@nxtedition/nxt-undici 7.4.1 → 7.4.3

package/lib/utils.js

@@ -1,4 +1,3 @@
-import cacheControlParser from 'cache-control-parser'
 import stream from 'node:stream'
 import assert from 'node:assert'
 import { util } from '@nxtedition/undici'
@@ -14,8 +13,295 @@ export function getFastNow() {
   return fastNow
 }
 
-export function parseCacheControl(str) {
-  return str ? cacheControlParser.parse(str) : null
+/**
+ * Vendored from undici's parseCacheControlHeader (lib/util/cache.js) with two
+ * deliberate deviations, both toward the conservative reading of RFC 9111:
+ * - duplicated max-age keeps the SMALLER value (§4.2.1 says a cache is free to
+ *   pick, so pick the one that revalidates sooner), upstream keeps the larger;
+ * - a bare (valueless) max-stale is represented as Infinity per §5.2.1.2
+ *   ("willing to accept a stale response of any age"), upstream drops it.
+ *
+ * Qualified no-cache/private (e.g. `no-cache="set-cookie"`) parse to an array
+ * of the listed field names; the unqualified forms parse to `true`. Callers
+ * that mean "unqualified" must check `=== true`, not truthiness.
+ *
+ * Keeps the historical wrapper contract: '', [], and non-strings return null
+ * (call sites rely on `?? {}`); an array of field lines is accepted directly
+ * (Cache-Control is list-typed, duplicated lines are legal per RFC 9110 §5.2).
+ *
+ * @param {string | string[] | null | undefined} header
+ * @returns {Record<string, boolean | number | string[]> | null}
+ */
+export function parseCacheControl(header) {
+  let directives
+  if (Array.isArray(header)) {
+    directives = []
+    for (const line of header) {
+      if (typeof line !== 'string') {
+        return null
+      }
+      directives.push(...line.split(','))
+    }
+    if (directives.length === 0) {
+      return null
+    }
+  } else if (header && typeof header === 'string') {
+    directives = header.split(',')
+  } else {
+    return null
+  }
+
+  const output = {}
+
+  for (let i = 0; i < directives.length; i++) {
+    const directive = directives[i].toLowerCase()
+    const keyValueDelimiter = directive.indexOf('=')
+
+    let key
+    let value
+    if (keyValueDelimiter !== -1) {
+      key = directive.substring(0, keyValueDelimiter).trim()
+      value = directive.substring(keyValueDelimiter + 1)
+    } else {
+      key = directive.trim()
+    }
+
+    switch (key) {
+      case 'min-fresh':
+      case 'max-stale':
+      case 'max-age':
+      case 's-maxage':
+      case 'stale-while-revalidate':
+      case 'stale-if-error': {
+        if (value === undefined) {
+          if (key === 'max-stale') {
+            // Bare max-stale: any staleness is acceptable (RFC 9111
+            // §5.2.1.2). Number semantics keep call-site math
+            // (`staleAt + max-stale * 1000`) working unchanged.
+            output[key] = Infinity
+          }
+          continue
+        }
+
+        // RFC 9110 §5.6.3: a recipient may remove BWS/OWS around the value, so
+        // tolerate whitespace (`max-age= 60`, `max-age=60 `) rather than
+        // dropping the directive.
+        value = value.trim()
+
+        if (value.length >= 2 && value[0] === '"' && value[value.length - 1] === '"') {
+          value = value.substring(1, value.length - 1)
+        }
+
+        // RFC 9111 delta-seconds are 1*DIGIT: require the whole value to be
+        // digits so malformed inputs (`max-age=60junk`, `-1`, `1.5`) are
+        // dropped rather than parseInt-coerced into freshness math.
+        if (!/^\d+$/.test(value)) {
+          continue
+        }
+        const parsedValue = parseInt(value, 10)
+
+        if (key === 'max-age' && key in output && output[key] <= parsedValue) {
+          // Duplicate max-age: keep the smaller (sooner-stale) value.
+          continue
+        }
+
+        output[key] = parsedValue
+
+        break
+      }
+      case 'private':
+      case 'no-cache': {
+        if (value) {
+          // Qualified form: a quoted, possibly comma-separated list of field
+          // names (`no-cache="set-cookie, warning"`). The split-by-comma above
+          // may have cut the quoted list apart, so scan forward until the part
+          // that carries the closing quote. https://www.rfc-editor.org/rfc/rfc9111.html#name-no-cache-2
+          //
+          // The unqualified form is strictly more restrictive (forbids
+          // storing / demands validation for the WHOLE response), so when
+          // both forms appear (`private, private="x"` — invalid but seen in
+          // the wild), the qualified form must never clobber the `true`.
+          value = value.trim()
+          if (value[0] === '"') {
+            const headerNames = [value.substring(1)]
+
+            // length > 1: a lone `"` is an opening quote, not a closed list.
+            let foundEndingQuote = value.length > 1 && value[value.length - 1] === '"'
+            if (!foundEndingQuote) {
+              for (let j = i + 1; j < directives.length; j++) {
+                // Trim before the closing-quote check: optional whitespace
+                // between the quote and the next comma (`no-cache="a, b" ,x`)
+                // must not defeat the scan.
+                const nextPart = directives[j].trim()
+                headerNames.push(nextPart)
+                if (nextPart.length !== 0 && nextPart[nextPart.length - 1] === '"') {
+                  foundEndingQuote = true
+                  // Consume the scanned parts so a quoted fragment (e.g. a
