Make sure we do not expose stacktraces in production (vercel#2843)

timneutkens · arunoda · commit 75a43f5a7158 · 2017-08-25T02:47:38.000+05:30
diff --git a/server/render.js b/server/render.js
@@ -138,14 +138,14 @@ export async function renderScript (req, res, page, opts) {
   }
 }
 
-export async function renderScriptError (req, res, page, error, customFields, opts) {
+export async function renderScriptError (req, res, page, error, customFields, { dev }) {
   // Asks CDNs and others to not to cache the errored page
   res.setHeader('Cache-Control', 'no-store, must-revalidate')
   // prevent XSS attacks by filtering the page before printing it.
   page = xssFilters.uriInSingleQuotedAttr(page)
+  res.setHeader('Content-Type', 'text/javascript')
 
   if (error.code === 'ENOENT') {
-    res.setHeader('Content-Type', 'text/javascript')
     res.end(`
       window.__NEXT_REGISTER_PAGE('${page}', function() {
         var error = new Error('Page does not exist: ${page}')
@@ -157,9 +157,8 @@ export async function renderScriptError (req, res, page, error, customFields, op
     return
   }
 
-  res.setHeader('Content-Type', 'text/javascript')
   const errorJson = {
-    ...errorToJSON(error),
+    ...serializeError(dev, error),
     ...customFields
   }
 

Original file line number	Diff line number	Diff line change
`@@ -138,14 +138,14 @@ export async function renderScript (req, res, page, opts) {`
`138`	`138`	`}`
`139`	`139`	`}`
`140`	`140`
`141`		`-export async function renderScriptError (req, res, page, error, customFields, opts) {`
	`141`	`+export async function renderScriptError (req, res, page, error, customFields, { dev }) {`
`142`	`142`	`// Asks CDNs and others to not to cache the errored page`
`143`	`143`	`res.setHeader('Cache-Control', 'no-store, must-revalidate')`
`144`	`144`	`// prevent XSS attacks by filtering the page before printing it.`
`145`	`145`	`page = xssFilters.uriInSingleQuotedAttr(page)`
	`146`	`+ res.setHeader('Content-Type', 'text/javascript')`
`146`	`147`
`147`	`148`	`if (error.code === 'ENOENT') {`
`148`		`- res.setHeader('Content-Type', 'text/javascript')`
`149`	`149`	res.end(`
`150`	`150`	`window.__NEXT_REGISTER_PAGE('${page}', function() {`
`151`	`151`	`var error = new Error('Page does not exist: ${page}')`
`@@ -157,9 +157,8 @@ export async function renderScriptError (req, res, page, error, customFields, op`
`157`	`157`	`return`
`158`	`158`	`}`
`159`	`159`
`160`		`- res.setHeader('Content-Type', 'text/javascript')`
`161`	`160`	`const errorJson = {`
`162`		`- ...errorToJSON(error),`
	`161`	`+ ...serializeError(dev, error),`
`163`	`162`	`...customFields`
`164`	`163`	`}`
`165`	`164`