@nestjs/platform-fastify 11.2.3 → 11.2.4

package/adapters/fastify-adapter.d.ts

@@ -122,8 +122,24 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     private registerMiddie;
     private getRequestOriginalUrl;
     private injectRouteOptions;
+    /**
+     * Fastify still accepts the router options ("ignoreTrailingSlash",
+     * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"
+     * only reflects them when they are passed through "routerOptions". As the
+     * adapter always passes "routerOptions" (for the version constraint), the
+     * top-level values are folded in so that plugins relying on
+     * "initialConfig.routerOptions" (like @fastify/middie) normalize request
+     * paths exactly like the router does.
+     */
+    private getTopLevelRouterOptions;
     private sanitizeUrl;
     private removeDuplicateSlashes;
     private trimLastSlash;
+    /**
+     * Mirrors the absolute-form request target handling of "find-my-way".
+     * Returns the path of an absolute-form target ("http://host/path" -> "/path")
+     * and leaves any other request target untouched.
+     */
+    private getPathFromRequestTarget;
 }
 export {};

package/adapters/fastify-adapter.js

@@ -14,7 +14,6 @@ const path_to_regexp_1 = require("path-to-regexp");
 const fast_querystring_1 = require("fast-querystring");
 const url_sanitizer_1 = require("find-my-way/lib/url-sanitizer");
 const constants_1 = require("../constants");
-const fastify_middie_1 = require("./middie/fastify-middie");
 /**
  * @publicApi
  */
@@ -95,6 +94,7 @@ class FastifyAdapter extends http_adapter_1.AbstractHttpAdapter {
             : (0, fastify_1.fastify)({
                 ...instanceOrOptions,
                 routerOptions: {
+                    ...this.getTopLevelRouterOptions(instanceOrOptions),
                     ...instanceOrOptions?.routerOptions,
                     constraints: {
                         version: this.versionConstraint,
@@ -462,7 +462,7 @@ class FastifyAdapter extends http_adapter_1.AbstractHttpAdapter {
     }
     async registerMiddie() {
         this.isMiddieRegistered = true;
-        await this.register(fastify_middie_1.default);
+        await this.register(Promise.resolve().then(() => require('@fastify/middie')));
     }
     getRequestOriginalUrl(rawRequest) {
         return rawRequest.originalUrl || rawRequest.url;
@@ -511,9 +511,39 @@ class FastifyAdapter extends http_adapter_1.AbstractHttpAdapter {
         }
         return this.instance.route(routeToInject);
     }
+    /**
+     * Fastify still accepts the router options ("ignoreTrailingSlash",
+     * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"
+     * only reflects them when they are passed through "routerOptions". As the
+     * adapter always passes "routerOptions" (for the version constraint), the
+     * top-level values are folded in so that plugins relying on
+     * "initialConfig.routerOptions" (like @fastify/middie) normalize request
+     * paths exactly like the router does.
+     */
+    getTopLevelRouterOptions(options) {
+        const routerOptions = {};
+        const routerOptionKeys = [
+            'ignoreTrailingSlash',
+            'ignoreDuplicateSlashes',
+            'caseSensitive',
+            'useSemicolonDelimiter',
+            'maxParamLength',
+            'allowUnsafeRegex',
+        ];
+        for (const key of routerOptionKeys) {
+            if (options?.[key] !== undefined) {
+                routerOptions[key] = options[key];
+            }
+        }
+        return routerOptions;
+    }
     sanitizeUrl(url) {
         const initialConfig = this.instance.initialConfig;
         const routerOptions = initialConfig.routerOptions;
+        // Absolute-form request targets ("GET http://host/path HTTP/1.1") must be
+        // resolved to their path before any other normalization, as the Fastify
+        // router does, so that middleware and routes always match the same path.
+        url = this.getPathFromRequestTarget(url);
         if (routerOptions.ignoreDuplicateSlashes ||
             initialConfig.ignoreDuplicateSlashes) {
             url = this.removeDuplicateSlashes(url);
@@ -541,5 +571,30 @@ class FastifyAdapter extends http_adapter_1.AbstractHttpAdapter {
         }
         return path;
     }
+    /**
+     * Mirrors the absolute-form request target handling of "find-my-way".
+     * Returns the path of an absolute-form target ("http://host/path" -> "/path")
+     * and leaves any other request target untouched.
+     */
+    getPathFromRequestTarget(url) {
+        if (url.charCodeAt(0) === 47 /* '/' */) {
+            return url;
+        }
+        const schemeEnd = url.indexOf('://');
+        if (schemeEnd === -1) {
+            return url;
+        }
+        const scheme = url.slice(0, schemeEnd).toLowerCase();
+        if (scheme !== 'http' && scheme !== 'https') {
+            return url;
+        }
+        const authorityStart = schemeEnd + 3;
+        const pathStart = url.indexOf('/', authorityStart);
+        if (pathStart === authorityStart || !URL.canParse(url)) {
+            // Malformed target: the router rejects it before any middleware runs
+            return url;
+        }
+        return pathStart === -1 ? '/' : url.slice(pathStart);
+    }
 }
 exports.FastifyAdapter = FastifyAdapter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-fastify",
-  "version": "11.2.3",
+  "version": "11.2.4",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-fastify)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -20,13 +20,12 @@
   "dependencies": {
     "@fastify/cors": "11.3.0",
     "@fastify/formbody": "8.0.2",
+    "@fastify/middie": "9.3.4",
     "fast-querystring": "1.1.2",
     "fastify": "5.11.3",
-    "fastify-plugin": "6.0.0",
     "find-my-way": "9.7.0",
     "light-my-request": "6.6.0",
     "path-to-regexp": "8.4.2",
-    "reusify": "1.1.0",
     "tslib": "2.8.1"
   },
   "peerDependencies": {
@@ -43,5 +42,5 @@
       "optional": true
     }
   },
-  "gitHead": "2b36ee5fea13dedcedfd9815a9c193b2d21130c1"
+  "gitHead": "d5046225d86131285fb2f44c4c06860316a99474"
 }

