@yanglaofish/fishtools 0.5.2 → 0.5.3

package/node_modules/undici/lib/web/fetch/formdata-parser.js

@@ -1,15 +1,19 @@
 'use strict'
 
-const { bufferToLowerCasedHeaderName } = require('../../core/util')
-const { HTTP_TOKEN_CODEPOINTS } = require('./data-url')
+const { isUSVString, bufferToLowerCasedHeaderName } = require('../../core/util')
+const { utf8DecodeBytes } = require('./util')
+const { HTTP_TOKEN_CODEPOINTS, isomorphicDecode } = require('./data-url')
+const { isFileLike } = require('./file')
 const { makeEntry } = require('./formdata')
-const { webidl } = require('../webidl')
 const assert = require('node:assert')
-const { isomorphicDecode } = require('../infra')
+const { File: NodeFile } = require('node:buffer')
 
+const File = globalThis.File ?? NodeFile
+
+const formDataNameBuffer = Buffer.from('form-data; name="')
+const filenameBuffer = Buffer.from('; filename')
 const dd = Buffer.from('--')
-const decoder = new TextDecoder()
-const decoderIgnoreBOM = new TextDecoder('utf-8', { ignoreBOM: true })
+const ddcrlf = Buffer.from('--\r\n')
 
 /**
  * @param {string} chars
@@ -71,7 +75,7 @@ function multipartFormDataParser (input, mimeType) {
   //    Otherwise, let boundary be the result of UTF-8 decoding mimeType’s
   //    parameters["boundary"].
   if (boundaryString === undefined) {
-    throw parsingError('missing boundary in content-type header')
+    return 'failure'
   }
 
   const boundary = Buffer.from(`--${boundaryString}`, 'utf8')
@@ -83,16 +87,20 @@ function multipartFormDataParser (input, mimeType) {
   //    the first byte.
   const position = { position: 0 }
 
-  // Note: Per RFC 2046 Section 5.1.1, we must ignore anything before the
-  // first boundary delimiter line (preamble). Search for the first boundary.
-  const firstBoundaryIndex = input.indexOf(boundary)
+  // Note: undici addition, allows leading and trailing CRLFs.
+  while (input[position.position] === 0x0d && input[position.position + 1] === 0x0a) {
+    position.position += 2
+  }
+
+  let trailing = input.length
 
-  if (firstBoundaryIndex === -1) {
-    throw parsingError('no boundary found in multipart body')
+  while (input[trailing - 1] === 0x0a && input[trailing - 2] === 0x0d) {
+    trailing -= 2
   }
 
-  // Start parsing from the first boundary, ignoring any preamble
-  position.position = firstBoundaryIndex
+  if (trailing !== input.length) {
+    input = input.subarray(0, trailing)
+  }
 
   // 5. While true:
   while (true) {
@@ -103,23 +111,23 @@ function multipartFormDataParser (input, mimeType) {
     if (input.subarray(position.position, position.position + boundary.length).equals(boundary)) {
       position.position += boundary.length
     } else {
-      throw parsingError('expected a value starting with -- and the boundary')
+      return 'failure'
     }
 
     // 5.2. If position points to the sequence of bytes 0x2D 0x2D 0x0D 0x0A
     //      (`--` followed by CR LF) followed by the end of input, return entry list.
-    // Note: Per RFC 2046 Section 5.1.1, we must ignore anything after the
-    // final boundary delimiter (epilogue). Check for -- or --CRLF and return
-    // regardless of what follows.
-    if (bufferStartsWith(input, dd, position)) {
-      // Found closing boundary delimiter (--), ignore any epilogue
+    // Note: a body does NOT need to end with CRLF. It can end with --.
+    if (
+      (position.position === input.length - 2 && bufferStartsWith(input, dd, position)) ||
+      (position.position === input.length - 4 && bufferStartsWith(input, ddcrlf, position))
+    ) {
       return entryList
     }
 
     // 5.3. If position does not point to a sequence of bytes starting with 0x0D
     //      0x0A (CR LF), return failure.
     if (input[position.position] !== 0x0d || input[position.position + 1] !== 0x0a) {
-      throw parsingError('expected CRLF')
+      return 'failure'
     }
 
     // 5.4. Advance position by 2. (This skips past the newline.)
@@ -130,6 +138,10 @@ function multipartFormDataParser (input, mimeType) {
     //      is not failure. Otherwise, return failure.
     const result = parseMultipartFormDataHeaders(input, position)
 
