0http-bun 1.2.1 → 1.3.0

package/lib/middleware/body-parser.js

@@ -12,6 +12,87 @@
  * - Error message sanitization to prevent information leakage
  */
 
+/**
+ * Symbol key for storing raw body text to prevent accidental serialization/logging (L-3 fix)
+ */
+const RAW_BODY_SYMBOL = Symbol.for('0http.rawBody')
+
+/**
+ * Keys that must be blocked to prevent prototype pollution attacks.
+ * Shared across all parsers (URL-encoded, multipart, nested key parsing).
+ */
+const PROTOTYPE_POLLUTION_KEYS = new Set([
+  '__proto__',
+  'constructor',
+  'prototype',
+  'hasOwnProperty',
+  'isPrototypeOf',
+  'propertyIsEnumerable',
+  'valueOf',
+  'toString',
+])
+
+/**
+ * Reads request body as text with inline size enforcement.
+ * Streams the body and aborts if the accumulated size exceeds the limit,
+ * preventing full memory allocation for oversized payloads (H-3 fix).
+ * @param {Request} req - Request object
+ * @param {number} maxBytes - Maximum allowed body size in bytes
+ * @returns {Promise<string>} Body text
+ * @throws {Object} Object with `status` and `message` on limit exceeded
+ */
+async function readBodyWithLimit(req, maxBytes) {
+  // If the request has no body stream, fall back to req.text()
+  if (!req.body || typeof req.body.getReader !== 'function') {
+    const text = await req.text()
+    const byteLength = new TextEncoder().encode(text).length
+    if (byteLength > maxBytes) {
+      const err = new Error('Request body size exceeded')
+      err.status = 413
+      throw err
+    }
+    return text
+  }
+
+  const reader = req.body.getReader()
+  const chunks = []
+  let totalBytes = 0
+
+  try {
+    while (true) {
+      const {done, value} = await reader.read()
+      if (done) break
+
+      totalBytes += value.byteLength
+      if (totalBytes > maxBytes) {
+        reader.cancel()
+        const err = new Error('Request body size exceeded')
+        err.status = 413
+        throw err
+      }
+      chunks.push(value)
+    }
+  } catch (e) {
+    // Re-throw size limit errors
+    if (e.status === 413) throw e
+    // Wrap other stream errors
+    const err = new Error('Failed to read request body')
+    err.status = 400
+    throw err
+  }
+
+  // Concatenate chunks and decode to string
+  const totalLength = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0)
+  const combined = new Uint8Array(totalLength)
+  let offset = 0
+  for (const chunk of chunks) {
+    combined.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+
+  return new TextDecoder().decode(combined)
+}
+
 /**
  * Parses size limit strings with suffixes (e.g. '500b', '1kb', '2mb')
  * @param {number|string} limit - Size limit
@@ -64,7 +145,9 @@ function parseLimit(limit) {
     return Math.min(bytes, 1024 * 1024 * 1024) // Max 1GB
   }
 
-  return limit || 1024 * 1024 // Default 1MB
+  throw new TypeError(
+    `Invalid limit type: expected number or string, got ${typeof limit}`,
+  )
 }
 
 /**
@@ -113,19 +196,7 @@ function parseNestedKey(obj, key, value, depth = 0) {
     throw new Error('Maximum nesting depth exceeded')
   }
 
-  // Protect against prototype pollution
-  const prototypePollutionKeys = [
-    '__proto__',
-    'constructor',
-    'prototype',
-    'hasOwnProperty',
-    'isPrototypeOf',
-    'propertyIsEnumerable',
-    'valueOf',
-    'toString',
-  ]
-
-  if (prototypePollutionKeys.includes(key)) {
+  if (PROTOTYPE_POLLUTION_KEYS.has(key)) {
     return // Silently ignore dangerous keys
   }
 
@@ -138,7 +209,7 @@ function parseNestedKey(obj, key, value, depth = 0) {
   const [, baseKey, indexKey, remaining] = match
 
