Skip to content

Commit d0b0838

Browse files
backstroke-botcloud-walker
backstroke-bot
authored and
cloud-walker
committedAug 27, 2018
Update from upstream repo facebook/create-react-app@master (#3)
* Add modes to our Babel preset (1.x) (facebook#4668) * babel-preset-react-app@3.1.2 * add react-testing-library documentation/examples (facebook#4679) * add react-testing-library documentation/examples * make react-testing-library a heading * fix typo * Fix link to the article about BEM (facebook#4858) * Use file name whitelist to prevent RCE (facebook#4866) * Use file name whitelist to prevent RCE Use a whitelist to validate user-provided file names. This doesn't cover the entire range of valid filenames but should cover almost all of them in practice. Allows letters, numbers, periods, dashes, and underscores. Opting to use a whitelist instead of a blacklist because getting this wrong leaves us vulnerable to a RCE attack. * Allow alphabet characters from all languages Updated the whitelist to /^[\p{L}0-9/.\-_]+$/u, which matches alphanumeric characters, periods, dashes, and underscores. Unicode property support is stage 4 so I've inlined the transpiled version. * Only use file name whitelist on Windows * Log error message if file name does not pass whitelist * Bump versions * Bump release * Add 1.1.5 release notes
1 parent c8eb308 commit d0b0838

File tree

12 files changed

+283
-134
lines changed

12 files changed

+283
-134
lines changed
 

‎CHANGELOG.md

+28
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,31 @@
1+
## 1.1.5 (August 24, 2018)
2+
3+
* `react-scripts`
4+
5+
* Update the `webpack-dev-server` dependency
6+
7+
* `react-dev-utils`
8+
9+
* [#4866](https://github.com/facebook/create-react-app/pull/4866) Fix a Windows-only vulnerability (`CVE-2018-6342`) in the development server ([@acdlite](https://github.com/acdlite))
10+
* Update the `sockjs-client` dependency
11+
12+
#### Committers: 1
13+
- Andrew Clark ([acdlite](https://github.com/acdlite))
14+
15+
### Migrating from 1.1.4 to 1.1.5
16+
17+
Inside any created project that has not been ejected, run:
18+
19+
```
20+
npm install --save --save-exact react-scripts@1.1.5
21+
```
22+
23+
or
24+
25+
```
26+
yarn add --exact react-scripts@1.1.5
27+
```
28+
129
## 1.1.4 (April 3, 2018)
230

