@nxtedition/nxt-undici 7.4.0 → 7.4.2

package/lib/request.js

@@ -201,7 +201,11 @@ export function request(dispatch, urlOrOpts, optsOrNully) {
 
   let path = url.path
   if (!path) {
-    path = url.search ? `${url.pathname}${url.search}` : url.pathname
+    // URLObject marks every field optional; default the path so e.g.
+    // request({ origin }) works instead of undici rejecting with
+    // "path must be a string".
+    const pathname = url.pathname || '/'
+    path = url.search ? `${pathname}${url.search}` : pathname
   }
 
   opts = {

package/lib/sqlite-cache-store.js

@@ -4,16 +4,41 @@ import { parseRangeHeader, getFastNow } from './utils.js'
 // Bump version when the URL key format or schema changes to invalidate old caches.
 const VERSION = 10
 
-/** @typedef {{ gc: () => void, clear: () => void } } */
+// Registry of live stores so process-level broadcasts (nxt:offPeak,
+// nxt:clearCache) can reach them. Stores are held via WeakRef so that a store
+// dropped without close() is not pinned forever (together with its open
+// DatabaseSync handle and page cache) — GC can still collect it. close()
+// remains the recommended, deterministic cleanup path.
+/** @type {Set<WeakRef<SqliteCacheStore>>} */
 const stores = new Set()
 
+// Removes a collected store's WeakRef entry once the store has been GC'd.
+// The callback runs after the store is already gone, so it must not (and
+// cannot) touch the store or its DatabaseSync — the native handle has its own
+// lifecycle and is released by GC/process exit. This only drops bookkeeping.
+const registry = new FinalizationRegistry((ref) => {
+  stores.delete(ref)
+})
+
+/**
+ * @param {(store: SqliteCacheStore) => void} fn
+ */
+function forEachStore(fn) {
+  for (const ref of stores) {
+    const store = ref.deref()
+    if (store === undefined) {
+      stores.delete(ref)
+    } else {
+      fn(store)
+    }
+  }
+}
+
 {
   const offPeakBC = new BroadcastChannel('nxt:offPeak')
   offPeakBC.unref()
   offPeakBC.onmessage = () => {
-    for (const store of stores) {
-      store.gc()
-    }
+    forEachStore((store) => store.gc())
   }
 }
 
@@ -21,9 +46,7 @@ const stores = new Set()
   const clearCacheBC = new BroadcastChannel('nxt:clearCache')
   clearCacheBC.unref()
   clearCacheBC.onmessage = () => {
-    for (const store of stores) {
-      store.clear()
-    }
+    forEachStore((store) => store.clear())
   }
 }
 
@@ -81,6 +104,11 @@ export class SqliteCacheStore {
   #insertSeq = 0
   #closed = false
 
+  /**
+   * @type {WeakRef<SqliteCacheStore>}
+   */
+  #ref
+
   /**
    * @param {import('undici-types/cache-interceptor.d.ts').default.SqliteCacheStoreOpts & { maxSize?: number } | undefined} opts
    */
@@ -122,6 +150,50 @@ export class SqliteCacheStore {
       CREATE INDEX IF NOT EXISTS idx_cacheInterceptorV${VERSION}_deleteExpiredValuesQuery ON cacheInterceptorV${VERSION}(deleteAt);
     `)
 
+    // Drop tables left behind by previous schema versions. gc(), clear() and
+    // the SQLITE_FULL eviction only ever touch the current version's table, so
+    // after a VERSION bump the old table's pages would otherwise stay allocated
+    // to its b-tree forever while max_page_count caps the whole file — new
+    // inserts hit SQLITE_FULL almost immediately and eviction frees nothing.
+    // Dropping returns the pages to SQLite's freelist, which subsequent inserts
+    // reuse, so no VACUUM is needed. SQLite drops the table's indexes and its
+    // sqlite_sequence row along with it.
+    try {
+      // LIKE is only a coarse pre-filter; the regexp restricts matches to
+      // digit-only version suffixes so user tables sharing the prefix (e.g.
+      // "cacheInterceptorVBackup") in a shared database file are never dropped.
+      const staleTables = this.#db
+        .prepare(
+          `SELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE 'cacheInterceptorV%'`,
+        )
+        .all()
+        .filter(
+          ({ name }) =>
+            /^cacheInterceptorV\d+$/.test(name) && name !== `cacheInterceptorV${VERSION}`,
+        )
+      if (staleTables.length > 0) {
+        this.#db.exec('BEGIN')
+        try {
+          for (const { name } of staleTables) {
+            // name comes from sqlite_master; quote it defensively anyway.
+            this.#db.exec(`DROP TABLE IF EXISTS "${String(name).replaceAll('"', '""')}"`)
+          }
+          this.#db.exec('COMMIT')
+        } catch (err) {
+          try {
+            this.#db.exec('ROLLBACK')
+          } catch {
+            // already rolled back automatically
+          }
+          throw err
+        }
+      }
+    } catch (err) {
+      // A failed cleanup must not brick construction — the current version's
+      // table still works, the stale one just keeps occupying pages.
+      process.emitWarning(err)
+    }
+
     this.#getValuesQuery = this.#db.prepare(`
       SELECT
         id,
@@ -174,7 +246,11 @@ export class SqliteCacheStore {
       `DELETE FROM cacheInterceptorV${VERSION} WHERE id IN (SELECT id FROM cacheInterceptorV${VERSION} ORDER BY deleteAt ASC LIMIT ?)`,
     )
 