+                  // literal `max-age=1` inside the field list) is not
+                  // re-parsed as a real directive.
+                  i = j
+                  break
+                }
+              }
+            }
+
+            if (foundEndingQuote) {
+              const lastHeader = headerNames[headerNames.length - 1]
+              if (lastHeader[lastHeader.length - 1] === '"') {
+                headerNames[headerNames.length - 1] = lastHeader.substring(0, lastHeader.length - 1)
+              }
+              if (output[key] !== true) {
+                const fields = headerNames.map((name) => name.trim().toLowerCase())
+                output[key] = Array.isArray(output[key]) ? output[key].concat(fields) : fields
+              }
+            } else {
+              // Unterminated quoted list (invalid header). Fail restrictive:
+              // treat as the unqualified form, and consume the remaining
+              // parts — they are fragments of the broken quoted string, not
+              // real directives.
+              output[key] = true
+              i = directives.length
+            }
+          } else {
+            // Unquoted value (e.g. `private=set-cookie`): the qualified form
+            // MUST be a quoted field-list (RFC 9111 §5.2.2.7). A bare token is
+            // malformed — fail restrictive and treat it as the unqualified
+            // directive (forbid storing / demand revalidation for the whole
+            // response) rather than a more permissive field list.
+            output[key] = true
+          }
+
+          break
+        }
+      }
+      // eslint-disable-next-line no-fallthrough
+      case 'public':
+      case 'no-store':
+      case 'must-revalidate':
+      case 'proxy-revalidate':
+      case 'immutable':
+      case 'no-transform':
+      case 'must-understand':
+      case 'only-if-cached':
+        // These directives take no value. An explicit `=` (even empty, e.g.
+        // `public=`) is an invalid qualified form and is ignored — not
+        // treated as the bare directive. `value === undefined` is the genuine
+        // valueless form (including the private/no-cache fallthrough above).
+        if (value !== undefined) {
+          continue
+        }
+
+        output[key] = true
+        break
+      default:
+        // Unknown directives are ignored per RFC 9111 §5.2.3.
+        continue
+    }
+  }
+
+  return output
+}
+
+const HTTP_DATE_MONTHS = {
+  Jan: 0,
+  Feb: 1,
+  Mar: 2,
+  Apr: 3,
+  May: 4,
+  Jun: 5,
+  Jul: 6,
+  Aug: 7,
+  Sep: 8,
+  Oct: 9,
+  Nov: 10,
+  Dec: 11,
+}
+
+const HTTP_DATE_DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat']
+const HTTP_DATE_FULL_DAYS = [
+  'Sunday',
+  'Monday',
+  'Tuesday',
+  'Wednesday',
+  'Thursday',
+  'Friday',
+  'Saturday',
+]
+
+// IMF-fixdate:  Sun, 06 Nov 1994 08:49:37 GMT
+const IMF_DATE_RE =
+  /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/
+// obsolete RFC 850: Sunday, 06-Nov-94 08:49:37 GMT
+const RFC850_DATE_RE =
+  /^(Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/
+// ANSI C asctime(): Sun Nov  6 08:49:37 1994 (day space-padded)
+const ASCTIME_DATE_RE =
+  /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ([ \d]\d) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/
+
+/**
+ * Strict HTTP-date parser per RFC 9110 §5.6.7 (the three accepted formats
+ * only). Deliberately NOT `new Date(str)`: V8 accepts many non-HTTP formats,
+ * and RFC 9111 §5.3 requires an invalid Expires (notably `Expires: 0`) to be
+ * treated as already expired rather than silently ignored — which needs the
+ * parse failure to be observable.
+ *
+ * @param {string} date
+ * @returns {Date | undefined} undefined when not a valid HTTP-date
+ */
+export function parseHttpDate(date) {
+  if (typeof date !== 'string') {
+    return undefined
+  }
+
+  let weekday
+  let day
+  let month
+  let year
+  let hour
+  let minute
+  let second
+
+  let m = IMF_DATE_RE.exec(date)
+  if (m) {
+    weekday = HTTP_DATE_DAYS.indexOf(m[1])
+    day = Number(m[2])
+    month = HTTP_DATE_MONTHS[m[3]]
+    year = Number(m[4])
+    hour = Number(m[5])
+    minute = Number(m[6])
+    second = Number(m[7])
+  } else if ((m = RFC850_DATE_RE.exec(date))) {
+    weekday = HTTP_DATE_FULL_DAYS.indexOf(m[1])
+    day = Number(m[2])
+    month = HTTP_DATE_MONTHS[m[3]]
+    // RFC 6265 §5.1.1 two-digit year windowing: 70-99 → 19xx, 00-69 → 20xx.
+    year = Number(m[4])
+    year += year < 70 ? 2000 : 1900
+    hour = Number(m[5])
+    minute = Number(m[6])
+    second = Number(m[7])
+  } else if ((m = ASCTIME_DATE_RE.exec(date))) {
+    weekday = HTTP_DATE_DAYS.indexOf(m[1])
+    month = HTTP_DATE_MONTHS[m[2]]
+    day = Number(m[3].trim())
+    hour = Number(m[4])
+    minute = Number(m[5])
+    second = Number(m[6])
+    year = Number(m[7])
+  } else {
+    return undefined
+  }
+
+  if (day < 1 || day > 31 || hour > 23 || minute > 59 || second > 59) {
+    return undefined
+  }
+
+  const result = new Date(Date.UTC(year, month, day, hour, minute, second))
+  // Date.UTC normalizes out-of-range components (Feb 30 → Mar 2) and the named
+  // weekday must match the actual date — both are rejected by the same check
+  // upstream uses (getUTCDay comparison catches normalization only by luck;
+  // check the day-of-month explicitly as well).
+  return result.getUTCDate() === day && result.getUTCDay() === weekday ? result : undefined
 }
 
