amqplib 1.0.1 → 1.0.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change log for amqplib
 
+## v1.0.3
+- Fix AssertionError crash when backpressure occurs while draining newStreams in Mux (fixes #841)
+
+## v1.0.2
+- Replace url-parse with WHATWG URL API
+
 ## v1.0.1
 - Fix TLS connection failure when connecting to an AMQPS broker using an IP address (IPv4 or IPv6) — setting servername to an IP is not permitted by TLS SNI and throws ERR_INVALID_ARG_VALUE in Node.js 25+
 

package/lib/connect.js

@@ -1,4 +1,4 @@
-const URL = require('url-parse');
+const { URL } = require('node:url');
 const QS = require('node:querystring');
 const net = require('node:net');
 const tls = require('node:tls');
@@ -124,14 +124,24 @@ function connect(url, socketOptions, openCallback) {
 
     fields = openFrames(url.vhost, config, sockopts.credentials || credentials.plain(user, pass), extraClientProperties);
   } else {
-    const parts = URL(url, true); // yes, parse the query string
-    const host = parts.hostname.replace(/^\[|\]$/g, '');
-    protocol = parts.protocol;
+    let parts;
+    try {
+      parts = new URL(url);
+    } catch (_e) {
+      parts = {};
+    }
+    const host = (parts.hostname || '').replace(/^\[|\]$/g, '');
+    protocol = parts.protocol || '';
     sockopts.host = host;
     if (!sockopts.servername && !net.isIP(host)) sockopts.servername = host;
     sockopts.port = parseInt(parts.port, 10) || (protocol === 'amqp:' ? 5672 : 5671);
     const vhost = parts.pathname ? parts.pathname.substr(1) : null;
-    fields = openFrames(vhost, parts.query, sockopts.credentials || credentialsFromUrl(parts), extraClientProperties);
+    const query = QS.parse(parts.search ? parts.search.slice(1) : '');
+    // QS.parse returns arrays for duplicate keys; match url-parse's first-value-wins behavior.
+    for (const key in query) {
+      if (Array.isArray(query[key])) query[key] = query[key][0];
+    }
+    fields = openFrames(vhost, query, sockopts.credentials || credentialsFromUrl(parts), extraClientProperties);
   }
 
   let sockok = false;

package/lib/mux.js

@@ -40,14 +40,13 @@ class Mux {
     // Try to read a chunk from each stream in turn, until all streams
     // are empty, or we exhaust our ability to accept chunks.
     function roundrobin(streams) {
-      let stream = streams.shift();
-      while (accepting && stream) {
+      while (accepting && streams.length > 0) {
+        const stream = streams.shift();
         const chunk = stream.read();
         if (chunk !== null) {
           accepting = out.write(chunk);
           streams.push(stream);
         }
-        stream = streams.shift();
       }
     }
 

package/package.json

@@ -2,7 +2,7 @@
   "name": "amqplib",
   "homepage": "http://amqp-node.github.io/amqplib/",
   "main": "./channel_api.js",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "An AMQP 0-9-1 (e.g., RabbitMQ) library and client.",
   "repository": {
     "type": "git",
@@ -12,8 +12,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "buffer-more-ints": "~1.0.0",
-    "url-parse": "~1.5.10"
+    "buffer-more-ints": "~1.0.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.2.2",

package/test/connect.test.js

@@ -2,53 +2,12 @@ const { describe, it, afterEach } = require('node:test');
 const assert = require('node:assert');
 const net = require('node:net');
 const connect = require('../lib/connect').connect;
-const credentialsFromUrl = require('../lib/connect').credentialsFromUrl;
 const defs = require('../lib/defs');
 const { plain, amqplain } = require('../lib/credentials')
 const { latch, runServer } = require('./lib/util');
 
