fastify 4.19.1 → 4.20.0

package/.c8rc.json

@@ -0,0 +1,8 @@
+{
+  "exclude": [
+    "lib/configValidator.js",
+    "lib/error-serializer.js",
+    "build/build-error-serializer.js",
+    "test/*"
+  ]
+}

package/.taprc

@@ -1,8 +1,9 @@
 ts: false
 jsx: false
 flow: false
-check-coverage: true
-coverage: true
+# the coverage is performed by c8
+check-coverage: false
+coverage: false
 node-arg: --allow-natives-syntax
 
 files:

package/SECURITY.md

@@ -27,6 +27,15 @@ reported vulnerabilities:
   validity of the report. In any case, the report should follow the same process
   as outlined below of inviting the maintainers to review and accept the
   vulnerability.
+* ***Do not*** attempt to show CI/CD vulnerabilities by creating new pull
+  requests to any of the Fastify organization's repositories. Doing so will
+  result in a [content report][cr] to GitHub as an unsolicited exploit.
+  The proper way to provide such reports is by creating a new repository,
+  configured in the same manner as the repository you would like to submit
+  a report about, and with a pull request to your own repository showing
+  the proof of concept.
+
+[cr]: https://docs.github.com/en/communities/maintaining-your-safety-on-github/reporting-abuse-or-spam#reporting-an-issue-or-pull-request
 
 ### Vulnerabilities found outside this process
 

package/docs/Guides/Prototype-Poisoning.md

@@ -13,8 +13,8 @@ open-source software and the limitations of existing communication channels.
 
 But first, if we use a JavaScript framework to process incoming JSON data, take
 a moment to read up on [Prototype Poisoning](https://medium.com/intrinsic/javascript-prototype-poisoning-vulnerabilities-in-the-wild-7bc15347c96)
-in general, and the specific [technical details]
-(https://github.com/hapijs/hapi/issues/3916) of this issue.
+in general, and the specific
+[technical details](https://github.com/hapijs/hapi/issues/3916) of this issue.
 This could be a critical issue so, we might need to verify your own code first.
 It focuses on specific framework however, any solution that uses `JSON.parse()` 
 to process external data is potentially at risk.

package/docs/Reference/Errors.md

@@ -168,8 +168,6 @@ ajv.plugins option should be an array.
 
 Version constraint should be a string.
 
-<a name="FST_ERR_CTP_ALREADY_PRESENT"></a>
-
 #### FST_ERR_CTP_ALREADY_PRESENT
 <a id="FST_ERR_CTP_ALREADY_PRESENT"></a>
 
@@ -260,6 +258,11 @@ The hook name must be a string.
 
 The hook callback must be a function.
 
+#### FST_ERR_HOOK_INVALID_ASYNC_HANDLER
+<a id="FST_ERR_HOOK_INVALID_ASYNC_HANDLER"></a>
+
+Async function has too many arguments. Async hooks should not use the `done` argument.
+
 #### FST_ERR_HOOK_NOT_SUPPORTED
 <a id="FST_ERR_HOOK_NOT_SUPPORTED"></a>
 
@@ -271,8 +274,8 @@ The hook is not supported.
 You must register a plugin for handling middlewares,
 visit [`Middleware`](./Middleware.md) for more info.
 
-<a name="FST_ERR_HOOK_TIMEOUT"></a>
 #### FST_ERR_HOOK_TIMEOUT
+<a id="FST_ERR_HOOK_TIMEOUT"></a>
 
 A callback for a hook timed out
 
@@ -327,11 +330,21 @@ Called `reply.trailer` with an invalid header name.
 
 Called `reply.trailer` with an invalid type. Expected a function.
 
+#### FST_ERR_FAILED_ERROR_SERIALIZATION
+<a id="FST_ERR_FAILED_ERROR_SERIALIZATION"></a>
+
+Failed to serialize an error.
+
 #### FST_ERR_MISSING_SERIALIZATION_FN
 <a id="FST_ERR_MISSING_SERIALIZATION_FN"></a>
 
 Missing serialization function.
 
