@fastify/reply-from 12.6.0 → 12.6.2

package/.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/LICENSE

@@ -1,9 +1,7 @@
 MIT License
 
 Copyright (c) 2017-present Matteo Collina
-Copyright (c) 2017-present The Fastify team
-
-The Fastify team members are listed at https://github.com/fastify/fastify#team.
+Copyright (c) 2017-present The Fastify team <https://github.com/fastify/fastify#team>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -66,10 +66,10 @@ target.listen({ port: 3001 }, (err) => {
 Set the base URL for all the forwarded requests. Will be required if `http2` is set to `true`
 Note that _every path will be discarded_.
 
-Set the base URL for all the forwarded requests.  
-*String or String[]*:  
+Set the base URL for all the forwarded requests.
+*String or String[]*:
 
-* **Single string** → a normal `undici.Pool` / `http.request` client is used.  
+* **Single string** → a normal `undici.Pool` / `http.request` client is used.
 * **Array with ≥ 2 elements** → **[`undici.BalancedPool`](https://undici.nodejs.org/#/docs/api/BalancedPool)** is automatically selected and requests are load-balanced round-robin across the given origins.
 
 When you provide an array, only the *origin* (`protocol://host:port`) part of each URL is considered; any path component is ignored.

package/index.js

@@ -11,6 +11,7 @@ const {
   filterPseudoHeaders,
   copyHeaders,
   stripHttp1ConnectionHeaders,
+  getConnectionHeaders,
   buildURL
 } = require('./lib/utils')
 
@@ -89,6 +90,18 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
 
     const sourceHttp2 = req.httpVersionMajor === 2
     const headers = sourceHttp2 ? filterPseudoHeaders(req.headers) : { ...req.headers }
+
+    // Strip client-supplied Connection header and all header names listed in it
+    // before rewriteRequestHeaders runs. This prevents clients from stripping
+    // headers added by the proxy itself.
+    const connectionHeaderNames = getConnectionHeaders(headers)
+    if (headers.connection || connectionHeaderNames.length > 0) {
+      delete headers.connection
+      for (let i = 0; i < connectionHeaderNames.length; i++) {
+        delete headers[connectionHeaderNames[i]]
+      }
+    }
+
     headers.host = url.host
     const qs = getQueryString(url.search, req.url, opts, this.request)
     let body = ''
@@ -250,11 +263,13 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
 
 function getQueryString (search, reqUrl, opts, request) {
   if (typeof opts.queryString === 'function') {
-    return '?' + opts.queryString(search, reqUrl, request)
+    const qs = opts.queryString(search, reqUrl, request)
+    return qs ? '?' + qs : ''
   }
 
   if (opts.queryString) {
-    return '?' + querystring.stringify(opts.queryString)
+    const qs = querystring.stringify(opts.queryString)
+    return qs ? '?' + qs : ''
   }
 
   if (search.length > 0) {

package/lib/utils.js

@@ -92,7 +92,12 @@ function stripHttp1ConnectionHeaders (headers) {
 
 // issue ref: https://github.com/fastify/fast-proxy/issues/42
 function buildURL (source, reqBase) {
-  if (decodeURIComponent(source).includes('..')) {
+  // Check for path traversal: '..' must be a complete path segment to be an
+  // attack. A bare substring match incorrectly rejects legitimate URLs that
+  // contain '...' (e.g. Next.js catch-all routes like '[...slug]').
+  // See: https://github.com/fastify/fastify-reply-from/issues/460
+  const decoded = decodeURIComponent(source)
+  if (decoded === '..' || decoded.includes('/..') || decoded.includes('../')) {
     const err = new Error('source/request contain invalid characters')
     err.statusCode = 400
     throw err

