@poppinss/multiparty 2.0.1 → 3.0.1

package/README.md

@@ -84,6 +84,9 @@ Creates a new form. Options:
  * `maxFilesSize` - Only relevant when `autoFiles` is `true`.  Limits the
    total bytes accepted for all files combined. If this value is exceeded,
    an `error` event is emitted. The default is `Infinity`.
+ * `maxHeaderSize` - Limits the size of header names and values for each part.
+   If this value is exceeded, an `error` event is emitted. The default size is
+   16KB.
  * `autoFields` - Enables `field` events and disables `part` events for fields.
    This is automatically set to `true` if you add a `field` listener.
  * `autoFiles` - Enables `file` events and disables `part` events for files.
@@ -271,5 +274,5 @@ stream uploads to disk for you.
 
 [npm-version-image]: https://img.shields.io/npm/v/@poppinss/multiparty?style=for-the-badge
 
-[gh-workflow-image]: https://img.shields.io/github/workflow/status/poppinss/multiparty/test?style=for-the-badge
+[gh-workflow-image]: https://img.shields.io/github/actions/workflow/status/poppinss/multiparty/test.yml?style=for-the-badge
 [gh-workflow-url]: https://github.com/poppinss/multiparty/actions/workflows/test.yml "Github action"

package/index.js

@@ -9,13 +9,12 @@
 'use strict'
 
 var createError = require('http-errors')
-var uid = require('uid-safe')
 var stream = require('stream');
 var util = require('util');
 var fs = require('fs');
 var path = require('path');
 var os = require('os');
-var Buffer = require('safe-buffer').Buffer
+var crypto = require('crypto');
 var StringDecoder = require('string_decoder').StringDecoder;
 
 var START = 0;
@@ -40,14 +39,28 @@ var A = 97;
 var Z = 122;
 
 var CONTENT_TYPE_RE = /^multipart\/(?:form-data|related)(?:;|$)/i;
-var CONTENT_TYPE_PARAM_RE = /;\s*([^=]+)=(?:"([^"]+)"|([^;]+))/gi;
+var CONTENT_TYPE_BOUNDARY_RE = /;[ \t]*boundary=(?:"([^"]*)"|([^;]+))/gi;
 var FILE_EXT_RE = /(\.[_\-a-zA-Z0-9]{0,16})[\S\s]*/;
-var FILENAME_PARAM_RE = /\bfilename=(?:"(.*?)"|([!#$%&'*+.0-9A-Z^_`a-z|~-]+))($|; )/i
+var FILENAME_PARAM_RE = /;[ \t]*filename=(?:"((?:[^"]|"(?![ \t]*(?:;|$)))*)"|([^;]+))/i
 var LAST_BOUNDARY_SUFFIX_LEN = 4; // --\r\n
-var NAME_PARAM_RE = /\bname=(?:"([^"]+)"|([!#$%&'*+.0-9A-Z^_`a-z|~-]+))/i
+var NAME_PARAM_RE = /;[ \t]*name=(?:"([^"]*)"|([^;]+))/i
 
 exports.Form = Form;
 
+/**
+ * Generates a URL safe random string of a given size
+ */
+function randomUid(size) {
+  var bits = (size + 1) * 6
+  var buffer = crypto.randomBytes(Math.ceil(bits / 8))
+  return Buffer.from(buffer)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '')
+    .slice(0, size)
+}
+
 util.inherits(Form, stream.Writable);
 function Form(options) {
   var opts = options || {}
@@ -62,6 +75,7 @@ function Form(options) {
   self.maxFields = opts.maxFields || 1000
   self.maxFieldsSize = opts.maxFieldsSize || 2 * 1024 * 1024
   self.maxFilesSize = opts.maxFilesSize || Infinity
+  self.maxHeaderSize = opts.maxHeaderSize || 16 * 1024
   self.uploadDir = opts.uploadDir || os.tmpdir()
   self.encoding = opts.encoding || 'utf8'
 
@@ -127,12 +141,24 @@ Form.prototype.parse = function(req, cb) {
       });
     });
     self.on('field', function(name, value) {
-      var fieldsArray = fields[name] || (fields[name] = []);
-      fieldsArray.push(value);
+      var fieldsArray = Object.prototype.hasOwnProperty.call(fields, name)
+        ? fields[name]
+        : undefined;
+      if (Array.isArray(fieldsArray)) {
+        fieldsArray.push(value);
+      } else {
+        fields[name] = [value]
+      }
     });
     self.on('file', function(name, file) {
-      var filesArray = files[name] || (files[name] = []);
-      filesArray.push(file);
+      var filesArray = Object.prototype.hasOwnProperty.call(files, name)
+        ? files[name]
+        : undefined;
+      if (Array.isArray(filesArray)) {
+        filesArray.push(file);
+      } else {
+        files[name] = [file]
+      }
     });
     self.on('close', function() {
       end(function() {
@@ -172,10 +198,9 @@ Form.prototype.parse = function(req, cb) {
   }
 