+#### FST_ERR_MISSING_CONTENTTYPE_SERIALIZATION_FN
+<a id="FST_ERR_MISSING_CONTENTTYPE_SERIALIZATION_FN"></a>
+
+Missing serialization function.
+
 #### FST_ERR_REQ_INVALID_VALIDATION_INVOCATION
 <a id="FST_ERR_REQ_INVALID_VALIDATION_INVOCATION"></a>
 
@@ -348,6 +361,11 @@ The schema provided does not have `$id` property.
 
 A schema with the same `$id` already exists.
 
+#### FST_ERR_SCH_CONTENT_MISSING_SCHEMA
+<a id="FST_ERR_SCH_CONTENT_MISSING_SCHEMA"></a>
+
+A schema is missing for the corresponding content type.
+
 #### FST_ERR_SCH_DUPLICATE
 <a id="FST_ERR_SCH_DUPLICATE"></a>
 
@@ -384,8 +402,8 @@ Invalid initialization options.
 Cannot set forceCloseConnections to `idle` as your HTTP server
 does not support `closeIdleConnections` method.
 
-<a name="FST_ERR_DUPLICATED_ROUTE"></a>
 #### FST_ERR_DUPLICATED_ROUTE
+<a id="FST_ERR_DUPLICATED_ROUTE"></a>
 
 The HTTP method already has a registered controller for that URL
 
@@ -394,7 +412,7 @@ The HTTP method already has a registered controller for that URL
 
 The router received an invalid url.
 
-### FST_ERR_ASYNC_CONSTRAINT
+#### FST_ERR_ASYNC_CONSTRAINT
 <a id="FST_ERR_ASYNC_CONSTRAINT"></a>
 
 The router received an error when using asynchronous constraints.
@@ -469,38 +487,42 @@ Fastify is already listening.
 
 Installed Fastify plugin mismatched expected version.
 
-<a name="FST_ERR_PLUGIN_CALLBACK_NOT_FN"></a>
-
 #### FST_ERR_PLUGIN_CALLBACK_NOT_FN
+<a id="FST_ERR_PLUGIN_CALLBACK_NOT_FN"></a>
 
 Callback for a hook is not a function (mapped directly from `avvio`)
 
-<a name="FST_ERR_PLUGIN_NOT_VALID"></a>
-
 #### FST_ERR_PLUGIN_NOT_VALID
+<a id="FST_ERR_PLUGIN_NOT_VALID"></a>
 
 Plugin must be a function or a promise.
 
-<a name="FST_ERR_ROOT_PLG_BOOTED"></a>
-
 #### FST_ERR_ROOT_PLG_BOOTED
+<a id="FST_ERR_ROOT_PLG_BOOTED"></a>
 
 Root plugin has already booted (mapped directly from `avvio`)
 
-<a name="FST_ERR_PARENT_PLUGIN_BOOTED"></a>
-
 #### FST_ERR_PARENT_PLUGIN_BOOTED
+<a id="FST_ERR_PARENT_PLUGIN_BOOTED"></a>
 
 Impossible to load plugin because the parent (mapped directly from `avvio`)
 
-<a name="FST_ERR_PLUGIN_TIMEOUT"></a>
-
 #### FST_ERR_PLUGIN_TIMEOUT
+<a id="FST_ERR_PLUGIN_TIMEOUT"></a>
 
 Plugin did not start in time. Default timeout (in millis): `10000`
 
-<a name="FST_ERR_PLUGIN_NOT_PRESENT_IN_INSTANCE"></a>
-
 #### FST_ERR_PLUGIN_NOT_PRESENT_IN_INSTANCE
+<a id="FST_ERR_PLUGIN_NOT_PRESENT_IN_INSTANCE"></a>
 
