fastify 5.9.0 → 5.11.0

package/fastify.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const VERSION = '5.9.0'
+const VERSION = '5.11.0'
 
 const Avvio = require('avvio')
 const http = require('node:http')
@@ -33,7 +33,8 @@ const {
   kChildLoggerFactory,
   kGenReqId,
   kErrorHandlerAlreadySet,
-  kHandlerTimeout
+  kHandlerTimeout,
+  kLogController
 } = require('./lib/symbols.js')
 
 const { createServer } = require('./lib/server')
@@ -44,7 +45,7 @@ const decorator = require('./lib/decorate')
 const ContentTypeParser = require('./lib/content-type-parser.js')
 const SchemaController = require('./lib/schema-controller')
 const { Hooks, hookRunnerApplication, supportedHooks } = require('./lib/hooks')
-const { createChildLogger, defaultChildLoggerFactory, createLogger } = require('./lib/logger-factory')
+const { createChildLogger, defaultChildLoggerFactory, createLogger, createLogController, LogController } = require('./lib/logger-factory')
 const pluginUtils = require('./lib/plugin-utils.js')
 const { getGenReqId, reqIdGenFactory } = require('./lib/req-id-gen-factory.js')
 const { buildRouting, validateBodyLimitOption, buildRouterOptions } = require('./lib/route')
@@ -79,7 +80,7 @@ const {
 } = errorCodes
 
 const { buildErrorHandler } = require('./lib/error-handler.js')
-const { FSTWRN004 } = require('./lib/warnings.js')
+const { FSTWRN004, FSTDEP023, FSTDEP024 } = require('./lib/warnings.js')
 
 const initChannel = diagnostics.channel('fastify.initialization')
 
@@ -90,7 +91,7 @@ function fastify (serverOptions) {
   const {
     options,
     genReqId,
-    disableRequestLogging,
+    logController,
     hasLogger,
     initialConfig
   } = processOptions(serverOptions, defaultRoute, onBadUrl, onMaxParamLength)
@@ -142,7 +143,9 @@ function fastify (serverOptions) {
         'OPTIONS',
         'PATCH',
         'PUT',
-        'POST'
+        'POST',
+        // RFC 10008
+        'QUERY'
       ])
     },
     [kOptions]: options,
@@ -199,6 +202,9 @@ function fastify (serverOptions) {
     options: function _options (url, options, handler) {
       return router.prepareRoute.call(this, { method: 'OPTIONS', url, options, handler })
     },
+    query: function _query (url, options, handler) {
+      return router.prepareRoute.call(this, { method: 'QUERY', url, options, handler })
+    },
     all: function _all (url, options, handler) {
       return router.prepareRoute.call(this, { method: this.supportedMethods, url, options, handler })
     },
@@ -216,6 +222,7 @@ function fastify (serverOptions) {
     },
     // expose logger instance
     log: options.logger,
+    [kLogController]: logController,
     // type provider
     withTypeProvider,
     // hooks
@@ -643,10 +650,7 @@ function fastify (serverOptions) {
       const request = new Request(id, null, req, null, childLogger, routeEventContext)
       const reply = new Reply(res, request, childLogger)
 
-      const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(req) : disableRequestLogging
-      if (resolvedDisableRequestLogging === false) {
-        childLogger.info({ req: request }, 'incoming request')
-      }
+      routeEventContext.server[kLogController].incomingRequest(request, reply)
 
       return options.frameworkErrors(new FST_ERR_BAD_URL(path), request, reply)
     }
@@ -671,10 +675,7 @@ function fastify (serverOptions) {
       const request = new Request(id, null, req, null, childLogger, routeEventContext)
       const reply = new Reply(res, request, childLogger)
 
