@nestjs/platform-express 12.1.3 → 12.2.0

package/adapters/express-adapter.d.ts

@@ -68,6 +68,10 @@ export declare class ExpressAdapter extends AbstractHttpAdapter<http.Server | ht
     setLocal(key: string, value: any): this;
     getType(): string;
     isRouteOrderSensitive(): boolean;
+    getRouteMatchingOptions(): {
+        caseSensitive: boolean;
+        ignoreTrailingSlash: boolean;
+    };
     applyVersionFilter(handler: Function, version: VersionValue, versioningOptions: VersioningOptions): VersionedRoute;
     mapException(error: unknown): unknown;
     private normalizePrefix;

package/adapters/express-adapter.js

@@ -95,6 +95,12 @@ export class ExpressAdapter extends AbstractHttpAdapter {
             return response.send();
         }
         if (body instanceof StreamableFile) {
+            // A stream that failed before the reply (e.g. while an interceptor
+            // awaited) has already emitted its 'error' event.
+            const { errored } = body.getStream();
+            if (errored) {
+                return body.errorHandler(errored, response);
+            }
             this.applyStreamHeaders(response, body);
             const stream = body.getStream();
             stream.once('error', err => {
@@ -107,6 +113,14 @@ export class ExpressAdapter extends AbstractHttpAdapter {
                     stream.destroy();
                 }
             });
+            // Node discards the body of a HEAD response without ever applying
+            // backpressure, so piping would read the whole source. The response
+            // ends once the source is readable instead, which still leaves an
+            // error opening it (e.g. a missing file) to the error handler.
+            if (response.req?.method === 'HEAD') {
+                stream.once('readable', () => response.end());
+                return response.on('error', (err) => body.errorLogger(err));
+            }
             return stream
                 .pipe(response)
                 .on('error', (err) => body.errorLogger(err));
@@ -114,7 +128,12 @@ export class ExpressAdapter extends AbstractHttpAdapter {
         const responseContentType = response.getHeader('Content-Type');
         if (typeof responseContentType === 'string' &&
             !isJsonContentType(responseContentType) &&
-            body?.statusCode >= HttpStatus.BAD_REQUEST) {
+            (body?.statusCode >= HttpStatus.BAD_REQUEST ||
+                // A custom error body (e.g. "new HttpException({ ... }, 404)") need
+                // not have a "statusCode" of its own
+                (isObject(body) &&
+                    !isNil(statusCode) &&
+                    statusCode >= HttpStatus.BAD_REQUEST))) {
             this.logger.warn("Content-Type doesn't match Reply body, you might need a custom ExceptionFilter for non-JSON responses");
             response.setHeader('Content-Type', 'application/json');
         }
@@ -267,13 +286,11 @@ export class ExpressAdapter extends AbstractHttpAdapter {
                 if (isExactPath && router === this.instance.use) {
                     router = this.instance.all;
                 }
-                // Express routes are not strict, so "/api" also matches "/api/". That
-                // path is left to the wildcard entry registered next to it (an optional
-                // "{*path}" matches it), so the middleware doesn't run twice.
-                const handler = isExactPath
-                    ? (req, res, next) => req.path.endsWith('/') ? next() : callback(req, res, next)
-                    : callback;
-                return router.call(this.instance, convertedPath, handler);
+                // Express routes are not strict, so "/api" also matches "/api/", which
+                // the wildcard path registered next to it may match too ("/api/{*path}"
+                // does, "/api/*path" does not). The core runs the middleware for the
+                // first of its paths that matches a request only.
+                return router.call(this.instance, convertedPath, callback);
             }
             catch (e) {
                 if (e instanceof TypeError) {
@@ -333,6 +350,18 @@ export class ExpressAdapter extends AbstractHttpAdapter {
     isRouteOrderSensitive() {
         return true;
     }
+    // The return type is spelled out (rather than "RouteMatchingOptions") so
+    // that the declarations still compile against an older "@nestjs/common"
+    getRouteMatchingOptions() {
+        // Routes are registered on the application router, which takes the
+        // "case sensitive routing" and "strict routing" settings in effect when
+        // it is created and ignores later changes
+        const router = this.getInstance().router;
+        return {
+            caseSensitive: !!router?.caseSensitive,
+            ignoreTrailingSlash: !router?.strict,
+        };
+    }
     applyVersionFilter(handler, version, versioningOptions) {
         const callNextHandler = (req, res, next) => {
             if (!next) {