   var boundary;
-  CONTENT_TYPE_PARAM_RE.lastIndex = m.index + m[0].length - 1;
-  while ((m = CONTENT_TYPE_PARAM_RE.exec(contentType))) {
-    if (m[1].toLowerCase() !== 'boundary') continue;
-    boundary = m[2] || m[3];
+  CONTENT_TYPE_BOUNDARY_RE.lastIndex = m.index + m[0].length - 1;
+  while ((m = CONTENT_TYPE_BOUNDARY_RE.exec(contentType))) {
+    boundary = m[1] || m[2];
     break;
   }
 
@@ -292,6 +317,7 @@ Form.prototype._write = function(buffer, encoding, cb) {
             return;
           }
           self.onParseHeaderField(buffer.slice(self.headerFieldMark, i));
+          if (self.error) return;
           self.headerFieldMark = null;
           state = HEADER_VALUE_START;
           break;
@@ -312,6 +338,7 @@ Form.prototype._write = function(buffer, encoding, cb) {
       case HEADER_VALUE:
         if (c === CR) {
           self.onParseHeaderValue(buffer.slice(self.headerValueMark, i));
+          if (self.error) return;
           self.headerValueMark = null;
           self.onParseHeaderEnd();
           state = HEADER_VALUE_ALMOST_DONE;
@@ -447,10 +474,20 @@ Form.prototype.onParsePartBegin = function() {
 }
 
 Form.prototype.onParseHeaderField = function(b) {
+  this.partHeadersSize += b.length;
+  if (this.partHeadersSize > this.maxHeaderSize) {
+    this.handleError(createError(413, 'maxHeaderSize ' + this.maxHeaderSize + ' exceeded'));
+    return;
+  }
   this.headerField += this.headerFieldDecoder.write(b);
 }
 
 Form.prototype.onParseHeaderValue = function(b) {
+  this.partHeadersSize += b.length;
+  if (this.partHeadersSize > this.maxHeaderSize) {
+    this.handleError(createError(413, 'maxHeaderSize ' + this.maxHeaderSize + ' exceeded'));
+    return;
+  }
   this.headerValue += this.headerValueDecoder.write(b);
 }
 
@@ -476,7 +513,13 @@ Form.prototype.onParseHeaderEnd = function() {
 
 Form.prototype.onParsePartData = function(b) {
   if (this.partTransferEncoding === 'base64') {
-    this.backpressure = ! this.destStream.write(b.toString('ascii'), 'base64');
+    // Count base64 characters, not whitespace, and retain incomplete groups.
+    var data = this.partRemainder + b.toString('binary').replace(/[\t\n\v\f\r ]/g, '');
+    var length = data.length - (data.length % 4);
+    this.partRemainder = data.slice(length);
+    if (length > 0) {
+      this.backpressure = ! this.destStream.write(data.slice(0, length), this.partTransferEncoding);
+    }
   } else {
     this.backpressure = ! this.destStream.write(b);
   }
@@ -486,8 +529,10 @@ Form.prototype.onParsePartEnd = function() {
   if (this.destStream) {
     flushWriteCbs(this);
     var s = this.destStream;
+    var remainder = this.partRemainder;
+    var encoding = this.partTransferEncoding;
     process.nextTick(function() {
-      s.end();
+      s.end(remainder, encoding);
     });
   }
   clearPartVars(this);
@@ -742,15 +787,16 @@ function handleField(self, fieldStream) {
     self.handleError(err);
   });
   fieldStream.on('readable', function() {
-    var buffer = fieldStream.read();
-    if (!buffer) return;
+    var buffer;
+    while ((buffer = fieldStream.read()) !== null) {
+      self.totalFieldSize += buffer.length;
+      if (self.totalFieldSize > self.maxFieldsSize) {
+        self.handleError(createError(413, 'maxFieldsSize ' + self.maxFieldsSize + ' exceeded'));
+        return;
+      }
 
