@nestjs/platform-fastify 12.0.1 → 12.0.3

package/adapters/fastify-adapter.d.ts

@@ -125,8 +125,24 @@ export declare class FastifyAdapter<TServer extends RawServerBase = RawServerDef
     private registerMiddie;
     private getRequestOriginalUrl;
     private injectRouteOptions;
+    /**
+     * Fastify still accepts the router options ("ignoreTrailingSlash",
+     * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"
+     * only reflects them when they are passed through "routerOptions". As the
+     * adapter always passes "routerOptions" (for the version constraint), the
+     * top-level values are folded in so that plugins relying on
+     * "initialConfig.routerOptions" (like @fastify/middie) normalize request
+     * paths exactly like the router does.
+     */
+    private getTopLevelRouterOptions;
     private sanitizeUrl;
     private removeDuplicateSlashes;
     private trimLastSlash;
+    /**
+     * Mirrors the absolute-form request target handling of "find-my-way".
+     * Returns the path of an absolute-form target ("http://host/path" -> "/path")
+     * and leaves any other request target untouched.
+     */
+    private getPathFromRequestTarget;
 }
 export {};

package/adapters/fastify-adapter.js

@@ -1,8 +1,9 @@
 import { HttpException, HttpStatus, Logger, StreamableFile, VERSION_NEUTRAL, VersioningType, } from '@nestjs/common';
 import { fastify, } from 'fastify';
-import * as Reply from 'fastify/lib/reply.js';
+import Reply from 'fastify/lib/reply.js';
 import fastifySymbols from 'fastify/lib/symbols.js';
 import { pathToRegexp } from 'path-to-regexp';
+import middie from '@fastify/middie';
 import { loadPackage, isNil, isString, isUndefined, } from '@nestjs/common/internal';
 import { AbstractHttpAdapter } from '@nestjs/core';
 import { LegacyRouteConverter } from '@nestjs/core/internal';
@@ -11,7 +12,6 @@ const { kRouteContext } = fastifySymbols;
 import { parse as querystringParse } from 'fast-querystring';
 import urlSanitizer from 'find-my-way/lib/url-sanitizer.js';
 import { FASTIFY_ROUTE_CONFIG_METADATA, FASTIFY_ROUTE_CONSTRAINTS_METADATA, FASTIFY_ROUTE_SCHEMA_METADATA, } from '../constants.js';
-import middie from './middie/fastify-middie.js';
 const { safeDecodeURI } = urlSanitizer;
 /**
  * @publicApi
@@ -68,7 +68,7 @@ export class FastifyAdapter extends AbstractHttpAdapter {
                 const acceptHeaderValue = (req.headers?.[MEDIA_TYPE_HEADER] || req.headers?.[MEDIA_TYPE_HEADER.toLowerCase()]);
                 const acceptHeaderVersionParameter = acceptHeaderValue
                     ? acceptHeaderValue.split(';')[1]
-                    : '';
+                    : undefined;
                 return isUndefined(acceptHeaderVersionParameter)
                     ? VERSION_NEUTRAL // No version was supplied
                     : acceptHeaderVersionParameter.split(this.versioningOptions.key)[1];
@@ -99,6 +99,7 @@ export class FastifyAdapter extends AbstractHttpAdapter {
             : fastify({
                 ...instanceOrOptions,
                 routerOptions: {
+                    ...this.getTopLevelRouterOptions(instanceOrOptions),
                     ...instanceOrOptions?.routerOptions,
                     constraints: {
                         version: this.versionConstraint,
@@ -540,9 +541,39 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         return this.instance.route(routeToInject);
     }
+    /**
+     * Fastify still accepts the router options ("ignoreTrailingSlash",
+     * "caseSensitive", ...) at the top level, but "initialConfig.routerOptions"
+     * only reflects them when they are passed through "routerOptions". As the
+     * adapter always passes "routerOptions" (for the version constraint), the
+     * top-level values are folded in so that plugins relying on
+     * "initialConfig.routerOptions" (like @fastify/middie) normalize request
+     * paths exactly like the router does.
+     */
+    getTopLevelRouterOptions(options) {
+        const routerOptions = {};
+        const routerOptionKeys = [
+            'ignoreTrailingSlash',
+            'ignoreDuplicateSlashes',
+            'caseSensitive',
+            'useSemicolonDelimiter',
+            'maxParamLength',
+            'allowUnsafeRegex',
+        ];
+        for (const key of routerOptionKeys) {
+            if (options?.[key] !== undefined) {
+                routerOptions[key] = options[key];
+            }
+        }
+        return routerOptions;
+    }
     sanitizeUrl(url) {
         const initialConfig = this.instance.initialConfig;
         const routerOptions = initialConfig.routerOptions;
+        // Absolute-form request targets ("GET http://host/path HTTP/1.1") must be
+        // resolved to their path before any other normalization, as the Fastify
+        // router does, so that middleware and routes always match the same path.
+        url = this.getPathFromRequestTarget(url);
         if (routerOptions.ignoreDuplicateSlashes ||
             initialConfig.ignoreDuplicateSlashes) {
             url = this.removeDuplicateSlashes(url);
@@ -570,4 +601,29 @@ export class FastifyAdapter extends AbstractHttpAdapter {
         }
         return path;
     }
+    /**
+     * Mirrors the absolute-form request target handling of "find-my-way".
+     * Returns the path of an absolute-form target ("http://host/path" -> "/path")
+     * and leaves any other request target untouched.
+     */
+    getPathFromRequestTarget(url) {
+        if (url.charCodeAt(0) === 47 /* '/' */) {
+            return url;
+        }
+        const schemeEnd = url.indexOf('://');
+        if (schemeEnd === -1) {
+            return url;
+        }
+        const scheme = url.slice(0, schemeEnd).toLowerCase();
+        if (scheme !== 'http' && scheme !== 'https') {
+            return url;
+        }
+        const authorityStart = schemeEnd + 3;
+        const pathStart = url.indexOf('/', authorityStart);
+        if (pathStart === authorityStart || !URL.canParse(url)) {
+            // Malformed target: the router rejects it before any middleware runs
+            return url;
+        }
+        return pathStart === -1 ? '/' : url.slice(pathStart);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-fastify",
-  "version": "12.0.1",
+  "version": "12.0.3",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-fastify)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -27,13 +27,12 @@
   "dependencies": {
     "@fastify/cors": "11.3.0",
     "@fastify/formbody": "9.0.0",
+    "@fastify/middie": "9.3.4",
     "fast-querystring": "1.1.2",
-    "fastify": "5.12.1",
-    "fastify-plugin": "6.0.0",
+    "fastify": "5.12.4",
     "find-my-way": "9.9.0",
     "light-my-request": "6.6.0",
     "path-to-regexp": "8.4.2",
-    "reusify": "1.1.0",
     "tslib": "2.8.1"
   },
   "peerDependencies": {
@@ -50,5 +49,5 @@
       "optional": true
     }
   },
-  "gitHead": "4c751c503bc753095f4b4f052e106f95218cc33f"
+  "gitHead": "14151790e1abe870abc3bbf00f88786fc3ebe509"
 }

