@fastify/reply-from 12.6.3 → 12.6.4

package/CLAUDE.md

@@ -0,0 +1,66 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Development Commands
+
+### Testing
+- `npm test` - Run all tests (unit + TypeScript)
+- `npm run test:unit` - Run unit tests with coverage using c8 and Node.js test runner
+- `npm run test:typescript` - Run TypeScript definition tests using tsd
+
+### Linting
+- `npm run lint` - Run ESLint to check code style
+- `npm run lint:fix` - Run ESLint with automatic fixes
+- ESLint configuration uses neostandard with TypeScript support
+
+### Building
+- No build step required - this is a CommonJS library
+
+## Architecture Overview
+
+This is a Fastify plugin for proxying HTTP requests to upstream servers. The plugin decorates the Fastify reply with a `from()` method.
+
+### Key Components
+
+**Main Plugin (`index.js`)**
+- Entry point that registers the plugin using fastify-plugin
+- Decorates `reply.from(source, opts)` method
+- Handles request proxying, retries, caching, and error handling
+- Supports HTTP/1.1, HTTP/2, and Undici client strategies
+
+**Request Builder (`lib/request.js`)**
+- Factory for creating request handlers based on transport (HTTP/1.1, HTTP/2, Undici)
+- Handles different agent configurations (HTTP, HTTPS, Unix sockets)
+- Manages timeouts, connection pooling, and retry logic
+- Returns unified interface: `{ request, close, retryOnError }`
+
+**Utilities (`lib/utils.js`)**
+- `filterPseudoHeaders()` - Removes HTTP/2 pseudo-headers (starting with :)
+- `copyHeaders()` - Copies headers to Fastify reply
+- `stripHttp1ConnectionHeaders()` - Removes HTTP/1 connection-specific headers for HTTP/2
+- `buildURL()` - Constructs destination URLs with base path validation
+
+**Error Definitions (`lib/errors.js`)**
+- Standardized error types using @fastify/error
+- Maps different error conditions to appropriate HTTP status codes
+- Includes timeout, connection reset, and gateway errors
+
+### Transport Strategies
+
+1. **Undici (default)** - High-performance HTTP/1.1 client with connection pooling
+2. **HTTP/2** - Native Node.js HTTP/2 client for modern protocols  
+3. **HTTP/1.1** - Node.js built-in http/https modules with custom agents
+
+### Key Features
+
+- **Caching**: URL parsing cache using toad-cache LruMap (default 100 entries)
+- **Retries**: Configurable retry logic for socket hangups and 503 errors
+- **Headers**: Smart header rewriting for HTTP/1.1 ↔ HTTP/2 compatibility
+- **Body handling**: Supports streams, JSON encoding, and custom content types
+- **Unix sockets**: Special handling for unix+http: and unix+https: protocols
+- **Timeouts**: Per-request and session-level timeout configuration
+
+### Configuration
+
+The plugin accepts extensive configuration for different transport methods, retry behavior, caching, and request/response transformation hooks. See README.md for full option documentation.

package/index.js

@@ -81,7 +81,7 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
     const dest = getUpstream(this.request, base)
     let url
     if (cache) {
-      const cacheKey = dest + source
+      const cacheKey = JSON.stringify([dest, source])
       url = cache.get(cacheKey) || buildURL(source, dest)
       cache.set(cacheKey, url)
     } else {
@@ -231,10 +231,14 @@ const fastifyReplyFrom = fp(function from (fastify, opts, next) {
         onError(this, { error: new BadGatewayError() })
         this.request.log.warn(err, 'response has invalid status code')
       }
-      if (this.request.raw.aborted && isHttp2) {
+      if (this.request.raw.aborted) {
         // the request could have been canceled before we got a response from the target
-        // forward this to the upstream server and close the stream to prevent leaks
-        res.stream.close(NGHTTP2_CANCEL)
+        // clean up the upstream stream to prevent leaks and skip sending a reply
+        if (isHttp2) {
+          res.stream.close(NGHTTP2_CANCEL)
+        } else {
+          res.stream.destroy()
+        }
         // no need to send a reply for aborted requests or call the onResponse callback
         return
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastify/reply-from",
-  "version": "12.6.3",
+  "version": "12.6.4",
   "description": "forward your HTTP request to another server, for fastify",
   "main": "index.js",
   "type": "commonjs",