-    stores.add(this)
+    this.#ref = new WeakRef(this)
+    stores.add(this.#ref)
+    // The store itself doubles as the unregister token so close() can drop
+    // the registry entry deterministically.
+    registry.register(this, this.#ref, this)
   }
 
   gc() {
@@ -222,7 +298,8 @@ export class SqliteCacheStore {
   }
 
   close() {
-    stores.delete(this)
+    stores.delete(this.#ref)
+    registry.unregister(this)
     // Drain the entire batch synchronously before closing. A plain #flush()
     // only commits one time-budget slice and reschedules the rest via
     // setImmediate; that deferred flush would see #closed and discard the

package/lib/utils.js

@@ -15,7 +15,13 @@ export function getFastNow() {
 }
 
 export function parseCacheControl(str) {
-  return str ? cacheControlParser.parse(str) : null
+  if (Array.isArray(str)) {
+    // Cache-Control is a list-typed field, so duplicated field lines are legal
+    // (e.g. CDN + origin each adding one) and combine into a single
+    // comma-separated value per RFC 9110 §5.2.
+    str = str.join(', ')
+  }
+  return str && typeof str === 'string' ? cacheControlParser.parse(str) : null
 }
 
 export function isDisturbed(body) {
@@ -133,26 +139,43 @@ export function parseURL(url) {
 
   if (!(url instanceof URL)) {
     const port = url.port != null ? url.port : url.protocol === 'https:' ? 443 : 80
-    let origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`
-    let path = url.path != null ? url.path : `${url.pathname || ''}${url.search || ''}`
-
-    if (origin.endsWith('/')) {
-      origin = origin.substring(0, origin.length - 1)
-    }
+    const origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`
+    const path = url.path != null ? url.path : `${url.pathname || ''}${url.search || ''}`
 
-    if (path && !path.startsWith('/')) {
-      path = `/${path}`
-    }
-    // new URL(path, origin) is unsafe when `path` contains an absolute URL
-    // From https://developer.mozilla.org/en-US/docs/Web/API/URL/URL:
-    // If first parameter is a relative URL, second param is required, and will be used as the base URL.
-    // If first parameter is an absolute URL, a given second param will be ignored.
-    url = new URL(origin + path)
+    url = buildURL(origin, path)
   }
 
   return url
 }
 
+// Build an absolute URL from an origin and a path by concatenation.
+//
+// `new URL(path, origin)` is unsafe when `path` is itself absolute or
+// protocol-relative (e.g. starts with `//host`): per the WHATWG URL spec, a
+// protocol-relative first argument inherits only the scheme from the base and
+// resolves its authority from `path`, so the origin's host is silently
+// discarded. Concatenating `origin + path` and parsing the whole thing as a
+// single absolute URL keeps the origin authoritative — which matters for
+// redirect resolution, where a leaked host is an SSRF/misrouting vector.
+//
+// From https://developer.mozilla.org/en-US/docs/Web/API/URL/URL:
+// If first parameter is a relative URL, second param is required, and will be used as the base URL.
+// If first parameter is an absolute URL, a given second param will be ignored.
+export function buildURL(origin, path) {
+  origin = String(origin)
+  path = path == null ? '' : String(path)
+
+  if (origin.endsWith('/')) {
+    origin = origin.substring(0, origin.length - 1)
+  }
+
+  if (path && !path.startsWith('/')) {
+    path = `/${path}`
+  }
+
+  return new URL(origin + path)
+}
+
 export function parseOrigin(url) {
   url = parseURL(url)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nxtedition/nxt-undici",
-  "version": "7.4.0",
+  "version": "7.4.2",
   "license": "MIT",
   "author": "Robert Nagy <robert.nagy@boffins.se>",
   "main": "lib/index.js",