 The decorator is not present in the instance.
+
+#### FST_ERR_VALIDATION
+<a id="FST_ERR_VALIDATION"></a>
+
+The Request failed the payload validation.
+
+#### FST_ERR_LISTEN_OPTIONS_INVALID
+<a id="FST_ERR_LISTEN_OPTIONS_INVALID"></a>
+
+Invalid listen options.

package/docs/Reference/Logging.md

@@ -196,7 +196,7 @@ app.addHook('preHandler', function (req, reply, done) {
 })
 ```
 
-**Note**: Care should be take to ensure serializers never throw, as an error
+**Note**: Care should be taken to ensure serializers never throw, as an error
 thrown from a serializer has the potential to cause the Node process to exit.
 See the [Pino documentation](https://getpino.io/#/docs/api?id=opt-serializers)
 on serializers for more information.

package/docs/Reference/Plugins.md

@@ -145,6 +145,10 @@ await fastify.ready()
 
 await fastify.listen({ port: 3000 })
 ```
+*Note: Using `await` when registering a plugin loads the plugin
+and the underlying dependency tree, "finalizing" the encapsulation process.
+Any mutations to the plugin after it and its dependencies have been
+loaded will not be reflected in the parent instance.*
 
 #### ESM support
 <a id="esm-support"></a>

package/docs/Reference/Routes.md

@@ -90,6 +90,14 @@ fastify.route(options)
   To access the default handler, you can access `instance.errorHandler`. Note
   that this will point to fastify's default `errorHandler` only if a plugin
   hasn't overridden it already.
+* `childLoggerFactory(logger, binding, opts, rawReq)`: a custom factory function
+  that will be called to produce a child logger instance for every request.
+  See [`childLoggerFactory`](./Server.md#childloggerfactory) for more info.
+  Overrides the default logger factory, and anything set by 
+  [`setChildLoggerFactory`](./Server.md#setchildloggerfactory), for requests to
+  the route. To access the default factory, you can access 
+  `instance.childLoggerFactory`. Note that this will point to Fastify's default
+  `childLoggerFactory` only if a plugin hasn't overridden it already.
 * `validatorCompiler({ schema, method, url, httpPart })`: function that builds
   schemas for request validations. See the [Validation and
   Serialization](./Validation-and-Serialization.md#schema-validator)

package/docs/Reference/Server.md

@@ -80,6 +80,7 @@ describes the properties available in that options object.
     - [schemaController](#schemacontroller)
     - [setNotFoundHandler](#setnotfoundhandler)
     - [setErrorHandler](#seterrorhandler)
+    - [setChildLoggerFactory](#setchildloggerfactory)
     - [addConstraintStrategy](#addconstraintstrategy)
     - [hasConstraintStrategy](#hasconstraintstrategy)
     - [printRoutes](#printroutes)
@@ -91,6 +92,7 @@ describes the properties available in that options object.
     - [getDefaultJsonParser](#getdefaultjsonparser)
     - [defaultTextParser](#defaulttextparser)
     - [errorHandler](#errorhandler)
+    - [childLoggerFactory](#childloggerfactory)
     - [initialConfig](#initialconfig)
 
 ### `http`
@@ -1537,6 +1539,35 @@ if (statusCode >= 500) {
   log.error(error)
 }
 ```
+#### setChildLoggerFactory
+<a id="set-child-logger-factory"></a>
+
+`fastify.setChildLoggerFactory(factory(logger, bindings, opts, rawReq))`: Set a
+function that will be called when creating a child logger instance for each request
+which allows for modifying or adding child logger bindings and logger options, or
+returning a completely custom child logger implementation.
+
+Child logger bindings have a performance advantage over per-log bindings, because
+they are pre-serialised by Pino when the child logger is created.
+
+The first parameter is the parent logger instance, followed by the default bindings
+and logger options which should be passed to the child logger, and finally
+the raw request (not a Fastify request object). The function is bound with `this`
+being the Fastify instance.
+
+For example:
+```js
+const fastify = require('fastify')({
+  childLoggerFactory: function (logger, bindings, opts, rawReq) {
+    // Calculate additional bindings from the request if needed
+    bindings.traceContext = rawReq.headers['x-cloud-trace-context']
+    return logger.child(bindings, opts)
+  }
+})
+```
+
+The handler is bound to the Fastify instance and is fully encapsulated, so
+different plugins can set different logger factories.
 
 #### addConstraintStrategy
 <a id="addConstraintStrategy"></a>
@@ -1810,6 +1841,13 @@ fastify.get('/', {
 }, handler)
 ```
 
