fastify 3.29.3 → 3.29.5

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '3.29.3'
+const VERSION = '3.29.5'
 
 const Avvio = require('avvio')
 const http = require('http')

package/lib/contentTypeParser.js

@@ -6,6 +6,7 @@ let lru = require('tiny-lru')
 // See https://github.com/fastify/fastify/issues/2356
 // and https://github.com/fastify/fastify/discussions/2907.
 lru = typeof lru === 'function' ? lru : lru.default
+const { safeParse: safeParseContentType, defaultContentType } = require('fast-content-type-parse')
 
 const secureJson = require('secure-json-parse')
 const {
@@ -36,7 +37,7 @@ function ContentTypeParser (bodyLimit, onProtoPoisoning, onConstructorPoisoning)
   this.customParsers = new Map()
   this.customParsers.set('application/json', new Parser(true, false, bodyLimit, this[kDefaultJsonParse]))
   this.customParsers.set('text/plain', new Parser(true, false, bodyLimit, defaultPlainTextParser))
-  this.parserList = ['application/json', 'text/plain']
+  this.parserList = [new ParserListItem('application/json'), new ParserListItem('text/plain')]
   this.parserRegExpList = []
   this.cache = lru(100)
 }
@@ -69,8 +70,9 @@ ContentTypeParser.prototype.add = function (contentType, opts, parserFn) {
     this.customParsers.set('', parser)
   } else {
     if (contentTypeIsString) {
-      this.parserList.unshift(contentType)
+      this.parserList.unshift(new ParserListItem(contentType))
     } else {
+      contentType.isEssence = contentType.source.indexOf(';') === -1
       this.parserRegExpList.unshift(contentType)
     }
     this.customParsers.set(contentType.toString(), parser)
@@ -97,11 +99,25 @@ ContentTypeParser.prototype.getParser = function (contentType) {
     return this.customParsers.get(contentType)
   }
 
+  const parser = this.cache.get(contentType)
+  // TODO not covered by tests, this is a security backport
+  /* istanbul ignore next */
+  if (parser !== undefined) return parser
+
+  const parsed = safeParseContentType(contentType)
+
+  // dummyContentType always the same object
+  // we can use === for the comparsion and return early
+  if (parsed === defaultContentType) {
+    return this.customParsers.get('')
+  }
+
   // eslint-disable-next-line no-var
   for (var i = 0; i !== this.parserList.length; ++i) {
-    const parserName = this.parserList[i]
-    if (contentType.indexOf(parserName) !== -1) {
-      const parser = this.customParsers.get(parserName)
+    const parserListItem = this.parserList[i]
+    if (compareContentType(parsed, parserListItem)) {
+      const parser = this.customParsers.get(parserListItem.name)
+      // we set request content-type in cache to reduce parsing of MIME type
       this.cache.set(contentType, parser)
       return parser
     }
@@ -110,8 +126,9 @@ ContentTypeParser.prototype.getParser = function (contentType) {
   // eslint-disable-next-line no-var
   for (var j = 0; j !== this.parserRegExpList.length; ++j) {
     const parserRegExp = this.parserRegExpList[j]
-    if (parserRegExp.test(contentType)) {
+    if (compareRegExpContentType(contentType, parsed.type, parserRegExp)) {
       const parser = this.customParsers.get(parserRegExp.toString())
+      // we set request content-type in cache to reduce parsing of MIME type
       this.cache.set(contentType, parser)
       return parser
     }
@@ -297,6 +314,7 @@ function buildContentTypeParser (c) {
   contentTypeParser[kDefaultJsonParse] = c[kDefaultJsonParse]
   contentTypeParser.customParsers = new Map(c.customParsers.entries())
   contentTypeParser.parserList = c.parserList.slice()
+  contentTypeParser.parserRegExpList = c.parserRegExpList.slice()
   return contentTypeParser
 }
 
@@ -348,6 +366,52 @@ function removeAllContentTypeParsers () {
   this[kContentTypeParser].removeAll()
 }
 