package/test/fix-GHSA-v574-6498-x57v.test.js

@@ -0,0 +1,219 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const From = require('..')
+
+// GHSA-v574-6498-x57v: Cache key collision via ambiguous concatenation.
+// dest + source was used as the cache key.  Different (dest, source) pairs
+// could produce identical concatenations while resolving to different URLs,
+// causing a request to be forwarded to the wrong upstream.
+//
+//   dest   = http://127.0.0.1:31001  , source = /private
+//   dest   = http://127.0.0.1:3100   , source = 1/private
+//
+// Both concatenate to "http://127.0.0.1:31001/private" but resolve to
+// different URLs.
+
+async function run (t) {
+  // victim upstream on port 31001 with a private route and a writable route
+  const victim = Fastify({ keepAliveTimeout: 1 })
+  victim.get('/private', async () => ({ marker: 'VICTIM_PRIVATE_DATA' }))
+  victim.get('/state', async () => ({ written: victim.written }))
+  victim.post('/private', async (req, reply) => {
+    victim.written = req.body
+    return { marker: 'VICTIM_PRIVATE_DATA', written: victim.written }
+  })
+  t.after(() => victim.close())
+  await victim.listen({ port: 31001 })
+
+  // attacker upstream on port 3100
+  const attacker = Fastify({ keepAliveTimeout: 1 })
+  attacker.get('/1/private', async () => ({ marker: 'ATTACKER_UPSTREAM' }))
+  attacker.post('/1/private', async (req, reply) => {
+    return { marker: 'ATTACKER_UPSTREAM', written: req.body }
+  })
+  t.after(() => attacker.close())
+  await attacker.listen({ port: 3100 })
+
+  // proxy using getUpstream() and default cache
+  const proxy = Fastify({ keepAliveTimeout: 1 })
+  proxy.register(From, {
+    base: 'http://localhost',
+    http: true
+  })
+
+  proxy.get('/proxy/victim/private', (req, reply) => {
+    reply.from('/private', {
+      getUpstream () {
+        return 'http://127.0.0.1:31001'
+      }
+    })
+  })
+
+  proxy.post('/proxy/victim/write', (req, reply) => {
+    reply.from('/private', {
+      method: 'POST',
+      body: JSON.stringify(req.body),
+      contentType: 'application/json',
+      getUpstream () {
+        return 'http://127.0.0.1:31001'
+      }
+    })
+  })
+
+  proxy.get('/proxy/attacker/private', (req, reply) => {
+    reply.from('1/private', {
+      getUpstream () {
+        return 'http://127.0.0.1:3100'
+      }
+    })
+  })
+
+  proxy.post('/proxy/attacker/write', (req, reply) => {
+    reply.from('1/private', {
+      method: 'POST',
+      body: JSON.stringify(req.body),
+      contentType: 'application/json',
+      getUpstream () {
+        return 'http://127.0.0.1:3100'
+      }
+    })
+  })
+
+  proxy.get('/proxy/victim/state', (req, reply) => {
+    reply.from('/state', {
+      getUpstream () {
+        return 'http://127.0.0.1:31001'
+      }
+    })
+  })
+
+  t.after(() => proxy.close())
+  await proxy.listen({ port: 31000 })
+
+  // prime the cache with the victim entry (dest = "http://127.0.0.1:31001", source = "/private")
+  const primeRes = await fetch('http://127.0.0.1:31000/proxy/victim/private')
+  t.assert.strictEqual(primeRes.status, 200)
+
+  // now the attacker pair (dest = "http://127.0.0.1:3100", source = "1/private")
+  // should NOT reuse the cached URL — it must resolve to the attacker upstream.
+
+  // 1. attacker read — should return ATTACKER_UPSTREAM, not VICTIM_PRIVATE_DATA
+  const attackerReadRes = await fetch('http://127.0.0.1:31000/proxy/attacker/private')
+  t.assert.strictEqual(attackerReadRes.status, 200)
+  const attackerReadBody = await attackerReadRes.json()
+  t.assert.strictEqual(
+    attackerReadBody.marker,
+    'ATTACKER_UPSTREAM',
+    'attacker request must reach attacker upstream, not victim'
+  )
+
+  // 2. attacker write — should write to attacker, not victim
+  const attackerWriteRes = await fetch('http://127.0.0.1:31000/proxy/attacker/write', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ changedBy: 'attacker' })
+  })
+  t.assert.strictEqual(attackerWriteRes.status, 200)
+
+  // 3. verify victim state is unchanged (victim.written should be undefined/null)
+  const victimStateRes = await fetch('http://127.0.0.1:31000/proxy/victim/state')
+  t.assert.strictEqual(victimStateRes.status, 200)
+  const victimStateBody = await victimStateRes.json()
+  t.assert.strictEqual(
+    victimStateBody.written,
+    undefined,
+    'victim state must not be affected by attacker write'
+  )
+}
+
+t.test('GHSA-v574-6498-x57v: cache key collision via ambiguous concatenation', async (t) => {
+  t.plan(6)
+  await run(t)
+})
+
+t.test('GHSA-v574-6498-x57v: cache key delimiter cannot be injected', async (t) => {
+  const victim = Fastify()
+  victim.get('/*', async (req) => ({ marker: 'VICTIM', path: req.url }))
+  t.after(() => victim.close())
+  const victimOrigin = await victim.listen({ host: '127.0.0.1', port: 0 })
+
+  const attacker = Fastify()
+  attacker.get('/*', async (req) => ({ marker: 'ATTACKER', path: req.url }))
+  t.after(() => attacker.close())
+  const attackerOrigin = await attacker.listen({ host: '127.0.0.1', port: 0 })
+
+  const victimPair = {
+    source: 'private',
+    dest: `${victimOrigin}/|${attackerOrigin}/`
+  }
+  const attackerPair = {
+    source: `private|${victimOrigin}/`,
+    dest: `${attackerOrigin}/`
+  }
+
+  // These pairs collide when the key is source + '|' + dest.
+  t.assert.strictEqual(
+    victimPair.source + '|' + victimPair.dest,
+    attackerPair.source + '|' + attackerPair.dest
+  )
+
+  const proxy = Fastify()
+  proxy.register(From, {
+    base: 'http://localhost',
+    http: true
+  })
+  proxy.get('/prime', (req, reply) => {
+    reply.from(victimPair.source, {
+      getUpstream: () => victimPair.dest
+    })
+  })
+  proxy.get('/collide', (req, reply) => {
+    reply.from(attackerPair.source, {
+      getUpstream: () => attackerPair.dest
+    })
+  })
+  t.after(() => proxy.close())
+
+  const primeResponse = await proxy.inject('/prime')
+  t.assert.strictEqual(primeResponse.statusCode, 200)
+  t.assert.strictEqual(primeResponse.json().marker, 'VICTIM')
+
+  const attackerResponse = await proxy.inject('/collide')
+  t.assert.strictEqual(attackerResponse.statusCode, 200)
+  t.assert.strictEqual(
+    attackerResponse.json().marker,
+    'ATTACKER',
+    'attacker request must not reuse the victim cache entry'
+  )
+})
+
+t.test('GHSA-v574-6498-x57v: cache key distinguishes an absent base', async (t) => {
+  const target = Fastify()
+  target.get('/private', async () => ({ marker: 'TARGET' }))
+  t.after(() => target.close())
+  const targetOrigin = await target.listen({ host: '127.0.0.1', port: 0 })
+  const source = `${targetOrigin}/private`
+
+  const proxy = Fastify()
+  proxy.register(From, { http: true })
+  proxy.get('/prime', (req, reply) => reply.from(source))
+  proxy.get('/invalid', (req, reply) => {
+    reply.from(source, {
+      getUpstream: () => 'undefined'
+    })
+  })
+  t.after(() => proxy.close())
+
+  const primeResponse = await proxy.inject('/prime')
+  t.assert.strictEqual(primeResponse.statusCode, 200)
+  t.assert.strictEqual(primeResponse.json().marker, 'TARGET')
+
+  const invalidResponse = await proxy.inject('/invalid')
+  t.assert.strictEqual(
+    invalidResponse.statusCode,
+    500,
+    'invalid upstream must not reuse the entry cached without a base'
+  )
+})