+#### childLoggerFactory
+<a id="childLoggerFactory"></a>
+
+`fastify.childLoggerFactory` returns the custom logger factory function for the
+Fastify instance. See the [`childLoggerFactory` config option](#setchildloggerfactory)
+for more info.
+
 #### initialConfig
 <a id="initial-config"></a>
 

package/fastify.d.ts

@@ -14,7 +14,7 @@ import { FastifyContext, FastifyContextConfig } from './types/context'
 import { FastifyErrorCodes } from './types/errors'
 import { DoneFuncWithErrOrRes, HookHandlerDoneFunction, RequestPayload, onCloseAsyncHookHandler, onCloseHookHandler, onErrorAsyncHookHandler, onErrorHookHandler, onReadyAsyncHookHandler, onReadyHookHandler, onRegisterHookHandler, onRequestAsyncHookHandler, onRequestHookHandler, onResponseAsyncHookHandler, onResponseHookHandler, onRouteHookHandler, onSendAsyncHookHandler, onSendHookHandler, onTimeoutAsyncHookHandler, onTimeoutHookHandler, preHandlerAsyncHookHandler, preHandlerHookHandler, preParsingAsyncHookHandler, preParsingHookHandler, preSerializationAsyncHookHandler, preSerializationHookHandler, preValidationAsyncHookHandler, preValidationHookHandler, onRequestAbortHookHandler, onRequestAbortAsyncHookHandler } from './types/hooks'
 import { FastifyListenOptions, FastifyInstance, PrintRoutesOptions } from './types/instance'
-import { FastifyBaseLogger, FastifyLoggerInstance, FastifyLoggerOptions, PinoLoggerOptions, FastifyLogFn, LogLevel } from './types/logger'
+import { FastifyBaseLogger, FastifyLoggerInstance, FastifyLoggerOptions, PinoLoggerOptions, FastifyLogFn, LogLevel, Bindings, ChildLoggerOptions } from './types/logger'
 import { FastifyPluginCallback, FastifyPluginAsync, FastifyPluginOptions, FastifyPlugin } from './types/plugin'
 import { FastifyRegister, FastifyRegisterOptions, RegisterOptions } from './types/register'
 import { FastifyReply } from './types/reply'
@@ -106,6 +106,7 @@ declare namespace fastify {
     serializerOpts?: FJSOptions | Record<string, unknown>,
     serverFactory?: FastifyServerFactory<RawServer>,
     caseSensitive?: boolean,
+    allowUnsafeRegex?: boolean,
     requestIdHeader?: string | false,
     requestIdLogLabel?: string;
     jsonShorthand?: boolean;
@@ -158,7 +159,7 @@ declare namespace fastify {
     /**
      * listener to error events emitted by client connections
      */
-    clientErrorHandler?: (error: ConnectionError, socket: Socket) => void
+    clientErrorHandler?: (error: ConnectionError, socket: Socket) => void,
   }
 
   export interface ValidationResult {

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '4.19.1'
+const VERSION = '4.20.0'
 
 const Avvio = require('avvio')
 const http = require('http')
@@ -28,20 +28,21 @@ const {
   kSchemaErrorFormatter,
   kErrorHandler,
   kKeepAliveConnections,
-  kFourOhFourContext
+  kChildLoggerFactory
 } = require('./lib/symbols.js')
 
