add more invalid paths for /_next/data (github#22423)

mikesurowiec · web-flow · commit fd9c8af939bf · 2021-10-26T23:04:31.000Z
diff --git a/middleware/handle-invalid-paths.js b/middleware/handle-invalid-paths.js
@@ -49,7 +49,7 @@ export default function handleInvalidPaths(req, res, next) {
   }
 
   // Prevent various malicious injection attacks targeting Next.js
-  if (req.path.match(/^\/_next[^/]/)) {
+  if (req.path.match(/^\/_next[^/]/) || req.path === '/_next/data' || req.path === '/_next/data/') {
     return next(404)
   }
 

Original file line number	Diff line number	Diff line change
`@@ -49,7 +49,7 @@ export default function handleInvalidPaths(req, res, next) {`
`49`	`49`	`}`
`50`	`50`
`51`	`51`	`// Prevent various malicious injection attacks targeting Next.js`
`52`		`- if (req.path.match(/^\/_next[^/]/)) {`
	`52`	`+ if (req.path.match(/^\/_next[^/]/) \|\| req.path === '/_next/data' \|\| req.path === '/_next/data/') {`
`53`	`53`	`return next(404)`
`54`	`54`	`}`
`55`	`55`