amqplib 2.2.1 → 2.3.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change log for amqplib
 
+## v2.3.1
+- Throw a clear `RangeError` from `publish` when an encoded headers or `arguments` table exceeds the 64 KiB encoding buffer. Previously the outcome depended on where the boundary fell: a string or Buffer value crossing the end of the buffer was silently truncated, producing a frame whose table length prefix did not match its contents, which RabbitMQ rejected by closing the connection with a 541 `INTERNAL_ERROR` after `publish` had returned; at other positions a bare `offset is out of range` error escaped from `publish` instead (fixes #867)
+
+## v2.3.0
+- Reject a `connection.tune` whose `frameMax` is below the protocol minimum of 4096 (the spec allows 0 or at least frame-min-size). Previously such a value was accepted, and the first publish whose encoded frames total 2048 bytes or more entered a loop in `sendContent` that never advanced, exhausting memory. `sendContent` now also throws if `frameMax` leaves no room for a body frame (GHSA-37f9-7m79-6866, reported by Rizwan Bedekar ([@r-bedekar](https://github.com/r-bedekar)); fix based in part on their patch and tests)
+- Add a `maxFrameSize` connection option, also settable as a URL query parameter, bounding the payload size of frames accepted from the server. The default is 64 MiB, or the negotiated `frameMax` if that is larger, so raising `frameMax` needs no second option; `0` disables the limit. Incoming frame sizes were previously unchecked, so a frame header declaring up to 4 GiB made the client buffer, and repeatedly re-copy, that much data before looking at it. An oversized frame is now refused from its header alone and closes the connection with `Frame size N exceeds maxFrameSize M`. The limit is deliberately separate from the negotiated `frameMax`, since some brokers send larger frames without splitting them (see #784). **Upgrade note:** a broker that delivers an unsplit frame larger than the limit will now have that connection closed; pass `maxFrameSize: 0`, or a higher value, to restore the previous behaviour (GHSA-37f9-7m79-6866)
+
 ## v2.2.1
 - Return the server acknowledgement from promise-based `channel.cancel`, matching the callback API (thanks [@edsonsims](https://github.com/edsonsims)).
 - Type `cancel` replies as `Replies.Cancel` (`{ consumerTag }`) in both the promise and callback API declarations, which previously claimed `Replies.Empty`.

package/lib/codec.js

@@ -62,12 +62,20 @@ function isFloatingPoint(n) {
   return n >= 0x8000000000000000 || (Math.abs(n) < 0x4000000000000 && Math.floor(n) !== n);
 }
 
+function checkSpace(buffer, offset, size) {
+  if (offset + size > buffer.length) {
+    throw new RangeError(`Encoded field table (headers or arguments) exceeds the ${buffer.length} byte encoding buffer`);
+  }
+}
+
 function encodeTable(buffer, val, offset) {
   const start = offset;
+  checkSpace(buffer, offset, 4);
   offset += 4; // leave room for the table length
   for (const key in val) {
     if (val[key] !== undefined) {
       const len = Buffer.byteLength(key);
+      checkSpace(buffer, offset, 1 + len);
       buffer.writeUInt8(len, offset);
       offset++;
       buffer.write(key, offset, 'utf8');
@@ -82,6 +90,7 @@ function encodeTable(buffer, val, offset) {
 
 function encodeArray(buffer, val, offset) {
   const start = offset;
+  checkSpace(buffer, offset, 4);
   offset += 4;
   for (let i = 0, num = val.length; i < num; i++) {
     offset += encodeFieldValue(buffer, val[i], offset);
@@ -133,6 +142,7 @@ function encodeFieldValue(buffer, value, offset) {
   }
 
