webpack-dev-server 3.1.10 → 3.1.14

package/CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="3.1.14"></a>
+## [3.1.14](https://github.com/webpack/webpack-dev-server/compare/v3.1.13...v3.1.14) (2018-12-24)
+
+
+### Bug Fixes
+
+* add workaround for Origin header in sockjs ([#1608](https://github.com/webpack/webpack-dev-server/issues/1608)) ([1dfd4fb](https://github.com/webpack/webpack-dev-server/commit/1dfd4fb))
+
+
+
+<a name="3.1.13"></a>
+## [3.1.13](https://github.com/webpack/webpack-dev-server/compare/v3.1.12...v3.1.13) (2018-12-22)
+
+
+### Bug Fixes
+
+* delete a comma for Node.js <= v7.x ([#1609](https://github.com/webpack/webpack-dev-server/issues/1609)) ([0bab1c0](https://github.com/webpack/webpack-dev-server/commit/0bab1c0))
+
+
+
+<a name="3.1.12"></a>
+## [3.1.12](https://github.com/webpack/webpack-dev-server/compare/v3.1.11...v3.1.12) (2018-12-22)
+
+
+### Bug Fixes
+
+* regression in `checkHost` for checking Origin header ([#1606](https://github.com/webpack/webpack-dev-server/issues/1606)) ([8bb3ca8](https://github.com/webpack/webpack-dev-server/commit/8bb3ca8))
+
+
+
+<a name="3.1.11"></a>
+## [3.1.11](https://github.com/webpack/webpack-dev-server/compare/v3.1.10...v3.1.11) (2018-12-21)
+
+
+### Bug Fixes
+
+* **bin/options:** correct check for color support (`options.color`) ([#1555](https://github.com/webpack/webpack-dev-server/issues/1555)) ([55398b5](https://github.com/webpack/webpack-dev-server/commit/55398b5))
+* **package:** update `spdy` v3.4.1...4.0.0 (assertion error) ([#1491](https://github.com/webpack/webpack-dev-server/issues/1491)) ([#1563](https://github.com/webpack/webpack-dev-server/issues/1563)) ([7a3a257](https://github.com/webpack/webpack-dev-server/commit/7a3a257))
+* **Server:** correct `node` version checks ([#1543](https://github.com/webpack/webpack-dev-server/issues/1543)) ([927a2b3](https://github.com/webpack/webpack-dev-server/commit/927a2b3))
+* **Server:** mime type for wasm in contentBase directory ([#1575](https://github.com/webpack/webpack-dev-server/issues/1575)) ([#1580](https://github.com/webpack/webpack-dev-server/issues/1580)) ([fadae5d](https://github.com/webpack/webpack-dev-server/commit/fadae5d))
+* add url for compatibility with webpack@5 ([#1598](https://github.com/webpack/webpack-dev-server/issues/1598)) ([#1599](https://github.com/webpack/webpack-dev-server/issues/1599)) ([68dd49a](https://github.com/webpack/webpack-dev-server/commit/68dd49a))
+* check origin header for websocket connection ([#1603](https://github.com/webpack/webpack-dev-server/issues/1603)) ([b3217ca](https://github.com/webpack/webpack-dev-server/commit/b3217ca))
+
+
+
 <a name="3.1.10"></a>
 ## [3.1.10](https://github.com/webpack/webpack-dev-server/compare/v3.1.9...v3.1.10) (2018-10-23)
 

package/bin/options.js

@@ -57,7 +57,9 @@ const options = {
     type: 'boolean',
     alias: 'colors',
     default: function supportsColor() {
-      return require('supports-color');
+      // Use `require('supports-color').stdout` for supports-color >= 5.0.0.
+      // See https://github.com/webpack/webpack-dev-server/pull/1555.
+      return require('supports-color').stdout;
     },
     group: DISPLAY_GROUP,
     describe: 'Enables/Disables colors on the console'

package/lib/Server.js

@@ -20,6 +20,8 @@ const https = require('https');
 const spdy = require('spdy');
 const sockjs = require('sockjs');
 
+const semver = require('semver');
+
 const killable = require('killable');
 
 const del = require('del');
@@ -41,13 +43,28 @@ const createCertificate = require('./utils/createCertificate');
 const validateOptions = require('schema-utils');
 const schema = require('./options.json');
 