package/adapters/utils/get-media-type-version.util.d.ts

@@ -6,6 +6,10 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */

package/adapters/utils/get-media-type-version.util.js

@@ -1,3 +1,29 @@
+/**
+ * Splits a header value at separators outside quoted strings in linear time.
+ * Backslash-escaped characters inside quoted strings are treated as literals.
+ */
+const splitOutsideQuotes = (value, separator) => {
+    const parts = [];
+    let start = 0;
+    let isQuoted = false;
+    const len = value.length;
+    for (let index = 0; index < len; index++) {
+        const character = value[index];
+        if (isQuoted && character === '\\') {
+            // A quoted-pair consumes the next character, including an escaped quote.
+            index++;
+        }
+        else if (character === '"') {
+            isQuoted = !isQuoted;
+        }
+        else if (character === separator && !isQuoted) {
+            parts.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    parts.push(value.slice(start));
+    return parts;
+};
 /**
  * Returns the version carried by an `Accept` header for media type versioning,
  * e.g. `2` for `application/json;v=2` with the `v=` key.
@@ -6,19 +32,27 @@
  * media range of a list (`text/html, application/json;v=2`); the first match
  * wins. Returns `undefined` when no parameter starts with the key.
  *
+ * Quoted parameter values are unescaped, and separators inside them are ignored.
+ * An unterminated quoted string runs to the end of the header value, so a
+ * version that follows its opening quote is not read.
+ *
  * Duplicated in each platform package so that a platform package never
  * depends on a newer `@nestjs/core` than the one installed.
  */
 export function getMediaTypeVersion(acceptHeader, key) {
     const mediaRanges = []
         .concat(acceptHeader ?? [])
-        .flatMap(value => value.split(','));
+        .flatMap(value => splitOutsideQuotes(value, ','));
     for (const mediaRange of mediaRanges) {
-        const [, ...parameters] = mediaRange.split(';');
+        const [, ...parameters] = splitOutsideQuotes(mediaRange, ';');
         for (const parameter of parameters) {
             const trimmedParameter = parameter.trim();
             if (trimmedParameter.startsWith(key)) {
-                return trimmedParameter.slice(key.length);
+                const version = trimmedParameter.slice(key.length);
+                if (version.startsWith('"') && version.endsWith('"')) {
+                    return version.slice(1, -1).replace(/\\([\s\S])/g, '$1');
+                }
+                return version;
             }
         }
     }

package/multer/interceptors/any-files.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  * @param localOptions
  *
@@ -12,7 +12,7 @@ export function AnyFilesInterceptor(localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -23,7 +23,9 @@ export function AnyFilesInterceptor(localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/file-fields.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  * @param uploadFields
  * @param localOptions
@@ -12,7 +12,7 @@ export function FileFieldsInterceptor(uploadFields, localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -23,7 +23,9 @@ export function FileFieldsInterceptor(uploadFields, localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/file.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  * @param fieldName
  * @param localOptions
@@ -13,7 +13,7 @@ export function FileInterceptor(fieldName, localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -24,7 +24,9 @@ export function FileInterceptor(fieldName, localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/files.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, removeFilesOnPipeRejection, transformException, } from '../multer/multer.utils.js';
 /**
  *
  * @param fieldName
@@ -15,7 +15,7 @@ export function FilesInterceptor(fieldName, maxCount, localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();
@@ -26,7 +26,9 @@ export function FilesInterceptor(fieldName, maxCount, localOptions) {
                 }
                 resolve();
             }));
-            return next.handle();
+            return next
+                .handle()
+                .pipe(removeFilesOnPipeRejection(this.multer.storage, ctx.getRequest(), ctx.getResponse()));
         }
     };
     MixinInterceptor = __decorate([

package/multer/interceptors/no-files.interceptor.js

@@ -2,7 +2,7 @@ import { __decorate, __metadata, __param } from "tslib";
 import { Inject, mixin, Optional, } from '@nestjs/common';
 import multer from 'multer';
 import { MULTER_MODULE_OPTIONS } from '../files.constants.js';
-import { mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
+import { applyDefaultLimits, mergeMulterOptions, transformException, } from '../multer/multer.utils.js';
 /**
  *
  * @param localOptions
@@ -12,7 +12,7 @@ export function NoFilesInterceptor(localOptions) {
     let MixinInterceptor = class MixinInterceptor {
         multer;
         constructor(options = {}) {
-            this.multer = multer(mergeMulterOptions(options, localOptions));
+            this.multer = multer(applyDefaultLimits(mergeMulterOptions(options, localOptions)));
         }
         async intercept(context, next) {
             const ctx = context.switchToHttp();

