Ensure unknown static paths 404 for data request (#16401)

We were accidentally allowing data requests to be rendered unconditionally. Instead, we should also check them against the staticPaths result and 404 when appropriate.

---

Fixes #15383

Author: Timer

packages/next/next-server/server/next-server.ts

@@ -1156,7 +1156,6 @@ export default class Server {
       fallbackMode !== 'blocking' &&
       ssgCacheKey &&
       !didRespond &&
-      !isDataReq &&
       !isPreviewMode &&
       isDynamicPathname &&
       // Development should trigger fallback when the path is not in
@@ -1173,27 +1172,29 @@ export default class Server {
         throw new NoFallbackError()
       }
 
-      let html: string
+      if (!isDataReq) {
+        let html: string
 
-      // Production already emitted the fallback as static HTML.
-      if (isProduction) {
-        html = await this.incrementalCache.getFallback(pathname)
-      }
-      // We need to generate the fallback on-demand for development.
-      else {
-        query.__nextFallback = 'true'
-        if (isLikeServerless) {
-          prepareServerlessUrl(req, query)
+        // Production already emitted the fallback as static HTML.
+        if (isProduction) {
+          html = await this.incrementalCache.getFallback(pathname)
+        }
+        // We need to generate the fallback on-demand for development.
+        else {
+          query.__nextFallback = 'true'
+          if (isLikeServerless) {
+            prepareServerlessUrl(req, query)
+          }
+          const { value: renderResult } = await doRender()
+          html = renderResult.html
         }
-        const { value: renderResult } = await doRender()
-        html = renderResult.html
-      }
 
-      sendPayload(req, res, html, 'html', {
-        generateEtags: this.renderOpts.generateEtags,
-        poweredByHeader: this.renderOpts.poweredByHeader,
-      })
-      return null
+        sendPayload(req, res, html, 'html', {
+          generateEtags: this.renderOpts.generateEtags,
+          poweredByHeader: this.renderOpts.poweredByHeader,
+        })
+        return null
+      }
     }
 
     const {

test/integration/prerender/test/index.test.js

@@ -576,6 +576,32 @@ const runTests = (dev = false, isEmulatedServerless = false) => {
     expect(value).toMatch(/Hi \[second\]!/)
   })
 
+  if (!isEmulatedServerless) {
+    it('should not return data for fallback: false and missing dynamic page', async () => {
+      const res1 = await fetchViaHTTP(
+        appPort,
+        `/_next/data/${buildId}/dynamic/oopsie.json`
+      )
+      expect(res1.status).toBe(404)
+
+      await waitFor(500)
+
+      const res2 = await fetchViaHTTP(
+        appPort,
+        `/_next/data/${buildId}/dynamic/oopsie.json`
+      )
+      expect(res2.status).toBe(404)
+
+      await waitFor(500)
+
+      const res3 = await fetchViaHTTP(
+        appPort,
+        `/_next/data/${buildId}/dynamic/oopsie.json`
+      )
+      expect(res3.status).toBe(404)
+    })
+  }
+
   it('should SSR catch-all page with brackets in param as string', async () => {
     const html = await renderViaHTTP(
       appPort,