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/reply-from",
-  "version": "12.6.0",
+  "version": "12.6.2",
   "description": "forward your HTTP request to another server, for fastify",
   "main": "index.js",
   "type": "commonjs",
@@ -63,14 +63,14 @@
     "@sinonjs/fake-timers": "^15.0.0",
     "@types/node": "^25.0.3",
     "@types/tap": "^18.0.0",
-    "c8": "^10.1.3",
+    "c8": "^11.0.0",
     "eslint": "^9.17.0",
     "fastify": "^5.0.0",
     "form-data": "^4.0.0",
     "h2url": "^0.2.0",
-    "neostandard": "^0.12.0",
+    "neostandard": "^0.13.0",
     "nock": "^14.0.0",
-    "proxy": "^2.1.1",
+    "proxy": "^4.0.0",
     "proxyquire": "^2.1.3",
     "split2": "^4.2.0",
     "tsd": "^0.33.0"

package/test/build-url.test.js

@@ -77,6 +77,15 @@ test('should throw when trying to override base', async (t) => {
   await Promise.all(promises)
 })
 
+test('should not throw on URLs containing "..." (e.g. Next.js catch-all routes)', (t) => {
+  t.plan(2)
+  // Next.js catch-all routes like [...slug] appear percent-encoded in static chunk URLs.
+  // These contain '...' as a substring but are not path traversal.
+  // See: https://github.com/fastify/fastify-reply-from/issues/460
+  t.assert.doesNotThrow(() => buildURL('/_next/static/chunks/pages/%5B...slug%5D.js', 'http://localhost'))
+  t.assert.doesNotThrow(() => buildURL('/_next/static/chunks/pages/%5B%5B...slug%5D%5D.js', 'http://localhost'))
+})
+
 test('should throw on path traversal attempts', (t) => {
   t.assert.throws(
     () => buildURL('/foo/bar/../', 'http://localhost'),

package/test/full-querystring-rewrite-option-empty-object.test.js

@@ -0,0 +1,41 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('queryString empty object should not append trailing ?', async (t) => {
+  t.plan(4)
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.url, '/world')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('hello world')
+  })
+
+  instance.get('/hello', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}/world`, {
+      queryString: {}
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise(resolve => target.listen({ port: 0 }, resolve))
+
+  instance.register(From)
+
+  await new Promise(resolve => instance.listen({ port: 0 }, resolve))
+
+  const result = await request(`http://localhost:${instance.server.address().port}/hello`)
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(await result.body.text(), 'hello world')
+})

package/test/full-querystring-rewrite-option-function-empty.test.js

@@ -0,0 +1,43 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const { request } = require('undici')
+const From = require('..')
+const http = require('node:http')
+
+const instance = Fastify()
+
+t.test('queryString function returning empty string should not append trailing ?', async (t) => {
+  t.plan(4)
+  t.after(() => instance.close())
+
+  const target = http.createServer((req, res) => {
+    t.assert.ok('request proxied')
+    t.assert.strictEqual(req.url, '/world')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('hello world')
+  })
+
+  instance.get('/hello', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}/world`, {
+      queryString () {
+        return ''
+      }
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise(resolve => target.listen({ port: 0 }, resolve))
+
+  instance.register(From)
+
+  await new Promise(resolve => instance.listen({ port: 0 }, resolve))
+
+  const result = await request(`http://localhost:${instance.server.address().port}/hello`)
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(await result.body.text(), 'hello world')
+})

package/test/strip-connection-headers.test.js

@@ -230,3 +230,79 @@ t.test('handles Connection header with keep-alive and custom headers (undici)',
   t.assert.strictEqual(result.statusCode, 200)
   t.assert.strictEqual(result.body, 'ok')
 })
+
+t.test('does not strip headers added by rewriteRequestHeaders (undici)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  let seenForwardedBy
+  const target = http.createServer((req, res) => {
+    seenForwardedBy = req.headers['x-forwarded-by']
+    t.assert.ok('request proxied')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`, {
+      rewriteRequestHeaders: (_request, headers) => {
+        return { ...headers, 'x-forwarded-by': 'fastify-proxy' }
+      }
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    Connection: 'X-Forwarded-By'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+  t.assert.strictEqual(seenForwardedBy, 'fastify-proxy', 'X-Forwarded-By should not be stripped')
+})
+
+t.test('does not strip headers added by rewriteRequestHeaders (http)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From, { undici: false })
+
+  t.after(() => instance.close())
+
+  let seenForwardedBy
+  const target = http.createServer((req, res) => {
+    seenForwardedBy = req.headers['x-forwarded-by']
+    t.assert.ok('request proxied')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`, {
+      rewriteRequestHeaders: (_request, headers) => {
+        return { ...headers, 'x-forwarded-by': 'fastify-proxy' }
+      }
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    Connection: 'X-Forwarded-By'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+  t.assert.strictEqual(seenForwardedBy, 'fastify-proxy', 'X-Forwarded-By should not be stripped')
+})