+function compareContentType (contentType, parserListItem) {
+  if (parserListItem.isEssence) {
+    // we do essence check
+    return contentType.type.indexOf(parserListItem) !== -1
+  } else {
+    // when the content-type includes parameters
+    // we do a full-text search
+    // reject essence content-type before checking parameters
+    if (contentType.type.indexOf(parserListItem.type) === -1) return false
+    for (const key of parserListItem.parameterKeys) {
+      // reject when missing parameters
+      if (!(key in contentType.parameters)) return false
+      // reject when parameters do not match
+      if (contentType.parameters[key] !== parserListItem.parameters[key]) return false
+    }
+    return true
+  }
+}
+
+function compareRegExpContentType (contentType, essenceMIMEType, regexp) {
+  if (regexp.isEssence) {
+    // we do essence check
+    return regexp.test(essenceMIMEType)
+  } else {
+    // when the content-type includes parameters
+    // we do a full-text match
+    return regexp.test(contentType)
+  }
+}
+
+function ParserListItem (contentType) {
+  this.name = contentType
+  // we pre-calculate all the needed information
+  // before content-type comparsion
+  const parsed = safeParseContentType(contentType)
+  this.type = parsed.type
+  this.parameters = parsed.parameters
+  this.parameterKeys = Object.keys(parsed.parameters)
+  this.isEssence = contentType.indexOf(';') === -1
+}
+
+// used in ContentTypeParser.remove
+ParserListItem.prototype.toString = function () {
+  return this.name
+}
+
 module.exports = ContentTypeParser
 module.exports.helpers = {
   buildContentTypeParser,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastify",
-  "version": "3.29.3",
+  "version": "3.29.5",
   "description": "Fast and low overhead web framework, for Node.js",
   "main": "fastify.js",
   "type": "commonjs",
@@ -158,9 +158,9 @@
     "ienoopen": "^1.1.0",
     "JSONStream": "^1.3.5",
     "license-checker": "^25.0.1",
-    "pem": "^1.14.4",
     "proxyquire": "^2.1.3",
     "pump": "^3.0.0",
+    "self-cert": "^2.0.0",
     "send": "^0.17.1",
     "serve-static": "^1.14.1",
     "simple-get": "^4.0.0",
@@ -181,6 +181,7 @@
     "@fastify/error": "^2.0.0",
     "abstract-logging": "^2.0.0",
     "avvio": "^7.1.2",
+    "fast-content-type-parse": "^1.0.0",
     "fast-json-stringify": "^2.5.2",
     "find-my-way": "^4.5.0",
     "flatstr": "^1.0.12",

package/test/build-certificate.js

@@ -1,19 +1,18 @@
 'use strict'
 
-const util = require('util')
-const pem = require('pem')
-
-const createCertificate = util.promisify(pem.createCertificate)
+const selfCert = require('self-cert')
 
 async function buildCertificate () {
   // "global" is used in here because "t.context" is only supported by "t.beforeEach" and "t.afterEach"
   // For the test case which execute this code which will be using `t.before` and it can reduce the
   // number of times executing it.
   if (!global.context || !global.context.cert || !global.context.key) {
-    const keys = await createCertificate({ days: 1, selfSigned: true })
+    const certs = selfCert({
+      expires: new Date(Date.now() + 86400000)
+    })
     global.context = {
-      cert: keys.certificate,
-      key: keys.serviceKey
+      cert: certs.certificate,
+      key: certs.privateKey
     }
   }
 }

package/test/content-parser.test.js

@@ -328,3 +328,260 @@ test('Safeguard against malicious content-type / 3', async t => {
 
