Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make sure to error when setting too large of preview data #10831

Merged
merged 2 commits into from Mar 4, 2020
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 10 additions & 1 deletion packages/next/next-server/server/api-utils.ts
Expand Up @@ -361,12 +361,21 @@ function setPreviewData<T>(
throw new Error('invariant: invalid previewModeSigningKey')
}

const stringifiedData = JSON.stringify(data)

// preview mode cookie can't exceed 4KB or else the browser will drop it
if (stringifiedData.length > 4000) {
ijjk marked this conversation as resolved.
Show resolved Hide resolved
throw new Error(
`Preview data can not exceed 4KB as this exceeds the cookie limit`
)
}

const jsonwebtoken = require('jsonwebtoken') as typeof import('jsonwebtoken')

const payload = jsonwebtoken.sign(
encryptWithSecret(
Buffer.from(options.previewModeEncryptionKey),
JSON.stringify(data)
stringifiedData
),
options.previewModeSigningKey,
{
Expand Down
@@ -1,4 +1,13 @@
export default (req, res) => {
res.setPreviewData(req.query)
if (req.query.tooBig) {
try {
res.setPreviewData(new Array(4000).fill('a'))
} catch (err) {
return res.status(500).end('too big')
}
} else {
res.setPreviewData(req.query)
}

res.status(200).end()
}
Expand Up @@ -156,6 +156,12 @@ function runTests(startServer = nextStart) {
expect(cookies[1]).not.toHaveProperty('Max-Age')
})

it('should throw error when setting too large of preview data', async () => {
const res = await fetchViaHTTP(appPort, '/api/preview?tooBig=true')
expect(res.status).toBe(500)
expect(await res.text()).toBe('too big')
})

/** @type import('next-webdriver').Chain */
let browser
it('should start the client-side browser', async () => {
Expand Down
11 changes: 10 additions & 1 deletion test/integration/prerender-preview/pages/api/preview.js
@@ -1,4 +1,13 @@
export default (req, res) => {
res.setPreviewData(req.query)
if (req.query.tooBig) {
try {
res.setPreviewData(new Array(4000).fill('a'))
} catch (err) {
return res.status(500).end('too big')
}
} else {
res.setPreviewData(req.query)
}

res.status(200).end()
}
6 changes: 6 additions & 0 deletions test/integration/prerender-preview/test/index.test.js
Expand Up @@ -63,6 +63,12 @@ function runTests(startServer = nextStart) {
expect(pre).toBe('undefined and undefined')
})

it('should throw error when setting too large of preview data', async () => {
const res = await fetchViaHTTP(appPort, '/api/preview?tooBig=true')
expect(res.status).toBe(500)
expect(await res.text()).toBe('too big')
})

let previewCookieString
it('should enable preview mode', async () => {
const res = await fetchViaHTTP(appPort, '/api/preview', { lets: 'goooo' })
Expand Down