@fastify/reply-from 12.6.1 → 12.6.2

package/.github/workflows/ci.yml

@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v5
+    uses: fastify/workflows/.github/workflows/plugins-ci.yml@v6
     with:
       license-check: true
       lint: true

package/.github/workflows/lock-threads.yml

@@ -0,0 +1,19 @@
+name: Lock Threads
+
+on:
+  schedule:
+    - cron: '0 0 1 * *'
+  workflow_dispatch:
+
+concurrency:
+  group: lock
+
+permissions:
+  contents: read
+
+jobs:
+  lock-threads:
+    permissions:
+      issues: write
+      pull-requests: write
+    uses: fastify/workflows/.github/workflows/lock-threads.yml@v6

package/index.js

@@ -11,6 +11,7 @@ const {
   filterPseudoHeaders,
   copyHeaders,
   stripHttp1ConnectionHeaders,
+  getConnectionHeaders,
   buildURL
 } = require('./lib/utils')
 
@@ -89,6 +90,18 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
 
     const sourceHttp2 = req.httpVersionMajor === 2
     const headers = sourceHttp2 ? filterPseudoHeaders(req.headers) : { ...req.headers }
+
+    // Strip client-supplied Connection header and all header names listed in it
+    // before rewriteRequestHeaders runs. This prevents clients from stripping
+    // headers added by the proxy itself.
+    const connectionHeaderNames = getConnectionHeaders(headers)
+    if (headers.connection || connectionHeaderNames.length > 0) {
+      delete headers.connection
+      for (let i = 0; i < connectionHeaderNames.length; i++) {
+        delete headers[connectionHeaderNames[i]]
+      }
+    }
+
     headers.host = url.host
     const qs = getQueryString(url.search, req.url, opts, this.request)
     let body = ''

package/lib/utils.js

@@ -92,7 +92,12 @@ function stripHttp1ConnectionHeaders (headers) {
 
 // issue ref: https://github.com/fastify/fast-proxy/issues/42
 function buildURL (source, reqBase) {
-  if (decodeURIComponent(source).includes('..')) {
+  // Check for path traversal: '..' must be a complete path segment to be an
+  // attack. A bare substring match incorrectly rejects legitimate URLs that
+  // contain '...' (e.g. Next.js catch-all routes like '[...slug]').
+  // See: https://github.com/fastify/fastify-reply-from/issues/460
+  const decoded = decodeURIComponent(source)
+  if (decoded === '..' || decoded.includes('/..') || decoded.includes('../')) {
     const err = new Error('source/request contain invalid characters')
     err.statusCode = 400
     throw err

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/reply-from",
-  "version": "12.6.1",
+  "version": "12.6.2",
   "description": "forward your HTTP request to another server, for fastify",
   "main": "index.js",
   "type": "commonjs",
@@ -68,9 +68,9 @@
     "fastify": "^5.0.0",
     "form-data": "^4.0.0",
     "h2url": "^0.2.0",
-    "neostandard": "^0.12.0",
+    "neostandard": "^0.13.0",
     "nock": "^14.0.0",
-    "proxy": "^2.1.1",
+    "proxy": "^4.0.0",
     "proxyquire": "^2.1.3",
     "split2": "^4.2.0",
     "tsd": "^0.33.0"

package/test/build-url.test.js

@@ -77,6 +77,15 @@ test('should throw when trying to override base', async (t) => {
   await Promise.all(promises)
 })
 
+test('should not throw on URLs containing "..." (e.g. Next.js catch-all routes)', (t) => {
+  t.plan(2)
+  // Next.js catch-all routes like [...slug] appear percent-encoded in static chunk URLs.
+  // These contain '...' as a substring but are not path traversal.
+  // See: https://github.com/fastify/fastify-reply-from/issues/460
+  t.assert.doesNotThrow(() => buildURL('/_next/static/chunks/pages/%5B...slug%5D.js', 'http://localhost'))
+  t.assert.doesNotThrow(() => buildURL('/_next/static/chunks/pages/%5B%5B...slug%5D%5D.js', 'http://localhost'))
+})
+
 test('should throw on path traversal attempts', (t) => {
   t.assert.throws(
     () => buildURL('/foo/bar/../', 'http://localhost'),

package/test/strip-connection-headers.test.js

@@ -230,3 +230,79 @@ t.test('handles Connection header with keep-alive and custom headers (undici)',
   t.assert.strictEqual(result.statusCode, 200)
   t.assert.strictEqual(result.body, 'ok')
 })
+
+t.test('does not strip headers added by rewriteRequestHeaders (undici)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From)
+
+  t.after(() => instance.close())
+
+  let seenForwardedBy
+  const target = http.createServer((req, res) => {
+    seenForwardedBy = req.headers['x-forwarded-by']
+    t.assert.ok('request proxied')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`, {
+      rewriteRequestHeaders: (_request, headers) => {
+        return { ...headers, 'x-forwarded-by': 'fastify-proxy' }
+      }
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    Connection: 'X-Forwarded-By'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+  t.assert.strictEqual(seenForwardedBy, 'fastify-proxy', 'X-Forwarded-By should not be stripped')
+})
+
+t.test('does not strip headers added by rewriteRequestHeaders (http)', async (t) => {
+  t.plan(4)
+  const instance = Fastify()
+  instance.register(From, { undici: false })
+
+  t.after(() => instance.close())
+
+  let seenForwardedBy
+  const target = http.createServer((req, res) => {
+    seenForwardedBy = req.headers['x-forwarded-by']
+    t.assert.ok('request proxied')
+    res.statusCode = 200
+    res.setHeader('Content-Type', 'text/plain')
+    res.end('ok')
+  })
+
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`, {
+      rewriteRequestHeaders: (_request, headers) => {
+        return { ...headers, 'x-forwarded-by': 'fastify-proxy' }
+      }
+    })
+  })
+
+  t.after(() => target.close())
+
+  await new Promise((resolve) => instance.listen({ port: 0 }, resolve))
+  await new Promise((resolve) => target.listen({ port: 0 }, resolve))
+
+  const result = await makeRequest(instance.server.address().port, {
+    Connection: 'X-Forwarded-By'
+  })
+
+  t.assert.strictEqual(result.statusCode, 200)
+  t.assert.strictEqual(result.body, 'ok')
+  t.assert.strictEqual(seenForwardedBy, 'fastify-proxy', 'X-Forwarded-By should not be stripped')
+})