webpack-dev-server 3.1.10 → 3.1.11

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="3.1.11"></a>
+## [3.1.11](https://github.com/webpack/webpack-dev-server/compare/v3.1.10...v3.1.11) (2018-12-21)
+
+
+### Bug Fixes
+
+* **bin/options:** correct check for color support (`options.color`) ([#1555](https://github.com/webpack/webpack-dev-server/issues/1555)) ([55398b5](https://github.com/webpack/webpack-dev-server/commit/55398b5))
+* **package:** update `spdy` v3.4.1...4.0.0 (assertion error) ([#1491](https://github.com/webpack/webpack-dev-server/issues/1491)) ([#1563](https://github.com/webpack/webpack-dev-server/issues/1563)) ([7a3a257](https://github.com/webpack/webpack-dev-server/commit/7a3a257))
+* **Server:** correct `node` version checks ([#1543](https://github.com/webpack/webpack-dev-server/issues/1543)) ([927a2b3](https://github.com/webpack/webpack-dev-server/commit/927a2b3))
+* **Server:** mime type for wasm in contentBase directory ([#1575](https://github.com/webpack/webpack-dev-server/issues/1575)) ([#1580](https://github.com/webpack/webpack-dev-server/issues/1580)) ([fadae5d](https://github.com/webpack/webpack-dev-server/commit/fadae5d))
+* add url for compatibility with webpack@5 ([#1598](https://github.com/webpack/webpack-dev-server/issues/1598)) ([#1599](https://github.com/webpack/webpack-dev-server/issues/1599)) ([68dd49a](https://github.com/webpack/webpack-dev-server/commit/68dd49a))
+* check origin header for websocket connection ([#1603](https://github.com/webpack/webpack-dev-server/issues/1603)) ([b3217ca](https://github.com/webpack/webpack-dev-server/commit/b3217ca))
+
+
+
 <a name="3.1.10"></a>
 ## [3.1.10](https://github.com/webpack/webpack-dev-server/compare/v3.1.9...v3.1.10) (2018-10-23)
 

package/bin/options.js

@@ -57,7 +57,9 @@ const options = {
     type: 'boolean',
     alias: 'colors',
     default: function supportsColor() {
-      return require('supports-color');
+      // Use `require('supports-color').stdout` for supports-color >= 5.0.0.
+      // See https://github.com/webpack/webpack-dev-server/pull/1555.
+      return require('supports-color').stdout;
     },
     group: DISPLAY_GROUP,
     describe: 'Enables/Disables colors on the console'

package/lib/Server.js

@@ -20,6 +20,8 @@ const https = require('https');
 const spdy = require('spdy');
 const sockjs = require('sockjs');
 
+const semver = require('semver');
+
 const killable = require('killable');
 
 const del = require('del');
@@ -46,8 +48,7 @@ const schema = require('./options.json');
 // breaking connection when certificate is not signed with prime256v1
 // change it to auto allows OpenSSL to select the curve automatically
 // See https://github.com/nodejs/node/issues/16196 for more infomation
-const version = parseFloat(process.version.slice(1));
-if (version >= 8.6 && version < 10) {
+if (semver.satisfies(process.version, '8.6.0 - 9')) {
   tls.DEFAULT_ECDH_CURVE = 'auto';
 }
 
@@ -131,6 +132,10 @@ function Server (compiler, options = {}, _log) {
   // eslint-disable-next-line
   const app = this.app = new express();
 
+  // ref: https://github.com/webpack/webpack-dev-server/issues/1575
+  // remove this when send@^0.16.3
+  express.static.mime.types.wasm = 'application/wasm';
+
   app.all('*', (req, res, next) => {
     if (this.checkHost(req.headers)) {
       return next();
@@ -592,7 +597,7 @@ function Server (compiler, options = {}, _log) {
     // - https://github.com/nodejs/node/issues/21665
     // - https://github.com/webpack/webpack-dev-server/issues/1449
     // - https://github.com/expressjs/express/issues/3388
-    if (version >= 10) {
+    if (semver.gte(process.version, '10.0.0')) {
       this.listeningApp = https.createServer(options.https, app);
     } else {
       this.listeningApp = spdy.createServer(options.https, app);
@@ -625,14 +630,16 @@ Server.prototype.setContentHeaders = function (req, res, next) {
   next();
 };
 
-Server.prototype.checkHost = function (headers) {
+Server.prototype.checkHost = function (headers, headerToCheck) {
   // allow user to opt-out this security check, at own risk
   if (this.disableHostCheck) {
     return true;
   }
+
+  if (!headerToCheck) headerToCheck = 'host';
   // get the Host header and extract hostname
   // we don't care about port not matching
-  const hostHeader = headers.host;
+  const hostHeader = headers[headerToCheck];
 
   if (!hostHeader) {
     return false;
@@ -720,8 +727,8 @@ Server.prototype.listen = function (port, hostname, fn) {
         return;
       }
 
-      if (!this.checkHost(connection.headers)) {
-        this.sockWrite([ connection ], 'error', 'Invalid Host header');
+      if (!this.checkHost(connection.headers) || !this.checkHost(connection.headers, 'origin')) {
+        this.sockWrite([ connection ], 'error', 'Invalid Host/Origin header');
 
         connection.close();
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webpack-dev-server",
-  "version": "3.1.10",
+  "version": "3.1.11",
   "description": "Serves a webpack app. Updates the browser on changes.",
   "bin": "bin/webpack-dev-server.js",
   "main": "lib/Server.js",
@@ -44,12 +44,14 @@
     "portfinder": "^1.0.9",
     "schema-utils": "^1.0.0",
     "selfsigned": "^1.9.1",
+    "semver": "^5.6.0",
     "serve-index": "^1.7.2",
     "sockjs": "0.3.19",
     "sockjs-client": "1.3.0",
-    "spdy": "^3.4.1",
+    "spdy": "^4.0.0",
     "strip-ansi": "^3.0.0",
     "supports-color": "^5.1.0",
+    "url": "^0.11.0",
     "webpack-dev-middleware": "3.4.0",
     "webpack-log": "^2.0.0",
     "yargs": "12.0.2"