   function tag(t) {
+    checkSpace(buffer, offset, 1);
     buffer.write(t, offset);
     offset++;
   }
@@ -142,6 +152,7 @@ function encodeFieldValue(buffer, value, offset) {
       // no shortstr in field tables
       const len = Buffer.byteLength(val, 'utf8');
       tag('S');
+      checkSpace(buffer, offset, 4 + len);
       buffer.writeUInt32BE(len, offset);
       offset += 4;
       buffer.write(val, offset, 'utf8');
@@ -156,6 +167,7 @@ function encodeFieldValue(buffer, value, offset) {
         offset += encodeArray(buffer, val, offset);
       } else if (Buffer.isBuffer(val)) {
         tag('x');
+        checkSpace(buffer, offset, 4 + val.length);
         buffer.writeUInt32BE(val.length, offset);
         offset += 4;
         val.copy(buffer, offset);
@@ -167,6 +179,7 @@ function encodeFieldValue(buffer, value, offset) {
       break;
     case 'boolean':
       tag('t');
+      checkSpace(buffer, offset, 1);
       buffer.writeUInt8(val ? 1 : 0, offset);
       offset++;
       break;
@@ -175,48 +188,56 @@ function encodeFieldValue(buffer, value, offset) {
     case 'double':
     case 'float64':
       tag('d');
+      checkSpace(buffer, offset, 8);
       buffer.writeDoubleBE(val, offset);
       offset += 8;
       break;
     case 'byte':
     case 'int8':
       tag('b');
+      checkSpace(buffer, offset, 1);
       buffer.writeInt8(val, offset);
       offset++;
       break;
     case 'unsignedbyte':
     case 'uint8':
       tag('B');
+      checkSpace(buffer, offset, 1);
       buffer.writeUInt8(val, offset);
       offset++;
       break;
     case 'short':
     case 'int16':
       tag('s');
+      checkSpace(buffer, offset, 2);
       buffer.writeInt16BE(val, offset);
       offset += 2;
       break;
     case 'unsignedshort':
     case 'uint16':
       tag('u');
+      checkSpace(buffer, offset, 2);
       buffer.writeUInt16BE(val, offset);
       offset += 2;
       break;
     case 'int':
     case 'int32':
       tag('I');
+      checkSpace(buffer, offset, 4);
       buffer.writeInt32BE(val, offset);
       offset += 4;
       break;
     case 'unsignedint':
     case 'uint32':
       tag('i');
+      checkSpace(buffer, offset, 4);
       buffer.writeUInt32BE(val, offset);
       offset += 4;
       break;
     case 'long':
     case 'int64':
       tag('l');
+      checkSpace(buffer, offset, 8);
       buffer.writeBigInt64BE(BigInt(val), offset);
       offset += 8;
       break;
@@ -225,17 +246,20 @@ function encodeFieldValue(buffer, value, offset) {
     // `{'!': type, value: val}
     case 'timestamp':
       tag('T');
+      checkSpace(buffer, offset, 8);
       buffer.writeBigUInt64BE(BigInt(val), offset);
       offset += 8;
       break;
     case 'float':
       tag('f');
+      checkSpace(buffer, offset, 4);
       buffer.writeFloatBE(val, offset);
       offset += 4;
       break;
     case 'decimal':
       tag('D');
       if (Object.hasOwn(val, 'places') && Object.hasOwn(val, 'digits') && val.places >= 0 && val.places < 256) {
+        checkSpace(buffer, offset, 5);
         buffer[offset] = val.places;
         offset++;
         buffer.writeUInt32BE(val.digits, offset);

package/lib/connect.js

@@ -47,6 +47,11 @@ function openFrames(vhost, query, credentials, extraClientProperties) {
     return val === undefined ? def : parseInt(val, 10);
   }
 
+  function maxFrameSizeOrUndefined(val) {
+    if (val == null) return undefined;
+    return /^\d+$/.test(String(val)) ? Number(val) : NaN;
+  }
+
   const clientProperties = Object.create(CLIENT_PROPERTIES);
 
   return {
@@ -61,6 +66,8 @@ function openFrames(vhost, query, credentials, extraClientProperties) {
     frameMax: intOrDefault(query.frameMax, 131072),
     heartbeat: query.heartbeat != null ? intOrDefault(query.heartbeat, 0) : null,
 
+    maxFrameSize: maxFrameSizeOrUndefined(query.maxFrameSize),
+
     // open
     virtualHost: vhost,
     capabilities: '',
@@ -120,6 +127,7 @@ function connect(url, socketOptions, openCallback) {
       channelMax: url.channelMax,
       frameMax: url.frameMax,
       heartbeat: url.heartbeat,
+      maxFrameSize: url.maxFrameSize,
     };
 
     fields = openFrames(url.vhost, config, sockopts.credentials || credentials.plain(user, pass), extraClientProperties);

package/lib/connection.js

@@ -27,6 +27,7 @@ const DEFAULT_WRITE_HWM = 1024;
 // at once. Note that this is less than the minimum frame size: if it
 // was greater, we might have to fragment the content.
 const SINGLE_CHUNK_THRESHOLD = 2048;
+const DEFAULT_MAX_FRAME_SIZE = 64 * 1024 * 1024;
 
 class Connection extends EventEmitter {
   constructor(underlying) {
@@ -38,6 +39,7 @@ class Connection extends EventEmitter {
     // frames
     this.rest = Buffer.alloc(0);
     this.frameMax = constants.FRAME_MIN_SIZE;
+    this.maxFrameSize = DEFAULT_MAX_FRAME_SIZE;
     this.sentSinceLastCheck = false;
     this.recvSinceLastCheck = false;
 