+// Workaround for sockjs@~0.3.19
+// sockjs will remove Origin header, however Origin header is required for checking host.
+// See https://github.com/webpack/webpack-dev-server/issues/1604 for more information
+{
+  // eslint-disable-next-line global-require
+  const SockjsSession = require('sockjs/lib/transport').Session;
+  const decorateConnection = SockjsSession.prototype.decorateConnection;
+  SockjsSession.prototype.decorateConnection = function(req) {
+    decorateConnection.call(this, req);
+    const connection = this.connection;
+    if (connection.headers && !('origin' in connection.headers) && 'origin' in req.headers) {
+      connection.headers.origin = req.headers.origin;
+    }
+  };
+}
+
 // Workaround for node ^8.6.0, ^9.0.0
 // DEFAULT_ECDH_CURVE is default to prime256v1 in these version
 // breaking connection when certificate is not signed with prime256v1
 // change it to auto allows OpenSSL to select the curve automatically
 // See https://github.com/nodejs/node/issues/16196 for more infomation
-const version = parseFloat(process.version.slice(1));
-if (version >= 8.6 && version < 10) {
+if (semver.satisfies(process.version, '8.6.0 - 9')) {
   tls.DEFAULT_ECDH_CURVE = 'auto';
 }
 
@@ -131,6 +148,10 @@ function Server (compiler, options = {}, _log) {
   // eslint-disable-next-line
   const app = this.app = new express();
 
+  // ref: https://github.com/webpack/webpack-dev-server/issues/1575
+  // remove this when send@^0.16.3
+  express.static.mime.types.wasm = 'application/wasm';
+
   app.all('*', (req, res, next) => {
     if (this.checkHost(req.headers)) {
       return next();
@@ -592,7 +613,7 @@ function Server (compiler, options = {}, _log) {
     // - https://github.com/nodejs/node/issues/21665
     // - https://github.com/webpack/webpack-dev-server/issues/1449
     // - https://github.com/expressjs/express/issues/3388
-    if (version >= 10) {
+    if (semver.gte(process.version, '10.0.0')) {
       this.listeningApp = https.createServer(options.https, app);
     } else {
       this.listeningApp = spdy.createServer(options.https, app);
@@ -625,21 +646,28 @@ Server.prototype.setContentHeaders = function (req, res, next) {
   next();
 };
 
-Server.prototype.checkHost = function (headers) {
+Server.prototype.checkHost = function (headers, headerToCheck) {
   // allow user to opt-out this security check, at own risk
   if (this.disableHostCheck) {
     return true;
   }
+
+  if (!headerToCheck) headerToCheck = 'host';
   // get the Host header and extract hostname
   // we don't care about port not matching
-  const hostHeader = headers.host;
+  const hostHeader = headers[headerToCheck];
 
   if (!hostHeader) {
     return false;
   }
 
   // use the node url-parser to retrieve the hostname from the host-header.
-  const hostname = url.parse(`//${hostHeader}`, false, true).hostname;
+  const hostname = url.parse(
+    // if hostHeader doesn't have scheme, add // for parsing.
+    /^(.+:)?\/\//.test(hostHeader) ? hostHeader : `//${hostHeader}`,
+    false,
+    true
+  ).hostname;
   // always allow requests with explicit IPv4 or IPv6-address.
   // A note on IPv6 addresses:
   // hostHeader will always contain the brackets denoting
@@ -720,8 +748,8 @@ Server.prototype.listen = function (port, hostname, fn) {
         return;
       }
 
-      if (!this.checkHost(connection.headers)) {
-        this.sockWrite([ connection ], 'error', 'Invalid Host header');
+      if (!this.checkHost(connection.headers) || !this.checkHost(connection.headers, 'origin')) {
+        this.sockWrite([ connection ], 'error', 'Invalid Host/Origin header');
 
         connection.close();
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webpack-dev-server",
-  "version": "3.1.10",
+  "version": "3.1.14",
   "description": "Serves a webpack app. Updates the browser on changes.",
   "bin": "bin/webpack-dev-server.js",
   "main": "lib/Server.js",
@@ -44,12 +44,14 @@
     "portfinder": "^1.0.9",
     "schema-utils": "^1.0.0",
     "selfsigned": "^1.9.1",
+    "semver": "^5.6.0",
     "serve-index": "^1.7.2",
     "sockjs": "0.3.19",
     "sockjs-client": "1.3.0",
-    "spdy": "^3.4.1",
+    "spdy": "^4.0.0",
     "strip-ansi": "^3.0.0",
     "supports-color": "^5.1.0",
+    "url": "^0.11.0",
     "webpack-dev-middleware": "3.4.0",
     "webpack-log": "^2.0.0",
     "yargs": "12.0.2"