npm - @browserless.io/browserless - Versions diffs - 2.26.1 → 2.27.0 - Mend

@browserless.io/browserless 2.26.1 → 2.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (437) hide show

package/extensions/ublocklite/rulesets/urlskip/default.json CHANGED Viewed

@@ -103,6 +103,13 @@
    "-base64"
   ]
  },
+ {
+  "re": "^[a-z-]+://(?:[^/?#]+\\.)?migmig\\.affilio\\.ir/api/v1/click(?:[^%.0-9a-z_-]|$)",
+  "steps": [
+   "?b64",
+   "-base64"
+  ]
+ },
  {
   "re": "^[a-z-]+://(?:[^/?#]+\\.)?freex2line\\.online/\\S*?/\\?redirect",
   "steps": [

package/extensions/ublocklite/ublock.zip CHANGED Viewed

Binary file

package/extensions/ublocklite/web_accessible_resources/fingerprint3.js ADDED Viewed

@@ -0,0 +1,45 @@
+/*******************************************************************************
+    uBlock Origin - a browser extension to block requests.
+    Copyright (C) 2022-present Raymond Hill
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see {http://www.gnu.org/licenses/}.
+    Home: https://github.com/gorhill/uBlock
+*/
+(function() {
+    'use strict';
+    const visitorId = (( ) => {
+        let id = '';
+        for ( let i = 0; i < 8; i++ ) {
+            id += (Math.random() * 0x10000 + 0x1000 | 0).toString(16).slice(-4);
+        }
+        return id;
+    })();
+    const FingerprintJS = class {
+        static hashComponents() {
+            return visitorId;
+        }
+        static load() {
+            return Promise.resolve(new FingerprintJS());
+        }
+        get() {
+            return Promise.resolve({
+                visitorId,
+            });
+        }
+    };
+    window.FingerprintJS = FingerprintJS;
+})();

package/extensions/ublocklite/zapper-ui.html CHANGED Viewed

@@ -10,7 +10,7 @@
 </head>
 <body>
-<aside style="right: 2px; bottom: 2px;">
+<aside>
     <div id="quit" data-i18n-title="zapperTipQuit">
         <svg viewBox="0 0 64 64"><path d="M16 16L48 48M16 48L48 16" /></svg>
     </div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@browserless.io/browserless",
-  "version": "2.26.1",
+  "version": "2.27.0",
   "license": "SSPL",
   "description": "The browserless platform",
   "author": "browserless.io",
@@ -55,7 +55,7 @@
     "get-port": "^7.1.0",
     "gradient-string": "^3.0.0",
     "http-proxy": "^1.18.1",
-    "lighthouse": "^12.4.0",
+    "lighthouse": "^12.5.1",
     "micromatch": "^4.0.8",
     "playwright-1.47": "npm:playwright-core@1.47.2",
     "playwright-1.48": "npm:playwright-core@1.48.2",
@@ -70,21 +70,21 @@
     "tar-fs": "^3.0.8"
   },
   "optionalDependencies": {
-    "@types/chai": "^5.2.0",
+    "@types/chai": "^5.2.1",
     "@types/debug": "^4.1.12",
     "@types/gradient-string": "^1.1.6",
     "@types/http-proxy": "^1.17.16",
     "@types/micromatch": "^4.0.9",
     "@types/mocha": "^10.0.10",
-    "@types/node": "^22.13.11",
+    "@types/node": "^22.13.15",
     "@types/sinon": "^17.0.4",
-    "@typescript-eslint/eslint-plugin": "^8.27.0",
-    "@typescript-eslint/parser": "^8.27.0",
+    "@typescript-eslint/eslint-plugin": "^8.29.0",
+    "@typescript-eslint/parser": "^8.29.0",
     "assert": "^2.0.0",
     "chai": "^5.2.0",
     "cross-env": "^7.0.3",
     "env-cmd": "^10.1.0",
-    "esbuild": "^0.25.1",
+    "esbuild": "^0.25.2",
     "esbuild-plugin-polyfill-node": "^0.3.0",
     "eslint": "^9.23.0",
     "extract-zip": "^2.0.1",
@@ -93,7 +93,7 @@
     "mocha": "^11.1.0",
     "move-file": "^3.1.0",
     "prettier": "^3.5.3",
-    "sinon": "^19.0.4",
+    "sinon": "^20.0.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.7.3",
     "typescript-json-schema": "^0.65.1"