-      const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(req) : disableRequestLogging
-      if (resolvedDisableRequestLogging === false) {
-        childLogger.info({ req: request }, 'incoming request')
-      }
+      routeEventContext.server[kLogController].incomingRequest(request, reply)
 
       return options.frameworkErrors(new FST_ERR_MAX_PARAM_LENGTH(path), request, reply)
     }
@@ -702,10 +703,7 @@ function fastify (serverOptions) {
           const request = new Request(id, null, req, null, childLogger, routeEventContext)
           const reply = new Reply(res, request, childLogger)
 
-          const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(req) : disableRequestLogging
-          if (resolvedDisableRequestLogging === false) {
-            childLogger.info({ req: request }, 'incoming request')
-          }
+          routeEventContext.server[kLogController].incomingRequest(request, reply)
 
           return options.frameworkErrors(new FST_ERR_ASYNC_CONSTRAINT(), request, reply)
         }
@@ -876,9 +874,13 @@ function processOptions (options, defaultRoute, onBadUrl, onMaxParamLength) {
 
   const requestIdHeader = typeof options.requestIdHeader === 'string' && options.requestIdHeader.length !== 0 ? options.requestIdHeader.toLowerCase() : (options.requestIdHeader === true && 'request-id')
   const genReqId = reqIdGenFactory(requestIdHeader, options.genReqId)
-  const requestIdLogLabel = options.requestIdLogLabel || 'reqId'
+  if (options.requestIdLogLabel !== undefined) {
+    FSTDEP024()
+  }
   options.bodyLimit = options.bodyLimit || defaultInitOptions.bodyLimit
-  const disableRequestLogging = options.disableRequestLogging || false
+  if (options.disableRequestLogging !== undefined) {
+    FSTDEP023()
+  }
 
   const ajvOptions = Object.assign({
     customOptions: {},
@@ -894,6 +896,10 @@ function processOptions (options, defaultRoute, onBadUrl, onMaxParamLength) {
 
   const { logger, hasLogger } = createLogger(options)
 
+  // the internal logger uses the input logger to execute the logging. This allows the user
+  // to customize every internal log line
+  const logController = createLogController(options)
+
   // Update the options with the fixed values
   options.connectionTimeout = options.connectionTimeout || defaultInitOptions.connectionTimeout
   options.keepAliveTimeout = options.keepAliveTimeout || defaultInitOptions.keepAliveTimeout
@@ -901,8 +907,6 @@ function processOptions (options, defaultRoute, onBadUrl, onMaxParamLength) {
   options.requestTimeout = options.requestTimeout || defaultInitOptions.requestTimeout
   options.logger = logger
   options.requestIdHeader = requestIdHeader
-  options.requestIdLogLabel = requestIdLogLabel
-  options.disableRequestLogging = disableRequestLogging
   options.ajv = ajvOptions
   options.clientErrorHandler = options.clientErrorHandler || defaultClientErrorHandler
   options.allowErrorHandlerOverride = options.allowErrorHandlerOverride ?? defaultInitOptions.allowErrorHandlerOverride
@@ -930,7 +934,7 @@ function processOptions (options, defaultRoute, onBadUrl, onMaxParamLength) {
   return {
     options,
     genReqId,
-    disableRequestLogging,
+    logController,
     hasLogger,
     initialConfig
   }
@@ -1010,5 +1014,6 @@ function validateSchemaErrorFormatter (schemaErrorFormatter) {
  */
 module.exports = fastify
 module.exports.errorCodes = errorCodes
+module.exports.LogController = LogController
 module.exports.fastify = fastify
 module.exports.default = fastify

package/lib/content-type-parser.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const { AsyncResource } = require('node:async_hooks')
-const { FifoMap: Fifo, LruMap: Lru } = require('toad-cache')
+const { FifoMap: Fifo } = require('toad-cache')
 const { parse: secureJsonParse } = require('secure-json-parse')
 const ContentType = require('./content-type')
 const {
@@ -39,15 +39,6 @@ function ContentTypeParser (bodyLimit, onProtoPoisoning, onConstructorPoisoning)
   this.parserList = ['application/json', 'text/plain']
   this.parserRegExpList = []
   this.cache = new Fifo(100)
-  this.ctCache = new Lru(100)
-}
-
-ContentTypeParser.prototype.getContentType = function (raw) {
-  let ct = this.ctCache.get(raw)
-  if (ct !== undefined) return ct
-  ct = new ContentType(raw)
-  this.ctCache.set(raw, ct)
-  return ct
 }
 
