fix: update net stubbing to not intercept requests sent to dev server (…

…#27788)

cli/CHANGELOG.md

@@ -10,8 +10,9 @@ _Released 09/12/2023 (PENDING)_
 **Bugfixes:**
 
 - Edge cases where `cy.intercept()` would not properly intercept and asset response bodies would not properly be captured for test replay have been addressed. Addressed in [#27771](https://github.com/cypress-io/cypress/pull/27771).
-- Fixed an issue where `enter`, `keyup`, and `space` events where not triggering `click` events properly in some versions of Firefox. Addressed in [#27715](https://github.com/cypress-io/cypress/pull/27715). 
-- Fixed a regression in `13.0.0` where tests using Basic Authorization can potentially hang indefinitely on chromium browsers. Addressed in [#27781](https://github.com/cypress-io/cypress/pull/27781) 
+- Fixed an issue where `enter`, `keyup`, and `space` events where not triggering `click` events properly in some versions of Firefox. Addressed in [#27715](https://github.com/cypress-io/cypress/pull/27715).
+- Fixed a regression in `13.0.0` where tests using Basic Authorization can potentially hang indefinitely on chromium browsers. Addressed in [#27781](https://github.com/cypress-io/cypress/pull/27781).
+- Fixed a regression in `13.0.0` where component tests using an intercept that matches all requests can potentially hang indefinitely. Addressed in [#27788](https://github.com/cypress-io/cypress/pull/27788).
 
 **Dependency Updates:**
 

packages/net-stubbing/lib/server/middleware/request.ts

@@ -28,6 +28,16 @@ const debug = null
 export const SetMatchingRoutes: RequestMiddleware = async function () {
   const span = telemetry.startSpan({ name: 'set:matching:routes', parentSpan: this.reqMiddlewareSpan, isVerbose: true })
 
+  const url = new URL(this.req.proxiedUrl)
+
+  // if this is a request to the dev server, do not match any routes as
+  // we do not want to allow the user to intercept requests to the dev server
+  if (url.pathname.startsWith(this.config.devServerPublicPathRoute)) {
+    span?.end()
+
+    return this.next()
+  }
+
   if (matchesRoutePreflight(this.netStubbingState.routes, this.req)) {
     // send positive CORS preflight response
     return sendStaticResponse(this, {

packages/proxy/test/integration/net-stubbing.spec.ts

@@ -328,6 +328,43 @@ context('network stubbing', () => {
     expect(sendContentLength).to.eq(realContentLength)
   })
 
+  it('does not intercept requests to the dev server', async () => {
+    destinationApp.get('/__cypress/src/main.js', (req, res) => res.send('it worked'))
+
+    // setup an intercept that matches all requests
+    // and has a static response
+    netStubbingState.routes.push({
+      id: '1',
+      routeMatcher: {
+        url: '*',
+      },
+      hasInterceptor: false,
+      staticResponse: {
+        body: 'foo',
+      },
+      getFixture,
+      matches: 1,
+    })
+
+    config.devServerPublicPathRoute = '/__cypress/src'
+
+    // request to the dev server does NOT get intercepted
+    await supertest(app)
+    .get(`/http://localhost:${destinationPort}/__cypress/src/main.js`)
+    .then((res) => {
+      expect(res.status).to.eq(200)
+      expect(res.text).to.eq('it worked')
+    })
+
+    // request NOT to the dev server DOES get intercepted
+    await supertest(app)
+    .get(`/http://localhost:${destinationPort}/`)
+    .then((res) => {
+      expect(res.status).to.eq(200)
+      expect(res.text).to.eq('foo')
+    })
+  })
+
   describe('CSP Headers', () => {
     // Loop through valid CSP header names can verify that we handle them
     [