331
#### :bug: Bug Fix

‎packages/babel-preset-react-app/create.js

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
/**
2+
* Copyright (c) 2015-present, Facebook, Inc.
3+
*
4+
* This source code is licensed under the MIT license found in the
5+
* LICENSE file in the root directory of this source tree.
6+
*/
7+
'use strict';
8+
9+
module.exports = function create(env) {
10+
if (env !== 'development' && env !== 'test' && env !== 'production') {
11+
throw new Error(
12+
'Using `babel-preset-react-app` requires that you specify `NODE_ENV` or ' +
13+
'`BABEL_ENV` environment variables. Valid values are "development", ' +
14+
'"test", and "production". Instead, received: ' +
15+
JSON.stringify(env) +
16+
'.'
17+
);
18+
}
19+
20+
const plugins = [
21+
// Necessary to include regardless of the environment because
22+
// in practice some other transforms (such as object-rest-spread)
23+
// don't work without it: https://github.com/babel/babel/issues/7215
24+
require.resolve('babel-plugin-transform-es2015-destructuring'),
25+
// class { handleClick = () => { } }
26+
require.resolve('babel-plugin-transform-class-properties'),
27+
// The following two plugins use Object.assign directly, instead of Babel's
28+
// extends helper. Note that this assumes `Object.assign` is available.
29+
// { ...todo, completed: true }
30+
[
31+
require.resolve('babel-plugin-transform-object-rest-spread'),
32+
{
33+
useBuiltIns: true,
34+
},
35+
],
36+
// Transforms JSX
37+
[
38+
require.resolve('babel-plugin-transform-react-jsx'),
39+
{
40+
useBuiltIns: true,
41+
},
42+
],
43+
// Polyfills the runtime needed for async/await and generators
44+
[
45+
require.resolve('babel-plugin-transform-runtime'),
46+
{
47+
helpers: false,
48+
polyfill: false,
49+
regenerator: true,
50+
},
51+
],
52+
];
53+
54+
if (env === 'development' || env === 'test') {
55+
// The following two plugins are currently necessary to make React warnings
56+
// include more valuable information. They are included here because they are
57+
// currently not enabled in babel-preset-react. See the below threads for more info:
58+
// https://github.com/babel/babel/issues/4702
59+
// https://github.com/babel/babel/pull/3540#issuecomment-228673661
60+
// https://github.com/facebookincubator/create-react-app/issues/989
61+
plugins.push.apply(plugins, [
62+
// Adds component stack to warning messages
63+
require.resolve('babel-plugin-transform-react-jsx-source'),
64+
// Adds __self attribute to JSX which React will use for some warnings
65+
require.resolve('babel-plugin-transform-react-jsx-self'),
66+
]);
67+
}
68+
69+
if (env === 'test') {
70+
return {
71+
presets: [
72+
// ES features necessary for user's Node version
73+
[
74+
require('babel-preset-env').default,
75+
{
76+
targets: {
77+
node: 'current',
78+
},
79+
},
80+
],
81+
// JSX, Flow
82+
require.resolve('babel-preset-react'),
83+
],
84+
plugins: plugins.concat([
85+
// Compiles import() to a deferred require()
86+
require.resolve('babel-plugin-dynamic-import-node'),
87+
]),
88+
};
89+
} else {
90+
return {
91+
presets: [
92+
// Latest stable ECMAScript features
93+
[
94+
require.resolve('babel-preset-env'),
95+
{
96+
targets: {
97+
// React parses on ie 9, so we should too
98+
ie: 9,
99+
// We currently minify with uglify
100+
// Remove after https://github.com/mishoo/UglifyJS2/issues/448
101+
uglify: true,
102+
},
103+
// Disable polyfill transforms
104+
useBuiltIns: false,
105+
// Do not transform modules to CJS
106+
modules: false,
107+
},
108+
],
109+
// JSX, Flow
110+
require.resolve('babel-preset-react'),
111+
],
112+
plugins: plugins.concat([
113+
// function* () { yield 42; yield 43; }
114+
[
115+
require.resolve('babel-plugin-transform-regenerator'),
116+
{
117+
// Async functions are converted to generators by babel-preset-env
118+
async: false,
119+
},
120+
],
121+
// Adds syntax support for import()
122+
require.resolve('babel-plugin-syntax-dynamic-import'),
123+
]),
124+
};
125+
126+
if (env === 'production') {
127+
// Optimization: hoist JSX that never changes out of render()
128+
// Disabled because of issues: https://github.com/facebookincubator/create-react-app/issues/553
129+
// TODO: Enable again when these issues are resolved.
130+
// plugins.push.apply(plugins, [
131+
// require.resolve('babel-plugin-transform-react-constant-elements')
132+
// ]);
133+
}
134+
}
135+
};

‎packages/babel-preset-react-app/dev.js

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/**
2+
* Copyright (c) 2015-present, Facebook, Inc.
3+
*
4+
* This source code is licensed under the MIT license found in the
5+
* LICENSE file in the root directory of this source tree.
6+
*/
7+
'use strict';
8+
9+
const create = require('./create');
10+
11+
module.exports = create('development');

‎packages/babel-preset-react-app/index.js

+2-123
Original file line numberDiff line numberDiff line change
@@ -6,39 +6,7 @@
66
*/
77
'use strict';
88

9-
const plugins = [
10-
// Necessary to include regardless of the environment because
11-
// in practice some other transforms (such as object-rest-spread)
12-
// don't work without it: https://github.com/babel/babel/issues/7215
13-
require.resolve('babel-plugin-transform-es2015-destructuring'),
14-
// class { handleClick = () => { } }
15-
require.resolve('babel-plugin-transform-class-properties'),
16-
// The following two plugins use Object.assign directly, instead of Babel's
17-
// extends helper. Note that this assumes `Object.assign` is available.
18-
// { ...todo, completed: true }
19-
[
20-
require.resolve('babel-plugin-transform-object-rest-spread'),
21-
{
22-
useBuiltIns: true,
23-
},
24-
],
25-
// Transforms JSX
26-
[
27-
require.resolve('babel-plugin-transform-react-jsx'),
28-
{
29-
useBuiltIns: true,
30-
},
31-
],
32-
// Polyfills the runtime needed for async/await and generators
33-
[
34-
require.resolve('babel-plugin-transform-runtime'),
35-
{
36-
helpers: false,
37-
polyfill: false,
38-
regenerator: true,
39-
},
40-
],
41-
];
9+
const create = require('./create');
4210

4311
// This is similar to how `env` works in Babel:
4412
// https://babeljs.io/docs/usage/babelrc/#env-option
@@ -47,94 +15,5 @@ const plugins = [
4715
// https://github.com/facebookincubator/create-react-app/issues/720
4816
// It’s also nice that we can enforce `NODE_ENV` being specified.
4917
var env = process.env.BABEL_ENV || process.env.NODE_ENV;
50-
if (env !== 'development' && env !== 'test' && env !== 'production') {
51-
throw new Error(
52-
'Using `babel-preset-react-app` requires that you specify `NODE_ENV` or ' +
53-
'`BABEL_ENV` environment variables. Valid values are "development", ' +
54-
'"test", and "production". Instead, received: ' +
55-
JSON.stringify(env) +
56-
'.'
57-
);
58-
}
5918

