@trayio/express 4.91.0 → 4.93.0

package/dist/http/ExpressHttpController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ExpressHttpController.d.ts","sourceRoot":"","sources":["../../src/http/ExpressHttpController.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AASnD,OAAO,EACN,cAAc,EAEd,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAW1D,qBAAa,qBAAqB;IAEhC,SAAS,CAAC,UAAU,EAAE,cAAc;IACpC,SAAS,CAAC,2BAA2B,EAAE,MAAM;IAC7C,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAFzB,UAAU,EAAE,cAAc,EAC1B,2BAA2B,EAAE,MAAe,EAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAGpC,OAAO,CAAC,QAAQ,CA4Ed;IAEF,SAAS,WAAY,MAAM,YAKzB;IAEF,OAAO,CAAC,gBAAgB,CAoBtB;IAGF,OAAO,CAAC,uBAAuB,CAI7B;IAEF,OAAO,CAAC,sBAAsB,CAmC3B;IAEH,OAAO,CAAC,aAAa,CAenB;IAEF,OAAO,CAAC,YAAY,CAkBlB;IAEF,OAAO,CAAC,+BAA+B,CAWpC;CACH"}
+{"version":3,"file":"ExpressHttpController.d.ts","sourceRoot":"","sources":["../../src/http/ExpressHttpController.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AASnD,OAAO,EACN,cAAc,EAEd,MAAM,qCAAqC,CAAC;AAG7C,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAW1D,qBAAa,qBAAqB;IAEhC,SAAS,CAAC,UAAU,EAAE,cAAc;IACpC,SAAS,CAAC,2BAA2B,EAAE,MAAM;IAC7C,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAFzB,UAAU,EAAE,cAAc,EAC1B,2BAA2B,EAAE,MAAe,EAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAGpC,OAAO,CAAC,QAAQ,CAiGd;IAEF,SAAS,WAAY,MAAM,YAKzB;IAEF,OAAO,CAAC,gBAAgB,CAoBtB;IAGF,OAAO,CAAC,uBAAuB,CAI7B;IAEF,OAAO,CAAC,sBAAsB,CAmC3B;IAEH,OAAO,CAAC,aAAa,CAenB;IAEF,OAAO,CAAC,YAAY,CAkBlB;IAEF,OAAO,CAAC,+BAA+B,CAWpC;CACH"}

package/dist/http/ExpressHttpController.js

@@ -78,8 +78,23 @@ class ExpressHttpController {
                 queryString: req.query,
                 body: requestBody,
             }))();
+            const sanitizeHeaderValue = (value) => {
+                let processedValue = value;
+                if (Array.isArray(value)) {
+                    processedValue = value.join(','); // flatten arrays
+                }
+                // Convert to string and sanitize for HTTP header compliance
+                // Remove control characters (0x00-0x1F, 0x7F), line breaks, and other invalid chars
+                return (String(processedValue)
+                    .replace(/\r\n/g, '_') // CRLF line breaks first
+                    .replace(/[\r\n]/g, '_') // remaining CR or LF
+                    // eslint-disable-next-line no-control-regex
+                    .replace(/[\u0000-\u0009\u000B\u000C\u000E-\u001F\u007F]/g, '_') // other control characters (excluding \n and \r)
+                    .replace(/["\\]/g, '_') // quotes and backslashes
+                    .trim()); // remove leading/trailing whitespace
+            };
             const response = Object.entries(httpResponse.headers)
-                .reduce((acc, [key, value]) => acc.setHeader(key, value), res)
+                .reduce((acc, [key, value]) => acc.setHeader(key, sanitizeHeaderValue(value)), res)
                 .status(httpResponse.statusCode);
             httpResponse.body.pipe(response);
         };

package/dist/http/ExpressHttpController.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ExpressHttpController.unit.test.d.ts.map

package/dist/http/ExpressHttpController.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExpressHttpController.unit.test.d.ts","sourceRoot":"","sources":["../../src/http/ExpressHttpController.unit.test.ts"],"names":[],"mappings":""}

