await renderViaHTTP(context.appPort, '/third')
     await renderViaHTTP(context.appPort, '/_next/on-demand-entries-ping', {page: '/third'})
     const thirdPagePath = resolve(__dirname, '../.next/bundles/pages/third.js')
 

test/integration/production/info.json

@@ -0,0 +1,3 @@
+{
+  "version": "cool-version"
+}

test/integration/production/test/index.test.js

@@ -13,6 +13,7 @@ import {
 import webdriver from 'next-webdriver'
 import fetch from 'node-fetch'
 import dynamicImportTests from '../../basic/test/dynamic'
+import { readFileSync } from 'fs'
 
 const appDir = join(__dirname, '../')
 let appPort
@@ -110,6 +111,21 @@ describe('Production Usage', () => {
       const data = await renderViaHTTP(appPort, '/static/data/item.txt')
       expect(data).toBe('item')
     })
+
+    it('should only access files inside .next directory', async () => {
+      const buildId = readFileSync(join(__dirname, '../.next/BUILD_ID'), 'utf8')
+
+      const pathsToCheck = [
+        `/_next/${buildId}/page/../../../info`,
+        `/_next/${buildId}/page/../../../info.js`,
+        `/_next/${buildId}/page/../../../info.json`
+      ]
+
+      for (const path of pathsToCheck) {
+        const data = await renderViaHTTP(appPort, path)
+        expect(data.includes('cool-version')).toBeFalsy()
+      }
+    })
   })
 
   describe('X-Powered-By header', () => {