Merge branch 'master' into devel

History.md

@@ -29,6 +29,12 @@
   [PR #9933](https://github.com/meteor/meteor/pull/9933)
   [PR #10050](https://github.com/meteor/meteor/pull/10050)
 
+## v1.7.0.5, 2018-08-16
+
+* Node has been updated to version
+  [8.11.4](https://nodejs.org/en/blog/release/v8.11.4/), an important
+  [security release](https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/).
+
 ## v1.7.0.4, 2018-08-07
 
 * The npm package `@babel/runtime`, which is depended on by most Meteor

meteor

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-BUNDLE_VERSION=8.11.3.1
+BUNDLE_VERSION=8.11.4-meteor-1.7.0.5-1
 
 # OS Check. Put here because here is where we download the precompiled
 # bundles that are arch specific.

packages/dynamic-import/server.js

@@ -7,6 +7,7 @@ const {
   normalize: pathNormalize,
 } = require("path");
 const { fetchURL } = require("./common.js");
+const { Meteor } = require("meteor/meteor");
 const { isModern } = require("meteor/modern-browsers");
 const hasOwn = Object.prototype.hasOwnProperty;
 
@@ -73,20 +74,39 @@ function middleware(request, response) {
     );
     response.setHeader("Access-Control-Allow-Methods", "POST");
     response.end();
+
   } else if (request.method === "POST") {
     const chunks = [];
     request.on("data", chunk => chunks.push(chunk));
     request.on("end", () => {
-      response.setHeader("Content-Type", "application/json");
-      response.end(JSON.stringify(readTree(
-        JSON.parse(Buffer.concat(chunks)),
-        getPlatform(request)
-      ), null, 2));
+      try {
+        const tree = JSON.stringify(readTree(
+          JSON.parse(Buffer.concat(chunks)),
+          getPlatform(request)
+        ), null, 2);
+
+        response.writeHead(200, {
+          "Content-Type": "application/json"
+        });
+
+        response.end(tree);
+
+      } catch (e) {
+        response.writeHead(400, {
+          "Content-Type": "application/json"
+        });
+
+        response.end(JSON.stringify(
+          Meteor.isDevelopment && e.message || "bad request"
+        ));
+      }
     });
+
   } else {
     response.writeHead(405, {
       "Cache-Control": "no-cache"
     });
+
     response.end(`method ${request.method} not allowed`);
   }
 }

packages/meteor-tool/package.js

@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.7.0_4'
+  version: '1.7.0_5'
 });
 
 Package.includeTool();

scripts/admin/meteor-release-experimental.json

@@ -1,6 +1,6 @@
 {
   "track": "METEOR",
-  "version": "1.7.0.4-rc.1",
+  "version": "1.7.0.5-rc.0",
   "recommended": false,
   "official": false,
   "description": "Meteor"

scripts/admin/meteor-release-official.json

@@ -1,13 +1,14 @@
 {
   "track": "METEOR",
-  "version": "1.7.0.4",
+  "version": "1.7.0.5",
   "recommended": false,
   "official": true,
   "patchFrom": [
     "1.7",
     "1.7.0.1",
     "1.7.0.2",
-    "1.7.0.3"
+    "1.7.0.3",
+    "1.7.0.4"
   ],
   "description": "The Official Meteor Distribution"
 }

scripts/build-dev-bundle-common.sh

@@ -5,7 +5,7 @@ set -u
 
 UNAME=$(uname)
 ARCH=$(uname -m)
-NODE_VERSION=8.11.3
+NODE_VERSION=8.11.4
 MONGO_VERSION_64BIT=3.6.4
 MONGO_VERSION_32BIT=3.2.19
 NPM_VERSION=6.3.0

tools/tests/apps/dynamic-import/.meteor/packages

@@ -25,3 +25,4 @@ lazy-test-package
 helper-package
 user:colon-name
 underscore@1.0.10
+fetch@0.1.0

tools/tests/apps/dynamic-import/tests.js

@@ -1,4 +1,5 @@
 import assert from "assert";
+import { Meteor } from "meteor/meteor";
 
 function assertDeepEqual(a, b) {
   const aWithoutDefault = Object.assign({}, a);
@@ -13,6 +14,20 @@ function assertDeepEqual(a, b) {
 describe("dynamic import(...)", function () {
   maybeClearDynamicImportCache();
 
+  it("ignores bad __meteor__/dynamic-import/fetch requests (#10147)", function () {
+    return fetch(Meteor.absoluteUrl("/__meteor__/dynamic-import/fetch"), {
+      // POST request with empty body.
+      method: "POST"
+    }).then(async (res) => {
+      assert.strictEqual(res.status, 400);
+      if (Meteor.isProduction) {
+        assert.strictEqual(await res.json(), "bad request");
+      } else {
+        assert.strictEqual(await res.json(), "Unexpected end of JSON input");
+      }
+    });
+  });
+
   it("import same module both statically and dynamically", function () {
     import moment from "moment";
     return import("./imports/date").then(date => {