-const urlparse = require('url-parse');
-
 describe('Connect', () => {
 
-  describe('Credentials', () => {
-    function assertCredentials(creds, username, password) {
-      assert.strictEqual(creds.mechanism, 'PLAIN');
-      assert.strictEqual(creds.username, username);
-      assert.strictEqual(creds.password, password);
-    }
-
-    it('no creds', () => {
-      const parts = urlparse('amqp://localhost');
-      const creds = credentialsFromUrl(parts);
-      assertCredentials(creds, 'guest', 'guest');
-    });
-
-    it('usual user:pass', () => {
-      const parts = urlparse('amqp://user:pass@localhost');
-      const creds = credentialsFromUrl(parts);
-      assertCredentials(creds, 'user', 'pass');
-    });
-
-    it('missing user', () => {
-      const parts = urlparse('amqps://:password@localhost');
-      const creds = credentialsFromUrl(parts);
-      assertCredentials(creds, '', 'password');
-    });
-
-    it('missing password', () => {
-      const parts = urlparse('amqps://username:@localhost');
-      const creds = credentialsFromUrl(parts);
-      assertCredentials(creds, 'username', '');
-    });
-
-    it('escaped colons', () => {
-      const parts = urlparse('amqp://user%3Aname:pass%3Aword@localhost');
-      const creds = credentialsFromUrl(parts);
-      assertCredentials(creds, 'user:name', 'pass:word');
-    });
-  });
-
   describe('Connect API', () => {
 
     let connection;

package/test/mux.test.js

@@ -184,6 +184,49 @@ describe('mux', () => {
     });
   });
 
+  it('backpressure does not crash when newStreams is drained', () => {
+    // Regression test: out.write() returns false (backpressure) while
+    // draining newStreams. The buggy code does an unconditional shift at the
+    // bottom of the loop, so if the next stream reads null (empty) it gets
+    // discarded without being pushed back, leaving newStreams empty and
+    // triggering assert(this.newStreams.length > 0) in the else-branch.
+    //
+    // Scenario: newStreams = [input1, input2], input1 has data, input2 empty.
+    // - shift input1, read 1, write → backpressure (false), push input1 back
+    // - (buggy) unconditional shift takes input2, loop condition false → exit
+    // - newStreams = [input1], length > 0, assert passes  ← not the bug path
+    //
+    // The crash path requires backpressure AND the shifted stream reading null
+    // with no other streams remaining. Use a single stream that has data, then
+    // engineer a second read() on the same stream returning null after the
+    // write so the stream is not pushed back, emptying newStreams entirely.
+    const input1 = stream();
+    const output = stream();
+    const mux = new Mux(output);
+
+    mux.newStreams.push(input1);
+    input1.write(1);
+
+    // After the first write (which triggers backpressure), wrap read() so
+    // the stream appears empty on the next call — simulating a stream that
+    // had one item buffered and is now drained within the same roundrobin pass.
+    const originalRead = input1.read.bind(input1);
+    let readCount = 0;
+    input1.read = (size) => {
+      readCount++;
+      if (readCount > 1) return null; // appear empty after first read
+      return originalRead(size);
+    };
+
+    const originalWrite = output.write.bind(output);
+    output.write = (...args) => {
+      originalWrite(...args);
+      return false; // signal backpressure immediately
+    };
+
+    assert.doesNotThrow(() => mux._readIncoming());
+  });
+
   it('roundrobin', (_t, done) => {
     const input1 = stream();
     const input2 = stream();