 ContentTypeParser.prototype.add = function (contentType, opts, parserFn) {
@@ -169,7 +160,6 @@ ContentTypeParser.prototype.removeAll = function () {
   this.parserRegExpList = []
   this.parserList = []
   this.cache = new Fifo(100)
-  this.ctCache = new Lru(100)
 }
 
 ContentTypeParser.prototype.remove = function (contentType) {

package/lib/content-type.js

@@ -1,15 +1,39 @@
 'use strict'
 
+const { LruMap: Lru } = require('toad-cache')
+
 /**
- * keyValuePairsReg is used to split the parameters list into associated
- * key value pairings. The leading `(?:^|;)\s*` anchor ensures the regex
- * only attempts matches at parameter boundaries, preventing quadratic
- * backtracking on malformed input.
+ * keyValuePairsReg matches a single `parameter-name "=" parameter-value`
+ * at a parameter boundary, following RFC 9110 §5.6.6 grammar:
+ *
+ *   parameter       = parameter-name "=" parameter-value
+ *   parameter-name  = token
+ *   parameter-value = ( token / quoted-string )
+ *   quoted-string   = DQUOTE *( qdtext / quoted-pair ) DQUOTE
+ *   qdtext          = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text
+ *   quoted-pair     = "\" ( HTAB / SP / VCHAR / obs-text )
+ *   obs-text        = %x80-FF
+ *
+ * The value alternative accepts either a bare token or a full quoted-string
+ * whose content matches the qdtext / quoted-pair character ranges. Because
+ * the quoted-string branch is aware of `\"` as an escape, embedded `"` and
+ * `;` characters inside a quoted value do not terminate the value.
  *
  * @see https://httpwg.org/specs/rfc9110.html#parameter
  * @type {RegExp}
  */
-const keyValuePairsReg = /(?:^|;)\s*([\w!#$%&'*+.^`|~-]+)=([^;]*)/gm
+const keyValuePairsReg = /(?:^|;)\s*([\w!#$%&'*+.^`|~-]+)=("(?:[\t\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\t\u0020-\u00ff])*"|[\w!#$%&'*+.^`|~-]+)/gu
+
+/**
+ * quotedPairReg matches a quoted-pair (a backslash followed by a single
+ * quoted-pair-allowed octet) inside a quoted-string value. Per RFC 9110
+ * §5.6.4, recipients that process the value of a quoted-string MUST handle
+ * a quoted-pair as if it were replaced by the octet following the backslash.
+ *
+ * @see https://httpwg.org/specs/rfc9110.html#quoted.string
+ * @type {RegExp}
+ */
+const quotedPairReg = /\\([\t\u0020-\u00ff])/gu
 
 /**
  * typeNameReg is used to validate that the first part of the media-type
@@ -35,6 +59,12 @@ const typeNameReg = /^[\w!#$%&'*+.^`|~-]+$/
  */
 const subtypeNameReg = /^[\w!#$%&'*+.^`|~-]+\s*$/
 
+/**
+ * Content-Type internal shared cache
+ * @type {Lru<ContentType>}
+ */
+const cache = new Lru(100)
+
 /**
  * ContentType parses and represents the value of the content-type header.
  *
@@ -49,6 +79,27 @@ class ContentType {
   #parameters = new Map()
   #string
 
