@fastify/reply-from 12.4.0 → 12.6.0

package/README.md

@@ -524,26 +524,34 @@ This is due to the fact that `@fastify/multipart` consumes the multipart content
 
 However, the two plugins may be used within the same fastify instance, at the condition that they belong to disjoint branches of the fastify plugins hierarchy tree.
 
-### Proxying multipart/form-data without @fastify/multipart
+### Proxying specific content types without parsing
 
-If you need to proxy `multipart/form-data` requests without parsing them, you can use a custom content type parser instead of `@fastify/multipart`:
+If you need to proxy certain content types (like `multipart/form-data` or `text/event-stream`) without parsing them, you can use custom content type parsers:
 
 ```js
-// Register a custom content type parser for multipart/form-data
-// This passes the raw body through without parsing
+// Register custom content type parsers that pass raw body through
 fastify.addContentTypeParser('multipart/form-data', function (req, body, done) {
   done(null, body)
 })
 
+fastify.addContentTypeParser('text/event-stream', function (req, body, done) {
+  done(null, body)
+})
+
 fastify.register(require('@fastify/reply-from'))
 
 fastify.post('/upload', (request, reply) => {
   // The multipart data will be proxied as-is to the upstream server
   reply.from('http://upstream-server.com/upload')
 })
+
+fastify.post('/events', (request, reply) => {
+  // The SSE data will be proxied as-is to the upstream server
+  reply.from('http://upstream-server.com/events')
+})
 ```
 
-This approach allows `multipart/form-data` to be proxied correctly while avoiding the incompatibility with `@fastify/multipart`.
+This approach allows these content types to be proxied correctly while avoiding parsing that would consume the request body.
 
 ## License
 

package/index.js

@@ -71,7 +71,9 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
     const retryDelay = opts.retryDelay || undefined
 
     if (!source) {
-      source = req.url
+      const requestUrl = req.url
+      const queryIndex = requestUrl.indexOf('?')
+      source = queryIndex >= 0 ? requestUrl.substring(0, queryIndex) : requestUrl
     }
 
     // we leverage caching to avoid parsing the destination URL

package/lib/request.js

@@ -5,7 +5,7 @@ const querystring = require('node:querystring')
 const eos = require('end-of-stream')
 const { pipeline } = require('node:stream')
 const undici = require('undici')
-const { stripHttp1ConnectionHeaders } = require('./utils')
+const { stripHttp1ConnectionHeaders, getConnectionHeaders } = require('./utils')
 const http2 = require('node:http2')
 
 const {
@@ -53,7 +53,7 @@ function buildRequest (opts) {
   const isBalanced = Array.isArray(opts.base) && opts.base.length > 1
   const undiciOpts = opts.undici || {}
   const globalAgent = opts.globalAgent
-  const destroyAgent = opts.destroyAgent
+  const destroyAgent = opts.destroyAgent || false
   let http2Client
   let undiciAgent
   let undiciInstance
@@ -104,6 +104,11 @@ function buildRequest (opts) {
   }
 
   function close () {
+    // Always destroy http2 client (internal implementation detail)
+    if (http2Client) {
+      http2Client.destroy()
+    }
+
     if (globalAgent || destroyAgent === false) {
       return
     }
@@ -114,18 +119,28 @@ function buildRequest (opts) {
     } else if (!isHttp2) {
       agents['http:'].destroy()
       agents['https:'].destroy()
-    } else if (http2Client) {
-      http2Client.destroy()
     }
   }
 
   function handleHttp1Req (opts, done) {
+    // Strip Connection header and headers listed in it (RFC 7230 Section 6.1)
+    // Headers are already lowercased by Node.js
+    const connectionHeaderNames = getConnectionHeaders(opts.headers)
+    let headers = opts.headers
+    if (opts.headers.connection || connectionHeaderNames.length > 0) {
+      headers = { ...opts.headers }
+      delete headers.connection
+      for (let i = 0; i < connectionHeaderNames.length; i++) {
+        delete headers[connectionHeaderNames[i]]
+      }
+    }
+
     const req = requests[opts.url.protocol].request({
       method: opts.method,
       port: opts.url.port,
       path: opts.url.pathname + opts.qs,
       hostname: opts.url.hostname,
-      headers: opts.headers,
+      headers,
       agent: agents[opts.url.protocol.replace(/^unix:/, '')],
       ...httpOpts.requestOptions,
       timeout: opts.timeout ?? httpOpts.requestOptions.timeout
@@ -171,10 +186,19 @@ function buildRequest (opts) {
       pool = undiciAgent
     }
 