+    if (result === 'failure') {
+      return 'failure'
+    }
+
     let { name, filename, contentType, encoding } = result
 
     // 5.6. Advance position by 2. (This skips past the empty line that marks
@@ -145,7 +157,7 @@ function multipartFormDataParser (input, mimeType) {
       const boundaryIndex = input.indexOf(boundary.subarray(2), position.position)
 
       if (boundaryIndex === -1) {
-        throw parsingError('expected boundary after body')
+        return 'failure'
       }
 
       body = input.subarray(position.position, boundaryIndex - 4)
@@ -162,7 +174,7 @@ function multipartFormDataParser (input, mimeType) {
     // 5.9. If position does not point to a sequence of bytes starting with
     //      0x0D 0x0A (CR LF), return failure. Otherwise, advance position by 2.
     if (input[position.position] !== 0x0d || input[position.position + 1] !== 0x0a) {
-      throw parsingError('expected CRLF')
+      return 'failure'
     } else {
       position.position += 2
     }
@@ -188,125 +200,18 @@ function multipartFormDataParser (input, mimeType) {
       // 5.11. Otherwise:
 
       // 5.11.1. Let value be the UTF-8 decoding without BOM of body.
-      value = decoderIgnoreBOM.decode(Buffer.from(body))
+      value = utf8DecodeBytes(Buffer.from(body))
     }
 
     // 5.12. Assert: name is a scalar value string and value is either a scalar value string or a File object.
-    assert(webidl.is.USVString(name))
-    assert((typeof value === 'string' && webidl.is.USVString(value)) || webidl.is.File(value))
+    assert(isUSVString(name))
+    assert((typeof value === 'string' && isUSVString(value)) || isFileLike(value))
 
     // 5.13. Create an entry with name and value, and append it to entry list.
     entryList.push(makeEntry(name, value, filename))
   }
 }
 
-/**
- * Parses content-disposition attributes (e.g., name="value" or filename*=utf-8''encoded)
- * @param {Buffer} input
- * @param {{ position: number }} position
- * @returns {{ name: string, value: string, extended: boolean } | null}
- */
-function parseContentDispositionAttribute (input, position) {
-  // Skip leading semicolon and whitespace
-  if (input[position.position] === 0x3b /* ; */) {
-    position.position++
-  }
-
-  // Skip whitespace
-  collectASequenceOfBytes(
-    (char) => char === 0x20 || char === 0x09,
-    input,
-    position
-  )
-
-  // Collect attribute name (token characters)
-  const attributeName = collectASequenceOfBytes(
-    (char) => isToken(char) && char !== 0x3d && char !== 0x2a, // not = or *
-    input,
-    position
-  )
-
-  if (attributeName.length === 0) {
-    return null
-  }
-
-  const attrNameStr = attributeName.toString('ascii').toLowerCase()
-
-  // Check for extended notation (attribute*)
-  const isExtended = input[position.position] === 0x2a /* * */
-  if (isExtended) {
-    position.position++ // skip *
-  }
-
-  // Expect = sign
-  if (input[position.position] !== 0x3d /* = */) {
-    return null
-  }
-  position.position++ // skip =
-
-  // Skip whitespace
-  collectASequenceOfBytes(
-    (char) => char === 0x20 || char === 0x09,
-    input,
-    position
-  )
-
-  let value
-
-  if (isExtended) {
-    // Extended attribute format: charset'language'encoded-value
-    const headerValue = collectASequenceOfBytes(
-      (char) => char !== 0x20 && char !== 0x0d && char !== 0x0a && char !== 0x3b, // not space, CRLF, or ;
-      input,
-      position
-    )
-
-    // Check for utf-8'' prefix (case insensitive)
-    if (
-      (headerValue[0] !== 0x75 && headerValue[0] !== 0x55) || // u or U
-      (headerValue[1] !== 0x74 && headerValue[1] !== 0x54) || // t or T
-      (headerValue[2] !== 0x66 && headerValue[2] !== 0x46) || // f or F
-      headerValue[3] !== 0x2d || // -
-      headerValue[4] !== 0x38 // 8
-    ) {
-      throw parsingError('unknown encoding, expected utf-8\'\'')
-    }
-
-    // Skip utf-8'' and decode the rest
-    value = decodeURIComponent(decoder.decode(headerValue.subarray(7)))
-  } else if (input[position.position] === 0x22 /* " */) {
-    // Quoted string
-    position.position++ // skip opening quote
-
-    const quotedValue = collectASequenceOfBytes(
-      (char) => char !== 0x0a && char !== 0x0d && char !== 0x22, // not LF, CR, or "
-      input,
-      position
-    )
-
-    if (input[position.position] !== 0x22) {
-      throw parsingError('Closing quote not found')
-    }
-    position.position++ // skip closing quote
-
-    value = decoder.decode(quotedValue)
-      .replace(/%0A/ig, '\n')
-      .replace(/%0D/ig, '\r')
-      .replace(/%22/g, '"')
-  } else {
-    // Token value (no quotes)
-    const tokenValue = collectASequenceOfBytes(
-      (char) => isToken(char) && char !== 0x3b, // not ;
-      input,
-      position
-    )
-
-    value = decoder.decode(tokenValue)
-  }
-
-  return { name: attrNameStr, value, extended: isExtended }
-}
-
 /**
  * @see https://andreubotella.github.io/multipart-form-data/#parse-multipart-form-data-headers
  * @param {Buffer} input
@@ -325,7 +230,7 @@ function parseMultipartFormDataHeaders (input, position) {
     if (input[position.position] === 0x0d && input[position.position + 1] === 0x0a) {
       // 2.1.1. If name is null, return failure.
       if (name === null) {
-        throw parsingError('header name is null')
+        return 'failure'
       }
 
