acrylblends 0.3.0 → 0.4.0

package/plugins/acryl-router/src/core/utils/body.test.ts

@@ -0,0 +1,496 @@
+import { parseBody } from './body.ts'
+import type { BodyData } from './body.ts'
+
+type RecursiveRecord<K extends string, T> = {
+  [key in K]: T | RecursiveRecord<K, T>
+}
+
+describe('Parse Body Util', () => {
+  const FORM_URL = 'https://localhost/form'
+  const SEARCH_URL = 'https://localhost/search'
+
+  const createRequest = (
+    url: string,
+    method: 'POST',
+    body: BodyInit,
+    headers?: { [key: string]: string }
+  ) => {
+    return new Request(url, {
+      method,
+      body,
+      headers,
+    })
+  }
+
+  const createNestedKey = (depth: number) =>
+    Array(depth + 1)
+      .fill('a')
+      .join('.')
+
+  it('should parse `multipart/form-data`', async () => {
+    const data = new FormData()
+    data.append('message', 'hello')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req)).toEqual({ message: 'hello' })
+  })
+
+  it('should parse `x-www-form-urlencoded`', async () => {
+    const searchParams = new URLSearchParams()
+    searchParams.append('message', 'hello')
+
+    const req = createRequest(SEARCH_URL, 'POST', searchParams, {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    })
+
+    expect(await parseBody(req)).toEqual({ message: 'hello' })
+  })
+
+  it('should parse mixed-case `x-www-form-urlencoded`', async () => {
+    const searchParams = new URLSearchParams()
+    searchParams.append('message', 'hello')
+
+    const req = createRequest(SEARCH_URL, 'POST', searchParams, {
+      'Content-Type': 'Application/X-WWW-Form-Urlencoded',
+    })
+
+    expect(await parseBody(req)).toEqual({ message: 'hello' })
+  })
+
+  it('should parse mixed-case `multipart/form-data`', async () => {
+    const data = new FormData()
+    data.append('message', 'hello')
+
+    const source = createRequest(FORM_URL, 'POST', data)
+    const contentType = source.headers
+      .get('Content-Type')!
+      .replace('multipart/form-data', 'Multipart/Form-Data')
+    const req = createRequest(FORM_URL, 'POST', await source.arrayBuffer(), {
+      'Content-Type': contentType,
+    })
+
+    expect(await parseBody(req)).toEqual({ message: 'hello' })
+  })
+
+  it('should not parse multiple values in default', async () => {
+    const data = new FormData()
+    data.append('file', 'bbb')
+    data.append('message', 'hello')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req)).toEqual({
+      file: 'bbb',
+      message: 'hello',
+    })
+  })
+
+  it('should not update file object properties', async () => {
+    const file = new File(['foo'], 'file1', {
+      type: 'application/octet-stream',
+    })
+    const data = new FormData()
+    data.append('file', file)
+    data.append('file.hoo', 'hoo')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    const parsedData = await parseBody(req, { dot: true })
+    expect(parsedData.file).not.instanceOf(File)
+    expect(parsedData).toEqual({
+      file: {
+        hoo: 'hoo',
+      },
+    })
+  })
+
+  it('should override value if `all` option is false', async () => {
+    const data = new FormData()
+    data.append('file', 'aaa')
+    data.append('file', 'bbb')
+    data.append('message', 'hello')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req)).toEqual({
+      file: 'bbb',
+      message: 'hello',
+    })
+  })
+
+  it('should parse multiple values if `all` option is true', async () => {
+    const data = new FormData()
+    data.append('file', 'aaa')
+    data.append('file', 'bbb')
+    data.append('message', 'hello')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { all: true })).toEqual({
+      file: ['aaa', 'bbb'],
+      message: 'hello',
+    })
+  })
+
+  it('should not parse nested values in default', async () => {
+    const data = new FormData()
+    data.append('obj.key1', 'value1')
+    data.append('obj.key2', 'value2')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: false })).toEqual({
+      'obj.key1': 'value1',
+      'obj.key2': 'value2',
+    })
+  })
+
+  it('should not parse nested values in default for non-nested keys', async () => {
+    const data = new FormData()
+    data.append('key1', 'value1')
+    data.append('key2', 'value2')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: false })).toEqual({
+      key1: 'value1',
+      key2: 'value2',
+    })
+  })
+
+  it('should handle nested values and non-nested values together with dot option true', async () => {
+    const data = new FormData()
+    data.append('obj.key1', 'value1')
+    data.append('obj.key2', 'value2')
+    data.append('key3', 'value3')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true })).toEqual({
+      obj: { key1: 'value1', key2: 'value2' },
+      key3: 'value3',
+    })
+  })
+
+  it('should handle deeply nested objects with dot option true', async () => {
+    const data = new FormData()