60-
if (env === 'development' || env === 'test') {
61-
// The following two plugins are currently necessary to make React warnings
62-
// include more valuable information. They are included here because they are
63-
// currently not enabled in babel-preset-react. See the below threads for more info:
64-
// https://github.com/babel/babel/issues/4702
65-
// https://github.com/babel/babel/pull/3540#issuecomment-228673661
66-
// https://github.com/facebookincubator/create-react-app/issues/989
67-
plugins.push.apply(plugins, [
68-
// Adds component stack to warning messages
69-
require.resolve('babel-plugin-transform-react-jsx-source'),
70-
// Adds __self attribute to JSX which React will use for some warnings
71-
require.resolve('babel-plugin-transform-react-jsx-self'),
72-
]);
73-
}
74-
75-
if (env === 'test') {
76-
module.exports = {
77-
presets: [
78-
// ES features necessary for user's Node version
79-
[
80-
require('babel-preset-env').default,
81-
{
82-
targets: {
83-
node: 'current',
84-
},
85-
},
86-
],
87-
// JSX, Flow
88-
require.resolve('babel-preset-react'),
89-
],
90-
plugins: plugins.concat([
91-
// Compiles import() to a deferred require()
92-
require.resolve('babel-plugin-dynamic-import-node'),
93-
]),
94-
};
95-
} else {
96-
module.exports = {
97-
presets: [
98-
// Latest stable ECMAScript features
99-
[
100-
require.resolve('babel-preset-env'),
101-
{
102-
targets: {
103-
// React parses on ie 9, so we should too
104-
ie: 9,
105-
// We currently minify with uglify
106-
// Remove after https://github.com/mishoo/UglifyJS2/issues/448
107-
uglify: true,
108-
},
109-
// Disable polyfill transforms
110-
useBuiltIns: false,
111-
// Do not transform modules to CJS
112-
modules: false,
113-
},
114-
],
115-
// JSX, Flow
116-
require.resolve('babel-preset-react'),
117-
],
118-
plugins: plugins.concat([
119-
// function* () { yield 42; yield 43; }
120-
[
121-
require.resolve('babel-plugin-transform-regenerator'),
122-
{
123-
// Async functions are converted to generators by babel-preset-env
124-
async: false,
125-
},
126-
],
127-
// Adds syntax support for import()
128-
require.resolve('babel-plugin-syntax-dynamic-import'),
129-
]),
130-
};
131-
132-
if (env === 'production') {
133-
// Optimization: hoist JSX that never changes out of render()
134-
// Disabled because of issues: https://github.com/facebookincubator/create-react-app/issues/553
135-
// TODO: Enable again when these issues are resolved.
136-
// plugins.push.apply(plugins, [
137-
// require.resolve('babel-plugin-transform-react-constant-elements')
138-
// ]);
139-
}
140-
}
19+
module.exports = create(env);

‎packages/babel-preset-react-app/package.json

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,18 @@
11
{
22
"name": "babel-preset-react-app",
3-
"version": "3.1.1",
3+
"version": "3.1.2",
44
"description": "Babel preset used by Create React App",
55
"repository": "facebookincubator/create-react-app",
66
"license": "MIT",
77
"bugs": {
88
"url": "https://github.com/facebookincubator/create-react-app/issues"
99
},
1010
"files": [
11-
"index.js"
11+
"index.js",
12+
"create.js",
13+
"dev.js",
14+
"prod.js",
15+
"test.js"
1216
],
1317
"dependencies": {
1418
"babel-plugin-dynamic-import-node": "1.1.0",

‎packages/babel-preset-react-app/prod.js

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/**
2+
* Copyright (c) 2015-present, Facebook, Inc.
3+
*
4+
* This source code is licensed under the MIT license found in the
5+
* LICENSE file in the root directory of this source tree.
6+
*/
7+
'use strict';
8+
9+
const create = require('./create');
10+
11+
module.exports = create('production');

‎packages/babel-preset-react-app/test.js

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
/**
2+
* Copyright (c) 2015-present, Facebook, Inc.
3+
*
4+
* This source code is licensed under the MIT license found in the
5+
* LICENSE file in the root directory of this source tree.
6+
*/
7+
'use strict';
8+
9+
const create = require('./create');
10+
11+
module.exports = create('test');

‎packages/react-dev-utils/launchEditor.js

+28
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,11 @@ const COMMON_EDITORS_WIN = [
9696
'webstorm64.exe',
9797
];
9898