       // 2.1.2. Return name, filename and contentType.
@@ -345,12 +250,12 @@ function parseMultipartFormDataHeaders (input, position) {
 
     // 2.4. If header name does not match the field-name token production, return failure.
     if (!HTTP_TOKEN_CODEPOINTS.test(headerName.toString())) {
-      throw parsingError('header name does not match the field-name token production')
+      return 'failure'
     }
 
     // 2.5. If the byte at position is not 0x3A (:), return failure.
     if (input[position.position] !== 0x3a) {
-      throw parsingError('expected :')
+      return 'failure'
     }
 
     // 2.6. Advance position by 1.
@@ -367,51 +272,53 @@ function parseMultipartFormDataHeaders (input, position) {
     // 2.8. Byte-lowercase header name and switch on the result:
     switch (bufferToLowerCasedHeaderName(headerName)) {
       case 'content-disposition': {
+        // 1. Set name and filename to null.
         name = filename = null
-        // Track whether filename was set from the extended (RFC 5987) form so
-        // a subsequent legacy `filename` attribute does not override it.
-        let filenameIsExtended = false
 
-        // Collect the disposition type (should be "form-data")
-        const dispositionType = collectASequenceOfBytes(
-          (char) => isToken(char),
-          input,
-          position
-        )
+        // 2. If position does not point to a sequence of bytes starting with
+        //    `form-data; name="`, return failure.
+        if (!bufferStartsWith(input, formDataNameBuffer, position)) {
+          return 'failure'
+        }
+
+        // 3. Advance position so it points at the byte after the next 0x22 (")
+        //    byte (the one in the sequence of bytes matched above).
+        position.position += 17
 
-        if (dispositionType.toString('ascii').toLowerCase() !== 'form-data') {
-          throw parsingError('expected form-data for content-disposition header')
+        // 4. Set name to the result of parsing a multipart/form-data name given
+        //    input and position, if the result is not failure. Otherwise, return
+        //    failure.
+        name = parseMultipartFormDataName(input, position)
+
+        if (name === null) {
+          return 'failure'
         }
 
-        // Parse attributes recursively until CRLF
-        while (
-          position.position < input.length &&
-          (input[position.position] !== 0x0d ||
-          input[position.position + 1] !== 0x0a)
-        ) {
-          const attribute = parseContentDispositionAttribute(input, position)
+        // 5. If position points to a sequence of bytes starting with `; filename="`:
+        if (bufferStartsWith(input, filenameBuffer, position)) {
+          // Note: undici also handles filename*
+          let check = position.position + filenameBuffer.length
 
-          if (!attribute) {
-            break
+          if (input[check] === 0x2a) {
+            position.position += 1
+            check += 1
           }
 
-          if (attribute.name === 'name') {
-            name = attribute.value
-          } else if (attribute.name === 'filename') {
-            // Per RFC 5987 §4.1, when both legacy and extended forms of the
-            // same parameter are present, the extended (filename*) form takes
-            // precedence regardless of the order they appear in.
-            if (attribute.extended) {
-              filename = attribute.value
-              filenameIsExtended = true
-            } else if (!filenameIsExtended) {
-              filename = attribute.value
-            }
+          if (input[check] !== 0x3d || input[check + 1] !== 0x22) { // ="
+            return 'failure'
           }
-        }
 