+  /**
+   * The shared cache of ContentType instances. The cache is used to avoid
+   * creating multiple instances of ContentType for the same header value.
+   * @type {Lru<ContentType>}
+   */
+  static get cache () { return cache }
+
+  /**
+   * Create a ContentType instance from a header value. If the value has been
+   * previously parsed, the cached instance will be returned.
+   * @param {string} headerValue
+   * @returns {ContentType | undefined}
+   */
+  static from (headerValue) {
+    let contentType = cache.get(headerValue)
+    if (contentType !== undefined) return contentType
+    contentType = new ContentType(headerValue)
+    cache.set(headerValue, contentType)
+    return contentType
+  }
+
   constructor (headerValue) {
     if (headerValue == null || headerValue === '' || headerValue === 'undefined') {
       return
@@ -106,22 +157,22 @@ class ContentType {
 
     let matches = keyValuePairsReg.exec(paramsList)
     while (matches) {
-      const key = matches[1]
-      const value = matches[2]
-      if (value[0] === '"') {
-        if (value.at(-1) !== '"') {
-          this.#parameters.set(key, 'invalid quoted string')
-          matches = keyValuePairsReg.exec(paramsList)
-          continue
+      // https://httpwg.org/specs/rfc9110.html#parameter
+      // Parameter names are case-insensitive.
+      const key = matches[1].toLowerCase()
+      // Parameter values might or might not be case-sensitive,
+      // depending on the semantics of the parameter name.
+      let value = matches[2]
+      if (value.charCodeAt(0) === 0x22 /* " */) {
+        // Strip the surrounding DQUOTEs and unescape quoted-pairs per
+        // RFC 9110 §5.6.4. The regex guarantees the value starts and ends
+        // with `"` and only contains permitted qdtext / quoted-pair octets.
+        value = value.slice(1, -1)
+        if (value.indexOf('\\') !== -1) {
+          value = value.replace(quotedPairReg, '$1')
         }
-        // We should probably verify the value matches a quoted string
-        // (https://httpwg.org/specs/rfc9110.html#rule.quoted-string) value.
-        // But we are not really doing much with the parameter values, so we
-        // are omitting that at this time.
-        this.#parameters.set(key, value.slice(1, value.length - 1))
-      } else {
-        this.#parameters.set(key, value)
       }
+      this.#parameters.set(key, value)
       matches = keyValuePairsReg.exec(paramsList)
     }
   }

package/lib/context.js

@@ -6,7 +6,6 @@ const {
   kSchemaErrorFormatter,
   kErrorHandler,
   kChildLoggerFactory,
-  kOptions,
   kReply,
   kRequest,
   kBodyLimit,
@@ -24,7 +23,6 @@ function Context ({
   schema,
   handler,
   config,
-  requestIdLogLabel,
   childLoggerFactory,
   errorHandler,
   bodyLimit,
@@ -56,7 +54,6 @@ function Context ({
   this.onRequestAbort = null
   this.config = config
   this.errorHandler = errorHandler || server[kErrorHandler]
-  this.requestIdLogLabel = requestIdLogLabel || server[kOptions].requestIdLogLabel
   this.childLoggerFactory = childLoggerFactory || server[kChildLoggerFactory]
   this._middie = null
   this._parserOptions = {

package/lib/error-handler.js

@@ -8,7 +8,7 @@ const {
   kReplyNextErrorHandler,
   kReplyIsRunningOnErrorHook,
   kRouteContext,
-  kDisableRequestLogging,
+  kLogController,
   kDiagnosticsStore
 } = require('./symbols.js')
 