   // Protect against prototype pollution on base key
-  if (prototypePollutionKeys.includes(baseKey)) {
+  if (PROTOTYPE_POLLUTION_KEYS.has(baseKey)) {
     return
   }
 
@@ -161,7 +232,7 @@ function parseNestedKey(obj, key, value, depth = 0) {
       }
     } else {
       // Protect against prototype pollution on index key
-      if (!prototypePollutionKeys.includes(indexKey)) {
+      if (!PROTOTYPE_POLLUTION_KEYS.has(indexKey)) {
         obj[baseKey][indexKey] = value
       }
     }
@@ -194,90 +265,104 @@ function createJSONParser(options = {}) {
       return deferNext ? null : next()
     }
 
-    try {
-      const contentLength = req.headers.get('content-length')
-      if (contentLength) {
-        const length = parseInt(contentLength)
-        if (isNaN(length) || length < 0) {
-          return new Response('Invalid content-length header', {status: 400})
-        }
-        if (length > parsedLimit) {
-          return new Response('Request body size exceeded', {status: 413})
-        }
+    const contentLength = req.headers.get('content-length')
+    if (contentLength) {
+      const length = parseInt(contentLength)
+      if (isNaN(length) || length < 0) {
+        return new Response('Invalid content-length header', {status: 400})
       }
-
-      // Check if the request has a null body (no body was provided)
-      if (req.body === null) {
-        Object.defineProperty(req, 'body', {
-          value: undefined,
-          writable: true,
-          enumerable: true,
-          configurable: true,
-        })
-        return deferNext ? null : next()
+      if (length > parsedLimit) {
+        return new Response('Request body size exceeded', {status: 413})
       }
+    }
 
-      const text = await req.text()
-      // Store raw body text for verification
-      req._rawBodyText = text
+    // Check if the request has a null body (no body was provided)
+    if (req.body === null) {
+      Object.defineProperty(req, 'body', {
+        value: undefined,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      })
+      return deferNext ? null : next()
+    }
 
-      // Validate text length to prevent memory exhaustion
-      const textLength = new TextEncoder().encode(text).length
-      if (textLength > parsedLimit) {
+    let text
+    try {
+      text = await readBodyWithLimit(req, parsedLimit)
+    } catch (e) {
+      if (e.status === 413) {
         return new Response('Request body size exceeded', {status: 413})
       }
-
-      // Additional protection against excessively deep nesting
-      if (text.length > 0) {
-        // Count nesting levels to prevent stack overflow during parsing
-        let nestingLevel = 0
-        let maxNesting = 0
-        for (let i = 0; i < text.length; i++) {
-          if (text[i] === '{' || text[i] === '[') {
-            nestingLevel++
-            maxNesting = Math.max(maxNesting, nestingLevel)
-          } else if (text[i] === '}' || text[i] === ']') {
-            nestingLevel--
-          }
+      return new Response('Failed to read request body', {status: 400})
+    }
+    // Store raw body text for verification (L-3: use Symbol to prevent accidental serialization)
+    req[RAW_BODY_SYMBOL] = text
+
+    // Additional protection against excessively deep nesting
+    if (text.length > 0) {
+      // Count nesting levels with string-awareness to prevent bypass via string content
+      let nestingLevel = 0
+      let maxNesting = 0
+      let inString = false
+      let escape = false
+      for (let i = 0; i < text.length; i++) {
+        const ch = text[i]
+        if (escape) {
+          escape = false
+          continue
         }
-        if (maxNesting > 100) {
-          return new Response('JSON nesting too deep', {status: 400})
+        if (ch === '\\' && inString) {
+          escape = true
+          continue
+        }
+        if (ch === '"') {
+          inString = !inString
+          continue
+        }
+        if (inString) continue
+        if (ch === '{' || ch === '[') {
+          nestingLevel++
+          maxNesting = Math.max(maxNesting, nestingLevel)
+        } else if (ch === '}' || ch === ']') {
+          nestingLevel--
         }
       }
-
-      // Handle empty string body (becomes empty object)
-      if (text === '' || text.trim() === '') {
-        Object.defineProperty(req, 'body', {
-          value: {},
-          writable: true,
-          enumerable: true,
-          configurable: true,
-        })
-        return deferNext ? null : next()
-      }
-
-      let body
-      try {
-        body = JSON.parse(text, reviver)
-      } catch (parseError) {
-        throw new Error(`Invalid JSON: ${parseError.message}`)
-      }
-
-      if (strict && typeof body !== 'object') {
-        throw new Error('JSON body must be an object or array')
+      if (maxNesting > 100) {
+        return new Response('JSON nesting too deep', {status: 400})
       }
+    }
 