   t.same(response.statusCode, 415)
 })
+
+test('Safeguard against content-type spoofing - string', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser('text/plain', function (request, body, done) {
+    t.pass('should be called')
+    done(null, body)
+  })
+  fastify.addContentTypeParser('application/json', function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'text/plain; content-type="application/json"'
+    },
+    body: ''
+  })
+})
+
+test('Safeguard against content-type spoofing - regexp', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser(/text\/plain/, function (request, body, done) {
+    t.pass('should be called')
+    done(null, body)
+  })
+  fastify.addContentTypeParser(/application\/json/, function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'text/plain; content-type="application/json"'
+    },
+    body: ''
+  })
+})
+
+test('content-type match parameters - string 1', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser('text/plain; charset=utf8', function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+  fastify.addContentTypeParser('application/json; charset=utf8', function (request, body, done) {
+    t.pass('should be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'application/json; charset=utf8'
+    },
+    body: ''
+  })
+})
+
+test('content-type match parameters - string 2', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser('application/json; charset=utf8; foo=bar', function (request, body, done) {
+    t.pass('should be called')
+    done(null, body)
+  })
+  fastify.addContentTypeParser('text/plain; charset=utf8; foo=bar', function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'application/json; foo=bar; charset=utf8'
+    },
+    body: ''
+  })
+})
+
+test('content-type match parameters - regexp', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser(/application\/json; charset=utf8/, function (request, body, done) {
+    t.pass('should be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'application/json; charset=utf8'
+    },
+    body: ''
+  })
+})
+
+test('content-type fail when parameters not match - string 1', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser('application/json; charset=utf8; foo=bar', function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'application/json; charset=utf8'
+    },
+    body: ''
+  })
+
+  t.same(response.statusCode, 415)
+})
+
+test('content-type fail when parameters not match - string 2', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser('application/json; charset=utf8; foo=bar', function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'application/json; charset=utf8; foo=baz'
+    },
+    body: ''
+  })
+
+  t.same(response.statusCode, 415)
+})
+
+test('content-type fail when parameters not match - regexp', async t => {
+  t.plan(1)
+
+  const fastify = Fastify()
+  fastify.removeAllContentTypeParsers()
+  fastify.addContentTypeParser(/application\/json; charset=utf8; foo=bar/, function (request, body, done) {
+    t.fail('shouldn\'t be called')
+    done(null, body)
+  })
+
+  fastify.post('/', async () => {
+    return 'ok'
+  })
+
+  const response = await fastify.inject({
+    method: 'POST',
+    path: '/',
+    headers: {
+      'content-type': 'application/json; charset=utf8'
+    },
+    body: ''
+  })
+
+  t.same(response.statusCode, 415)
+})
+
+// Refs: https://github.com/fastify/fastify/issues/4495
+test('content-type regexp list should be cloned when plugin override', async t => {
+  t.plan(6)
+
+  const fastify = Fastify()
+
+  fastify.addContentTypeParser(/^image\/.*/, { parseAs: 'buffer' }, (req, payload, done) => {
+    done(null, payload)
+  })
+
+  fastify.register(function plugin (fastify, options, done) {
+    fastify.post('/', function (request, reply) {
+      reply.type(request.headers['content-type']).send(request.body)
+    })
+
+    done()
+  })
+
+  {
+    const { payload, headers, statusCode } = await fastify.inject({
+      method: 'POST',
+      path: '/',
+      payload: 'jpeg',
+      headers: { 'content-type': 'image/jpeg' }
+    })
+    t.same(statusCode, 200)
+    t.same(headers['content-type'], 'image/jpeg')
+    t.same(payload, 'jpeg')
+  }
+
+  {
+    const { payload, headers, statusCode } = await fastify.inject({
+      method: 'POST',
+      path: '/',
+      payload: 'png',
+      headers: { 'content-type': 'image/png' }
+    })
+    t.same(statusCode, 200)
+    t.same(headers['content-type'], 'image/png')
+    t.same(payload, 'png')
+  }
+})

package/test/custom-parser.test.js

@@ -1120,7 +1120,7 @@ test('The charset should not interfere with the content type handling', t => {
       url: 'http://localhost:' + fastify.server.address().port,
       body: '{"hello":"world"}',
       headers: {
-        'Content-Type': 'application/json charset=utf-8'
+        'Content-Type': 'application/json; charset=utf-8'
       }
     }, (err, response, body) => {
       t.error(err)
@@ -1303,7 +1303,7 @@ test('contentTypeParser should add a custom parser with RegExp value', t => {
         url: 'http://localhost:' + fastify.server.address().port,
         body: '{"hello":"world"}',
         headers: {
-          'Content-Type': 'weird-content-type+json'
+          'Content-Type': 'weird/content-type+json'
         }
       }, (err, response, body) => {
         t.error(err)
@@ -1333,7 +1333,7 @@ test('contentTypeParser should add multiple custom parsers with RegExp values',
     done(null, 'xml')
   })
 
-  fastify.addContentTypeParser(/.*\+myExtension$/, function (req, payload, done) {
+  fastify.addContentTypeParser(/.*\+myExtension$/i, function (req, payload, done) {
     let data = ''
     payload.on('data', chunk => { data += chunk })
     payload.on('end', () => {