Merge branch 'master' into patch-2

Author: evilebottnawi

.travis.yml

@@ -18,7 +18,9 @@ jobs:
       stage: Test (MacOS)
       os: 'osx'
       env: SCRIPT=test
-      node_js: 'stable'
+      # Node 10 instead of 'stable' since Node 11 segfaults
+      # https://github.com/webpack/webpack-dev-server/pull/1588
+      node_js: 10
     - <<: *osx
       node_js: 'lts/*'
     - <<: *osx

CHANGELOG.md

@@ -2,6 +2,51 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="3.1.14"></a>
+## [3.1.14](https://github.com/webpack/webpack-dev-server/compare/v3.1.13...v3.1.14) (2018-12-24)
+
+
+### Bug Fixes
+
+* add workaround for Origin header in sockjs ([#1608](https://github.com/webpack/webpack-dev-server/issues/1608)) ([1dfd4fb](https://github.com/webpack/webpack-dev-server/commit/1dfd4fb))
+
+
+
+<a name="3.1.13"></a>
+## [3.1.13](https://github.com/webpack/webpack-dev-server/compare/v3.1.12...v3.1.13) (2018-12-22)
+
+
+### Bug Fixes
+
+* delete a comma for Node.js <= v7.x ([#1609](https://github.com/webpack/webpack-dev-server/issues/1609)) ([0bab1c0](https://github.com/webpack/webpack-dev-server/commit/0bab1c0))
+
+
+
+<a name="3.1.12"></a>
+## [3.1.12](https://github.com/webpack/webpack-dev-server/compare/v3.1.11...v3.1.12) (2018-12-22)
+
+
+### Bug Fixes
+
+* regression in `checkHost` for checking Origin header ([#1606](https://github.com/webpack/webpack-dev-server/issues/1606)) ([8bb3ca8](https://github.com/webpack/webpack-dev-server/commit/8bb3ca8))
+
+
+
+<a name="3.1.11"></a>
+## [3.1.11](https://github.com/webpack/webpack-dev-server/compare/v3.1.10...v3.1.11) (2018-12-21)
+
+
+### Bug Fixes
+
+* **bin/options:** correct check for color support (`options.color`) ([#1555](https://github.com/webpack/webpack-dev-server/issues/1555)) ([55398b5](https://github.com/webpack/webpack-dev-server/commit/55398b5))
+* **package:** update `spdy` v3.4.1...4.0.0 (assertion error) ([#1491](https://github.com/webpack/webpack-dev-server/issues/1491)) ([#1563](https://github.com/webpack/webpack-dev-server/issues/1563)) ([7a3a257](https://github.com/webpack/webpack-dev-server/commit/7a3a257))
+* **Server:** correct `node` version checks ([#1543](https://github.com/webpack/webpack-dev-server/issues/1543)) ([927a2b3](https://github.com/webpack/webpack-dev-server/commit/927a2b3))
+* **Server:** mime type for wasm in contentBase directory ([#1575](https://github.com/webpack/webpack-dev-server/issues/1575)) ([#1580](https://github.com/webpack/webpack-dev-server/issues/1580)) ([fadae5d](https://github.com/webpack/webpack-dev-server/commit/fadae5d))
+* add url for compatibility with webpack@5 ([#1598](https://github.com/webpack/webpack-dev-server/issues/1598)) ([#1599](https://github.com/webpack/webpack-dev-server/issues/1599)) ([68dd49a](https://github.com/webpack/webpack-dev-server/commit/68dd49a))
+* check origin header for websocket connection ([#1603](https://github.com/webpack/webpack-dev-server/issues/1603)) ([b3217ca](https://github.com/webpack/webpack-dev-server/commit/b3217ca))
+
+
+
 <a name="3.1.10"></a>
 ## [3.1.10](https://github.com/webpack/webpack-dev-server/compare/v3.1.9...v3.1.10) (2018-10-23)
 

README.md

@@ -19,6 +19,17 @@ live reloading. This should be used for **development only**.
 It uses [webpack-dev-middleware][middleware-url] under the hood, which provides
 fast in-memory access to the webpack assets.
 
+## Table of Contents
+
+1. [Getting Started](#getting-started)
+2. [Usage](#usage)
+3. [Browser Support](#browser-support)
+4. [Support](#support)
+5. [Contributing](#contributing)
+6. [Maintainers](#maintainers)
+7. [Attribution](#attribution)
+8. [License](#license)
+
 ## Getting Started
 
 First things first, install the module:
@@ -43,6 +54,7 @@ The easiest way to use it is with the CLI. In the directory where your
 ```console
 node_modules/.bin/webpack-dev-server
 ```
+_**Note**: Many CLI options are available with `webpack-dev-server`. Explore this [link](https://webpack.js.org/configuration/dev-server/)._
 
 ### With NPM Scripts
 

examples/cli/compression/README.md

@@ -11,7 +11,7 @@ npm run webpack-dev-server -- --open --compress
 
 ## What should happen
 
-1. The script should open `https://localhost:8080/`.
+1. The script should open `http://localhost:8080/`.
 2. Files being sent to the browser from the `webpack` bundle should be gzipped.
 3. Open the console in your browser's devtools and select the _Network_ tab.
 4. Find `bundle.js`. The response headers should contain `Content-Encoding: gzip`.