package/test/http1-aborted-request.test.js

@@ -0,0 +1,61 @@
+'use strict'
+
+const t = require('node:test')
+const Fastify = require('fastify')
+const From = require('..')
+const http = require('node:http')
+const { once } = require('node:events')
+
+// See https://github.com/fastify/fastify-reply-from/issues/419
+// When a client aborts an HTTP/1 request before the upstream target responds,
+// reply-from must not attempt to forward the (late) upstream response: it should
+// neither invoke the onResponse callback nor pipe the upstream body to the
+// already-closed reply. The equivalent HTTP/2 path was already handled; this
+// covers the HTTP/1 path.
+t.test('does not forward the upstream response when the HTTP/1 request was aborted', async (t) => {
+  t.plan(1)
+
+  // Target that delays its response long enough for the client to abort first.
+  const target = http.createServer((_req, res) => {
+    setTimeout(() => {
+      res.statusCode = 200
+      res.end('hello world')
+    }, 500)
+  })
+  t.after(() => target.close())
+  target.listen({ port: 0 })
+  await once(target, 'listening')
+
+  const instance = Fastify()
+  t.after(() => instance.close())
+
+  let onResponseCalled = false
+  instance.register(From)
+  instance.get('/', (_request, reply) => {
+    reply.from(`http://localhost:${target.address().port}`, {
+      onResponse (_req, replyInner, res) {
+        onResponseCalled = true
+        replyInner.send(res.stream)
+      }
+    })
+  })
+
+  instance.listen({ port: 0 })
+  await once(instance.server, 'listening')
+
+  await new Promise((resolve) => {
+    const req = http.request({
+      host: 'localhost',
+      port: instance.server.address().port,
+      path: '/'
+    }, (res) => { res.resume() })
+    req.on('error', () => {})
+    req.end()
+    // Abort well before the target responds.
+    setTimeout(() => req.destroy(), 50)
+    // Wait past the target's response so any (buggy) forwarding would have happened.
+    setTimeout(resolve, 800)
+  })
+
+  t.assert.strictEqual(onResponseCalled, false, 'onResponse must not run for an aborted request')
+})