+    // Handle empty string body — return undefined to distinguish from actual data (L-2 fix)
+    if (text === '' || text.trim() === '') {
       Object.defineProperty(req, 'body', {
-        value: body,
+        value: undefined,
         writable: true,
         enumerable: true,
         configurable: true,
       })
-
       return deferNext ? null : next()
-    } catch (error) {
-      throw error
     }
+
+    let body
+    try {
+      body = JSON.parse(text, reviver)
+    } catch (parseError) {
+      throw new Error(`Invalid JSON: ${parseError.message}`)
+    }
+
+    if (strict && typeof body !== 'object') {
+      throw new Error('JSON body must be an object or array')
+    }
+
+    Object.defineProperty(req, 'body', {
+      value: body,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
+
+    return deferNext ? null : next()
   }
 }
 
@@ -299,38 +384,37 @@ function createTextParser(options = {}) {
       return deferNext ? null : next()
     }
 
-    try {
-      const contentLength = req.headers.get('content-length')
-      if (contentLength) {
-        const length = parseInt(contentLength)
-        if (isNaN(length) || length < 0) {
-          return new Response('Invalid content-length header', {status: 400})
-        }
-        if (length > parsedLimit) {
-          return new Response('Request body size exceeded', {status: 413})
-        }
+    const contentLength = req.headers.get('content-length')
+    if (contentLength) {
+      const length = parseInt(contentLength)
+      if (isNaN(length) || length < 0) {
+        return new Response('Invalid content-length header', {status: 400})
       }
+      if (length > parsedLimit) {
+        return new Response('Request body size exceeded', {status: 413})
+      }
+    }
 
-      const text = await req.text()
-      // Store raw body text for verification
-      req._rawBodyText = text
-
-      const textLength = new TextEncoder().encode(text).length
-      if (textLength > parsedLimit) {
+    let text
+    try {
+      text = await readBodyWithLimit(req, parsedLimit)
+    } catch (e) {
+      if (e.status === 413) {
         return new Response('Request body size exceeded', {status: 413})
       }
+      return new Response('Failed to read request body', {status: 400})
+    }
+    // Store raw body text for verification (L-3: use Symbol to prevent accidental serialization)
+    req[RAW_BODY_SYMBOL] = text
 
-      Object.defineProperty(req, 'body', {
-        value: text,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
+    Object.defineProperty(req, 'body', {
+      value: text,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
 
-      return deferNext ? null : next()
-    } catch (error) {
-      throw error
-    }
+    return deferNext ? null : next()
   }
 }
 
@@ -338,8 +422,8 @@ function createTextParser(options = {}) {
  * Creates a URL-encoded form parser middleware
  * @param {Object} options - Body parser configuration
  * @param {number|string} options.limit - Maximum body size in bytes
- * @param {boolean} options.extended - Use extended query string parsing
- * @param {boolean} options.parseNestedObjects - Parse nested object notation
+ * @param {boolean} options.extended - Enable rich parsing: nested objects, arrays, and duplicate key merging (default: true). When false, only flat key-value pairs are returned.
+ * @param {boolean} options.parseNestedObjects - Parse bracket notation (e.g. a[b]=1) into nested objects. Only applies when extended=true (default: true)
  * @param {boolean} options.deferNext - If true, don't call next() and let caller handle it
  * @returns {Function} Middleware function
  */
@@ -361,92 +445,87 @@ function createURLEncodedParser(options = {}) {
       return deferNext ? null : next()
     }
 