package/.github/stale.yml

@@ -1,21 +0,0 @@
-# Number of days of inactivity before an issue becomes stale
-daysUntilStale: 15
-# Number of days of inactivity before a stale issue is closed
-daysUntilClose: 7
-# Issues with these labels will never be considered stale
-exemptLabels:
-  - "discussion"
-  - "feature request"
-  - "bug"
-  - "help wanted"
-  - "plugin suggestion"
-  - "good first issue"
-# Label to use when marking an issue as stale
-staleLabel: stale
-# Comment to post when marking an issue as stale. Set to `false` to disable
-markComment: >
-  This issue has been automatically marked as stale because it has not had
-  recent activity. It will be closed if no further activity occurs. Thank you
-  for your contributions.
-# Comment to post when closing a stale issue. Set to `false` to disable
-closeComment: false

package/.taprc

@@ -1,3 +0,0 @@
-disable-coverage: true
-files:
-  - test/**/*.test.js

package/CLAUDE.md

@@ -1,66 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Development Commands
-
-### Testing
-- `npm test` - Run all tests (unit + TypeScript)
-- `npm run test:unit` - Run unit tests with coverage using c8 and Node.js test runner
-- `npm run test:typescript` - Run TypeScript definition tests using tsd
-
-### Linting
-- `npm run lint` - Run ESLint to check code style
-- `npm run lint:fix` - Run ESLint with automatic fixes
-- ESLint configuration uses neostandard with TypeScript support
-
-### Building
-- No build step required - this is a CommonJS library
-
-## Architecture Overview
-
-This is a Fastify plugin for proxying HTTP requests to upstream servers. The plugin decorates the Fastify reply with a `from()` method.
-
-### Key Components
-
-**Main Plugin (`index.js`)**
-- Entry point that registers the plugin using fastify-plugin
-- Decorates `reply.from(source, opts)` method
-- Handles request proxying, retries, caching, and error handling
-- Supports HTTP/1.1, HTTP/2, and Undici client strategies
-
-**Request Builder (`lib/request.js`)**
-- Factory for creating request handlers based on transport (HTTP/1.1, HTTP/2, Undici)
-- Handles different agent configurations (HTTP, HTTPS, Unix sockets)
-- Manages timeouts, connection pooling, and retry logic
-- Returns unified interface: `{ request, close, retryOnError }`
-
-**Utilities (`lib/utils.js`)**
-- `filterPseudoHeaders()` - Removes HTTP/2 pseudo-headers (starting with :)
-- `copyHeaders()` - Copies headers to Fastify reply
-- `stripHttp1ConnectionHeaders()` - Removes HTTP/1 connection-specific headers for HTTP/2
-- `buildURL()` - Constructs destination URLs with base path validation
-
-**Error Definitions (`lib/errors.js`)**
-- Standardized error types using @fastify/error
-- Maps different error conditions to appropriate HTTP status codes
-- Includes timeout, connection reset, and gateway errors
-
-### Transport Strategies
-
-1. **Undici (default)** - High-performance HTTP/1.1 client with connection pooling
-2. **HTTP/2** - Native Node.js HTTP/2 client for modern protocols  
-3. **HTTP/1.1** - Node.js built-in http/https modules with custom agents
-
-### Key Features
-
-- **Caching**: URL parsing cache using toad-cache LruMap (default 100 entries)
-- **Retries**: Configurable retry logic for socket hangups and 503 errors
-- **Headers**: Smart header rewriting for HTTP/1.1 ↔ HTTP/2 compatibility
-- **Body handling**: Supports streams, JSON encoding, and custom content types
-- **Unix sockets**: Special handling for unix+http: and unix+https: protocols
-- **Timeouts**: Per-request and session-level timeout configuration
-
-### Configuration
-
-The plugin accepts extensive configuration for different transport methods, retry behavior, caching, and request/response transformation hooks. See README.md for full option documentation.