amqplib 2.2.1 → 2.3.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Change log for amqplib
 
+## v2.3.0
+- Reject a `connection.tune` whose `frameMax` is below the protocol minimum of 4096 (the spec allows 0 or at least frame-min-size). Previously such a value was accepted, and the first publish whose encoded frames total 2048 bytes or more entered a loop in `sendContent` that never advanced, exhausting memory. `sendContent` now also throws if `frameMax` leaves no room for a body frame (GHSA-37f9-7m79-6866, reported by Rizwan Bedekar ([@r-bedekar](https://github.com/r-bedekar)); fix based in part on their patch and tests)
+- Add a `maxFrameSize` connection option, also settable as a URL query parameter, bounding the payload size of frames accepted from the server. The default is 64 MiB, or the negotiated `frameMax` if that is larger, so raising `frameMax` needs no second option; `0` disables the limit. Incoming frame sizes were previously unchecked, so a frame header declaring up to 4 GiB made the client buffer, and repeatedly re-copy, that much data before looking at it. An oversized frame is now refused from its header alone and closes the connection with `Frame size N exceeds maxFrameSize M`. The limit is deliberately separate from the negotiated `frameMax`, since some brokers send larger frames without splitting them (see #784). **Upgrade note:** a broker that delivers an unsplit frame larger than the limit will now have that connection closed; pass `maxFrameSize: 0`, or a higher value, to restore the previous behaviour (GHSA-37f9-7m79-6866)
+
 ## v2.2.1
 - Return the server acknowledgement from promise-based `channel.cancel`, matching the callback API (thanks [@edsonsims](https://github.com/edsonsims)).
 - Type `cancel` replies as `Replies.Cancel` (`{ consumerTag }`) in both the promise and callback API declarations, which previously claimed `Replies.Empty`.

package/lib/connect.js

@@ -47,6 +47,11 @@ function openFrames(vhost, query, credentials, extraClientProperties) {
     return val === undefined ? def : parseInt(val, 10);
   }
 
+  function maxFrameSizeOrUndefined(val) {
+    if (val == null) return undefined;
+    return /^\d+$/.test(String(val)) ? Number(val) : NaN;
+  }
+
   const clientProperties = Object.create(CLIENT_PROPERTIES);
 
   return {
@@ -61,6 +66,8 @@ function openFrames(vhost, query, credentials, extraClientProperties) {
     frameMax: intOrDefault(query.frameMax, 131072),
     heartbeat: query.heartbeat != null ? intOrDefault(query.heartbeat, 0) : null,
 
+    maxFrameSize: maxFrameSizeOrUndefined(query.maxFrameSize),
+
     // open
     virtualHost: vhost,
     capabilities: '',
@@ -120,6 +127,7 @@ function connect(url, socketOptions, openCallback) {
       channelMax: url.channelMax,
       frameMax: url.frameMax,
       heartbeat: url.heartbeat,
+      maxFrameSize: url.maxFrameSize,
     };
 
     fields = openFrames(url.vhost, config, sockopts.credentials || credentials.plain(user, pass), extraClientProperties);

package/lib/connection.js

@@ -27,6 +27,7 @@ const DEFAULT_WRITE_HWM = 1024;
 // at once. Note that this is less than the minimum frame size: if it
 // was greater, we might have to fragment the content.
 const SINGLE_CHUNK_THRESHOLD = 2048;
+const DEFAULT_MAX_FRAME_SIZE = 64 * 1024 * 1024;
 
 class Connection extends EventEmitter {
   constructor(underlying) {
@@ -38,6 +39,7 @@ class Connection extends EventEmitter {
     // frames
     this.rest = Buffer.alloc(0);
     this.frameMax = constants.FRAME_MIN_SIZE;
+    this.maxFrameSize = DEFAULT_MAX_FRAME_SIZE;
     this.sentSinceLastCheck = false;
     this.recvSinceLastCheck = false;
 
@@ -86,6 +88,17 @@ class Connection extends EventEmitter {
     const self = this;
     const openCallback = openCallback0 || (() => {});
 
