@iislee/opencodex 2.11.0 → 2.31.0

package/src/server/request-decompress.ts

@@ -45,6 +45,101 @@ function declaredBodyLength(req: Request): number | null {
   return Number.isFinite(length) && length >= 0 ? length : null;
 }
 
+function cancelStreamWithoutWaiting(stream: ReadableStream<Uint8Array> | null, reason: unknown): void {
+  if (!stream || stream.locked) return;
+  try {
+    void stream.cancel(reason).catch(() => undefined);
+  } catch {
+    // A non-standard stream may throw synchronously from cancel().
+  }
+}
+
+function cancelReaderWithoutWaiting(reader: ReadableStreamDefaultReader<Uint8Array>, reason: unknown): void {
+  // Request.clone() tees can leave cancel() pending until the other branch
+  // drains. Cancellation must never extend this reader's own admission bound.
+  try {
+    void reader.cancel(reason).catch(() => undefined);
+  } catch {
+    // A non-standard reader may throw synchronously from cancel().
+  }
+}
+
+async function readRequestBodyBytesCapped(
+  body: ReadableStream<Uint8Array> | null,
+  maxBytes: number,
+  signal?: AbortSignal,
+): Promise<Uint8Array> {
+  if (signal?.aborted) {
+    cancelStreamWithoutWaiting(body, signal.reason);
+    throw signal.reason;
+  }
+  if (!body) return new Uint8Array(0);
+
+  const reader = body.getReader();
+  // Keep one geometric buffer instead of one object per transport chunk. A
+  // hostile peer can fragment a bounded payload into arbitrarily many chunks.
+  let retained = new Uint8Array(Math.min(maxBytes, 64 * 1024));
+  let retainedBytes = 0;
+  let aborted = false;
+  let abortReason: unknown;
+  let cancellationStarted = false;
+  const cancel = (reason: unknown): void => {
+    if (cancellationStarted) return;
+    cancellationStarted = true;
+    cancelReaderWithoutWaiting(reader, reason);
+  };
+  const onAbort = (): void => {
+    aborted = true;
+    abortReason = signal?.reason;
+    cancel(abortReason);
+  };
+  signal?.addEventListener("abort", onAbort, { once: true });
+  // Close the narrow race between the preflight check and listener install.
+  if (signal?.aborted) onAbort();
+
+  try {
+    while (true) {
+      if (aborted) throw abortReason;
+      const { value, done } = await reader.read();
+      // cancel() can resolve a pending read as EOF. Preserve the caller's
+      // original abort reason instead of misclassifying that as a clean body.
+      if (aborted) throw abortReason;
+      if (done) {
+        return retainedBytes === retained.byteLength
+          ? retained
+          : retained.slice(0, retainedBytes);
+      }
+      if (!value || value.byteLength === 0) continue;
+
+      if (value.byteLength > maxBytes - retainedBytes) {
+        const error = new DecompressedBodyTooLargeError(retainedBytes + value.byteLength, maxBytes);
+        cancel(error);
+        throw error;
+      }
+
+      const required = retainedBytes + value.byteLength;
+      if (required > retained.byteLength) {
+        const grown = new Uint8Array(Math.min(maxBytes, Math.max(retained.byteLength * 2, required)));
+        grown.set(retained.subarray(0, retainedBytes));
+        retained = grown;
+      }
+      retained.set(value, retainedBytes);
+      retainedBytes = required;
+    }
+  } catch (error) {
+    const failure = aborted ? abortReason : error;
+    cancel(failure);
+    throw failure;
+  } finally {
+    signal?.removeEventListener("abort", onAbort);
+    try {
+      reader.releaseLock();
+    } catch {
+      // A pending cancellation can retain the lock briefly; never await it.
+    }
+  }
+}
+
 function inflateDeflateBody(compressed: Uint8Array<ArrayBuffer>, opts: { maxOutputLength: number }): Uint8Array {
   // HTTP "deflate" appears both zlib-wrapped and raw in the wild (Bun.deflateSync emits raw,
   // which the previous Bun.inflateSync accepted). Try zlib-wrapped first, fall back to raw —
@@ -85,29 +180,38 @@ export function decodeRequestBody(
   return assertBodySizeWithinLimit(decoded, maxBytes);
 }
 
-/** Parse a bounded JSON request body, transparently decoding compressed payloads. */
+/**
+ * Parse a bounded JSON request body, transparently decoding compressed payloads.
+ *
+ * `options.signal`, when provided, replaces `req.signal` rather than composing with
+ * it. Callers that need both (for example request disconnect plus a deadline) must
+ * merge them into one AbortSignal before calling.
+ */
 export async function readBoundedJsonRequestBody(
   req: Request,
   maxBytes: number,
   budget?: TranslatorBudget,
+  options?: { emptyBodyFallback?: unknown; signal?: AbortSignal },
 ): Promise<unknown> {
   const encoding = req.headers.get("content-encoding");
   const declaredLength = declaredBodyLength(req);
-  // Reject an honest oversized declaration before req.arrayBuffer() can allocate it.
-  // Missing, malformed, or dishonest declarations remain covered by decodeRequestBody's
-  // post-read cap below.
+  // Reject an honest oversized declaration before reading. Missing, malformed,
+  // and dishonest declarations remain bounded by the streaming reader below.
   if (declaredLength !== null && declaredLength > maxBytes) {
-    throw new DecompressedBodyTooLargeError(declaredLength, maxBytes);
+    const error = new DecompressedBodyTooLargeError(declaredLength, maxBytes);
+    cancelStreamWithoutWaiting(req.body, error);
+    throw error;
   }
   const releaseReservation = budget && declaredLength !== null && declaredLength > 0
     ? budget.observeAcceptedRequestCopy(declaredLength)
     : undefined;
   let raw: Uint8Array;
   try {
-    raw = new Uint8Array(await req.arrayBuffer());
+    raw = await readRequestBodyBytesCapped(req.body, maxBytes, options?.signal ?? req.signal);
   } finally {
     releaseReservation?.();
   }
+  assertBodySizeWithinLimit(raw, maxBytes);
   const releaseRaw = budget?.observeAcceptedRequestCopy(raw.byteLength);
   let releaseDecoded: (() => void) | undefined;
   let releaseText: (() => void) | undefined;
@@ -116,6 +220,9 @@ export async function readBoundedJsonRequestBody(
     releaseDecoded = decoded === raw ? undefined : budget?.observeAcceptedRequestCopy(decoded.byteLength);
     const text = new TextDecoder().decode(decoded);
     releaseText = budget?.observeAcceptedRequestCopy(new TextEncoder().encode(text).byteLength);
+    if (options && "emptyBodyFallback" in options && text.trim() === "") {
+      return options.emptyBodyFallback;
+    }
     const parsed = JSON.parse(text);
     budget?.observeAcceptedRequestCopy(new TextEncoder().encode(JSON.stringify(parsed)).byteLength);
     return parsed;