-    try {
-      const contentLength = req.headers.get('content-length')
-      if (contentLength) {
-        const length = parseInt(contentLength)
-        if (isNaN(length) || length < 0) {
-          return new Response('Invalid content-length header', {status: 400})
-        }
-        if (length > parsedLimit) {
-          return new Response('Request body size exceeded', {status: 413})
-        }
+    const contentLength = req.headers.get('content-length')
+    if (contentLength) {
+      const length = parseInt(contentLength)
+      if (isNaN(length) || length < 0) {
+        return new Response('Invalid content-length header', {status: 400})
       }
+      if (length > parsedLimit) {
+        return new Response('Request body size exceeded', {status: 413})
+      }
+    }
 
-      const text = await req.text()
-      // Store raw body text for verification
-      req._rawBodyText = text
-
-      const textLength = new TextEncoder().encode(text).length
-      if (textLength > parsedLimit) {
+    let text
+    try {
+      text = await readBodyWithLimit(req, parsedLimit)
+    } catch (e) {
+      if (e.status === 413) {
         return new Response('Request body size exceeded', {status: 413})
       }
+      return new Response('Failed to read request body', {status: 400})
+    }
+    // Store raw body text for verification (L-3: use Symbol to prevent accidental serialization)
+    req[RAW_BODY_SYMBOL] = text
 
-      const body = {}
-      const params = new URLSearchParams(text)
+    const body = Object.create(null)
+    const params = new URLSearchParams(text)
 
-      // Prevent DoS through excessive parameters
-      let paramCount = 0
-      const maxParams = 1000 // Reasonable limit for URL-encoded parameters
+    // Prevent DoS through excessive parameters
+    let paramCount = 0
+    const maxParams = 1000 // Reasonable limit for URL-encoded parameters
 
-      for (const [key, value] of params.entries()) {
-        paramCount++
-        if (paramCount > maxParams) {
-          return new Response('Too many parameters', {status: 400})
-        }
+    for (const [key, value] of params.entries()) {
+      paramCount++
+      if (paramCount > maxParams) {
+        return new Response('Too many parameters', {status: 400})
+      }
 
-        // Validate key and value lengths to prevent memory exhaustion
-        if (key.length > 1000 || value.length > 10000) {
-          return new Response('Parameter too long', {status: 400})
-        }
+      // Validate key and value lengths to prevent memory exhaustion
+      if (key.length > 1000 || value.length > 10000) {
+        return new Response('Parameter too long', {status: 400})
+      }
 
-        if (parseNestedObjects) {
-          try {
-            parseNestedKey(body, key, value)
-          } catch (parseError) {
-            return new Response(
-              `Invalid parameter structure: ${parseError.message}`,
-              {status: 400},
-            )
-          }
-        } else {
-          // Protect against prototype pollution even when parseNestedObjects is false
-          const prototypePollutionKeys = [
-            '__proto__',
-            'constructor',
-            'prototype',
-            'hasOwnProperty',
-            'isPrototypeOf',
-            'propertyIsEnumerable',
-            'valueOf',
-            'toString',
-          ]
-
-          if (!prototypePollutionKeys.includes(key)) {
-            if (body[key] !== undefined) {
-              if (Array.isArray(body[key])) {
-                body[key].push(value)
-              } else {
-                body[key] = [body[key], value]
-              }
+      if (extended && parseNestedObjects) {
+        // Extended + nested: parse bracket notation into nested objects/arrays
+        // (parseNestedKey has its own prototype pollution guards via PROTOTYPE_POLLUTION_KEYS)
+        try {
+          parseNestedKey(body, key, value)
+        } catch (parseError) {
+          return new Response(
+            `Invalid parameter structure: ${parseError.message}`,
+            {status: 400},
+          )
+        }
+      } else if (extended) {
+        // Extended but no nested parsing: flat keys with duplicate key merging into arrays
+        if (!PROTOTYPE_POLLUTION_KEYS.has(key)) {
+          if (body[key] !== undefined) {
+            if (Array.isArray(body[key])) {
+              body[key].push(value)
             } else {
-              body[key] = value
+              body[key] = [body[key], value]
             }
+          } else {
+            body[key] = value
           }
         }
+      } else {
+        // Simple mode: flat key-value pairs, last value wins
+        if (!PROTOTYPE_POLLUTION_KEYS.has(key)) {
+          body[key] = value
+        }
       }
+    }
 