package/adapters/middie/fastify-middie.d.ts

@@ -1,46 +0,0 @@
-import { FastifyInstance, FastifyPluginCallback } from 'fastify';
-import * as http from 'node:http';
-export type MiddlewareFn<Req extends {
-    url: string;
-    originalUrl?: string;
-}, Res extends {
-    finished?: boolean;
-    writableEnded?: boolean;
-}, Ctx = unknown> = (req: Req, res: Res, next: (err?: unknown) => void) => void;
-declare const supportedHooks: readonly ["onError", "onSend", "preParsing", "preSerialization", "onRequest", "onResponse", "onTimeout", "preHandler", "preValidation"];
-type SupportedHook = (typeof supportedHooks)[number];
-interface MiddieOptions {
-    hook?: SupportedHook;
-}
-declare function fastifyMiddie(fastify: FastifyInstance, options: MiddieOptions, next: (err?: Error) => void): void;
-declare namespace fastifyMiddie {
-    export interface FastifyMiddieOptions {
-        hook?: 'onRequest' | 'preParsing' | 'preValidation' | 'preHandler' | 'preSerialization' | 'onSend' | 'onResponse' | 'onTimeout' | 'onError';
-    }
-    type FastifyMiddie = FastifyPluginCallback<fastifyMiddie.FastifyMiddieOptions>;
-    export interface IncomingMessageExtended {
-        body?: any;
-        query?: any;
-    }
-    export type NextFunction = (err?: any) => void;
-    export type SimpleHandleFunction = (req: http.IncomingMessage & IncomingMessageExtended, res: http.ServerResponse) => void;
-    export type NextHandleFunction = (req: http.IncomingMessage & IncomingMessageExtended, res: http.ServerResponse, next: NextFunction) => void;
-    export type Handler = SimpleHandleFunction | NextHandleFunction;
-    export const fastifyMiddie: FastifyMiddie;
-    export { fastifyMiddie as default };
-}
-declare module 'fastify' {
-    interface FastifyInstance {
-        use(fn: fastifyMiddie.Handler): this;
-        use(route: string, fn: fastifyMiddie.Handler): this;
-        use(routes: string[], fn: fastifyMiddie.Handler): this;
-    }
-}
-/**
- * A clone of `@fastify/middie` engine https://github.com/fastify/middie
- * with an extra vulnerability fix. Path is now decoded before matching to
- * avoid bypassing middleware with encoded characters.
- */
-declare const _default: typeof fastifyMiddie;
-export default _default;
-export { fastifyMiddie };