package/multer/interfaces/multer-options.interface.d.ts

@@ -16,9 +16,17 @@ export interface MulterLimits {
     parts?: number;
     /** For multipart forms, the max number of header key=> value pairs to parse Default: 2000(same as node's http). */
     headerPairs?: number;
-    /** Max nesting depth of field names; `a[b][c]` has 2 levels (Default: Infinity) */
+    /**
+     * Max nesting depth of field names; `a[b][c]` has 2 levels (Default: 32,
+     * where multer's own default is Infinity). Set it to `Infinity` to lift
+     * the limit.
+     */
     fieldNestingDepth?: number;
-    /** Max numeric array index accepted in field names; `a[3]` uses index 3 (Default: Infinity) */
+    /**
+     * Max numeric array index accepted in field names; `a[3]` uses index 3
+     * (Default: 1000, where multer's own default is Infinity). Set it to
+     * `Infinity` to lift the limit.
+     */
     fieldArrayIndexLimit?: number;
 }
 /**
@@ -31,8 +39,9 @@ export interface MulterOptions {
     /** The storage engine to use for uploaded files. */
     storage?: any;
     /**
-     * An object specifying the size limits of the following optional properties. This object is passed to busboy
-     * directly, and the details of properties can be found on https://github.com/mscdex/busboy#busboy-methods
+     * An object specifying the size limits of the following optional properties. This object is passed to multer
+     * and on to busboy, with `fieldNestingDepth` and `fieldArrayIndexLimit` set to their defaults when absent.
+     * The details of the busboy properties can be found on https://github.com/mscdex/busboy#busboy-methods
      *
      * Since multer 2.4.0, this can also be a function of the request that returns such an object.
      */

package/multer/multer/multer.constants.d.ts

@@ -11,6 +11,17 @@ export declare const multerExceptions: {
     LIMIT_FIELD_ARRAY_INDEX: string;
     INVALID_FIELD_NAME: string;
 };
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses.
+ */
+export declare const DEFAULT_FIELD_NAME_LIMITS: {
+    readonly fieldNestingDepth: 32;
+    readonly fieldArrayIndexLimit: 1000;
+};
 export declare const busboyExceptions: {
     MULTIPART_BOUNDARY_NOT_FOUND: string;
     MULTIPART_MALFORMED_PART_HEADER: string;

package/multer/multer/multer.constants.js

@@ -15,6 +15,17 @@ export const multerExceptions = {
     // engine after the file stream was destroyed, not by the request, so it
     // stays a 500.
 };
+/**
+ * Defaults of the field name limits that multer leaves at `Infinity`, which
+ * let a single small request build an arbitrarily deep `req.body`
+ * (`fieldNestingDepth`) or arrays of arbitrary length (`fieldArrayIndexLimit`).
+ * `32` is the nesting depth `body-parser` allows in the urlencoded bodies the
+ * ExpressAdapter parses; `1000` is the number of parameters it parses.
+ */
+export const DEFAULT_FIELD_NAME_LIMITS = {
+    fieldNestingDepth: 32,
+    fieldArrayIndexLimit: 1000,
+};
 export const busboyExceptions = {
     // from https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js
     MULTIPART_BOUNDARY_NOT_FOUND: 'Multipart: Boundary not found',

package/multer/multer/multer.utils.d.ts

@@ -1,4 +1,5 @@
 import { HttpException } from '@nestjs/common';
+import { type MonoTypeOperatorFunction } from 'rxjs';
 import { MulterModuleOptions } from '../interfaces/index.js';
 import { MulterOptions } from '../interfaces/multer-options.interface.js';
 /**
@@ -12,6 +13,20 @@ import { MulterOptions } from '../interfaces/multer-options.interface.js';
  * `limits`) the local value wins outright, matching the pre-merge behaviour.
  */
 export declare function mergeMulterOptions(options?: MulterModuleOptions, localOptions?: MulterOptions): MulterModuleOptions;
+/**
+ * Sets the field name limits multer leaves at `Infinity` to
+ * `DEFAULT_FIELD_NAME_LIMITS` wherever they are not set. multer only checks
+ * a limit that is present in `limits`, so the defaults are added to the
+ * object, or to the object a function-valued `limits` returns.
+ */
+export declare function applyDefaultLimits<T extends MulterOptions>(options: T): T;
+/**
+ * Removes the files multer stored for `req` when the route's pipes reject
+ * the request (e.g. `ParseFilePipe`): the route handler never sees them, and
+ * nothing else would remove them. They are removed once the response has
+ * been sent, as an exception filter may still use (or remove) them.
+ */
+export declare function removeFilesOnPipeRejection<T>(storage: any, req: any, res: any): MonoTypeOperatorFunction<T>;
 export declare function transformException(error: (Error & {
     field?: string;
     code?: string;