-      Object.defineProperty(req, 'body', {
-        value: body,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
+    Object.defineProperty(req, 'body', {
+      value: body,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
 
-      return deferNext ? null : next()
-    } catch (error) {
-      throw error
-    }
+    return deferNext ? null : next()
   }
 }
 
@@ -468,109 +547,141 @@ function createMultipartParser(options = {}) {
       return deferNext ? null : next()
     }
 
-    try {
-      const contentLength = req.headers.get('content-length')
-      if (contentLength) {
-        const length = parseInt(contentLength)
-        if (isNaN(length) || length < 0) {
-          return new Response('Invalid content-length header', {status: 400})
-        }
-        if (length > parsedLimit) {
-          return new Response('Request body size exceeded', {status: 413})
-        }
+    const contentLength = req.headers.get('content-length')
+    if (contentLength) {
+      const length = parseInt(contentLength)
+      if (isNaN(length) || length < 0) {
+        return new Response('Invalid content-length header', {status: 400})
+      }
+      if (length > parsedLimit) {
+        return new Response('Request body size exceeded', {status: 413})
       }
+    }
 
-      const formData = await req.formData()
+    const formData = await req.formData()
 
-      // Calculate actual size of form data and validate
-      let totalSize = 0
-      let fieldCount = 0
-      const maxFields = 100 // Reasonable limit for form fields
+    // Single-pass: validate and extract simultaneously (H-5 fix)
+    // Merges the validation and extraction loops to avoid double iteration
+    let totalSize = 0
+    let fieldCount = 0
+    const maxFields = 100 // Reasonable limit for form fields
 
-      for (const [key, value] of formData.entries()) {
-        fieldCount++
-        if (fieldCount > maxFields) {
-          return new Response('Too many form fields', {status: 400})
-        }
+    const body = Object.create(null)
+    const files = Object.create(null)
 
-        // Validate field name length
-        if (key.length > 1000) {
-          return new Response('Field name too long', {status: 400})
-        }
+    for (const [key, value] of formData.entries()) {
+      fieldCount++
+      if (fieldCount > maxFields) {
+        return new Response('Too many form fields', {status: 400})
+      }
 
-        if (value instanceof File) {
-          totalSize += value.size
-          // Validate file name length for security
-          if (value.name && value.name.length > 255) {
-            return new Response('Filename too long', {status: 400})
-          }
-          // Validate file size individually
-          if (value.size > parsedLimit) {
-            return new Response('File too large', {status: 413})
-          }
-        } else {
-          const valueSize = new TextEncoder().encode(value).length
-          totalSize += valueSize
-          // Validate field value length
-          if (valueSize > 100000) {
-            // 100KB per field
-            return new Response('Field value too long', {status: 400})
-          }
+      // Validate field name length
+      if (key.length > 1000) {
+        return new Response('Field name too long', {status: 400})
+      }
+
+      // Skip prototype pollution keys
+      if (PROTOTYPE_POLLUTION_KEYS.has(key)) {
+        continue
+      }
+
+      if (value instanceof File) {
+        totalSize += value.size
+        // Validate file name length for security
+        if (value.name && value.name.length > 255) {
+          return new Response('Filename too long', {status: 400})
         }
+        // Validate file size individually
+        if (value.size > parsedLimit) {
+          return new Response('File too large', {status: 413})
+        }
+
         totalSize += new TextEncoder().encode(key).length
 