+    data.append('a.b.c.d', 'value')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true })).toEqual({
+      a: { b: { c: { d: 'value' } } },
+    })
+  })
+
+  it('should allow 32 nesting levels by default', async () => {
+    const data = new FormData()
+    data.append(createNestedKey(32), 'value')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+    let nested: unknown = await parseBody(req, { dot: true })
+
+    for (let i = 0; i <= 32; i++) {
+      nested = (nested as Record<string, unknown>).a
+    }
+    expect(nested).toBe('value')
+  })
+
+  it('should reject dot notation deeper than the default limit', async () => {
+    const data = new FormData()
+    data.append(createNestedKey(33), 'value')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    await expect(parseBody(req, { dot: true })).rejects.toThrow('Nesting limit exceeded')
+  })
+
+  it('should reject deeply nested keys without splitting every segment', async () => {
+    const req = createRequest(SEARCH_URL, 'POST', `${'.'.repeat(65_530)}=value`, {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    })
+
+    await expect(parseBody(req, { dot: true })).rejects.toThrow('Nesting limit exceeded')
+  })
+
+  it('should reject too many nested objects across multiple fields', async () => {
+    const searchParams = new URLSearchParams()
+    for (let i = 0; i <= 10_000; i++) {
+      searchParams.append(`field${i}.value`, 'value')
+    }
+
+    const req = createRequest(SEARCH_URL, 'POST', searchParams, {
+      'Content-Type': 'application/x-www-form-urlencoded',
+    })
+
+    await expect(parseBody(req, { dot: true })).rejects.toThrow('Nesting limit exceeded')
+  })
+
+  it('should skip keys starting with __proto__. to prevent prototype pollution', async () => {
+    const data = new FormData()
+    data.append('__proto__.polluted', 'malicious')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true })).toEqual({})
+  })
+
+  it('should skip keys containing nested __proto__. to prevent prototype pollution', async () => {
+    const data = new FormData()
+    data.append('a.__proto__.polluted', 'malicious')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true })).toEqual({})
+  })
+
+  it('should not pollute Object.prototype via __proto__ keys', async () => {
+    const data = new FormData()
+    data.append('__proto__.injected', 'yes')
+    data.append('a.__proto__.injected', 'yes')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    await parseBody(req, { dot: true })
+
+    expect(({} as Record<string, unknown>).injected).toBeUndefined()
+  })
+
+  it('should parse key ending with __proto__ as a normal value', async () => {
+    const data = new FormData()
+    data.append('a.__proto__', 'value')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    const result = await parseBody(req, { dot: true })
+    expect(result).toHaveProperty('a')
+    expect(
+      Object.getOwnPropertyDescriptor(
+        (result as Record<string, Record<string, string>>).a,
+        '__proto__'
+      )?.value
+    ).toBe('value')
+  })
+
+  it('should parse key containing __proto__ as a substring normally', async () => {
+    const data = new FormData()
+    data.append('data__proto__key.value', 'test')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true })).toEqual({
+      data__proto__key: { value: 'test' },
+    })
+  })
+
+  it('should parse nested values if `dot` option is true', async () => {
+    const data = new FormData()
+    data.append('obj.key1', 'value1')
+    data.append('obj.key2', 'value2')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true })).toEqual({
+      obj: { key1: 'value1', key2: 'value2' },
+    })
+  })
+
+  it('should parse data if both `all` and `dot` are set', async () => {
+    const data = new FormData()
+    data.append('obj.sub.foo', 'value1')
+    data.append('obj.sub.foo', 'value2')
+    data.append('key', 'value3')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { dot: true, all: true })).toEqual({
+      obj: { sub: { foo: ['value1', 'value2'] } },
+      key: 'value3',
+    })
+  })
+
+  it('should parse nested values if values are `File`', async () => {
+    const file1 = new File(['foo'], 'file1', {
+      type: 'application/octet-stream',
+    })
+    const file2 = new File(['bar'], 'file2', {
+      type: 'application/octet-stream',
+    })
+    const data = new FormData()
+    data.append('file.file1', file1)
+    data.append('file.file2', file2)
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    const result = await parseBody(req, { all: true, dot: true })
+    expect(result).toMatchObject({
+      file: {
+        file1: { name: 'file1', type: 'application/octet-stream' },
+        file2: { name: 'file2', type: 'application/octet-stream' },
+      },
+    })
+  })
+
+  it('should parse multiple values if values are `File`', async () => {
+    const file1 = new File(['foo'], 'file1', {
