@maiyunnet/kebab 9.14.0 → 9.14.2

package/sys/route.js

@@ -935,6 +935,18 @@ export function getFormData(req, events = {}, limits = {}) {
         };
         /** --- 获取的 boundary 文本 --- */
         const boundary = ct.slice(clio + 9);
+        // --- 超时护盾：防止网络静默断开时 Promise 永不 resolve ---
+        /** --- 超时定时器 --- */
+        let timer;
+        /** --- 是否已经结束（防止重复 resolve） --- */
+        let finished = false;
+        /** --- 清理定时器 --- */
+        function clearTimer() {
+            if (timer) {
+                clearTimeout(timer);
+                timer = undefined;
+            }
+        }
         // 一下变量是相对于 data 事件的全局变量 ---
         /** --- 当前临时读入的还未处理的 buffer --- */
         let buffer = Buffer.from('');
@@ -978,6 +990,23 @@ export function getFormData(req, events = {}, limits = {}) {
                 }
             }
         }
+        // --- 启动超时定时器（在所有变量声明之后，确保回调闭包可引用） ---
+        const timeoutMs = limits.timeout ?? 300_000;
+        if (timeoutMs > 0) {
+            timer = setTimeout(() => {
+                if (finished) {
+                    return;
+                }
+                finished = true;
+                if ((state === EState.FILE) && ftmpName && ftmpStream) {
+                    ftmpStream.destroy();
+                }
+                lCore.debug('[ROUTE][GETFORMDATA] formdata request timeout');
+                lCore.log({}, '[ROUTE][GETFORMDATA] formdata request timeout after ' + timeoutMs + 'ms', '-error');
+                cleanupFiles();
+                resolve(false);
+            }, timeoutMs);
+        }
         /** --- 拒绝当前文件：销毁流、删临时文件、标记 rejected --- */
         function rejectFile() {
             rejected = true;
@@ -988,6 +1017,11 @@ export function getFormData(req, events = {}, limits = {}) {
         }
         /** --- 最终输出 --- */
         function finalize() {
+            if (finished) {
+                return;
+            }
+            finished = true;
+            clearTimer();
             if (rejected) {
                 cleanupFiles();
                 resolve(false);
@@ -1064,6 +1098,12 @@ export function getFormData(req, events = {}, limits = {}) {
                         // --- POST 模式 ---
                         const io = buffer.indexOf('\r\n--' + boundary);
                         if (io === -1) {
+                            // --- 检查字段大小限制，防止畸形数据导致 buffer 无限增长 ---
+                            const maxField = limits.maxFieldSize ?? 1_048_576;
+                            if (buffer.length > maxField + boundary.length + 4) {
+                                rejected = true;
+                                return;
+                            }
                             return;
                         }
                         // --- 找到结束标语，写入 POST ---
@@ -1178,6 +1218,11 @@ export function getFormData(req, events = {}, limits = {}) {
             }
         });
         req.on('error', function (e) {
+            if (finished) {
+                return;
+            }
+            finished = true;
+            clearTimer();
             if ((state === EState.FILE) && ftmpName) {
                 ftmpStream.destroy();
             }
@@ -1186,8 +1231,26 @@ export function getFormData(req, events = {}, limits = {}) {
             cleanupFiles();
             resolve(false);
         });
+        // --- 监听连接关闭（HTTP/2 RST_STREAM、代理断连、或用户主动中断上传等场景） ---
+        req.on('close', function () {
+            if (finished) {
+                return;
+            }
+            // --- 若数据未读完且连接已关闭，视为传输中断（多数是用户主动取消，无需记录错误） ---
+            if (!readEnd && writeFileLength > 0) {
+                finished = true;
+                clearTimer();
+                if ((state === EState.FILE) && ftmpName && ftmpStream) {
+                    ftmpStream.destroy();
+                }
+                lCore.debug('[ROUTE][GETFORMDATA] connection closed before formdata complete');
+                cleanupFiles();
+                resolve(false);
+            }
+        });
         req.on('end', function () {
             readEnd = true;
+            clearTimer();
             // --- 被拒绝则清理文件并 resolve(false) ---
             if (rejected) {
                 finalize();

package/www/example/ctr/test.d.ts

@@ -47,6 +47,8 @@ export default class extends sCtr.Ctr {
     coreChecktype(): string;
     coreCheckschema(): string;
     coreMuid(): string;
+    coreIplimit(): string;
+    coreRealiplimit(): string;
     coreGetlog(): Promise<string>;
     coreLs(): Promise<string>;
     coreUpdatecode(): Promise<string>;