+    // Strip headers listed in Connection header (RFC 7230 Section 6.1)
+    // Headers are already lowercased
+    const connectionHeaderNames = getConnectionHeaders(req.headers)
+
     // remove forbidden headers
     req.headers.connection = undefined
     req.headers['transfer-encoding'] = undefined
 
+    // Also remove headers listed in Connection header
+    for (let i = 0; i < connectionHeaderNames.length; i++) {
+      req.headers[connectionHeaderNames[i]] = undefined
+    }
+
     pool.request(req, function (err, res) {
       if (err) {
         done(err)

package/lib/utils.js

@@ -28,10 +28,36 @@ function copyHeaders (headers, reply) {
   }
 }
 
+// Parse Connection header and return list of header names to strip (per RFC 7230 Section 6.1)
+function getConnectionHeaders (headers) {
+  const connectionHeader = headers.connection
+  if (typeof connectionHeader !== 'string') {
+    return []
+  }
+  // Connection header is comma-separated list of header names
+  const lowerCased = connectionHeader.toLowerCase()
+  const result = []
+  let start = 0
+  let end = 0
+  for (; end <= lowerCased.length; end++) {
+    if (lowerCased.charCodeAt(end) === 44 || end === lowerCased.length) { // 44 = ','
+      const token = lowerCased.slice(start, end).trim()
+      if (token.length > 0) {
+        result.push(token)
+      }
+      start = end + 1
+    }
+  }
+  return result
+}
+
 function stripHttp1ConnectionHeaders (headers) {
   const headersKeys = Object.keys(headers)
   const dest = {}
 
+  // Get headers listed in Connection header that should be stripped (RFC 7230 Section 6.1)
+  const connectionHeaderNames = getConnectionHeaders(headers)
+
   let header
   let i
 
@@ -54,7 +80,10 @@ function stripHttp1ConnectionHeaders (headers) {
         }
         break
       default:
-        dest[header] = headers[header]
+        // Also skip headers listed in Connection header (RFC 7230 Section 6.1)
+        if (!connectionHeaderNames.includes(header)) {
+          dest[header] = headers[header]
+        }
         break
     }
   }
@@ -63,6 +92,12 @@ function stripHttp1ConnectionHeaders (headers) {
 
 // issue ref: https://github.com/fastify/fast-proxy/issues/42
 function buildURL (source, reqBase) {
+  if (decodeURIComponent(source).includes('..')) {
+    const err = new Error('source/request contain invalid characters')
+    err.statusCode = 400
+    throw err
+  }
+
   if (Array.isArray(reqBase)) reqBase = reqBase[0]
   let baseOrigin = reqBase ? new URL(reqBase).href : undefined
 
@@ -90,6 +125,7 @@ function buildURL (source, reqBase) {
 module.exports = {
   copyHeaders,
   stripHttp1ConnectionHeaders,
+  getConnectionHeaders,
   filterPseudoHeaders,
   buildURL
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/reply-from",
-  "version": "12.4.0",
+  "version": "12.6.0",
   "description": "forward your HTTP request to another server, for fastify",
   "main": "index.js",
   "type": "commonjs",
@@ -60,8 +60,8 @@
   "devDependencies": {
     "@fastify/formbody": "^8.0.0",
     "@fastify/multipart": "^9.0.0",
-    "@sinonjs/fake-timers": "^14.0.0",
-    "@types/node": "^24.0.8",
+    "@sinonjs/fake-timers": "^15.0.0",
+    "@types/node": "^25.0.3",
     "@types/tap": "^18.0.0",
     "c8": "^10.1.3",
     "eslint": "^9.17.0",

package/test/build-url.test.js

@@ -76,3 +76,35 @@ test('should throw when trying to override base', async (t) => {
 
   await Promise.all(promises)
 })
+
+test('should throw on path traversal attempts', (t) => {
+  t.assert.throws(
+    () => buildURL('/foo/bar/../', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/..', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/%2e%2e/', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/%2E%2E/', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/..%2f', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+
+  t.assert.throws(
+    () => buildURL('/foo/bar/%2e%2e%2f', 'http://localhost'),
+    new Error('source/request contain invalid characters')
+  )
+})