99+
// Transpiled version of: /^[\p{L}0-9/.\-_\\]+$/u
100+
// Non-transpiled version requires support for Unicode property regex. Allows
101+
// alphanumeric characters, periods, dashes, slashes, and underscores.
102+
const WINDOWS_FILE_NAME_WHITELIST = /^(?:[\x2D-9A-Z\\_a-z\xAA\xB5\xBA\xC0-\xD6\xD8-\xF6\xF8-\u02C1\u02C6-\u02D1\u02E0-\u02E4\u02EC\u02EE\u0370-\u0374\u0376\u0377\u037A-\u037D\u037F\u0386\u0388-\u038A\u038C\u038E-\u03A1\u03A3-\u03F5\u03F7-\u0481\u048A-\u052F\u0531-\u0556\u0559\u0560-\u0588\u05D0-\u05EA\u05EF-\u05F2\u0620-\u064A\u066E\u066F\u0671-\u06D3\u06D5\u06E5\u06E6\u06EE\u06EF\u06FA-\u06FC\u06FF\u0710\u0712-\u072F\u074D-\u07A5\u07B1\u07CA-\u07EA\u07F4\u07F5\u07FA\u0800-\u0815\u081A\u0824\u0828\u0840-\u0858\u0860-\u086A\u08A0-\u08B4\u08B6-\u08BD\u0904-\u0939\u093D\u0950\u0958-\u0961\u0971-\u0980\u0985-\u098C\u098F\u0990\u0993-\u09A8\u09AA-\u09B0\u09B2\u09B6-\u09B9\u09BD\u09CE\u09DC\u09DD\u09DF-\u09E1\u09F0\u09F1\u09FC\u0A05-\u0A0A\u0A0F\u0A10\u0A13-\u0A28\u0A2A-\u0A30\u0A32\u0A33\u0A35\u0A36\u0A38\u0A39\u0A59-\u0A5C\u0A5E\u0A72-\u0A74\u0A85-\u0A8D\u0A8F-\u0A91\u0A93-\u0AA8\u0AAA-\u0AB0\u0AB2\u0AB3\u0AB5-\u0AB9\u0ABD\u0AD0\u0AE0\u0AE1\u0AF9\u0B05-\u0B0C\u0B0F\u0B10\u0B13-\u0B28\u0B2A-\u0B30\u0B32\u0B33\u0B35-\u0B39\u0B3D\u0B5C\u0B5D\u0B5F-\u0B61\u0B71\u0B83\u0B85-\u0B8A\u0B8E-\u0B90\u0B92-\u0B95\u0B99\u0B9A\u0B9C\u0B9E\u0B9F\u0BA3\u0BA4\u0BA8-\u0BAA\u0BAE-\u0BB9\u0BD0\u0C05-\u0C0C\u0C0E-\u0C10\u0C12-\u0C28\u0C2A-\u0C39\u0C3D\u0C58-\u0C5A\u0C60\u0C61\u0C80\u0C85-\u0C8C\u0C8E-\u0C90\u0C92-\u0CA8\u0CAA-\u0CB3\u0CB5-\u0CB9\u0CBD\u0CDE\u0CE0\u0CE1\u0CF1\u0CF2\u0D05-\u0D0C\u0D0E-\u0D10\u0D12-\u0D3A\u0D3D\u0D4E\u0D54-\u0D56\u0D5F-\u0D61\u0D7A-\u0D7F\u0D85-\u0D96\u0D9A-\u0DB1\u0DB3-\u0DBB\u0DBD\u0DC0-\u0DC6\u0E01-\u0E30\u0E32\u0E33\u0E40-\u0E46\u0E81\u0E82\u0E84\u0E87\u0E88\u0E8A\u0E8D\u0E94-\u0E97\u0E99-\u0E9F\u0EA1-\u0EA3\u0EA5\u0EA7\u0EAA\u0EAB\u0EAD-\u0EB0\u0EB2\u0EB3\u0EBD\u0EC0-\u0EC4\u0EC6\u0EDC-\u0EDF\u0F00\u0F40-\u0F47\u0F49-\u0F6C\u0F88-\u0F8C\u1000-\u102A\u103F\u1050-\u1055\u105A-\u105D\u1061\u1065\u1066\u106E-\u1070\u1075-\u1081\u108E\u10A0-\u10C5\u10C7\u10CD\u10D0-\u10FA\u10FC-\u1248\u124A-\u124D\u1250-\u1256\u1258\u125A-\u125D\u1260-\u1288\u128A-\u128D\u1290-\u12B0\u12B2-\u12B5\u12B8-\u12BE\u12C0\u12C2-\u12C5\u12C8-\u12D6\u12D8-\u1310\u1312-\u1315\u1318-\u135A\u1380-\u138F\u13A0-\u13F5\u13F8-\u13FD\u1401-\u166C\u166F-\u167F\u1681-\u169A\u16A0-\u16EA\u16F1-\u16F8\u1700-\u170C\u170E-\u1711\u1720-\u1731\u1740-\u1751\u1760-\u176C\u176E-\u1770\u1780-\u17B3\u17D7\u17DC\u1820-\u1878\u1880-\u1884\u1887-\u18A8\u18AA\u18B0-\u18