package/www/example/ctr/test.js

@@ -153,6 +153,8 @@ export default class extends sCtr.Ctr {
             `<br><a href="${this._config.const.urlBase}test/core-checktype">View "test/core-checktype"</a>`,
             `<br><a href="${this._config.const.urlBase}test/core-checkschema">View "test/core-checkschema"</a>`,
             `<br><a href="${this._config.const.urlBase}test/core-muid">View "test/core-muid"</a>`,
+            `<br><a href="${this._config.const.urlBase}test/core-iplimit">View "test/core-iplimit"</a>`,
+            `<br><a href="${this._config.const.urlBase}test/core-realiplimit">View "test/core-realiplimit"</a>`,
             `<br><a href="${this._config.const.urlBase}test/core-getlog">View "test/core-getlog"</a>`,
             `<br><a href="${this._config.const.urlBase}test/core-ls">View "test/core-ls"</a>`,
             `<br><a href="${this._config.const.urlBase}test/core-reload">View "test/core-reload"</a>`,
@@ -213,6 +215,7 @@ export default class extends sCtr.Ctr {
             `<br><a href="${this._config.const.urlBase}test/sql?type=having">View "test/sql?type=having"</a> <a href="${this._config.const.urlBase}test/sql?type=having&s=pgsql">pgsql</a>`,
             `<br><a href="${this._config.const.urlBase}test/sql?type=by">View "test/sql?type=by"</a> <a href="${this._config.const.urlBase}test/sql?type=by&s=pgsql">pgsql</a>`,
             `<br><a href="${this._config.const.urlBase}test/sql?type=field">View "test/sql?type=field"</a> <a href="${this._config.const.urlBase}test/sql?type=field&s=pgsql">pgsql</a>`,
+            `<br><a href="${this._config.const.urlBase}test/sql?type=hint">View "test/sql?type=hint"</a>`,
             '<br><br><b>Consistent:</b>',
             `<br><br><a href="${this._config.const.urlBase}test/consistent-hash">View "test/consistent-hash"</a>`,
             `<br><a href="${this._config.const.urlBase}test/consistent-distributed">View "test/consistent-distributed"</a>`,
@@ -1367,6 +1370,24 @@ for (let i = 0; i < 30000; ++i) {
         }
         return echo.join('') + this._getEnd();
     }
+    coreIplimit() {
+        const v6 = '2001:db8:85a3:8d3:1319:8a2e:370:7348';
+        return '<pre>lCore.ipLimit(\'192.168.1.100\');</pre>' + lCore.ipLimit('192.168.1.100') +
+            '<pre>lCore.ipLimit(\'2001:db8:85a3:8d3:1319:8a2e:370:7348\');</pre>' + lCore.ipLimit(v6) +
+            '<pre>lCore.ipLimit(\'2001:db8:85a3:8d3:1319:8a2e:370:7348\', 48);</pre>' + lCore.ipLimit(v6, 48) +
+            '<pre>lCore.ipLimit(\'2001:db8:85a3:8d3:1319:8a2e:370:7348\', 56);</pre>' + lCore.ipLimit(v6, 56) +
+            '<pre>lCore.ipLimit(\'2001:db8:85a3:8d3:1319:8a2e:370:7348\', 128);</pre>' + lCore.ipLimit(v6, 128) +
+            '<pre>lCore.ipLimit(\'::1\');</pre>' + lCore.ipLimit('::1') +
+            '<pre>lCore.ipLimit(\'\');</pre>' + JSON.stringify(lCore.ipLimit('')) +
+            '<br><br>' + this._getEnd();
+    }
+    coreRealiplimit() {
+        return '<pre>lCore.realIP(this);</pre>' + lCore.realIP(this) +
+            '<pre>lCore.realIPLimit(this);</pre>' + lCore.realIPLimit(this) +
+            '<pre>lCore.realIPLimit(this, \'\', 48);</pre>' + lCore.realIPLimit(this, '', 48) +
+            '<pre>lCore.realIPLimit(this, \'\', 56);</pre>' + lCore.realIPLimit(this, '', 56) +
+            '<br><br>' + this._getEnd();
+    }
     async coreGetlog() {
         const path = lTime.format(null, 'Y/m/d/H');
         const log = await lCore.getLog({
@@ -3064,6 +3085,21 @@ Result:<pre id="result">Nothing.</pre>`);
                 echo.push(`<pre>sql.field('*');</pre>` + sql.field('*'));
                 break;
             }
+            case 'hint': {
+                let s = sql.hint('INDEX(`supply_date_0_0` `idx_supply_date_query`)').select('*', 'supply_date_0_0').getSql();
+                let sd = sql.getData();
+                echo.push(`<pre>sql.hint('INDEX(\`supply_date_0_0\` \`idx_supply_date_query\`)').select('*', 'supply_date_0_0');</pre>
+<b>getSql() :</b> ${s}<br>
+<b>getData():</b> <pre>${JSON.stringify(sd, undefined, 4)}</pre>
+<b>format() :</b> ${sql.format(s, sd)}<hr>`);
+                s = sql.hint('INDEX(`supply_date_0_0` `idx_supply_date_query`) NO_INDEX(`supply_date_0_0` `idx_old`)').select('*', 'supply_date_0_0').getSql();
+                sd = sql.getData();
+                echo.push(`<pre>sql.hint('INDEX(\`supply_date_0_0\` \`idx_supply_date_query\`) NO_INDEX(\`supply_date_0_0\` \`idx_old\`)').select('*', 'supply_date_0_0');</pre>
+<b>getSql() :</b> ${s}<br>
+<b>getData():</b> <pre>${JSON.stringify(sd, undefined, 4)}</pre>
+<b>format() :</b> ${sql.format(s, sd)}`);
+                break;
+            }
         }
         return echo.join('') + '<br><br>' + this._getEnd();
     }