package/dist/http/ExpressHttpController.unit.test.js

@@ -0,0 +1,272 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Http_1 = require("@trayio/commons/http/Http");
+const O = __importStar(require("fp-ts/Option"));
+const T = __importStar(require("fp-ts/Task"));
+const stream_1 = require("stream");
+const ExpressHttpController_1 = require("./ExpressHttpController");
+describe('ExpressHttpController', () => {
+    let mockHttpController;
+    let mockEndpoint;
+    let expressHttpController;
+    let mockRouter;
+    beforeEach(() => {
+        mockEndpoint = {
+            path: '/test',
+            method: Http_1.HttpMethod.Get,
+            execute: jest.fn(),
+        };
+        mockHttpController = {
+            getEndpoints: jest.fn().mockReturnValue([mockEndpoint]),
+        };
+        expressHttpController = new ExpressHttpController_1.ExpressHttpController(mockHttpController, '/tmp', O.none);
+        mockRouter = {
+            get: jest.fn(),
+            post: jest.fn(),
+            put: jest.fn(),
+            delete: jest.fn(),
+            patch: jest.fn(),
+        };
+    });
+    describe('addRoutes', () => {
+        it('should add GET route to router', () => {
+            expressHttpController.addRoutes(mockRouter);
+            expect(mockRouter.get).toHaveBeenCalledWith('/test', expect.any(Function));
+        });
+        it('should add POST route to router', () => {
+            mockEndpoint.method = Http_1.HttpMethod.Post;
+            expressHttpController.addRoutes(mockRouter);
+            expect(mockRouter.post).toHaveBeenCalledWith('/test', expect.any(Function));
+        });
+        it('should add PUT route to router', () => {
+            mockEndpoint.method = Http_1.HttpMethod.Put;
+            expressHttpController.addRoutes(mockRouter);
+            expect(mockRouter.put).toHaveBeenCalledWith('/test', expect.any(Function));
+        });
+        it('should add DELETE route to router', () => {
+            mockEndpoint.method = Http_1.HttpMethod.Delete;
+            expressHttpController.addRoutes(mockRouter);
+            expect(mockRouter.delete).toHaveBeenCalledWith('/test', expect.any(Function));
+        });
+        it('should add PATCH route to router', () => {
+            mockEndpoint.method = Http_1.HttpMethod.Patch;
+            expressHttpController.addRoutes(mockRouter);
+            expect(mockRouter.patch).toHaveBeenCalledWith('/test', expect.any(Function));
+        });
+    });
+    describe('header sanitization', () => {
+        let mockReq;
+        let mockRes;
+        let routeHandler;
+        beforeEach(() => {
+            mockReq = {
+                headers: {},
+                params: {},
+                query: {},
+                body: {},
+                path: '/test',
+            };
+            mockRes = {
+                setHeader: jest.fn().mockReturnThis(),
+                status: jest.fn().mockReturnThis(),
+                on: jest.fn(),
+                once: jest.fn(),
+                end: jest.fn(),
+                write: jest.fn(),
+                removeListener: jest.fn(),
+                emit: jest.fn(),
+            };
+            const mockResponse = new stream_1.Readable();
+            mockResponse.push(null);
+            const httpResponse = {
+                statusCode: 200,
+                headers: {},
+                body: mockResponse,
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            expressHttpController.addRoutes(mockRouter);
+            // eslint-disable-next-line prefer-destructuring
+            routeHandler = mockRouter.get.mock.calls[0][1];
+        });
+        it('should sanitize header values with control characters', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': 'value\x00with\x1fcontrol\x7fchars',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_control_chars');
+        });
+        it('should sanitize header values with line breaks', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': 'value\nwith\rline\r\nbreaks',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_line_breaks');
+        });
+        it('should sanitize header values with quotes and backslashes', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': 'value"with\\quotes',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with_quotes');
+        });
+        it('should trim whitespace from header values', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': '  value with spaces  ',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value with spaces');
+        });
+        it('should handle array header values by joining with comma', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': ['value1', 'value2', 'value3'],
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value1,value2,value3');
+        });
+        it('should handle numeric header values', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'content-length': '123',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('content-length', '123');
+        });
+        it('should sanitize complex header values with multiple issues', async () => {
+            const httpResponse = {
+                statusCode: 200,
+                headers: {
+                    'test-header': '  value\x00with\r\n"multiple\\issues"  ',
+                },
+                body: new stream_1.Readable({
+                    read() {
+                        this.push(null);
+                    },
+                }),
+            };
+            mockEndpoint.execute.mockReturnValue(() => T.of(httpResponse));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.setHeader).toHaveBeenCalledWith('test-header', 'value_with__multiple_issues_');
+        });
+    });
+    describe('error handling', () => {
+        let mockReq;
+        let mockRes;
+        let routeHandler;
+        beforeEach(() => {
+            mockReq = {
+                headers: { 'content-type': 'multipart/form-data' },
+                params: {},
+                query: {},
+                body: {},
+                path: '/test',
+            };
+            mockRes = {
+                setHeader: jest.fn().mockReturnThis(),
+                status: jest.fn().mockReturnThis(),
+                json: jest.fn().mockReturnThis(),
+            };
+            expressHttpController = new ExpressHttpController_1.ExpressHttpController(mockHttpController, '/tmp', O.some({
+                warning: jest.fn(),
+            }));
+            expressHttpController.addRoutes(mockRouter);
+            // eslint-disable-next-line prefer-destructuring
+            routeHandler = mockRouter.get.mock.calls[0][1];
+        });
+        it('should handle file too large error', async () => {
+            jest
+                .spyOn(expressHttpController, 'parseRequestBody')
+                .mockRejectedValue(new Error('maxFileSize exceeded'));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.status).toHaveBeenCalledWith(400);
+            expect(mockRes.json).toHaveBeenCalledWith({
+                error: 'File too large. Max size is 100MB.',
+            });
+        });
+        it('should handle general parsing errors', async () => {
+            jest
+                .spyOn(expressHttpController, 'parseRequestBody')
+                .mockRejectedValue(new Error('Invalid format'));
+            await routeHandler(mockReq, mockRes);
+            expect(mockRes.status).toHaveBeenCalledWith(400);
+            expect(mockRes.json).toHaveBeenCalledWith({
+                error: 'Invalid request: Invalid format',
+            });
+        });
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trayio/express",
-  "version": "4.91.0",
+  "version": "4.93.0",
   "description": "Express extensions and implementations",
   "exports": {
     "./*": "./dist/*.js"
@@ -14,7 +14,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@trayio/commons": "4.91.0",
+    "@trayio/commons": "4.93.0",
     "cors": "2.8.5",
     "express": "4.20.0",
     "formidable": "3.5.1"