F5\u1900-\u191E\u1950-\u196D\u1970-\u1974\u1980-\u19AB\u19B0-\u19C9\u1A00-\u1A16\u1A20-\u1A54\u1AA7\u1B05-\u1B33\u1B45-\u1B4B\u1B83-\u1BA0\u1BAE\u1BAF\u1BBA-\u1BE5\u1C00-\u1C23\u1C4D-\u1C4F\u1C5A-\u1C7D\u1C80-\u1C88\u1C90-\u1CBA\u1CBD-\u1CBF\u1CE9-\u1CEC\u1CEE-\u1CF1\u1CF5\u1CF6\u1D00-\u1DBF\u1E00-\u1F15\u1F18-\u1F1D\u1F20-\u1F45\u1F48-\u1F4D\u1F50-\u1F57\u1F59\u1F5B\u1F5D\u1F5F-\u1F7D\u1F80-\u1FB4\u1FB6-\u1FBC\u1FBE\u1FC2-\u1FC4\u1FC6-\u1FCC\u1FD0-\u1FD3\u1FD6-\u1FDB\u1FE0-\u1FEC\u1FF2-\u1FF4\u1FF6-\u1FFC\u2071\u207F\u2090-\u209C\u2102\u2107\u210A-\u2113\u2115\u2119-\u211D\u2124\u2126\u2128\u212A-\u212D\u212F-\u2139\u213C-\u213F\u2145-\u2149\u214E\u2183\u2184\u2C00-\u2C2E\u2C30-\u2C5E\u2C60-\u2CE4\u2CEB-\u2CEE\u2CF2\u2CF3\u2D00-\u2D25\u2D27\u2D2D\u2D30-\u2D67\u2D6F\u2D80-\u2D96\u2DA0-\u2DA6\u2DA8-\u2DAE\u2DB0-\u2DB6\u2DB8-\u2DBE\u2DC0-\u2DC6\u2DC8-\u2DCE\u2DD0-\u2DD6\u2DD8-\u2DDE\u2E2F\u3005\u3006\u3031-\u3035\u303B\u303C\u3041-\u3096\u309D-\u309F\u30A1-\u30FA\u30FC-\u30FF\u3105-\u312F\u3131-\u318E\u31A0-\u31BA\u31F0-\u31FF\u3400-\u4DB5\u4E00-\u9FEF\uA000-\uA48C\uA4D0-\uA4FD\uA500-\uA60C\uA610-\uA61F\uA62A\uA62B\uA640-\uA66E\uA67F-\uA69D\uA6A0-\uA6E5\uA717-\uA71F\uA722-\uA788\uA78B-\uA7B9\uA7F7-\uA801\uA803-\uA805\uA807-\uA80A\uA80C-\uA822\uA840-\uA873\uA882-\uA8B3\uA8F2-\uA8F7\uA8FB\uA8FD\uA8FE\uA90A-\uA925\uA930-\uA946\uA960-\uA97C\uA984-\uA9B2\uA9CF\uA9E0-\uA9E4\uA9E6-\uA9EF\uA9FA-\uA9FE\uAA00-\uAA28\uAA40-\uAA42\uAA44-\uAA4B\uAA60-\uAA76\uAA7A\uAA7E-\uAAAF\uAAB1\uAAB5\uAAB6\uAAB9-\uAABD\uAAC0\uAAC2\uAADB-\uAADD\uAAE0-\uAAEA\uAAF2-\uAAF4\uAB01-\uAB06\uAB09-\uAB0E\uAB11-\uAB16\uAB20-\uAB26\uAB28-\uAB2E\uAB30-\uAB5A\uAB5C-\uAB65\uAB70-\uABE2\uAC00-\uD7A3\uD7B0-\uD7C6\uD7CB-\uD7FB\uF900-\uFA6D\uFA70-\uFAD9\uFB00-\uFB06\uFB13-\uFB17\uFB1D\uFB1F-\uFB28\uFB2A-\uFB36\uFB38-\uFB3C\uFB3E\uFB40\uFB41\uFB43\uFB44\uFB46-\uFBB1\uFBD3-\uFD3D\uFD50-\uFD8F\uFD92-\uFDC7\uFDF0-\uFDFB\uFE70-\uFE74\uFE76-\uFEFC\uFF21-\uFF3A\uFF41-\uFF5A\uFF66-\uFFBE\uFFC2-\uFFC7\uFFCA-\uFFCF\uFFD2-\uFFD7\uFFDA-\uFFDC]|\uD800[\uDC00-\uDC0B\uDC0D-\uDC26\uDC28-\uDC3A\uDC3C\uDC3D\uDC3F-\uDC4D\uDC50-\uDC5D\uDC80-\uDCFA\uDE80-\uDE9C\uDEA0-\uDED0\uDF00-\uDF1F\uDF2D-\uDF40\uDF42-\uDF49\uDF50-\uDF75\uDF80-\uDF9D\uDFA0-\uDFC3\uDFC8-\uDFCF]|\uD801[\uDC00-\uDC9D\uDCB0-\uDCD3\uDCD8-\uDCFB\uDD00-\uDD27\uDD30-\uDD63\uDE00-\uDF36\uDF40-\uDF55\uDF60-\uDF67]|\uD802[\uDC00-\uDC05\uDC08\uDC0A-\uDC35\uDC37\uDC38\uDC3C\uDC3F-\uDC55\uDC60-\uDC76\uDC80-\uDC9E\uDCE0-\uDCF2\uDCF4\uDCF5\uDD00-\uDD15\uDD20-\uDD39\uDD80-\uDDB7\uDDBE\uDDBF\uDE00\uDE10-\uDE13\uDE15-\uDE17\uDE19-\uDE35\uDE60-\uDE7C\uDE80