+    const maxFrameSize = allFields.maxFrameSize;
+    const maxFrameSizeDefaulted = maxFrameSize === undefined || maxFrameSize === null;
+    if (maxFrameSizeDefaulted) {
+      self.maxFrameSize = DEFAULT_MAX_FRAME_SIZE;
+    } else if (!Number.isInteger(maxFrameSize) || (maxFrameSize !== 0 && maxFrameSize < constants.FRAME_MIN_SIZE)) {
+      bail(new TypeError(fmt('maxFrameSize must be 0 (no limit) or an integer of at least %d; got %s', constants.FRAME_MIN_SIZE, maxFrameSize)));
+      return;
+    } else {
+      self.maxFrameSize = maxFrameSize;
+    }
+
     // This is where we'll put our negotiated values
     const tunedOptions = Object.create(allFields);
 
@@ -157,6 +170,10 @@ class Connection extends EventEmitter {
           break;
         case defs.ConnectionTune: {
           const fields = reply.fields;
+          if (fields.frameMax !== 0 && fields.frameMax < constants.FRAME_MIN_SIZE) {
+            bail(new Error(fmt('Server frameMax %d is below the protocol minimum %d', fields.frameMax, constants.FRAME_MIN_SIZE)));
+            return;
+          }
           tunedOptions.frameMax = negotiate(fields.frameMax, allFields.frameMax);
           tunedOptions.channelMax = negotiate(fields.channelMax, allFields.channelMax);
           if (allFields.heartbeat == null) {
@@ -191,6 +208,9 @@ class Connection extends EventEmitter {
       // value is zero, meaning "no, no limits"
       self.channelMax = tunedOptions.channelMax || 0xffff;
       self.frameMax = tunedOptions.frameMax || 0xffffffff;
+      if (maxFrameSizeDefaulted && tunedOptions.frameMax !== 0 && tunedOptions.frameMax > self.maxFrameSize) {
+        self.maxFrameSize = tunedOptions.frameMax;
+      }
       // 0 means "no heartbeat", rather than "maximum period of
       // heartbeating"
       self.heartbeat = tunedOptions.heartbeat;
@@ -526,6 +546,9 @@ class Connection extends EventEmitter {
     const buffer = this.channels[channel].buffer;
 
     const maxBody = this.frameMax - FRAME_OVERHEAD;
+    if (!(maxBody > 0)) {
+      throw new Error(fmt('Cannot send content: frameMax %d leaves no room for a body frame', this.frameMax));
+    }
 
     for (let offset = 0; offset < body.length; offset += maxBody) {
       const end = offset + maxBody;
@@ -539,7 +562,7 @@ class Connection extends EventEmitter {
 
   recvFrame() {
     // %%% identifying invariants might help here?
-    const frame = parseFrame(this.rest);
+    const frame = parseFrame(this.rest, this.maxFrameSize);
 
     if (!frame) {
       const incoming = this.stream.read();
@@ -654,3 +677,4 @@ function isFatalError(error) {
 
 module.exports.Connection = Connection;
 module.exports.isFatalError = isFatalError;
+module.exports.DEFAULT_MAX_FRAME_SIZE = DEFAULT_MAX_FRAME_SIZE;

package/lib/frame.js

@@ -78,7 +78,7 @@ module.exports.makeBodyFrame = (channel, payload) => {
  * @arg { number } max
  * @returns { FrameStructure | boolean }
  */
-function parseFrame(bin) {
+function parseFrame(bin, max) {
   if (bin.length < FRAME_HEADER_BYTES) {
     return false;
   }
@@ -87,6 +87,10 @@ function parseFrame(bin) {
   const channel = bin.readUInt16BE(1);
   const size = bin.readUInt32BE(3);
 
+  if (max > 0 && size > max) {
+    throw new Error(`Frame size ${size} exceeds maxFrameSize ${max}`);
+  }
+
   const totalSize = FRAME_HEADER_BYTES + size + FRAME_END_BYTES;
 
   if (bin.length < totalSize) {

package/lib/properties.d.ts

@@ -33,6 +33,7 @@ export namespace Options {
     password?: string;
     locale?: string;
     frameMax?: number;
+    maxFrameSize?: number;
     heartbeat?: number;
     vhost?: string;
     channelMax?: number;

package/package.json

@@ -2,7 +2,7 @@
   "name": "amqplib",
   "homepage": "http://amqp-node.github.io/amqplib/",
   "main": "./channel_api.js",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "types": "./index.d.ts",
   "exports": {
     ".": {