@fastify/reply-from 12.4.0 → 12.5.0

package/README.md

@@ -524,26 +524,34 @@ This is due to the fact that `@fastify/multipart` consumes the multipart content
 
 However, the two plugins may be used within the same fastify instance, at the condition that they belong to disjoint branches of the fastify plugins hierarchy tree.
 
-### Proxying multipart/form-data without @fastify/multipart
+### Proxying specific content types without parsing
 
-If you need to proxy `multipart/form-data` requests without parsing them, you can use a custom content type parser instead of `@fastify/multipart`:
+If you need to proxy certain content types (like `multipart/form-data` or `text/event-stream`) without parsing them, you can use custom content type parsers:
 
 ```js
-// Register a custom content type parser for multipart/form-data
-// This passes the raw body through without parsing
+// Register custom content type parsers that pass raw body through
 fastify.addContentTypeParser('multipart/form-data', function (req, body, done) {
   done(null, body)
 })
 
+fastify.addContentTypeParser('text/event-stream', function (req, body, done) {
+  done(null, body)
+})
+
 fastify.register(require('@fastify/reply-from'))
 
 fastify.post('/upload', (request, reply) => {
   // The multipart data will be proxied as-is to the upstream server
   reply.from('http://upstream-server.com/upload')
 })
+
+fastify.post('/events', (request, reply) => {
+  // The SSE data will be proxied as-is to the upstream server
+  reply.from('http://upstream-server.com/events')
+})
 ```
 
-This approach allows `multipart/form-data` to be proxied correctly while avoiding the incompatibility with `@fastify/multipart`.
+This approach allows these content types to be proxied correctly while avoiding parsing that would consume the request body.
 
 ## License
 

package/index.js

@@ -71,7 +71,9 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
     const retryDelay = opts.retryDelay || undefined
 
     if (!source) {
-      source = req.url
+      const requestUrl = req.url
+      const queryIndex = requestUrl.indexOf('?')
+      source = queryIndex >= 0 ? requestUrl.substring(0, queryIndex) : requestUrl
     }
 
     // we leverage caching to avoid parsing the destination URL

package/lib/utils.js

@@ -63,6 +63,12 @@ function stripHttp1ConnectionHeaders (headers) {
 
 // issue ref: https://github.com/fastify/fast-proxy/issues/42
 function buildURL (source, reqBase) {
+  if (decodeURIComponent(source).includes('..')) {
+    const err = new Error('source/request contain invalid characters')
+    err.statusCode = 400
+    throw err
+  }
+
   if (Array.isArray(reqBase)) reqBase = reqBase[0]
   let baseOrigin = reqBase ? new URL(reqBase).href : undefined
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/reply-from",
-  "version": "12.4.0",
+  "version": "12.5.0",
   "description": "forward your HTTP request to another server, for fastify",
   "main": "index.js",
   "type": "commonjs",

package/test/build-url.test.js

@@ -76,3 +76,35 @@ test('should throw when trying to override base', async (t) => {
 
   await Promise.all(promises)
 })
+
+test('should throw on path traversal attempts', (t) => {
+  t.assert.throws(
+    () => buildURL('/foo/bar/../', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/..', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/%2e%2e/', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/%2E%2E/', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/..%2f', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/%2e%2e%2f', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+})

package/test/fix-GHSA-2q7r-29rg-6m5h.test.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('fix for GHSA-2q7r-29rg-6m5h vulnerability', async (t) => {
+  t.plan(2)
+
+  const target = http.createServer((_, res) => {
+    res.statusCode = 205
+    res.end('hi')
+  })
+  await target.listen({ port: 0 })
+  t.after(() => target.close())
+
+  instance.get('/', (_request, reply) => { reply.from('/ho/%2E%2E/hi') })
+  instance.register(From, {
+    base: `http://localhost:${target.address().port}/hi/`,
+    undici: true
+  })
+  await instance.listen({ port: 0 })
+  t.after(() => instance.close())
+
+  const { statusCode, body } = await request(`http://localhost:${instance.server.address().port}`)
+  t.assert.strictEqual(statusCode, 400)
+  t.assert.strictEqual(await body.text(), '{"statusCode":400,"error":"Bad Request","message":"source/request contain invalid characters"}')
+})

package/test/full-querystring-url.test.js

@@ -0,0 +1,55 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('full querystring url', async (t) => {
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.method, 'GET')
+    t.assert.strictEqual(req.url, '/hi?a=/ho/%2E%2E/hi')
+    res.statusCode = 205
+    res.setHeader('Content-Type', 'text/plain')
+    res.setHeader('x-my-header', 'hi!')
+    res.end('hi')
+  })
+
+  await target.listen({ port: 0 })
+  t.after(() => target.close())
+
+  await instance.register(From, {
+    base: `http://localhost:${target.address().port}`
+  })
+
+  instance.get('/hi', (_request, reply) => {
+    reply.from()
+  })
+
+  instance.get('/foo', (_request, reply) => {
+    reply.from('/hi')
+  })
+
+  await instance.listen({ port: 0 })
+  t.after(() => instance.close())
+
+  {
+    const result = await request(`http://localhost:${instance.server.address().port}/hi?a=/ho/%2E%2E/hi`)
+    t.assert.strictEqual(result.headers['content-type'], 'text/plain')
+    t.assert.strictEqual(result.headers['x-my-header'], 'hi!')
+    t.assert.strictEqual(result.statusCode, 205)
+    t.assert.strictEqual(await result.body.text(), 'hi')
+  }
+
+  {
+    const result = await request(`http://localhost:${instance.server.address().port}/foo?a=/ho/%2E%2E/hi`)
+    t.assert.strictEqual(result.headers['content-type'], 'text/plain')
+    t.assert.strictEqual(result.headers['x-my-header'], 'hi!')
+    t.assert.strictEqual(result.statusCode, 205)
+    t.assert.strictEqual(await result.body.text(), 'hi')
+  }
+})

package/test/text-event-stream-custom-parser.test.js

@@ -0,0 +1,68 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+t.test('text/event-stream proxying with custom content type parser', async (t) => {
+  t.plan(6)
+
+  // Target server that sends SSE data
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.method, 'POST')
+    t.assert.match(req.headers['content-type'], /^text\/event-stream/)
+
+    let data = ''
+    req.setEncoding('utf8')
+    req.on('data', (chunk) => {
+      data += chunk
+    })
+    req.on('end', () => {
+      // Verify the SSE data is received
+      t.assert.match(data, /data: test message/)
+      t.assert.match(data, /event: custom/)
+
+      res.setHeader('content-type', 'application/json')
+      res.statusCode = 200
+      res.end(JSON.stringify({ received: 'sse data' }))
+    })
+  })
+
+  // Fastify instance with custom text/event-stream parser
+  const fastify = Fastify()
+
+  // Register custom content type parser for text/event-stream
+  // This allows the raw body to be passed through without parsing
+  fastify.addContentTypeParser('text/event-stream', function (req, body, done) {
+    done(null, body)
+  })
+
+  fastify.register(From)
+
+  fastify.post('/', (request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => fastify.close())
+  t.after(() => target.close())
+
+  await fastify.listen({ port: 0 })
+  await target.listen({ port: 0 })
+
+  // Create SSE-like data
+  const sseData = 'data: test message\nevent: custom\ndata: another line\n\n'
+
+  // Send request with SSE data
+  const result = await request(`http://localhost:${fastify.server.address().port}`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'text/event-stream'
+    },
+    body: sseData
+  })
+
+  t.assert.deepStrictEqual(await result.body.json(), { received: 'sse data' })
+})