-\uDE9C\uDEC0-\uDEC7\uDEC9-\uDEE4\uDF00-\uDF35\uDF40-\uDF55\uDF60-\uDF72\uDF80-\uDF91]|\uD803[\uDC00-\uDC48\uDC80-\uDCB2\uDCC0-\uDCF2\uDD00-\uDD23\uDF00-\uDF1C\uDF27\uDF30-\uDF45]|\uD804[\uDC03-\uDC37\uDC83-\uDCAF\uDCD0-\uDCE8\uDD03-\uDD26\uDD44\uDD50-\uDD72\uDD76\uDD83-\uDDB2\uDDC1-\uDDC4\uDDDA\uDDDC\uDE00-\uDE11\uDE13-\uDE2B\uDE80-\uDE86\uDE88\uDE8A-\uDE8D\uDE8F-\uDE9D\uDE9F-\uDEA8\uDEB0-\uDEDE\uDF05-\uDF0C\uDF0F\uDF10\uDF13-\uDF28\uDF2A-\uDF30\uDF32\uDF33\uDF35-\uDF39\uDF3D\uDF50\uDF5D-\uDF61]|\uD805[\uDC00-\uDC34\uDC47-\uDC4A\uDC80-\uDCAF\uDCC4\uDCC5\uDCC7\uDD80-\uDDAE\uDDD8-\uDDDB\uDE00-\uDE2F\uDE44\uDE80-\uDEAA\uDF00-\uDF1A]|\uD806[\uDC00-\uDC2B\uDCA0-\uDCDF\uDCFF\uDE00\uDE0B-\uDE32\uDE3A\uDE50\uDE5C-\uDE83\uDE86-\uDE89\uDE9D\uDEC0-\uDEF8]|\uD807[\uDC00-\uDC08\uDC0A-\uDC2E\uDC40\uDC72-\uDC8F\uDD00-\uDD06\uDD08\uDD09\uDD0B-\uDD30\uDD46\uDD60-\uDD65\uDD67\uDD68\uDD6A-\uDD89\uDD98\uDEE0-\uDEF2]|\uD808[\uDC00-\uDF99]|\uD809[\uDC80-\uDD43]|[\uD80C\uD81C-\uD820\uD840-\uD868\uD86A-\uD86C\uD86F-\uD872\uD874-\uD879][\uDC00-\uDFFF]|\uD80D[\uDC00-\uDC2E]|\uD811[\uDC00-\uDE46]|\uD81A[\uDC00-\uDE38\uDE40-\uDE5E\uDED0-\uDEED\uDF00-\uDF2F\uDF40-\uDF43\uDF63-\uDF77\uDF7D-\uDF8F]|\uD81B[\uDE40-\uDE7F\uDF00-\uDF44\uDF50\uDF93-\uDF9F\uDFE0\uDFE1]|\uD821[\uDC00-\uDFF1]|\uD822[\uDC00-\uDEF2]|\uD82C[\uDC00-\uDD1E\uDD70-\uDEFB]|\uD82F[\uDC00-\uDC6A\uDC70-\uDC7C\uDC80-\uDC88\uDC90-\uDC99]|\uD835[\uDC00-\uDC54\uDC56-\uDC9C\uDC9E\uDC9F\uDCA2\uDCA5\uDCA6\uDCA9-\uDCAC\uDCAE-\uDCB9\uDCBB\uDCBD-\uDCC3\uDCC5-\uDD05\uDD07-\uDD0A\uDD0D-\uDD14\uDD16-\uDD1C\uDD1E-\uDD39\uDD3B-\uDD3E\uDD40-\uDD44\uDD46\uDD4A-\uDD50\uDD52-\uDEA5\uDEA8-\uDEC0\uDEC2-\uDEDA\uDEDC-\uDEFA\uDEFC-\uDF14\uDF16-\uDF34\uDF36-\uDF4E\uDF50-\uDF6E\uDF70-\uDF88\uDF8A-\uDFA8\uDFAA-\uDFC2\uDFC4-\uDFCB]|\uD83A[\uDC00-\uDCC4\uDD00-\uDD43]|\uD83B[\uDE00-\uDE03\uDE05-\uDE1F\uDE21\uDE22\uDE24\uDE27\uDE29-\uDE32\uDE34-\uDE37\uDE39\uDE3B\uDE42\uDE47\uDE49\uDE4B\uDE4D-\uDE4F\uDE51\uDE52\uDE54\uDE57\uDE59\uDE5B\uDE5D\uDE5F\uDE61\uDE62\uDE64\uDE67-\uDE6A\uDE6C-\uDE72\uDE74-\uDE77\uDE79-\uDE7C\uDE7E\uDE80-\uDE89\uDE8B-\uDE9B\uDEA1-\uDEA3\uDEA5-\uDEA9\uDEAB-\uDEBB]|\uD869[\uDC00-\uDED6\uDF00-\uDFFF]|\uD86D[\uDC00-\uDF34\uDF40-\uDFFF]|\uD86E[\uDC00-\uDC1D\uDC20-\uDFFF]|\uD873[\uDC00-\uDEA1\uDEB0-\uDFFF]|\uD87A[\uDC00-\uDFE0]|\uD87E[\uDC00-\uDE1D])+$/
103+
99104
function addWorkspaceToArgumentsIfExists(args, workspace) {
100105
if (workspace) {
101106
args.unshift(workspace);
@@ -306,6 +311,29 @@ function launchEditor(fileName, lineNumber, colNumber) {
306311
fileName = path.relative('', fileName);
307312
}
308313