@@ -86,6 +88,17 @@ class Connection extends EventEmitter {
     const self = this;
     const openCallback = openCallback0 || (() => {});
 
+    const maxFrameSize = allFields.maxFrameSize;
+    const maxFrameSizeDefaulted = maxFrameSize === undefined || maxFrameSize === null;
+    if (maxFrameSizeDefaulted) {
+      self.maxFrameSize = DEFAULT_MAX_FRAME_SIZE;
+    } else if (!Number.isInteger(maxFrameSize) || (maxFrameSize !== 0 && maxFrameSize < constants.FRAME_MIN_SIZE)) {
+      bail(new TypeError(fmt('maxFrameSize must be 0 (no limit) or an integer of at least %d; got %s', constants.FRAME_MIN_SIZE, maxFrameSize)));
+      return;
+    } else {
+      self.maxFrameSize = maxFrameSize;
+    }
+
     // This is where we'll put our negotiated values
     const tunedOptions = Object.create(allFields);
 
@@ -157,6 +170,10 @@ class Connection extends EventEmitter {
           break;
         case defs.ConnectionTune: {
           const fields = reply.fields;
+          if (fields.frameMax !== 0 && fields.frameMax < constants.FRAME_MIN_SIZE) {
+            bail(new Error(fmt('Server frameMax %d is below the protocol minimum %d', fields.frameMax, constants.FRAME_MIN_SIZE)));
+            return;
+          }
           tunedOptions.frameMax = negotiate(fields.frameMax, allFields.frameMax);
           tunedOptions.channelMax = negotiate(fields.channelMax, allFields.channelMax);
           if (allFields.heartbeat == null) {
@@ -191,6 +208,9 @@ class Connection extends EventEmitter {
       // value is zero, meaning "no, no limits"
       self.channelMax = tunedOptions.channelMax || 0xffff;
       self.frameMax = tunedOptions.frameMax || 0xffffffff;
+      if (maxFrameSizeDefaulted && tunedOptions.frameMax !== 0 && tunedOptions.frameMax > self.maxFrameSize) {
+        self.maxFrameSize = tunedOptions.frameMax;
+      }
       // 0 means "no heartbeat", rather than "maximum period of
       // heartbeating"
       self.heartbeat = tunedOptions.heartbeat;
@@ -526,6 +546,9 @@ class Connection extends EventEmitter {
     const buffer = this.channels[channel].buffer;
 
     const maxBody = this.frameMax - FRAME_OVERHEAD;
+    if (!(maxBody > 0)) {
+      throw new Error(fmt('Cannot send content: frameMax %d leaves no room for a body frame', this.frameMax));
+    }
 
     for (let offset = 0; offset < body.length; offset += maxBody) {
       const end = offset + maxBody;
@@ -539,7 +562,7 @@ class Connection extends EventEmitter {
 
   recvFrame() {
     // %%% identifying invariants might help here?
-    const frame = parseFrame(this.rest);
+    const frame = parseFrame(this.rest, this.maxFrameSize);
 
     if (!frame) {
       const incoming = this.stream.read();
@@ -654,3 +677,4 @@ function isFatalError(error) {
 
 module.exports.Connection = Connection;
 module.exports.isFatalError = isFatalError;
+module.exports.DEFAULT_MAX_FRAME_SIZE = DEFAULT_MAX_FRAME_SIZE;

package/lib/frame.js

@@ -78,7 +78,7 @@ module.exports.makeBodyFrame = (channel, payload) => {
  * @arg { number } max
  * @returns { FrameStructure | boolean }
  */
-function parseFrame(bin) {
+function parseFrame(bin, max) {
   if (bin.length < FRAME_HEADER_BYTES) {
     return false;
   }
@@ -87,6 +87,10 @@ function parseFrame(bin) {
   const channel = bin.readUInt16BE(1);
   const size = bin.readUInt32BE(3);
 
+  if (max > 0 && size > max) {
+    throw new Error(`Frame size ${size} exceeds maxFrameSize ${max}`);
+  }
+
   const totalSize = FRAME_HEADER_BYTES + size + FRAME_END_BYTES;
 
   if (bin.length < totalSize) {

package/lib/properties.d.ts

@@ -33,6 +33,7 @@ export namespace Options {
     password?: string;
     locale?: string;
     frameMax?: number;
+    maxFrameSize?: number;
     heartbeat?: number;
     vhost?: string;
     channelMax?: number;

package/package.json

@@ -2,7 +2,7 @@
   "name": "amqplib",
   "homepage": "http://amqp-node.github.io/amqplib/",
   "main": "./channel_api.js",
-  "version": "2.2.1",
+  "version": "2.3.1",
   "types": "./index.d.ts",
   "exports": {
     ".": {