package/adapters/middie/fastify-middie.js

@@ -1,252 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.fastifyMiddie = fastifyMiddie;
-const fastify_plugin_1 = require("fastify-plugin");
-const url_sanitizer_1 = require("find-my-way/lib/url-sanitizer");
-const path_to_regexp_1 = require("path-to-regexp");
-const reusify = require("reusify");
-function bindLast(fn, last) {
-    return (...args) => fn(...args, last);
-}
-/**
- * A clone of `@fastify/middie` engine https://github.com/fastify/middie
- * with an extra vulnerability fix. Path is now decoded before matching to
- * avoid bypassing middleware with encoded characters.
- */
-function middie(complete, initialConfig) {
-    const middlewares = [];
-    const pool = reusify(Holder);
-    return {
-        use,
-        run: bindLast(run, initialConfig),
-    };
-    function use(url, f) {
-        if (f === undefined) {
-            f = url;
-            url = null;
-        }
-        let regexp;
-        if (typeof url === 'string') {
-            const pathRegExp = (0, path_to_regexp_1.pathToRegexp)(sanitizePrefixUrl(url), {
-                end: false,
-            });
-            regexp = pathRegExp.regexp;
-        }
-        if (Array.isArray(f)) {
-            for (const val of f) {
-                middlewares.push({ regexp, fn: val });
-            }
-        }
-        else {
-            middlewares.push({ regexp, fn: f });
-        }
-        return this;
-    }
-    function run(req, res, ctx, initialConfig) {
-        if (!middlewares.length) {
-            complete(null, req, res, ctx);
-            return;
-        }
-        req.originalUrl = req.url;
-        const holder = pool.get();
-        holder.req = req;
-        holder.res = res;
-        holder.url = sanitizeUrl(req.url);
-        holder.context = ctx;
-        holder.initialConfig = initialConfig;
-        holder.done();
-    }
-    function Holder() {
-        this.req = null;
-        this.res = null;
-        this.url = null;
-        this.context = null;
-        this.initialConfig = null;
-        this.i = 0;
-        const that = this;
-        this.done = function (err) {
-            const req = that.req;
-            const res = that.res;
-            const url = that.url;
-            const context = that.context;
-            const i = that.i++;
-            req.url = req.originalUrl;
-            if (res.finished === true || res.writableEnded === true) {
-                cleanup();
-                return;
-            }
-            if (err || middlewares.length === i) {
-                complete(err, req, res, context);
-                cleanup();
-            }
-            else {
-                const { fn, regexp } = middlewares[i];
-                if (regexp) {
-                    // Decode URL before matching to avoid bypassing middleware
-                    let sanitizedUrl = url;
-                    if (that.initialConfig.ignoreDuplicateSlashes ||
-                        that.initialConfig.routerOptions?.ignoreDuplicateSlashes) {
-                        sanitizedUrl = removeDuplicateSlashes(sanitizedUrl);
-                    }
-                    if (that.initialConfig.ignoreTrailingSlash ||
-                        that.initialConfig.routerOptions?.ignoreTrailingSlash) {
-                        sanitizedUrl = trimLastSlash(sanitizedUrl);
-                    }
-                    if (that.initialConfig.caseSensitive === false ||
-                        that.initialConfig.routerOptions?.caseSensitive === false) {
-                        sanitizedUrl = sanitizedUrl.toLowerCase();
-                    }
-                    const decodedUrl = (0, url_sanitizer_1.safeDecodeURI)(sanitizedUrl, that.initialConfig?.routerOptions?.useSemicolonDelimiter ||
-                        that.initialConfig?.useSemicolonDelimiter).path;
-                    const result = regexp.exec(decodedUrl);
-                    if (result) {
-                        req.url = req.url.replace(result[0], '');
-                        if (req.url[0] !== '/')
-                            req.url = '/' + req.url;
-                        fn(req, res, that.done);
-                    }
-                    else {
-                        that.done();
-                    }
-                }
-                else {
-                    fn(req, res, that.done);
-                }