lib/Server.js

@@ -43,6 +43,22 @@ const createCertificate = require('./utils/createCertificate');
 const validateOptions = require('schema-utils');
 const schema = require('./options.json');
 
+// Workaround for sockjs@~0.3.19
+// sockjs will remove Origin header, however Origin header is required for checking host.
+// See https://github.com/webpack/webpack-dev-server/issues/1604 for more information
+{
+  // eslint-disable-next-line global-require
+  const SockjsSession = require('sockjs/lib/transport').Session;
+  const decorateConnection = SockjsSession.prototype.decorateConnection;
+  SockjsSession.prototype.decorateConnection = function(req) {
+    decorateConnection.call(this, req);
+    const connection = this.connection;
+    if (connection.headers && !('origin' in connection.headers) && 'origin' in req.headers) {
+      connection.headers.origin = req.headers.origin;
+    }
+  };
+}
+
 // Workaround for node ^8.6.0, ^9.0.0
 // DEFAULT_ECDH_CURVE is default to prime256v1 in these version
 // breaking connection when certificate is not signed with prime256v1
@@ -134,6 +150,10 @@ function Server (compiler, options = {}, _log) {
   // eslint-disable-next-line
   const app = this.app = new express();
 
+  // ref: https://github.com/webpack/webpack-dev-server/issues/1575
+  // remove this when send@^0.16.3
+  express.static.mime.types.wasm = 'application/wasm';
+
   app.all('*', (req, res, next) => {
     if (this.checkHost(req.headers)) {
       return next();
@@ -629,20 +649,35 @@ Server.prototype.setContentHeaders = function (req, res, next) {
 };
 
 Server.prototype.checkHost = function (headers) {
+  return this.checkHeaders(headers, 'host');
+};
+
+Server.prototype.checkOrigin = function (headers) {
+  return this.checkHeaders(headers, 'origin');
+};
+
+Server.prototype.checkHeaders = function (headers, headerToCheck) {
   // allow user to opt-out this security check, at own risk
   if (this.disableHostCheck) {
     return true;
   }
+
+  if (!headerToCheck) headerToCheck = 'host';
   // get the Host header and extract hostname
   // we don't care about port not matching
-  const hostHeader = headers.host;
+  const hostHeader = headers[headerToCheck];
 
   if (!hostHeader) {
     return false;
   }
 
   // use the node url-parser to retrieve the hostname from the host-header.
-  const hostname = url.parse(`//${hostHeader}`, false, true).hostname;
+  const hostname = url.parse(
+    // if hostHeader doesn't have scheme, add // for parsing.
+    /^(.+:)?\/\//.test(hostHeader) ? hostHeader : `//${hostHeader}`,
+    false,
+    true
+  ).hostname;
   // always allow requests with explicit IPv4 or IPv6-address.
   // A note on IPv6 addresses:
   // hostHeader will always contain the brackets denoting
@@ -723,8 +758,8 @@ Server.prototype.listen = function (port, hostname, fn) {
         return;
       }
 
-      if (!this.checkHost(connection.headers)) {
-        this.sockWrite([ connection ], 'error', 'Invalid Host header');
+      if (!this.checkHost(connection.headers) || !this.checkOrigin(connection.headers)) {
+        this.sockWrite([ connection ], 'error', 'Invalid Host/Origin header');
 
         connection.close();
 

lib/utils/addEntries.js

@@ -6,6 +6,7 @@
   array-bracket-spacing,
   space-before-function-paren
 */
+const webpack = require('webpack');
 const createDomain = require('./createDomain');
 
 function addEntries (config, options, server) {
@@ -48,6 +49,13 @@ function addEntries (config, options, server) {
 
     [].concat(config).forEach((config) => {
       config.entry = prependEntry(config.entry || './src');
+
+      if (options.hot || options.hotOnly) {
+        config.plugins = config.plugins || [];
+        if (!config.plugins.find(plugin => plugin.constructor === webpack.HotModuleReplacementPlugin)) {
+          config.plugins.push(new webpack.HotModuleReplacementPlugin());
+        }
+      }
     });
   }
 }

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "webpack-dev-server",
-  "version": "3.1.10",
+  "version": "3.1.14",
   "description": "Serves a webpack app. Updates the browser on changes.",
   "bin": "bin/webpack-dev-server.js",
   "main": "lib/Server.js",
@@ -48,9 +48,10 @@
     "serve-index": "^1.7.2",
     "sockjs": "0.3.19",
     "sockjs-client": "1.3.0",
-    "spdy": "^3.4.1",
+    "spdy": "^4.0.0",
     "strip-ansi": "^3.0.0",
     "supports-color": "^5.1.0",
+    "url": "^0.11.0",
     "webpack-dev-middleware": "3.4.0",
     "webpack-log": "^2.0.0",
     "yargs": "12.0.2"

package.json

@@ -121,4 +121,18 @@ describe('ContentBase', () => {
         .expect(404, done);
     });
   });
+
+  describe('Content type', () => {
+    before((done) => {
+      server = helper.start(config, {
+        contentBase: [contentBasePublic]
+      }, done);
+      req = request(server.app);
+    });
+
+    it('Request foo.wasm', (done) => {
+      req.get('/foo.wasm')
+        .expect('Content-Type', 'application/wasm', done);
+    });
+  });
 });