package/adapters/middie/fastify-middie.d.ts

@@ -1,46 +0,0 @@
-import { FastifyInstance, FastifyPluginCallback } from 'fastify';
-import * as http from 'node:http';
-export type MiddlewareFn<Req extends {
-    url: string;
-    originalUrl?: string;
-}, Res extends {
-    finished?: boolean;
-    writableEnded?: boolean;
-}, Ctx = unknown> = (req: Req, res: Res, next: (err?: unknown) => void) => void;
-declare const supportedHooks: readonly ["onError", "onSend", "preParsing", "preSerialization", "onRequest", "onResponse", "onTimeout", "preHandler", "preValidation"];
-type SupportedHook = (typeof supportedHooks)[number];
-interface MiddieOptions {
-    hook?: SupportedHook;
-}
-declare function fastifyMiddie(fastify: FastifyInstance, options: MiddieOptions, next: (err?: Error) => void): void;
-declare namespace fastifyMiddie {
-    export interface FastifyMiddieOptions {
-        hook?: 'onRequest' | 'preParsing' | 'preValidation' | 'preHandler' | 'preSerialization' | 'onSend' | 'onResponse' | 'onTimeout' | 'onError';
-    }
-    type FastifyMiddie = FastifyPluginCallback<fastifyMiddie.FastifyMiddieOptions>;
-    export interface IncomingMessageExtended {
-        body?: any;
-        query?: any;
-    }
-    export type NextFunction = (err?: any) => void;
-    export type SimpleHandleFunction = (req: http.IncomingMessage & IncomingMessageExtended, res: http.ServerResponse) => void;
-    export type NextHandleFunction = (req: http.IncomingMessage & IncomingMessageExtended, res: http.ServerResponse, next: NextFunction) => void;
-    export type Handler = SimpleHandleFunction | NextHandleFunction;
-    export const fastifyMiddie: FastifyMiddie;
-    export { fastifyMiddie as default };
-}
-declare module 'fastify' {
-    interface FastifyInstance {
-        use(fn: fastifyMiddie.Handler): this;
-        use(route: string, fn: fastifyMiddie.Handler): this;
-        use(routes: string[], fn: fastifyMiddie.Handler): this;
-    }
-}
-/**
- * A clone of `@fastify/middie` engine https://github.com/fastify/middie
- * with an extra vulnerability fix. Path is now decoded before matching to
- * avoid bypassing middleware with encoded characters.
- */
-declare const _default: typeof fastifyMiddie;
-export default _default;
-export { fastifyMiddie };