package/multer/multer/multer.utils.js

@@ -1,6 +1,9 @@
 import { BadRequestException, HttpException, PayloadTooLargeException, } from '@nestjs/common';
 import { isPlainObject } from '@nestjs/common/internal';
-import { multerExceptions, busboyExceptions } from './multer.constants.js';
+import { isRejectedByPipes } from '@nestjs/core/internal';
+import { catchError, throwError } from 'rxjs';
+import { finished } from 'stream';
+import { DEFAULT_FIELD_NAME_LIMITS, multerExceptions, busboyExceptions, } from './multer.constants.js';
 /**
  * Merges module-level (global) multer options with interceptor-level (local)
  * options. `limits` is merged key-by-key rather than replaced outright, so
@@ -16,8 +19,66 @@ export function mergeMulterOptions(options = {}, localOptions = {}) {
     if (isPlainObject(options.limits) && isPlainObject(localOptions.limits)) {
         merged.limits = { ...options.limits, ...localOptions.limits };
     }
+    // `dest` and `storage` both say where files go, and multer prefers
+    // `storage`, so a global storage engine would shadow a local `dest`.
+    if (localOptions.dest && !localOptions.storage) {
+        delete merged.storage;
+    }
     return merged;
 }
+/**
+ * Sets the field name limits multer leaves at `Infinity` to
+ * `DEFAULT_FIELD_NAME_LIMITS` wherever they are not set. multer only checks
+ * a limit that is present in `limits`, so the defaults are added to the
+ * object, or to the object a function-valued `limits` returns.
+ */
+export function applyDefaultLimits(options) {
+    const { limits } = options;
+    return {
+        ...options,
+        limits: typeof limits === 'function'
+            ? (req) => withDefaultLimits(limits(req))
+            : withDefaultLimits(limits),
+    };
+}
+function withDefaultLimits(limits) {
+    return {
+        ...limits,
+        fieldNestingDepth: limits?.fieldNestingDepth ?? DEFAULT_FIELD_NAME_LIMITS.fieldNestingDepth,
+        fieldArrayIndexLimit: limits?.fieldArrayIndexLimit ??
+            DEFAULT_FIELD_NAME_LIMITS.fieldArrayIndexLimit,
+    };
+}
+/**
+ * Removes the files multer stored for `req` when the route's pipes reject
+ * the request (e.g. `ParseFilePipe`): the route handler never sees them, and
+ * nothing else would remove them. They are removed once the response has
+ * been sent, as an exception filter may still use (or remove) them.
+ */
+export function removeFilesOnPipeRejection(storage, req, res) {
+    return catchError(err => {
+        if (isRejectedByPipes(req)) {
+            finished(res, () => {
+                for (const file of storedFiles(req)) {
+                    try {
+                        storage._removeFile(req, file, () => undefined);
+                    }
+                    catch {
+                        // The request has failed already.
+                    }
+                }
+            });
+        }
+        return throwError(() => err);
+    });
+}
+function storedFiles(req) {
+    const { file, files } = req;
+    if (file) {
+        return [file];
+    }
+    return Array.isArray(files) ? files : Object.values(files ?? {}).flat();
+}
 // Multer may add in a 'field' property to the error
 // https://github.com/expressjs/multer/blob/aa42bea6ac7d0cb8fcb279b15a7278cda805dc63/lib/multer-error.js#L19
 export function transformException(error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-express",
-  "version": "12.1.3",
+  "version": "12.2.0",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-express)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -8,6 +8,7 @@
   "main": "./index.js",
   "exports": {
     ".": "./index.js",
+    "./package.json": "./package.json",
     "./*.js": "./*.js",
     "./*": "./*.js"
   },
@@ -26,18 +27,18 @@
   },
   "dependencies": {
     "cors": "2.8.6",
-    "express": "5.2.1",
+    "express": "5.3.0",
     "multer": "2.4.0",
     "path-to-regexp": "8.4.2",
     "tslib": "2.8.1"
   },
   "devDependencies": {
-    "@nestjs/common": "12.1.3",
-    "@nestjs/core": "12.1.3"
+    "@nestjs/common": "12.2.0",
+    "@nestjs/core": "12.2.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^12.0.0",
     "@nestjs/core": "^12.0.0"
   },
-  "gitHead": "4514623279f6087808e3c8f08fbf9f37d3c17482"
+  "gitHead": "af37111368de7fd2dfab0bdec2f530c7845510c2"
 }