+      type: 'application/octet-stream',
+    })
+    const file2 = new File(['bar'], 'file2', {
+      type: 'application/octet-stream',
+    })
+    const data = new FormData()
+    data.append('file', file1)
+    data.append('file', file2)
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    const result = await parseBody(req, { all: true })
+    expect(result).toMatchObject({
+      file: [
+        { name: 'file1', type: 'application/octet-stream' },
+        { name: 'file2', type: 'application/octet-stream' },
+      ],
+    })
+  })
+
+  it('should parse multiple values if key ends with `[]`', async () => {
+    const data = new FormData()
+    data.append('file[]', 'aaa')
+    data.append('file[]', 'bbb')
+    data.append('message', 'hello')
+
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { all: true })).toEqual({
+      'file[]': ['aaa', 'bbb'],
+      message: 'hello',
+    })
+  })
+
+  it('should parse single value as array if the key has `[]`', async () => {
+    const data = new FormData()
+    data.append('foo[]', 'bar')
+    const req = createRequest(FORM_URL, 'POST', data)
+
+    expect(await parseBody(req, { all: true })).toEqual({
+      'foo[]': ['bar'],
+    })
+  })
+
+  it('should return blank object if body is JSON', async () => {
+    const payload = { message: 'hello acryl' }
+
+    const req = createRequest('http://localhost/json', 'POST', JSON.stringify(payload), {
+      'Content-Type': 'application/json',
+    })
+
+    expect(await parseBody(req)).toEqual({})
+  })
+
+  describe('Return type', () => {
+    let req: Request
+    beforeEach(() => {
+      req = createRequest(FORM_URL, 'POST', new FormData())
+    })
+
+    it('without options', async () => {
+      expectTypeOf((await parseBody(req))['key']).toEqualTypeOf<string | File>()
+    })
+
+    it('{all: true}', async () => {
+      expectTypeOf((await parseBody(req, { all: true }))['key']).toEqualTypeOf<
+        string | File | (string | File)[]
+      >()
+    })
+
+    it('{all: boolean}', async () => {
+      expectTypeOf((await parseBody(req, { all: !!Math.random() }))['key']).toEqualTypeOf<
+        string | File | (string | File)[]
+      >()
+    })
+
+    it('{dot: true}', async () => {
+      expectTypeOf((await parseBody(req, { dot: true }))['key']).toEqualTypeOf<
+        string | File | RecursiveRecord<string, string | File>
+      >()
+    })
+
+    it('{dot: boolean}', async () => {
+      expectTypeOf((await parseBody(req, { dot: !!Math.random() }))['key']).toEqualTypeOf<
+        string | File | RecursiveRecord<string, string | File>
+      >()
+    })
+
+    it('{all: true, dot: true}', async () => {
+      expectTypeOf((await parseBody(req, { all: true, dot: true }))['key']).toEqualTypeOf<
+        | string
+        | File
+        | (string | File)[]
+        | RecursiveRecord<string, string | File | (string | File)[]>
+      >()
+    })
+
+    it('{all: boolean, dot: boolean}', async () => {
+      expectTypeOf(
+        (await parseBody(req, { all: !!Math.random(), dot: !!Math.random() }))['key']
+      ).toEqualTypeOf<
+        | string
+        | File
+        | (string | File)[]
+        | RecursiveRecord<string, string | File | (string | File)[]>
+      >()
+    })
+
+    it('specify return type explicitly', async () => {
+      expectTypeOf(
+        await parseBody<{ key1: string; key2: string }>(req, {
+          all: !!Math.random(),
+          dot: !!Math.random(),
+        })
+      ).toEqualTypeOf<{ key1: string; key2: string }>()
+    })
+  })
+})
+
+describe('BodyData', () => {
+  it('without options', async () => {
+    expectTypeOf(({} as BodyData)['key']).toEqualTypeOf<string | File>()
+  })
+
+  it('{all: true}', async () => {
+    expectTypeOf(({} as BodyData<{ all: true }>)['key']).toEqualTypeOf<
+      string | File | (string | File)[]
+    >()
+  })
+
+  it('{all: boolean}', async () => {
+    expectTypeOf(({} as BodyData<{ all: boolean }>)['key']).toEqualTypeOf<
+      string | File | (string | File)[]
+    >()
+  })
+
+  it('{dot: true}', async () => {
+    expectTypeOf(({} as BodyData<{ dot: true }>)['key']).toEqualTypeOf<
+      string | File | RecursiveRecord<string, string | File>
+    >()
+  })
+
+  it('{dot: boolean}', async () => {
+    expectTypeOf(({} as BodyData<{ dot: boolean }>)['key']).toEqualTypeOf<
+      string | File | RecursiveRecord<string, string | File>
+    >()
+  })
+
+  it('{all: true, dot: true}', async () => {
+    expectTypeOf(({} as BodyData<{ all: true; dot: true }>)['key']).toEqualTypeOf<
+      string | File | (string | File)[] | RecursiveRecord<string, string | File | (string | File)[]>
+    >()
+  })
+
+  it('{all: boolean, dot: boolean}', async () => {
+    expectTypeOf(({} as BodyData<{ all: boolean; dot: boolean }>)['key']).toEqualTypeOf<
+      string | File | (string | File)[] | RecursiveRecord<string, string | File | (string | File)[]>
+    >()
+  })
+})