package/src/config.ts CHANGED Viewed

@@ -17,7 +17,6 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 /**
  * configs to add:
  * EXIT_ON_HEALTH_FAILURE
- * MAX_PAYLOAD_SIZE
  */
 enum oldConfig {
@@ -176,6 +175,7 @@ export class Config extends EventEmitter {
   protected corsMaxAge = +(process.env.CORS_MAX_AGE ?? '2592000');
   protected maxCpu = +(process.env.MAX_CPU_PERCENT ?? '99');
   protected maxMemory = +(process.env.MAX_MEMORY_PERCENT ?? '99');
+  protected maxPayloadSize = +(process.env.MAX_PAYLOAD_SIZE ?? '10485760'); // Default 10MB
   protected healthCheck = !!parseEnvVars(false, 'HEALTH');
   protected failedHealthURL = process.env.FAILED_HEALTH_URL ?? null;
   protected queueAlertURL = process.env.QUEUE_ALERT_URL ?? null;
@@ -251,6 +251,9 @@ export class Config extends EventEmitter {
   public getMemoryLimit(): number {
     return this.maxMemory;
   }
+  public getMaxPayloadSize(): number {
+    return this.maxPayloadSize;
+  }
   public getHealthChecksEnabled(): boolean {
     return this.healthCheck;
   }
@@ -410,6 +413,11 @@ export class Config extends EventEmitter {
     return (this.maxMemory = limit);
   }
+  public setMaxPayloadSize(limit: number): number {
+    this.emit('maxPayloadSize', limit);
+    return (this.maxPayloadSize = limit);
+  }
   public enableHealthChecks(enable: boolean): boolean {
     this.emit('healthCheck', enable);
     return (this.healthCheck = enable);

package/src/routes/chromium/tests/pdf.spec.ts CHANGED Viewed

@@ -389,4 +389,31 @@ describe('/chromium/pdf API', function () {
       expect(res.status).to.equal(200);
     });
   });
+  it('returns 400 when payload size exceeds maximum allowed size', async () => {
+    const config = new Config();
+    config.setToken('browserless');
+    config.setMaxPayloadSize(100); // Set a very small max payload size for testing
+    const metrics = new Metrics();
+    await start({ config, metrics });
+    // Create a large payload that exceeds the 100 byte limit
+    const body = {
+      html: 'a'.repeat(200), // Create a 200 byte string
+    };
+    await fetch('http://localhost:3000/chromium/pdf?token=browserless', {
+      body: JSON.stringify(body),
+      headers: {
+        'content-type': 'application/json',
+      },
+      method: 'POST',
+    }).then(async (res) => {
+      const errorText = await res.text();
+      console.log(errorText);
+      expect(res.status).to.equal(400);
+      expect(errorText).to.include('Request payload size');
+      expect(errorText).to.include('exceeds maximum allowed size');
+    });
+  });
 });