 export function isDisturbed(body) {
@@ -133,26 +419,43 @@ export function parseURL(url) {
 
   if (!(url instanceof URL)) {
     const port = url.port != null ? url.port : url.protocol === 'https:' ? 443 : 80
-    let origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`
-    let path = url.path != null ? url.path : `${url.pathname || ''}${url.search || ''}`
-
-    if (origin.endsWith('/')) {
-      origin = origin.substring(0, origin.length - 1)
-    }
+    const origin = url.origin != null ? url.origin : `${url.protocol}//${url.hostname}:${port}`
+    const path = url.path != null ? url.path : `${url.pathname || ''}${url.search || ''}`
 
-    if (path && !path.startsWith('/')) {
-      path = `/${path}`
-    }
-    // new URL(path, origin) is unsafe when `path` contains an absolute URL
-    // From https://developer.mozilla.org/en-US/docs/Web/API/URL/URL:
-    // If first parameter is a relative URL, second param is required, and will be used as the base URL.
-    // If first parameter is an absolute URL, a given second param will be ignored.
-    url = new URL(origin + path)
+    url = buildURL(origin, path)
   }
 
   return url
 }
 
+// Build an absolute URL from an origin and a path by concatenation.
+//
+// `new URL(path, origin)` is unsafe when `path` is itself absolute or
+// protocol-relative (e.g. starts with `//host`): per the WHATWG URL spec, a
+// protocol-relative first argument inherits only the scheme from the base and
+// resolves its authority from `path`, so the origin's host is silently
+// discarded. Concatenating `origin + path` and parsing the whole thing as a
+// single absolute URL keeps the origin authoritative — which matters for
+// redirect resolution, where a leaked host is an SSRF/misrouting vector.
+//
+// From https://developer.mozilla.org/en-US/docs/Web/API/URL/URL:
+// If first parameter is a relative URL, second param is required, and will be used as the base URL.
+// If first parameter is an absolute URL, a given second param will be ignored.
+export function buildURL(origin, path) {
+  origin = String(origin)
+  path = path == null ? '' : String(path)
+
+  if (origin.endsWith('/')) {
+    origin = origin.substring(0, origin.length - 1)
+  }
+
+  if (path && !path.startsWith('/')) {
+    path = `/${path}`
+  }
+
+  return new URL(origin + path)
+}
+
 export function parseOrigin(url) {
   url = parseURL(url)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nxtedition/nxt-undici",
-  "version": "7.4.1",
+  "version": "7.4.3",
   "license": "MIT",
   "author": "Robert Nagy <robert.nagy@boffins.se>",
   "main": "lib/index.js",
@@ -11,7 +11,6 @@
   "dependencies": {
     "@nxtedition/scheduler": "^4.1.1",
     "@nxtedition/undici": "^11.1.4",
-    "cache-control-parser": "^2.2.0",
     "fast-querystring": "^1.1.2",
     "http-errors": "^2.0.1",
     "xxhash-wasm": "^1.1.0"