314+
// cmd.exe on Windows is vulnerable to RCE attacks given a file name of the
315+
// form "C:\Users\myusername\Downloads\& curl 172.21.93.52". Use a whitelist
316+
// to validate user-provided file names. This doesn't cover the entire range
317+
// of valid file names but should cover almost all of them in practice.
318+
if (
319+
process.platform === 'win32' &&
320+
!WINDOWS_FILE_NAME_WHITELIST.test(fileName.trim())
321+
) {
322+
console.log();
323+
console.log(
324+
chalk.red('Could not open ' + path.basename(fileName) + ' in the editor.')
325+
);
326+
console.log();
327+
console.log(
328+
'When running on Windows, file names are checked against a whitelist ' +
329+
'to protect against remote code execution attacks. File names may ' +
330+
'consist only of alphanumeric characters (all languages), periods, ' +
331+
'dashes, slashes, and underscores.'
332+
);
333+
console.log();
334+
return;
335+
}
336+
309337
let workspace = null;
310338
if (lineNumber) {
311339
args = args.concat(

‎packages/react-dev-utils/package.json

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "react-dev-utils",
3-
"version": "5.0.1",
3+
"version": "5.0.2",
44
"description": "Webpack utilities used by Create React App",
55
"repository": "facebookincubator/create-react-app",
66
"license": "MIT",
@@ -48,10 +48,10 @@
4848
"inquirer": "3.3.0",
4949
"is-root": "1.0.0",
5050
"opn": "5.2.0",
51-
"react-error-overlay": "^4.0.0",
51+
"react-error-overlay": "^4.0.1",
5252
"recursive-readdir": "2.2.1",
5353
"shell-quote": "1.6.1",
54-
"sockjs-client": "1.1.4",
54+
"sockjs-client": "1.1.5",
5555
"strip-ansi": "3.0.1",
5656
"text-table": "0.2.0"
5757
},

‎packages/react-error-overlay/package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "react-error-overlay",
3-
"version": "4.0.0",
3+
"version": "4.0.1",
44
"description": "An overlay for displaying stack frames.",
55
"main": "lib/index.js",
66
"scripts": {