 const { createServer, compileValidateHTTPVersion } = require('./lib/server')
 const Reply = require('./lib/reply')
 const Request = require('./lib/request')
+const Context = require('./lib/context.js')
 const { supportedMethods } = require('./lib/httpMethods')
 const decorator = require('./lib/decorate')
 const ContentTypeParser = require('./lib/contentTypeParser')
 const SchemaController = require('./lib/schema-controller')
 const { Hooks, hookRunnerApplication, supportedHooks } = require('./lib/hooks')
-const { createLogger } = require('./lib/logger')
+const { createLogger, createChildLogger, defaultChildLoggerFactory } = require('./lib/logger')
 const pluginUtils = require('./lib/pluginUtils')
-const reqIdGenFactory = require('./lib/reqIdGenFactory')
+const { reqIdGenFactory } = require('./lib/reqIdGenFactory')
 const { buildRouting, validateBodyLimitOption } = require('./lib/route')
 const build404 = require('./lib/fourOhFour')
 const getSecuredInitialConfig = require('./lib/initialConfigValidation')
@@ -74,14 +75,6 @@ const {
 
 const { buildErrorHandler } = require('./lib/error-handler.js')
 
-const onBadUrlContext = {
-  config: {
-  },
-  onSend: [],
-  onError: [],
-  [kFourOhFourContext]: null
-}
-
 function defaultBuildPrettyMeta (route) {
   // return a shallow copy of route's sanitized context
 
@@ -95,6 +88,9 @@ function defaultBuildPrettyMeta (route) {
   return Object.assign({}, cleanKeys)
 }
 
+/**
+ * @param {import('./fastify.js').FastifyServerOptions} options
+ */
 function fastify (options) {
   // Options validations
   options = options || {}
@@ -113,7 +109,7 @@ function fastify (options) {
 
   validateBodyLimitOption(options.bodyLimit)
 
-  const requestIdHeader = (options.requestIdHeader === false) ? false : (options.requestIdHeader || defaultInitOptions.requestIdHeader)
+  const requestIdHeader = (options.requestIdHeader === false) ? false : (options.requestIdHeader || defaultInitOptions.requestIdHeader).toLowerCase()
   const genReqId = reqIdGenFactory(requestIdHeader, options.genReqId)
   const requestIdLogLabel = options.requestIdLogLabel || 'reqId'
   const bodyLimit = options.bodyLimit || defaultInitOptions.bodyLimit
@@ -235,6 +231,7 @@ function fastify (options) {
     [kSchemaController]: schemaController,
     [kSchemaErrorFormatter]: null,
     [kErrorHandler]: buildErrorHandler(),
+    [kChildLoggerFactory]: defaultChildLoggerFactory,
     [kReplySerializerDefault]: null,
     [kContentTypeParser]: new ContentTypeParser(
       bodyLimit,
@@ -340,6 +337,8 @@ function fastify (options) {
     // custom error handling
     setNotFoundHandler,
     setErrorHandler,
+    // child logger
+    setChildLoggerFactory,
     // Set fastify initial configuration options read-only object
     initialConfig,
     // constraint strategies
@@ -351,11 +350,13 @@ function fastify (options) {
     listeningOrigin: {
       get () {
         const address = this.addresses().slice(-1).pop()
-        /* istanbul ignore if windows: unix socket is not testable on Windows platform */
+        /* ignore if windows: unix socket is not testable on Windows platform */
+        /* c8 ignore next 3 */
         if (typeof address === 'string') {
           return address
         }
-        return `${this[kOptions].https ? 'https' : 'http'}://${address.address}:${address.port}`
+        const host = address.family === 'IPv6' ? `[${address.address}]` : address.address
+        return `${this[kOptions].https ? 'https' : 'http'}://${host}:${address.port}`
       }
     },
     pluginName: {
@@ -379,6 +380,10 @@ function fastify (options) {
       configurable: true,
       get () { return this[kSchemaController].getSerializerCompiler() }
     },
+    childLoggerFactory: {
+      configurable: true,
+      get () { return this[kChildLoggerFactory] }
+    },
     version: {
       configurable: true,
       get () { return VERSION }
@@ -426,12 +431,6 @@ function fastify (options) {
       router.closeRoutes()
 