-    self.totalFieldSize += buffer.length;
-    if (self.totalFieldSize > self.maxFieldsSize) {
-      self.handleError(createError(413, 'maxFieldsSize ' + self.maxFieldsSize + ' exceeded'));
-      return;
+      value += decoder.write(buffer);
     }
-    value += decoder.write(buffer);
   });
 
   fieldStream.on('end', function() {
@@ -783,9 +829,11 @@ function hasListeners (emitter, type) {
 
 function clearPartVars(self) {
   self.partHeaders = {};
+  self.partHeadersSize = 0;
   self.partName = null;
   self.partFilename = null;
   self.partTransferEncoding = 'binary';
+  self.partRemainder = '';
   self.destStream = null;
 
   self.headerFieldDecoder = new StringDecoder(self.encoding);
@@ -819,16 +867,16 @@ function setUpParser(self, boundary) {
 
 function uploadPath(baseDir, filename) {
   var ext = path.extname(filename).replace(FILE_EXT_RE, '$1');
-  var name = uid.sync(18) + ext
+  var name = randomUid(18) + ext
   return path.join(baseDir, name);
 }
 
 function parseFilename(headerValue) {
   var m = FILENAME_PARAM_RE.exec(headerValue)
   if (!m) {
-    m = headerValue.match(/\bfilename\*=utf-8''(.*?)($|; )/i)
+    m = headerValue.match(/;[ \t]*filename\*=utf-8''([^;]*)/i)
     if (m) {
-      m[1] = decodeURI(m[1]);
+      m[1] = tryDecode(m[1]);
     } else {
       return;
     }
@@ -836,7 +884,7 @@ function parseFilename(headerValue) {
 
   var filename = m[1] || m[2] || '';
   filename = filename.replace(/%22|\\"/g, '"');
-  filename = filename.replace(/&#([\d]{4});/g, function(m, code) {
+  filename = filename.replace(/&#([0-9]{1,5});/g, function(m, code) {
     return String.fromCharCode(code);
   });
   return filename.substr(filename.lastIndexOf('\\') + 1);
@@ -845,3 +893,11 @@ function parseFilename(headerValue) {
 function lower(c) {
   return c | 0x20;
 }
+
+function tryDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch (e) {
+    return undefined;
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poppinss/multiparty",
-  "version": "2.0.1",
+  "version": "3.0.1",
   "description": "multipart/form-data parser which supports streaming",
   "main": "index.js",
   "contributors": [
@@ -16,15 +16,13 @@
     "s3"
   ],
   "dependencies": {
-    "http-errors": "^2.0.0",
-    "safe-buffer": "5.2.1",
-    "uid-safe": "2.1.5"
+    "http-errors": "^2.0.0"
   },
   "devDependencies": {
     "eslint": "^8.9.0",
     "eslint-plugin-markdown": "2.2.1",
     "mkdirp": "^1.0.4",
-    "mocha": "^9.2.1",
+    "mocha": "^10.8.2",
     "nyc": "15.1.0",
     "pend": "1.2.0",
     "require-all": "3.0.0",
@@ -32,7 +30,6 @@
     "superagent": "^7.1.1"
   },
   "files": [
-    "HISTORY.md",
     "LICENSE",
     "README.md",
     "index.js"