package/adapters/middie/fastify-middie.js

@@ -1,251 +0,0 @@
-import fp from 'fastify-plugin';
-import urlSanitizer from 'find-my-way/lib/url-sanitizer.js';
-import { pathToRegexp } from 'path-to-regexp';
-import reusify from 'reusify';
-const { safeDecodeURI } = urlSanitizer;
-function bindLast(fn, last) {
-    return (...args) => fn(...args, last);
-}
-/**
- * A clone of `@fastify/middie` engine https://github.com/fastify/middie
- * with an extra vulnerability fix. Path is now decoded before matching to
- * avoid bypassing middleware with encoded characters.
- */
-function middie(complete, initialConfig) {
-    const middlewares = [];
-    const pool = reusify(Holder);
-    return {
-        use,
-        run: bindLast(run, initialConfig),
-    };
-    function use(url, f) {
-        if (f === undefined) {
-            f = url;
-            url = null;
-        }
-        let regexp;
-        if (typeof url === 'string') {
-            const pathRegExp = pathToRegexp(sanitizePrefixUrl(url), {
-                end: false,
-            });
-            regexp = pathRegExp.regexp;
-        }
-        if (Array.isArray(f)) {
-            for (const val of f) {
-                middlewares.push({ regexp, fn: val });
-            }
-        }
-        else {
-            middlewares.push({ regexp, fn: f });
-        }
-        return this;
-    }
-    function run(req, res, ctx, initialConfig) {
-        if (!middlewares.length) {
-            complete(null, req, res, ctx);
-            return;
-        }
-        req.originalUrl = req.url;
-        const holder = pool.get();
-        holder.req = req;
-        holder.res = res;
-        holder.url = sanitizeUrl(req.url);
-        holder.context = ctx;
-        holder.initialConfig = initialConfig;
-        holder.done();
-    }
-    function Holder() {
-        this.req = null;
-        this.res = null;
-        this.url = null;
-        this.context = null;
-        this.initialConfig = null;
-        this.i = 0;
-        const that = this;
-        this.done = function (err) {
-            const req = that.req;
-            const res = that.res;
-            const url = that.url;
-            const context = that.context;
-            const i = that.i++;
-            req.url = req.originalUrl;
-            if (res.finished === true || res.writableEnded === true) {
-                cleanup();
-                return;
-            }
-            if (err || middlewares.length === i) {
-                complete(err, req, res, context);
-                cleanup();
-            }
-            else {
-                const { fn, regexp } = middlewares[i];
-                if (regexp) {
-                    // Decode URL before matching to avoid bypassing middleware
-                    let sanitizedUrl = url;
-                    if (that.initialConfig.ignoreDuplicateSlashes ||
-                        that.initialConfig.routerOptions?.ignoreDuplicateSlashes) {
-                        sanitizedUrl = removeDuplicateSlashes(sanitizedUrl);
-                    }
-                    if (that.initialConfig.ignoreTrailingSlash ||
-                        that.initialConfig.routerOptions?.ignoreTrailingSlash) {
-                        sanitizedUrl = trimLastSlash(sanitizedUrl);
-                    }
-                    if (that.initialConfig.caseSensitive === false ||
-                        that.initialConfig.routerOptions?.caseSensitive === false) {
-                        sanitizedUrl = sanitizedUrl.toLowerCase();
-                    }
-                    const decodedUrl = safeDecodeURI(sanitizedUrl, that.initialConfig?.routerOptions?.useSemicolonDelimiter ||
-                        that.initialConfig?.useSemicolonDelimiter).path;
-                    const result = regexp.exec(decodedUrl);
-                    if (result) {
-                        req.url = req.url.replace(result[0], '');
-                        if (req.url[0] !== '/')
-                            req.url = '/' + req.url;
-                        fn(req, res, that.done);
-                    }
-                    else {
-                        that.done();
-                    }
-                }
-                else {
-                    fn(req, res, that.done);
-                }
-            }
-        };
-        function cleanup() {