package/test/core-with-path-in-base.test.js

@@ -9,14 +9,14 @@ const http = require('node:http')
 const instance = Fastify()
 
 t.test('core with path in base', async (t) => {
-  t.plan(8)
+  t.plan(7)
   t.after(() => instance.close())
 
   const target = http.createServer((req, res) => {
     t.assert.ok('request proxied')
     t.assert.strictEqual(req.method, 'GET')
     t.assert.strictEqual(req.url, '/hello')
-    t.assert.strictEqual(req.headers.connection, 'close')
+    // Connection header is not forwarded per RFC 7230 Section 6.1
     res.statusCode = 205
     res.setHeader('Content-Type', 'text/plain')
     res.setHeader('x-my-header', 'hello!')

package/test/fix-GHSA-2q7r-29rg-6m5h.test.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('fix for GHSA-2q7r-29rg-6m5h vulnerability', async (t) => {
+  t.plan(2)
+
+  const target = http.createServer((_, res) => {
+    res.statusCode = 205
+    res.end('hi')
+  })
+  await target.listen({ port: 0 })
+  t.after(() => target.close())
+
+  instance.get('/', (_request, reply) => { reply.from('/ho/%2E%2E/hi') })
+  instance.register(From, {
+    base: `http://localhost:${target.address().port}/hi/`,
+    undici: true
+  })
+  await instance.listen({ port: 0 })
+  t.after(() => instance.close())
+
+  const { statusCode, body } = await request(`http://localhost:${instance.server.address().port}`)
+  t.assert.strictEqual(statusCode, 400)
+  t.assert.strictEqual(await body.text(), '{"statusCode":400,"error":"Bad Request","message":"source/request contain invalid characters"}')
+})

package/test/full-querystring-url.test.js

@@ -0,0 +1,55 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('full querystring url', async (t) => {
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.method, 'GET')
+    t.assert.strictEqual(req.url, '/hi?a=/ho/%2E%2E/hi')
+    res.statusCode = 205
+    res.setHeader('Content-Type', 'text/plain')
+    res.setHeader('x-my-header', 'hi!')
+    res.end('hi')
+  })
+
+  await target.listen({ port: 0 })
+  t.after(() => target.close())
+
+  await instance.register(From, {
+    base: `http://localhost:${target.address().port}`
+  })
+
+  instance.get('/hi', (_request, reply) => {
+    reply.from()
+  })
+
+  instance.get('/foo', (_request, reply) => {
+    reply.from('/hi')
+  })
+
+  await instance.listen({ port: 0 })
+  t.after(() => instance.close())
+
+  {
+    const result = await request(`http://localhost:${instance.server.address().port}/hi?a=/ho/%2E%2E/hi`)
+    t.assert.strictEqual(result.headers['content-type'], 'text/plain')
+    t.assert.strictEqual(result.headers['x-my-header'], 'hi!')
+    t.assert.strictEqual(result.statusCode, 205)
+    t.assert.strictEqual(await result.body.text(), 'hi')
+  }
+
+  {
+    const result = await request(`http://localhost:${instance.server.address().port}/foo?a=/ho/%2E%2E/hi`)
+    t.assert.strictEqual(result.headers['content-type'], 'text/plain')
+    t.assert.strictEqual(result.headers['x-my-header'], 'hi!')
+    t.assert.strictEqual(result.statusCode, 205)
+    t.assert.strictEqual(await result.body.text(), 'hi')
+  }
+})

