Ensure invalid request to static page is handled correctly (#34346)

* Ensure invalid request to static page is handled correctly * update test
vercel · Feb 15, 2022 · 982b65a · 982b65a
1 parent 4500cb7
commit 982b65a
Show file tree

Hide file tree

Showing 5 changed files with 48 additions and 1 deletion.
diff --git a/packages/next/server/base-server.ts b/packages/next/server/base-server.ts
@@ -1143,6 +1143,23 @@ export default abstract class Server {
       res.statusCode = parseInt(pathname.substr(1), 10)
     }
 
+    // static pages can only respond to GET/HEAD
+    // requests so ensure we respond with 405 for
+    // invalid requests
+    if (
+      !is404Page &&
+      !is500Page &&
+      pathname !== '/_error' &&
+      req.method !== 'HEAD' &&
+      req.method !== 'GET' &&
+      (typeof components.Component === 'string' || isSSG)
+    ) {
+      res.statusCode = 405
+      res.setHeader('Allow', ['GET', 'HEAD'])
+      await this.renderError(null, req, res, pathname)
+      return null
+    }
+
     // handle static page
     if (typeof components.Component === 'string') {
       return {

diff --git a/test/e2e/getserversideprops/test/index.test.ts b/test/e2e/getserversideprops/test/index.test.ts
@@ -290,6 +290,14 @@ const runTests = (dev = false) => {
     expect(await res.text()).toBe('hello from gssp')
   })
 
+  it('should allow POST request for getServerSideProps page', async () => {
+    const res = await fetchViaHTTP(next.url, '/', undefined, {
+      method: 'POST',
+    })
+    expect(res.status).toBe(200)
+    expect(await res.text()).toMatch(/hello.*?world/)
+  })
+
   it('should render correctly when notFound is false (non-dynamic)', async () => {
     const res = await fetchViaHTTP(next.url, '/not-found')
 

diff --git a/test/e2e/prerender.test.ts b/test/e2e/prerender.test.ts
@@ -422,6 +422,14 @@ describe('Prerender', () => {
   const runTests = (dev = false) => {
     navigateTest(dev)
 
+    it('should respond with 405 for POST to static page', async () => {
+      const res = await fetchViaHTTP(next.url, '/', undefined, {
+        method: 'POST',
+      })
+      expect(res.status).toBe(405)
+      expect(await res.text()).toContain('Method Not Allowed')
+    })
+
     it('should SSR normal page correctly', async () => {
       const html = await renderViaHTTP(next.url, '/')
       expect(html).toMatch(/hello.*?world/)

diff --git a/test/integration/api-support/pages/user.js b/test/integration/api-support/pages/user.js
@@ -1,3 +1,9 @@
 export default function Page() {
   return <div>User</div>
 }
+
+export function getServerSideProps() {
+  return {
+    props: {},
+  }
+}
diff --git a/test/integration/production/test/index.test.js b/test/integration/production/test/index.test.js
@@ -69,6 +69,14 @@ describe('Production Usage', () => {
     )
   })
 
+  it('should respond with 405 for POST to static page', async () => {
+    const res = await fetchViaHTTP(appPort, '/', undefined, {
+      method: 'POST',
+    })
+    expect(res.status).toBe(405)
+    expect(await res.text()).toContain('Method Not Allowed')
+  })
+
   it('should contain generated page count in output', async () => {
     const pageCount = 40
     expect(output).toContain(`Generating static pages (0/${pageCount})`)
@@ -369,7 +377,7 @@ describe('Production Usage', () => {
     it('should render 200 for POST on page', async () => {
       const res = await fetchViaHTTP(
         `http://localhost:${appPort}`,
-        '/about',
+        '/fully-dynamic',
         undefined,
         {
           method: 'POST',