-        // Check total size periodically to prevent memory exhaustion
+        // Check total size to prevent memory exhaustion
         if (totalSize > parsedLimit) {
           return new Response('Request body size exceeded', {status: 413})
         }
-      }
 
-      const body = {}
-      const files = {}
-
-      for (const [key, value] of formData.entries()) {
-        if (value instanceof File) {
-          const mimetype = value.type?.split(';')[0] || value.type
-          const fileData = new Uint8Array(await value.arrayBuffer())
+        const mimetype = value.type?.split(';')[0] || value.type
+        const fileData = new Uint8Array(await value.arrayBuffer())
+        // Sanitize filename to prevent path traversal
+        let sanitizedFilename = value.name
+        if (sanitizedFilename) {
+          const originalName = sanitizedFilename
+          // Remove null bytes
+          sanitizedFilename = sanitizedFilename.replace(/\0/g, '')
+          // Remove path separators and directory components
+          sanitizedFilename = sanitizedFilename.replace(/\.\./g, '')
+          sanitizedFilename = sanitizedFilename.replace(/[/\\]/g, '')
+          // Remove leading dots (hidden files)
+          sanitizedFilename = sanitizedFilename.replace(/^\.+/, '')
+          // If nothing is left after sanitization, use a default name
+          if (!sanitizedFilename) {
+            sanitizedFilename = 'upload'
+          }
           files[key] = {
-            filename: value.name,
-            name: value.name,
+            filename: sanitizedFilename,
+            originalName: originalName,
+            name: sanitizedFilename,
             size: value.size,
             type: value.type,
             mimetype: mimetype,
             data: fileData,
           }
         } else {
-          if (body[key] !== undefined) {
-            if (Array.isArray(body[key])) {
-              body[key].push(value)
-            } else {
-              body[key] = [body[key], value]
-            }
-          } else {
-            body[key] = value
+          files[key] = {
+            filename: value.name,
+            name: value.name,
+            size: value.size,
+            type: value.type,
+            mimetype: mimetype,
+            data: fileData,
           }
         }
-      }
+      } else {
+        const valueSize = new TextEncoder().encode(value).length
+        totalSize += valueSize
+        // Validate field value length
+        if (valueSize > 100000) {
+          // 100KB per field
+          return new Response('Field value too long', {status: 400})
+        }
 
-      Object.defineProperty(req, 'body', {
-        value: body,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
+        totalSize += new TextEncoder().encode(key).length
 
-      Object.defineProperty(req, 'files', {
-        value: files,
-        writable: true,
-        enumerable: true,
-        configurable: true,
-      })
+        // Check total size to prevent memory exhaustion
+        if (totalSize > parsedLimit) {
+          return new Response('Request body size exceeded', {status: 413})
+        }
 
-      return deferNext ? null : next()
-    } catch (error) {
-      throw error
+        if (body[key] !== undefined) {
+          if (Array.isArray(body[key])) {
+            body[key].push(value)
+          } else {
+            body[key] = [body[key], value]
+          }
+        } else {
+          body[key] = value
+        }
+      }
     }
+
+    Object.defineProperty(req, 'body', {
+      value: body,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
+
+    Object.defineProperty(req, 'files', {
+      value: files,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
+
+    return deferNext ? null : next()
   }
 }
 