-        if (name === null) {
-          throw parsingError('name attribute is required in content-disposition header')
+          // 1. Advance position so it points at the byte after the next 0x22 (") byte
+          //    (the one in the sequence of bytes matched above).
+          position.position += 12
+
+          // 2. Set filename to the result of parsing a multipart/form-data name given
+          //    input and position, if the result is not failure. Otherwise, return failure.
+          filename = parseMultipartFormDataName(input, position)
+
+          if (filename === null) {
+            return 'failure'
+          }
         }
 
         break
@@ -459,14 +366,51 @@ function parseMultipartFormDataHeaders (input, position) {
 
     // 2.9. If position does not point to a sequence of bytes starting with 0x0D 0x0A
     //      (CR LF), return failure. Otherwise, advance position by 2 (past the newline).
-    if (input[position.position] !== 0x0d || input[position.position + 1] !== 0x0a) {
-      throw parsingError('expected CRLF')
+    if (input[position.position] !== 0x0d && input[position.position + 1] !== 0x0a) {
+      return 'failure'
     } else {
       position.position += 2
     }
   }
 }
 
+/**
+ * @see https://andreubotella.github.io/multipart-form-data/#parse-a-multipart-form-data-name
+ * @param {Buffer} input
+ * @param {{ position: number }} position
+ */
+function parseMultipartFormDataName (input, position) {
+  // 1. Assert: The byte at (position - 1) is 0x22 (").
+  assert(input[position.position - 1] === 0x22)
+
+  // 2. Let name be the result of collecting a sequence of bytes that are not 0x0A (LF), 0x0D (CR) or 0x22 ("), given position.
+  /** @type {string | Buffer} */
+  let name = collectASequenceOfBytes(
+    (char) => char !== 0x0a && char !== 0x0d && char !== 0x22,
+    input,
+    position
+  )
+
+  // 3. If the byte at position is not 0x22 ("), return failure. Otherwise, advance position by 1.
+  if (input[position.position] !== 0x22) {
+    return null // name could be 'failure'
+  } else {
+    position.position++
+  }
+
+  // 4. Replace any occurrence of the following subsequences in name with the given byte:
+  // - `%0A`: 0x0A (LF)
+  // - `%0D`: 0x0D (CR)
+  // - `%22`: 0x22 (")
+  name = new TextDecoder().decode(name)
+    .replace(/%0A/ig, '\n')
+    .replace(/%0D/ig, '\r')
+    .replace(/%22/g, '"')
+
+  // 5. Return the UTF-8 decoding without BOM of name.
+  return name
+}
+
 /**
  * @param {(char: number) => boolean} condition
  * @param {Buffer} input
@@ -524,62 +468,6 @@ function bufferStartsWith (buffer, start, position) {
   return true
 }
 
-function parsingError (cause) {
-  return new TypeError('Failed to parse body as FormData.', { cause: new TypeError(cause) })
-}
-
-/**
- * CTL            = <any US-ASCII control character
- *                  (octets 0 - 31) and DEL (127)>
- * @param {number} char
- */
-function isCTL (char) {
-  return char <= 0x1f || char === 0x7f
-}
-
-/**
- * tspecials :=  "(" / ")" / "<" / ">" / "@" /
- *                "," / ";" / ":" / "\" / <">
- *                "/" / "[" / "]" / "?" / "="
- *                ; Must be in quoted-string,
- *                ; to use within parameter values
- * @param {number} char
- */
-function isTSpecial (char) {
-  return (
-    char === 0x28 || // (
-    char === 0x29 || // )
-    char === 0x3c || // <
-    char === 0x3e || // >
-    char === 0x40 || // @
-    char === 0x2c || // ,
-    char === 0x3b || // ;
-    char === 0x3a || // :
-    char === 0x5c || // \
-    char === 0x22 || // "
-    char === 0x2f || // /
-    char === 0x5b || // [
-    char === 0x5d || // ]
-    char === 0x3f || // ?
-    char === 0x3d    // +
-  )
-}
-
-/**
- * token := 1*<any (US-ASCII) CHAR except SPACE, CTLs,
- *          or tspecials>
- * @param {number} char
- */
-function isToken (char) {
-  return (
-    char <= 0x7f &&  // ascii
-    char !== 0x20 && // space
-    char !== 0x09 &&
-    !isCTL(char) &&
-    !isTSpecial(char)
-  )
-}
-
 module.exports = {
   multipartFormDataParser,
   validateBoundary