       hookRunnerApplication('preClose', fastify[kAvvioBoot], fastify, function () {
-        // No new TCP connections are accepted.
-        // We must call close on the server even if we are not listening
-        // otherwise memory will be leaked.
-        // https://github.com/nodejs/node/issues/48604
-        instance.server.close(done)
-
         if (fastify[kState].listening) {
           /* istanbul ignore next: Cannot test this without Node.js core support */
           if (forceCloseConnections === 'idle') {
@@ -450,13 +449,34 @@ function fastify (options) {
               fastify[kKeepAliveConnections].delete(conn)
             }
           }
+        }
+
+        // No new TCP connections are accepted.
+        // We must call close on the server even if we are not listening
+        // otherwise memory will be leaked.
+        // https://github.com/nodejs/node/issues/48604
+        if (!options.serverFactory || fastify[kState].listening) {
+          instance.server.close(function (err) {
+            /* c8 ignore next 6 */
+            if (err && err.code !== 'ERR_SERVER_NOT_RUNNING') {
+              done(null)
+            } else {
+              done()
+            }
+          })
         } else {
-          done(null)
+          process.nextTick(done, null)
         }
       })
     })
   })
 
+  // Create bad URL context
+  const onBadUrlContext = new Context({
+    server: fastify,
+    config: {}
+  })
+
   // Set the default 404 handler
   fastify.setNotFoundHandler()
   fourOhFour.arrange404(fastify)
@@ -698,7 +718,7 @@ function fastify (options) {
   function onBadUrl (path, req, res) {
     if (frameworkErrors) {
       const id = genReqId(req)
-      const childLogger = logger.child({ reqId: id })
+      const childLogger = createChildLogger(onBadUrlContext, logger, req, id)
 
       const request = new Request(id, null, req, null, childLogger, onBadUrlContext)
       const reply = new Reply(res, request, childLogger)
@@ -723,7 +743,7 @@ function fastify (options) {
       if (err) {
         if (frameworkErrors) {
           const id = genReqId(req)
-          const childLogger = logger.child({ reqId: id })
+          const childLogger = createChildLogger(onBadUrlContext, logger, req, id)
 
           const request = new Request(id, null, req, null, childLogger, onBadUrlContext)
           const reply = new Reply(res, request, childLogger)
@@ -795,6 +815,13 @@ function fastify (options) {
     return this
   }
 
+  function setChildLoggerFactory (factory) {
+    throwIfAlreadyStarted('Cannot call "setChildLoggerFactory"!')
+
+    this[kChildLoggerFactory] = factory
+    return this
+  }
+
   function printRoutes (opts = {}) {
     // includeHooks:true - shortcut to include all supported hooks exported by fastify.Hooks
     opts.includeMeta = opts.includeHooks ? opts.includeMeta ? supportedHooks.concat(opts.includeMeta) : supportedHooks : opts.includeMeta

package/lib/context.js

@@ -5,6 +5,8 @@ const {
   kReplySerializerDefault,
   kSchemaErrorFormatter,
   kErrorHandler,
+  kChildLoggerFactory,
+  kOptions,
   kReply,
   kRequest,
   kBodyLimit,
@@ -22,6 +24,8 @@ function Context ({
   schema,
   handler,
   config,
+  requestIdLogLabel,
+  childLoggerFactory,
   errorHandler,
   bodyLimit,
   logLevel,
@@ -51,6 +55,8 @@ function Context ({
   this.onRequestAbort = null
   this.config = config
   this.errorHandler = errorHandler || server[kErrorHandler]
+  this.requestIdLogLabel = requestIdLogLabel || server[kOptions].requestIdLogLabel
+  this.childLoggerFactory = childLoggerFactory || server[kChildLoggerFactory]
   this._middie = null
   this._parserOptions = {
     limit: bodyLimit || server[kBodyLimit]