package/test/strip-connection-headers.test.js

@@ -0,0 +1,232 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const From = require('..')
+const http = require('node:http')
+
+// RFC 7230 Section 6.1 - Connection header handling
+// A proxy MUST parse the Connection header and remove any headers listed within it
+
+// Helper to make HTTP request with Connection header (undici doesn't allow this)
+function makeRequest (port, headers) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      method: 'GET',
+      hostname: 'localhost',
+      port,
+      path: '/',
+      headers
+    }, (res) => {
+      let data = ''
+      res.on('data', (chunk) => { data += chunk })
+      res.on('end', () => resolve({ statusCode: res.statusCode, body: data }))
+    })
+    req.on('error', reject)
+    req.end()
+  })
+}
+
+t.test('strips headers listed in Connection header (undici)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-header'], undefined, 'X-Custom-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-Header': 'some-value',
+    Connection: 'X-Custom-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('strips multiple headers listed in Connection header (undici)', async (t) => {
+  t.plan(5)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-one'], undefined, 'X-Custom-One should be stripped')
+    t.assert.strictEqual(req.headers['x-custom-two'], undefined, 'X-Custom-Two should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-One': 'value1',
+    'X-Custom-Two': 'value2',
+    Connection: 'X-Custom-One, X-Custom-Two'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('preserves headers not listed in Connection header (undici)', async (t) => {
+  t.plan(5)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-keep-header'], 'keep-me', 'X-Keep-Header should be preserved')
+    t.assert.strictEqual(req.headers['x-strip-header'], undefined, 'X-Strip-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Keep-Header': 'keep-me',
+    'X-Strip-Header': 'strip-me',
+    Connection: 'X-Strip-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('strips headers listed in Connection header (http)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From, { undici: false })
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-header'], undefined, 'X-Custom-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-Header': 'some-value',
+    Connection: 'X-Custom-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('strips multiple headers listed in Connection header (http)', async (t) => {
+  t.plan(5)
+  const instance = Fastify()
+  instance.register(From, { undici: false })
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-one'], undefined, 'X-Custom-One should be stripped')
+    t.assert.strictEqual(req.headers['x-custom-two'], undefined, 'X-Custom-Two should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-One': 'value1',
+    'X-Custom-Two': 'value2',
+    Connection: 'X-Custom-One, X-Custom-Two'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})
+
+t.test('handles Connection header with keep-alive and custom headers (undici)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.headers['x-custom-header'], undefined, 'X-Custom-Header should be stripped')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    'X-Custom-Header': 'some-value',
+    Connection: 'keep-alive, X-Custom-Header'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+})

package/test/text-event-stream-custom-parser.test.js

@@ -0,0 +1,68 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+t.test('text/event-stream proxying with custom content type parser', async (t) => {
+  t.plan(6)
+
+  // Target server that sends SSE data
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.method, 'POST')
+    t.assert.match(req.headers['content-type'], /^text\/event-stream/)
+
+    let data = ''
+    req.setEncoding('utf8')
+    req.on('data', (chunk) => {
+      data += chunk
+    })
+    req.on('end', () => {
+      // Verify the SSE data is received
+      t.assert.match(data, /data: test message/)
+      t.assert.match(data, /event: custom/)
+
+      res.setHeader('content-type', 'application/json')
+      res.statusCode = 200
+      res.end(JSON.stringify({ received: 'sse data' }))
+    })
+  })
+
+  // Fastify instance with custom text/event-stream parser
+  const fastify = Fastify()
+
+  // Register custom content type parser for text/event-stream
+  // This allows the raw body to be passed through without parsing
+  fastify.addContentTypeParser('text/event-stream', function (req, body, done) {
+    done(null, body)
+  })
+
+  fastify.register(From)
+
+  fastify.post('/', (request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`)
+  })
+
+  t.after(() => fastify.close())
+  t.after(() => target.close())
+
+  await fastify.listen({ port: 0 })
+  await target.listen({ port: 0 })
+
+  // Create SSE-like data
+  const sseData = 'data: test message\nevent: custom\ndata: another line\n\n'
+
+  // Send request with SSE data
+  const result = await request(`http://localhost:${fastify.server.address().port}`, {
+    method: 'POST',
+    headers: {
+      'content-type': 'text/event-stream'
+    },
+    body: sseData
+  })
+
+  t.assert.deepStrictEqual(await result.body.json(), { received: 'sse data' })
+})

package/test/undici-no-destroy.test.js

@@ -27,3 +27,25 @@ test('destroyAgent false', async (t) => {
   await instance.ready()
   await instance.close()
 })
+
+test('destroyAgent default false', async (t) => {
+  const mockAgent = new undici.Agent()
+  mockAgent.destroy = () => {
+    t.fail()
+  }
+  const instance = Fastify()
+
+  t.after(() => instance.close())
+
+  instance.get('/', (_request, reply) => {
+    reply.from()
+  })
+
+  instance.register(From, {
+    base: 'http://localhost:4242',
+    undici: mockAgent
+  })
+
+  await instance.ready()
+  await instance.close()
+})