‎packages/react-scripts/package.json

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "react-scripts",
3-
"version": "1.1.4",
3+
"version": "1.1.5",
44
"description": "Configuration and scripts for Create React App.",
55
"repository": "facebookincubator/create-react-app",
66
"license": "MIT",
@@ -26,7 +26,7 @@
2626
"babel-eslint": "7.2.3",
2727
"babel-jest": "20.0.3",
2828
"babel-loader": "7.1.2",
29-
"babel-preset-react-app": "^3.1.1",
29+
"babel-preset-react-app": "^3.1.2",
3030
"babel-runtime": "6.26.0",
3131
"case-sensitive-paths-webpack-plugin": "2.1.1",
3232
"chalk": "1.1.3",
@@ -50,13 +50,13 @@
5050
"postcss-loader": "2.0.8",
5151
"promise": "8.0.1",
5252
"raf": "3.4.0",
53-
"react-dev-utils": "^5.0.1",
53+
"react-dev-utils": "^5.0.2",
5454
"resolve": "1.6.0",
5555
"style-loader": "0.19.0",
5656
"sw-precache-webpack-plugin": "0.11.4",
5757
"url-loader": "0.6.2",
5858
"webpack": "3.8.1",
59-
"webpack-dev-server": "2.9.4",
59+
"webpack-dev-server": "2.11.3",
6060
"webpack-manifest-plugin": "1.3.2",
6161
"whatwg-fetch": "2.0.3"
6262
},

‎packages/react-scripts/template/README.md

+43-1
Original file line numberDiff line numberDiff line change
@@ -506,7 +506,7 @@ class Button extends Component {
506506
}
507507
```
508508

509-
**This is not required for React** but many people find this feature convenient. You can read about the benefits of this approach [here](https://medium.com/seek-ui-engineering/block-element-modifying-your-javascript-components-d7f99fcab52b). However you should be aware that this makes your code less portable to other build tools and environments than Webpack.
509+
**This is not required for React** but many people find this feature convenient. You can read about the benefits of this approach [here](https://medium.com/seek-blog/block-element-modifying-your-javascript-components-d7f99fcab52b). However you should be aware that this makes your code less portable to other build tools and environments than Webpack.
510510

511511
In development, expressing dependencies this way allows your styles to be reloaded on the fly as you edit them. In production, all CSS files will be concatenated into a single minified `.css` file in the build output.
512512

@@ -1428,6 +1428,48 @@ Import it in [`src/setupTests.js`](#initializing-test-environment) to make its m
14281428
import 'jest-enzyme';
14291429
```
14301430

1431+
#### Use `react-testing-library`
1432+
1433+
As an alternative or companion to `enzyme`, you may consider using `react-testing-library`. [`react-testing-library`](https://github.com/kentcdodds/react-testing-library) is a library for testing React components in a way that resembles the way the components are used by end users. It is well suited for unit, integration, and end-to-end testing of React components and applications. It works more directly with DOM nodes, and therefore it's recommended to use with [`jest-dom`](https://github.com/gnapse/jest-dom) for improved assertions.
1434+
1435+
To install `react-testing-library` and `jest-dom`, you can run:
1436+
1437+
```sh
1438+
npm install --save react-testing-library jest-dom
1439+
```
1440+
1441+
Alternatively you may use `yarn`:
1442+
1443+
```sh
1444+
yarn add react-testing-library jest-dom
1445+
```
1446+
1447+
Similar to `enzyme` you can create a `src/setupTests.js` file to avoid boilerplate in your test files:
1448+
1449+
```js
1450+
// react-testing-library renders your components to document.body,
1451+
// this will ensure they're removed after each test.
1452+
import 'react-testing-library/cleanup-after-each';
1453+
1454+
// this adds jest-dom's custom assertions
1455+
import 'jest-dom/extend-expect';
1456+
```
1457+
1458+
Here's an example of using `react-testing-library` and `jest-dom` for testing that the `<App />` component renders "Welcome to React".
1459+
1460+
```js
1461+
import React from 'react';
1462+
import { render } from 'react-testing-library';
1463+
import App from './App';
1464+
1465+
it('renders welcome message', () => {
1466+
const { getByText } = render(<App />);
1467+
expect(getByText('Welcome to React')).toBeInTheDOM();
1468+
});
1469+
```
1470+
1471+
Learn more about the utilities provided by `react-testing-library` to facilitate testing asynchronous interactions as well as selecting form elements from [the `react-testing-library` documentation](https://github.com/kentcdodds/react-testing-library) and [examples](https://codesandbox.io/s/github/kentcdodds/react-testing-library-examples).
1472+
14311473
### Using Third Party Assertion Libraries
14321474

14331475
We recommend that you use `expect()` for assertions and `jest.fn()` for spies. If you are having issues with them please [file those against Jest](https://github.com/facebook/jest/issues/new), and we’ll fix them. We intend to keep making them better for React, supporting, for example, [pretty-printing React elements as JSX](https://github.com/facebook/jest/pull/1566).

0 commit comments

Comments
 (0)
Please sign in to comment.