fastify 5.3.3 → 5.4.0

package/test/proto-poisoning.test.js

@@ -1,11 +1,10 @@
 'use strict'
 
 const Fastify = require('..')
-const sget = require('simple-get').concat
 const { test } = require('node:test')
 
-test('proto-poisoning error', (t, done) => {
-  t.plan(3)
+test('proto-poisoning error', async (t) => {
+  t.plan(2)
 
   const fastify = Fastify()
 
@@ -13,52 +12,46 @@ test('proto-poisoning error', (t, done) => {
     t.assert.fail('handler should not be called')
   })
 
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: '{ "__proto__": { "a": 42 } }'
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 400)
-      fastify.close()
-      done()
-    })
+  t.after(() => fastify.close())
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ "__proto__": { "a": 42 } }'
   })
+
+  t.assert.ok(!result.ok)
+  t.assert.strictEqual(result.status, 400)
 })
 
-test('proto-poisoning remove', (t, done) => {
-  t.plan(4)
+test('proto-poisoning remove', async (t) => {
+  t.plan(3)
 
   const fastify = Fastify({ onProtoPoisoning: 'remove' })
 
+  t.after(() => fastify.close())
+
   fastify.post('/', (request, reply) => {
     t.assert.strictEqual(undefined, Object.assign({}, request.body).a)
     reply.send({ ok: true })
   })
 
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: '{ "__proto__": { "a": 42 }, "b": 42 }'
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 200)
-      fastify.close()
-      done()
-    })
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ "__proto__": { "a": 42 }, "b": 42 }'
   })
+
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
 })
 
-test('proto-poisoning ignore', (t, done) => {
-  t.plan(4)
+test('proto-poisoning ignore', async (t) => {
+  t.plan(3)
 
   const fastify = Fastify({ onProtoPoisoning: 'ignore' })
 
@@ -67,25 +60,22 @@ test('proto-poisoning ignore', (t, done) => {
     reply.send({ ok: true })
   })
 
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: '{ "__proto__": { "a": 42 }, "b": 42 }'
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 200)
-      fastify.close()
-      done()
-    })
+  t.after(() => fastify.close())
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ "__proto__": { "a": 42 }, "b": 42 }'
   })
+
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
 })
 
-test('constructor-poisoning error (default in v3)', (t, done) => {
-  t.plan(3)
+test('constructor-poisoning error (default in v3)', async (t) => {
+  t.plan(2)
 
   const fastify = Fastify()
 
@@ -93,72 +83,63 @@ test('constructor-poisoning error (default in v3)', (t, done) => {
     reply.send('ok')
   })
 
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: '{ "constructor": { "prototype": { "foo": "bar" } } }'
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 400)
-      fastify.close()
-      done()
-    })
+  t.after(() => fastify.close())
+
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ "constructor": { "prototype": { "foo": "bar" } } }'
   })
+
+  t.assert.ok(!result.ok)
+  t.assert.strictEqual(result.status, 400)
 })
 
-test('constructor-poisoning error', (t, done) => {
-  t.plan(3)
+test('constructor-poisoning error', async (t) => {
+  t.plan(2)
 
   const fastify = Fastify({ onConstructorPoisoning: 'error' })
 
+  t.after(() => fastify.close())
+
   fastify.post('/', (request, reply) => {
     t.assert.fail('handler should not be called')
   })
 
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: '{ "constructor": { "prototype": { "foo": "bar" } } }'
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 400)
-      fastify.close()
-      done()
-    })
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ "constructor": { "prototype": { "foo": "bar" } } }'
   })
+
+  t.assert.ok(!result.ok)
+  t.assert.strictEqual(result.status, 400)
 })
 
-test('constructor-poisoning remove', (t, done) => {
-  t.plan(4)
+test('constructor-poisoning remove', async (t) => {
+  t.plan(3)
 
   const fastify = Fastify({ onConstructorPoisoning: 'remove' })
 
+  t.after(() => fastify.close())
+
   fastify.post('/', (request, reply) => {
     t.assert.strictEqual(undefined, Object.assign({}, request.body).foo)
     reply.send({ ok: true })
   })
 
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: '{ "constructor": { "prototype": { "foo": "bar" } } }'
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 200)
-      fastify.close()
-      done()
-    })
+  const fastifyServer = await fastify.listen({ port: 0 })
+
+  const result = await fetch(fastifyServer, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: '{ "constructor": { "prototype": { "foo": "bar" } } }'
   })
+
+  t.assert.ok(result.ok)
+  t.assert.strictEqual(result.status, 200)
 })

package/test/request-error.test.js

@@ -323,52 +323,6 @@ test('default clientError replies with bad request on reused keep-alive connecti
   })
 })
 
-test('request.routeOptions should be immutable', (t, done) => {
-  t.plan(14)
-  const fastify = Fastify()
-  const handler = function (req, res) {
-    t.assert.strictEqual('POST', req.routeOptions.method)
-    t.assert.strictEqual('/', req.routeOptions.url)
-    t.assert.throws(() => { req.routeOptions = null }, new TypeError('Cannot set property routeOptions of #<Request> which has only a getter'))
-    t.assert.throws(() => { req.routeOptions.method = 'INVALID' }, new TypeError('Cannot assign to read only property \'method\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.url = '//' }, new TypeError('Cannot assign to read only property \'url\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.bodyLimit = 0xDEADBEEF }, new TypeError('Cannot assign to read only property \'bodyLimit\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.attachValidation = true }, new TypeError('Cannot assign to read only property \'attachValidation\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.logLevel = 'invalid' }, new TypeError('Cannot assign to read only property \'logLevel\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.version = '95.0.1' }, new TypeError('Cannot assign to read only property \'version\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.prefixTrailingSlash = true }, new TypeError('Cannot assign to read only property \'prefixTrailingSlash\' of object \'#<Object>\''))
-    t.assert.throws(() => { req.routeOptions.newAttribute = {} }, new TypeError('Cannot add property newAttribute, object is not extensible'))
-
-    for (const key of Object.keys(req.routeOptions)) {
-      if (typeof req.routeOptions[key] === 'object' && req.routeOptions[key] !== null) {
-        t.fail('Object.freeze must run recursively on nested structures to ensure that routeOptions is immutable.')
-      }
-    }
-
-    res.send({})
-  }
-  fastify.post('/', {
-    bodyLimit: 1000,
-    handler
-  })
-  fastify.listen({ port: 0 }, function (err) {
-    t.assert.ifError(err)
-    t.after(() => fastify.close())
-
-    sget({
-      method: 'POST',
-      url: 'http://localhost:' + fastify.server.address().port,
-      headers: { 'Content-Type': 'application/json' },
-      body: [],
-      json: true
-    }, (err, response, body) => {
-      t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 200)
-      done()
-    })
-  })
-})
-
 test('request.routeOptions.method is an uppercase string /1', (t, done) => {
   t.plan(4)
   const fastify = Fastify()