@@ -586,6 +697,7 @@ function createMultipartParser(options = {}) {
  * @param {Function} options.onError - Custom error handler
  * @param {Function} options.verify - Body verification function
  * @param {boolean} options.parseNestedObjects - Parse nested object notation (for compatibility)
+ * @param {boolean} options.extended - Enable rich URL-encoded parsing (for compatibility, forwarded to urlencoded.extended)
  * @param {string|number} options.jsonLimit - JSON size limit (backward compatibility)
  * @param {string|number} options.textLimit - Text size limit (backward compatibility)
  * @param {string|number} options.urlencodedLimit - URL-encoded size limit (backward compatibility)
@@ -603,6 +715,7 @@ function createBodyParser(options = {}) {
     onError,
     verify,
     parseNestedObjects = true,
+    extended,
     // Backward compatibility for direct limit options
     jsonLimit,
     textLimit,
@@ -626,6 +739,12 @@ function createBodyParser(options = {}) {
       urlencoded.urlencodedLimit ||
       urlencoded.limit ||
       '1mb',
+    extended:
+      urlencoded.extended !== undefined
+        ? urlencoded.extended
+        : extended !== undefined
+          ? extended
+          : true,
     parseNestedObjects:
       urlencoded.parseNestedObjects !== undefined
         ? urlencoded.parseNestedObjects
@@ -640,7 +759,7 @@ function createBodyParser(options = {}) {
   // Create parsers with custom types consideration
   const jsonParserMiddleware = createJSONParser({
     ...jsonOptions,
-    type: 'application/', // Broad match for JSON types
+    type: 'application/json', // Match only JSON content types
     deferNext: !!verify, // Defer next if verification is enabled
   })
   const textParserMiddleware = createTextParser({
@@ -686,7 +805,26 @@ function createBodyParser(options = {}) {
 
       // Custom JSON parser handling for custom JSON types (case-insensitive)
       if (jsonParser && isJsonType(contentType, jsonTypes)) {
-        const text = await req.text()
+        const contentLength = req.headers.get('content-length')
+        const jsonParsedLimit = parseLimit(jsonOptions.limit)
+        if (contentLength) {
+          const length = parseInt(contentLength)
+          if (isNaN(length) || length < 0) {
+            return new Response('Invalid content-length header', {status: 400})
+          }
+          if (length > jsonParsedLimit) {
+            return new Response('Request body size exceeded', {status: 413})
+          }
+        }
+        let text
+        try {
+          text = await readBodyWithLimit(req, jsonParsedLimit)
+        } catch (e) {
+          if (e.status === 413) {
+            return new Response('Request body size exceeded', {status: 413})
+          }
+          return new Response('Failed to read request body', {status: 400})
+        }
         const body = jsonParser(text)
         Object.defineProperty(req, 'body', {
           value: body,
@@ -699,7 +837,15 @@ function createBodyParser(options = {}) {
       } else {
         // Check if content type matches any JSON types first (including custom ones)
         if (isJsonType(contentType, jsonTypes)) {
-          result = await jsonParserMiddleware(req, next)
+          // Use a JSON parser that matches the detected custom type
+          const customTypeJsonParser = createJSONParser({
+            ...jsonOptions,
+            type: jsonTypes.find((t) =>
+              contentType.toLowerCase().includes(t.toLowerCase()),
+            ),
+            deferNext: !!verify,
+          })
+          result = await customTypeJsonParser(req, next)
         } else {
           // Route to appropriate parser based on content type (case-insensitive)
           const lowerContentType = contentType.toLowerCase()
@@ -735,10 +881,10 @@ function createBodyParser(options = {}) {
       if (verify && req.body !== undefined) {
         try {
           // For verification, we need to pass the raw body text
-          // Get the original text/data that was parsed
+          // Get the original text/data that was parsed (L-3: read from Symbol)
           let rawBody = ''
-          if (req._rawBodyText) {
-            rawBody = req._rawBodyText
+          if (req[RAW_BODY_SYMBOL]) {
+            rawBody = req[RAW_BODY_SYMBOL]
           }
           verify(req, rawBody)
         } catch (verifyError) {
@@ -777,6 +923,7 @@ module.exports = {
   hasBody,
   shouldParse,
   parseLimit,
+  RAW_BODY_SYMBOL,
 }
 
 // Default export is the main body parser