-            }
-        };
-        function cleanup() {
-            that.req = null;
-            that.res = null;
-            that.context = null;
-            that.initialConfig = null;
-            that.i = 0;
-            pool.release(that);
-        }
-    }
-}
-function removeDuplicateSlashes(path) {
-    const REMOVE_DUPLICATE_SLASHES_REGEXP = /\/\/+/g;
-    return path.indexOf('//') !== -1
-        ? path.replace(REMOVE_DUPLICATE_SLASHES_REGEXP, '/')
-        : path;
-}
-function trimLastSlash(path) {
-    if (path.length > 1 && path.charCodeAt(path.length - 1) === 47) {
-        return path.slice(0, -1);
-    }
-    return path;
-}
-function sanitizeUrl(url) {
-    for (let i = 0, len = url.length; i < len; i++) {
-        const charCode = url.charCodeAt(i);
-        if (charCode === 63 || charCode === 35) {
-            return url.slice(0, i);
-        }
-    }
-    return url;
-}
-function sanitizePrefixUrl(url) {
-    if (url === '/')
-        return '';
-    if (url[url.length - 1] === '/')
-        return url.slice(0, -1);
-    return url;
-}
-const kMiddlewares = Symbol('fastify-middie-middlewares');
-const kMiddie = Symbol('fastify-middie-instance');
-const kMiddieHasMiddlewares = Symbol('fastify-middie-has-middlewares');
-const supportedHooksWithPayload = [
-    'onError',
-    'onSend',
-    'preParsing',
-    'preSerialization',
-];
-const supportedHooksWithoutPayload = [
-    'onRequest',
-    'onResponse',
-    'onTimeout',
-    'preHandler',
-    'preValidation',
-];
-const supportedHooks = [
-    ...supportedHooksWithPayload,
-    ...supportedHooksWithoutPayload,
-];
-function fastifyMiddie(fastify, options, next) {
-    fastify.decorate('use', use);
-    fastify[kMiddlewares] = [];
-    fastify[kMiddieHasMiddlewares] = false;
-    fastify[kMiddie] = middie(onMiddieEnd, fastify.initialConfig);
-    const hook = options.hook || 'onRequest';
-    if (!supportedHooks.includes(hook)) {
-        next(new Error(`The hook "${hook}" is not supported by fastify-middie`));
-        return;
-    }
-    fastify
-        .addHook(hook, supportedHooksWithPayload.includes(hook)
-        ? runMiddieWithPayload
-        : runMiddie)
-        .addHook('onRegister', onRegister);
-    function use(path, fn) {
-        if (typeof path === 'string') {
-            const prefix = this.prefix;
-            path = prefix + (path === '/' && prefix.length > 0 ? '' : path);
-        }
-        this[kMiddlewares].push([path, fn]);
-        if (fn == null) {
-            this[kMiddie].use(path);
-        }
-        else {
-            this[kMiddie].use(path, fn);
-        }
-        this[kMiddieHasMiddlewares] = true;
-        return this;
-    }
-    function runMiddie(req, reply, next) {
-        if (this[kMiddieHasMiddlewares]) {
-            const raw = req.raw;
-            raw.id = req.id;
-            raw.hostname = req.hostname;
-            raw.protocol = req.protocol;
-            raw.ip = req.ip;
-            raw.ips = req.ips;
-            raw.log = req.log;
-            req.raw.query = req.query;
-            reply.raw.log = req.log;
-            if (req.body !== undefined)
-                req.raw.body = req.body;
-            this[kMiddie].run(req.raw, reply.raw, next);
-        }
-        else {
-            next();
-        }
-    }
-    function runMiddieWithPayload(req, reply, _payload, next) {
-        runMiddie.bind(this)(req, reply, next);
-    }
-    function onMiddieEnd(err, _req, _res, next) {
-        next(err);
-    }
-    function onRegister(instance) {
-        const middlewares = instance[kMiddlewares].slice();
-        instance[kMiddlewares] = [];
-        instance[kMiddie] = middie(onMiddieEnd, instance.initialConfig);
-        instance[kMiddieHasMiddlewares] = false;
-        instance.decorate('use', use);
-        for (const middleware of middlewares) {
-            instance[kMiddlewares].push(middleware);
-            instance[kMiddie].use(...middleware);
-        }
-        instance[kMiddieHasMiddlewares] = middlewares.length > 0;
-    }
-    next();
-}
-/**
- * A clone of `@fastify/middie` engine https://github.com/fastify/middie
- * with an extra vulnerability fix. Path is now decoded before matching to
- * avoid bypassing middleware with encoded characters.
- */
-exports.default = (0, fastify_plugin_1.default)(fastifyMiddie, {
-    fastify: '5.x',
-    name: '@fastify/middie',
-});