package/test/uri_spec.test.js

@@ -0,0 +1,210 @@
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const net = require('node:net');
+const connect = require('../lib/connect').connect;
+const defs = require('../lib/defs');
+const { runServer } = require('./lib/util');
+
+function captureHandshake(url, callback) {
+  let server;
+  const captured = {};
+
+  server = net.createServer((socket) => {
+    socket.once('data', (_header) => {
+      runServer(socket, (send, wait) => {
+        send(defs.ConnectionStart, {
+          versionMajor: 0,
+          versionMinor: 9,
+          serverProperties: {},
+          mechanisms: Buffer.from('PLAIN'),
+          locales: Buffer.from('en_US'),
+        });
+        wait(defs.ConnectionStartOk)().then((startOk) => {
+          const parts = startOk.fields.response.toString().split('\0');
+          captured.username = parts[1];
+          captured.password = parts[2];
+          send(defs.ConnectionTune, { channelMax: 0, heartbeat: 0, frameMax: 0 });
+          return wait(defs.ConnectionTuneOk)();
+        }).then(() => {
+          return wait(defs.ConnectionOpen)();
+        }).then((open) => {
+          captured.vhost = open.fields.virtualHost;
+          send(defs.ConnectionClose, {
+            replyCode: 200,
+            replyText: 'ok',
+            classId: 0,
+            methodId: 0,
+          });
+        }).catch((err) => {
+          server.close();
+          callback(err);
+        });
+      });
+
+      socket.once('end', () => {
+        server.close(() => callback(null, captured));
+      });
+    });
+  });
+
+  server.listen(0, () => {
+    const port = server.address().port;
+    const urlWithPort = url.replace('TESTPORT', String(port));
+    connect(urlWithPort, {}, (_err) => {});
+  });
+}
+
+describe('AMQP URI spec', () => {
+
+  describe('credentials', () => {
+
+    it('no userinfo defaults to guest/guest', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'guest');
+        assert.strictEqual(result.password, 'guest');
+        done();
+      });
+    });
+
+    it('plain user:pass', (_t, done) => {
+      captureHandshake('amqp://user:pass@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'user');
+        assert.strictEqual(result.password, 'pass');
+        done();
+      });
+    });
+
+    it('empty username', (_t, done) => {
+      captureHandshake('amqp://:password@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, '');
+        assert.strictEqual(result.password, 'password');
+        done();
+      });
+    });
+
+    it('empty password', (_t, done) => {
+      captureHandshake('amqp://username:@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'username');
+        assert.strictEqual(result.password, '');
+        done();
+      });
+    });
+
+    // Issue #385: colon in username or password must be percent-encoded
+    it('percent-encoded colon (%3A) in username and password', (_t, done) => {
+      captureHandshake('amqp://user%3Aname:pass%3Aword@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'user:name');
+        assert.strictEqual(result.password, 'pass:word');
+        done();
+      });
+    });
+
+    // Issue #483: @ in password must be percent-encoded as %40
+    it('percent-encoded @ (%40) in password', (_t, done) => {
+      captureHandshake('amqp://user:p%40ssword@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'user');
+        assert.strictEqual(result.password, 'p@ssword');
+        done();
+      });
+    });
+
+    // RabbitMQ URI spec example: amqp://user:passw%23rd@host:10000/vhost
+    it('percent-encoded # (%23) in password', (_t, done) => {
+      captureHandshake('amqp://user:passw%23rd@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'user');
+        assert.strictEqual(result.password, 'passw#rd');
+        done();
+      });
+    });
+
+    it('percent-encoded % (%25) in password', (_t, done) => {
+      captureHandshake('amqp://user:pass%25word@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'user');
+        assert.strictEqual(result.password, 'pass%word');
+        done();
+      });
+    });
+
+    // RabbitMQ URI spec example: amqp://user%61:%61pass@ho%61st:10000/v%2fhost
+    it('percent-encoded letters (%61 = "a") in username and password', (_t, done) => {
+      captureHandshake('amqp://user%61:%61pass@localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.username, 'usera');
+        assert.strictEqual(result.password, 'apass');
+        done();
+      });
+    });
+
+  });
+
+  describe('vhost', () => {
+
+    it('no path defaults to vhost /', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, '/');
+        done();
+      });
+    });
+
+    it('explicit / path gives vhost /', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT/', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, '/');
+        done();
+      });
+    });
+
+    it('named vhost', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT/myvhost', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, 'myvhost');
+        done();
+      });
+    });
+
+    // The RabbitMQ spec requires %2F to represent a literal / in a vhost
+    it('percent-encoded slash (%2F) in vhost decodes to /', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT/%2F', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, '/');
+        done();
+      });
+    });
+
+    it('percent-encoded slash lowercase (%2f) in vhost decodes to /', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT/%2f', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, '/');
+        done();
+      });
+    });
+
+    // RabbitMQ URI spec example: /v%2fhost => "v/host"
+    it('mixed percent-encoding in vhost (v%2Fhost decodes to "v/host")', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT/v%2Fhost', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, 'v/host');
+        done();
+      });
+    });
+
+    it('percent-encoded space (%20) in vhost', (_t, done) => {
+      captureHandshake('amqp://localhost:TESTPORT/my%20vhost', (err, result) => {
+        assert.ifError(err);
+        assert.strictEqual(result.vhost, 'my vhost');
+        done();
+      });
+    });
+
+  });
+
+});

package/.claude/settings.local.json

@@ -1,16 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(npx oxlint:*)",
-      "Bash(npm t)",
-      "Bash(git add:*)",
-      "Bash(git commit:*)",
-      "Bash(npm run lint:*)",
-      "Bash(git checkout:*)",
-      "Bash(npx biome lint:*)",
-      "Bash(node:*)"
-    ],
-    "deny": [],
-    "ask": []
-  }
-}