-            that.req = null;
-            that.res = null;
-            that.context = null;
-            that.initialConfig = null;
-            that.i = 0;
-            pool.release(that);
-        }
-    }
-}
-function removeDuplicateSlashes(path) {
-    const REMOVE_DUPLICATE_SLASHES_REGEXP = /\/\/+/g;
-    return path.indexOf('//') !== -1
-        ? path.replace(REMOVE_DUPLICATE_SLASHES_REGEXP, '/')
-        : path;
-}
-function trimLastSlash(path) {
-    if (path.length > 1 && path.charCodeAt(path.length - 1) === 47) {
-        return path.slice(0, -1);
-    }
-    return path;
-}
-function sanitizeUrl(url) {
-    for (let i = 0, len = url.length; i < len; i++) {
-        const charCode = url.charCodeAt(i);
-        if (charCode === 63 || charCode === 35) {
-            return url.slice(0, i);
-        }
-    }
-    return url;
-}
-function sanitizePrefixUrl(url) {
-    if (url === '/')
-        return '';
-    if (url[url.length - 1] === '/')
-        return url.slice(0, -1);
-    return url;
-}
-const kMiddlewares = Symbol('fastify-middie-middlewares');
-const kMiddie = Symbol('fastify-middie-instance');
-const kMiddieHasMiddlewares = Symbol('fastify-middie-has-middlewares');
-const supportedHooksWithPayload = [
-    'onError',
-    'onSend',
-    'preParsing',
-    'preSerialization',
-];
-const supportedHooksWithoutPayload = [
-    'onRequest',
-    'onResponse',
-    'onTimeout',
-    'preHandler',
-    'preValidation',
-];
-const supportedHooks = [
-    ...supportedHooksWithPayload,
-    ...supportedHooksWithoutPayload,
-];
-function fastifyMiddie(fastify, options, next) {
-    fastify.decorate('use', use);
-    fastify[kMiddlewares] = [];
-    fastify[kMiddieHasMiddlewares] = false;
-    fastify[kMiddie] = middie(onMiddieEnd, fastify.initialConfig);
-    const hook = options.hook || 'onRequest';
-    if (!supportedHooks.includes(hook)) {
-        next(new Error(`The hook "${hook}" is not supported by fastify-middie`));
-        return;
-    }
-    fastify
-        .addHook(hook, supportedHooksWithPayload.includes(hook)
-        ? runMiddieWithPayload
-        : runMiddie)
-        .addHook('onRegister', onRegister);
-    function use(path, fn) {
-        if (typeof path === 'string') {
-            const prefix = this.prefix;
-            path = prefix + (path === '/' && prefix.length > 0 ? '' : path);
-        }
-        this[kMiddlewares].push([path, fn]);
-        if (fn == null) {
-            this[kMiddie].use(path);
-        }
-        else {
-            this[kMiddie].use(path, fn);
-        }
-        this[kMiddieHasMiddlewares] = true;
-        return this;
-    }
-    function runMiddie(req, reply, next) {
-        if (this[kMiddieHasMiddlewares]) {
-            const raw = req.raw;
-            raw.id = req.id;
-            raw.hostname = req.hostname;
-            raw.protocol = req.protocol;
-            raw.ip = req.ip;
-            raw.ips = req.ips;
-            raw.log = req.log;
-            req.raw.query = req.query;
-            reply.raw.log = req.log;
-            if (req.body !== undefined)
-                req.raw.body = req.body;
-            this[kMiddie].run(req.raw, reply.raw, next);
-        }
-        else {
-            next();
-        }
-    }
-    function runMiddieWithPayload(req, reply, _payload, next) {
-        runMiddie.bind(this)(req, reply, next);
-    }
-    function onMiddieEnd(err, _req, _res, next) {
-        next(err);
-    }
-    function onRegister(instance) {
-        const middlewares = instance[kMiddlewares].slice();
-        instance[kMiddlewares] = [];
-        instance[kMiddie] = middie(onMiddieEnd, instance.initialConfig);
-        instance[kMiddieHasMiddlewares] = false;
-        instance.decorate('use', use);
-        for (const middleware of middlewares) {
-            instance[kMiddlewares].push(middleware);
-            instance[kMiddie].use(...middleware);
-        }
-        instance[kMiddieHasMiddlewares] = middlewares.length > 0;
-    }
-    next();
-}
-/**
- * A clone of `@fastify/middie` engine https://github.com/fastify/middie
- * with an extra vulnerability fix. Path is now decoded before matching to
- * avoid bypassing middleware with encoded characters.
- */
-export default fp(fastifyMiddie, {
-    fastify: '5.x',
-    name: '@fastify/middie',
-});
-export { fastifyMiddie };