package/src/server.ts CHANGED Viewed

@@ -60,6 +60,32 @@ export class HTTPServer extends EventEmitter {
     );
   }
+  protected handleErrorRequest(e: Error, res: Response | stream.Duplex) {
+    if (e instanceof BadRequest) {
+      return writeResponse(res, 400, e.message);
+    }
+    if (e instanceof NotFound) {
+      return writeResponse(res, 404, e.message);
+    }
+    if (e instanceof Unauthorized) {
+      return writeResponse(res, 401, e.message);
+    }
+    if (e instanceof TooManyRequests) {
+      return writeResponse(res, 429, e.message);
+    }
+    if (e instanceof Timeout) {
+      return writeResponse(res, 408, e.message);
+    }
+    this.logger.error(`Error handling request: ${e}\n${e.stack}`);
+    return writeResponse(res, 500, e.toString());
+  }
   protected onHTTPUnauthorized(_req: Request, res: Response) {
     this.logger.error(
       `HTTP request is not properly authorized, responding with 401`,
@@ -177,7 +203,9 @@ export class HTTPServer extends EventEmitter {
       }
     }
-    const body = await readBody(req);
+    const body = await readBody(req, this.config.getMaxPayloadSize()).catch(
+      (e) => this.handleErrorRequest(e, res),
+    );
     req.body = body;
     req.queryParams = queryParamsToObject(req.parsed.searchParams);
@@ -285,29 +313,7 @@ export class HTTPServer extends EventEmitter {
       .then(() => {
         this.logger.trace('HTTP connection complete');
       })
-      .catch((e) => {
-        if (e instanceof BadRequest) {
-          return writeResponse(res, 400, e.message);
-        }
-        if (e instanceof NotFound) {
-          return writeResponse(res, 404, e.message);
-        }
-        if (e instanceof Unauthorized) {
-          return writeResponse(res, 401, e.message);
-        }
-        if (e instanceof TooManyRequests) {
-          return writeResponse(res, 429, e.message);
-        }
-        if (e instanceof Timeout) {
-          return writeResponse(res, 408, e.message);
-        }
-        return writeResponse(res, 500, e.toString());
-      });
+      .catch((e) => this.handleErrorRequest(e, res));
   }
   protected async handleWebSocket(
@@ -394,29 +400,7 @@ export class HTTPServer extends EventEmitter {
         .then(() => {
           this.logger.trace('Websocket connection complete');
         })
-        .catch((e) => {
-          if (e instanceof BadRequest) {
-            return writeResponse(socket, 400, e.message);
-          }
-          if (e instanceof NotFound) {
-            return writeResponse(socket, 404, e.message);
-          }
-          if (e instanceof Unauthorized) {
-            return writeResponse(socket, 401, e.message);
-          }
-          if (e instanceof TooManyRequests) {
-            return writeResponse(socket, 429, e.message);
-          }
-          this.logger.error(
-            `Error handling request at "${route.path}": ${e}\n${e.stack}`,
-          );
-          return writeResponse(socket, 500, e.message);
-        });
+        .catch((e) => this.handleErrorRequest(e, socket));
     }
     this.logger.error(

package/src/utils.ts CHANGED Viewed

@@ -236,10 +236,14 @@ export const getTokenFromRequest = (req: Request) => {
 };
 // NOTE, if proxying request elsewhere, you must re-stream the body again
-export const readRequestBody = async (req: Request): Promise<string> => {
-  return new Promise((resolve) => {
+export const readRequestBody = async (
+  req: Request,
+  maxSize: number = 10485760,
+): Promise<string> => {
+  return new Promise((resolve, reject) => {
     const body: Uint8Array[] = [];
     let hasResolved = false;
+    let totalSize = 0;
     const resolveOnce = (results: string) => {
       if (hasResolved) {
@@ -249,8 +253,27 @@ export const readRequestBody = async (req: Request): Promise<string> => {
       resolve(results);
     };
+    const rejectOnce = (error: Error) => {
+      if (hasResolved) {
+        return;
+      }
+      hasResolved = true;
+      reject(error);
+    };
     req
-      .on('data', (chunk) => body.push(chunk))
+      .on('data', (chunk) => {
+        totalSize += chunk.length;
+        if (totalSize > maxSize) {
+          rejectOnce(
+            new BadRequest(
+              `Request payload size (${totalSize} bytes) exceeds maximum allowed size of ${maxSize} bytes`,
+            ),
+          );
+          return;
+        }
+        body.push(chunk);
+      })
       .on('end', () => {
         const final = Buffer.concat(body).toString();
         resolveOnce(final);
@@ -258,8 +281,8 @@ export const readRequestBody = async (req: Request): Promise<string> => {
       .on('aborted', () => {
         resolveOnce('');
       })
-      .on('error', () => {
-        resolveOnce('');
+      .on('error', (error) => {
+        rejectOnce(error);
       });
   });
 };
@@ -317,6 +340,7 @@ export const generateDataDir = async (
 export const readBody = async (
   req: Request,
+  maxSize: number = 10485760,
 ): Promise<ReturnType<typeof safeParse>> => {
   if (
     typeof req.body === 'string' &&
@@ -324,7 +348,7 @@ export const readBody = async (
   ) {
     return safeParse(convertIfBase64(req.body));
   }
-  const body = await readRequestBody(req);
+  const body = await readRequestBody(req, maxSize);
   return req.headers['content-type']?.includes(contentTypes.json)
     ? safeParse(body)