package/HISTORY.md

@@ -1,255 +0,0 @@
-unreleased
-==========
-
-  * Fix form parsing when no `part` event listener added
-
-4.2.3 / 2022-01-20
-==================
-
-  * Fix handling of unquoted values in `Content-Disposition`
-  * deps: http-errors@~1.8.1
-    - deps: toidentifier@1.0.1
-
-4.2.2 / 2020-07-27
-==================
-
-  * Fix empty files on Node.js 14.x
-  * Fix form emitting aborted error after close
-  * Replace `fd-slicer` module with internal transform stream
-  * deps: http-errors@~1.8.0
-    - Fix error creating objects in some environments
-    - deps: inherits@2.0.4
-    - deps: setprototypeof@1.2.0
-  * deps: safe-buffer@5.2.1
-
-4.2.1 / 2018-08-12
-==================
-
-  * Use `uid-safe` module to for temp file names
-  * deps: fd-slicer@1.1.0
-  * deps: http-errors@~1.7.0
-
-4.2.0 / 2018-07-30
-==================
-
-  * Use `http-errors` for raised errors
-  * Use `random-bytes` module for polyfill
-  * perf: remove parameter reassignment
-
-4.1.4 / 2018-05-11
-==================
-
-  * Fix file extension filtering stopping on certain whitespace characters
-  * Use `safe-buffer` for improved API safety
-  * perf: enable strict mode
-
-4.1.3 / 2017-01-22
-==================
-
-  * Use `os.tmpdir()` instead of `os.tmpDir()`
-  * deps: fd-slicer@1.0.1
-
-4.1.2 / 2015-05-09
-==================
-
-  * Do not emit error on part prior to emitting part
-  * Fix filename with quotes truncating from certain clients
-
-4.1.1 / 2015-01-18
-==================
-
-  * Do not clobber existing temporary files
-
-4.1.0 / 2014-12-04
-==================
-
-  * Add `statusCode` field to HTTP-related errors
-  * deps: fd-slicer@1.0.0
-
-4.0.0 / 2014-10-14
-==================
-
-  * `part` events for fields no longer fire if `autoFields` is on
-  * `part` events for files no longer fire if `autoFiles` is on
-  * `field`, `file`, and `part` events are guaranteed to emit in the
-    correct order - the order that the user places the parts in the
-    request. Each `part` `end` event is guaranteed to emit before the
-    next `part` event is emitted.
-  * Drop Node.js 0.8.x support
-  * Improve random temp file names
-    - Now using 18 bytes of randomness instead of 8.
-  * More robust `maxFilesSize` implementation
-    - Before it was possible for race conditions to cause more than
-    `maxFilesSize` bytes to get written to disk. That is now fixed.
-  * Now `part` objects emit `error` events
-    - This makes streaming work better since the part stream will emit
-      an error when it is no longer streaming.
-  * Remove support for generating the hash digest of a part
-    - If you want this, do it in your own code.
-  * Remove undocumented `ws` property from `file` objects
-  * Require the close boundary
-    - This makes multiparty more RFC-compliant and makes some invalid
-      requests which used to work, now emit an error instead.
-
-3.3.2 / 2014-08-07
-==================
-
-  * Do not invoke callback after close
-  * Share callback ending logic between error and close
-
-3.3.1 / 2014-07-22
-==================
-
-  * Remove problematic test fixtures
-
-3.3.0 / 2014-07-03
-==================
-
-  * Always emit close after all parts ended
-
-3.2.10 / 2014-07-03
-===================
-
-  * Fix callback hang in node.js 0.8 on errors
-  * Remove execute bit from files
-
-3.2.9 / 2014-06-16
-==================
-
-  * Fix attaching error listeners directly after form.parse
-  * Fix to not synchronously invoke callback to form.parse on error
-
-3.2.8 / 2014-06-01
-==================
-
-  * Fix developer accidentally corrupting data
-  * Fix handling epilogue in a separate chunk
-  * Fix initial check errors to use supplied callback
-
-3.2.7 / 2014-05-26
-==================
-
-  * Fix errors hanging responses in callback-style
-
-3.2.6 / 2014-05-13
-==================
-
-  * Fix `maxFields` to error on field after max
-
-3.2.5 / 2014-05-11
-==================
-
-  * Support boundary containing equal sign
-
-3.2.4 / 2014-03-26
-==================
-
-  * Keep `part.byteCount` undefined in chunked encoding
-  * Fix temp files not always cleaned up
-
-3.2.3 / 2014-02-20
-==================
-
-  * Improve parsing boundary attribute from `Content-Type`
-
-3.2.2 / 2014-01-29
-==================
-
-  * Fix error on empty payloads
-
-3.2.1 / 2014-01-27
-==================
-
-  * Fix `maxFilesSize` overcalculation bug
-
-3.2.0 / 2014-01-17
-==================
-
-  * Add `maxFilesSize` for `autoFiles`
-
-3.1.2 / 2014-01-13
-==================
-
-  * Fix incorrectly using `autoFields` value for `autoFiles`
-
-3.1.1 / 2013-12-13
-==================
-
-  * Fix not emitting `close` after all part `end` events
-
-3.1.0 / 2013-11-10
-==================
-
-  * Support UTF-8 filename in `Content-Disposition`
-
-3.0.0 / 2013-10-25
-==================
-
-  * `form.parse` callback API changed in a compatibility-breaking manner
-
-2.2.0 / 2013-10-15
-==================
-
-  * Add callback API to support multiple files with same field name
-  * Fix assertion crash when max field count is exceeded
-  * Fix assertion crash when client aborts an invalid request
-  * Fix assertion crash when `EMFILE` occurrs
-  * Switch from assertions to only `error` events
-  * Unpipe the request when an error occurs to save resources
-  * Update readable-stream to ~1.1.9
-
-2.1.9 / 2013-10-06
-==================
-
-  * relax `Content-Type` detection regex
-
-2.1.8 / 2013-08-26
-==================
-
-  * Replace deprecated `Buffer.write()`
-
-2.1.7 / 2013-05-23
-==================
-
-  * Add repository field to package.json
-
-2.1.6 / 2013-04-30
-==================
-
-  * Expose `hash` as an option to `Form`
-
-2.1.5 / 2013-04-10
-==================
-
-  * Fix possible `close` event before all temp files are done
-
-2.1.4 / 2013-04-09
-==================
-
-  * Fix crash for invalid requests
-
-2.1.3 / 2013-04-09
-==================
-
-  * Add `file.size`
-
-2.1.2 / 2013-04-08
-==================
-
-  * Add proper backpressure support
-
-2.1.1 / 2013-04-05
-==================
-
-  * Add `part.byteCount` and `part.byteOffset`
-  * Fix uploads larger than 2KB
-
-2.1.0 / 2013-04-04
-==================
-
- * Complete rewrite. See README for changes and new API.
-
-2.0.0 / 2013-04-02
-==================
-
-  * Fork and rewrite from `formidable`