@@ -36,12 +36,7 @@ function handleError (reply, error, cb) {
       try {
         reply.raw.writeHead(reply.raw.statusCode, reply[kReplyHeaders])
       } catch (error) {
-        if (!reply.log[kDisableRequestLogging]) {
-          reply.log.warn(
-            { req: reply.request, res: reply, err: error },
-            error?.message
-          )
-        }
+        reply.server[kLogController].writeHeadError(error, reply.request, reply)
         reply.raw.writeHead(reply.raw.statusCode)
       }
       reply.raw.end(payload)
@@ -83,21 +78,7 @@ function handleError (reply, error, cb) {
 function defaultErrorHandler (error, request, reply) {
   setErrorHeaders(error, reply)
   setErrorStatusCode(reply, error)
-  if (reply.statusCode < 500) {
-    if (!reply.log[kDisableRequestLogging]) {
-      reply.log.info(
-        { res: reply, err: error },
-        error?.message
-      )
-    }
-  } else {
-    if (!reply.log[kDisableRequestLogging]) {
-      reply.log.error(
-        { req: request, res: reply, err: error },
-        error?.message
-      )
-    }
-  }
+  request.server[kLogController].defaultErrorLog(error, request, reply)
   reply.send(error)
 }
 
@@ -123,10 +104,10 @@ function fallbackErrorHandler (error, reply, cb) {
       }))
     }
   } catch (err) {
-    if (!reply.log[kDisableRequestLogging]) {
-      // error is always FST_ERR_SCH_SERIALIZATION_BUILD because this is called from route/compileSchemasForSerialization
-      reply.log.error({ err, statusCode: res.statusCode }, 'The serializer for the given status code failed')
-    }
+    // error is always FST_ERR_SCH_SERIALIZATION_BUILD
+    // because this is called from route/compileSchemasForSerialization
+    reply.server[kLogController].serializerError(err, reply.request, reply, { statusCode: res.statusCode })
+
     reply.code(500)
     payload = serializeError(new FST_ERR_FAILED_ERROR_SERIALIZATION(err.message, error.message))
   }

package/lib/errors.js

@@ -243,6 +243,13 @@ const codes = {
     TypeError
   ),
 
+  FST_ERR_LOG_INVALID_LOG_CONTROLLER: createError(
+    'FST_ERR_LOG_INVALID_LOG_CONTROLLER',
+    "logController option must be an instance of LogController, got '%s'.",
+    500,
+    TypeError
+  ),
+
   /**
    * reply
   */
@@ -448,6 +455,16 @@ const codes = {
     500,
     TypeError
   ),
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE: createError(
+    'FST_ERR_ROUTE_MISSING_CONTENT_TYPE',
+    "Method '%s' must provide a 'Content-Type' header.",
+    400
+  ),
+  FST_ERR_ROUTE_MISSING_CONTENT: createError(
+    'FST_ERR_ROUTE_MISSING_CONTENT',
+    "Method '%s' must provide a request body.",
+    400
+  ),
 
   /**
    *  again listen when close server

package/lib/four-oh-four.js

@@ -11,7 +11,8 @@ const {
   kFourOhFourLevelInstance,
   kFourOhFourContext,
   kHooks,
-  kErrorHandler
+  kErrorHandler,
+  kLogController
 } = require('./symbols.js')
 const { lifecycleHooks } = require('./hooks')
 const { buildErrorHandler } = require('./error-handler.js')
@@ -29,7 +30,7 @@ const { getGenReqId } = require('./req-id-gen-factory.js')
  * kFourOhFourContext: the context in the reply object where the handler will be executed
  */
 function fourOhFour (options) {
-  const { logger, disableRequestLogging } = options
+  const { logger } = options
 
   // 404 router, used for handling encapsulated 404 handlers
   const router = FindMyWay({
@@ -52,14 +53,10 @@ function fourOhFour (options) {
   }
 
   function basic404 (request, reply) {
+    request.server[kLogController].routeNotFound(request, reply)
     const { url, method } = request.raw
-    const message = `Route ${method}:${url} not found`
-    const resolvedDisableRequestLogging = typeof disableRequestLogging === 'function' ? disableRequestLogging(request.raw) : disableRequestLogging
-    if (!resolvedDisableRequestLogging) {
-      request.log.info(message)
-    }
     reply.code(404).send({
-      message,
+      message: `Route ${method}:${url} not found`,
       error: 'Not Found',
       statusCode: 404
     })
@@ -181,11 +178,12 @@ function fourOhFour (options) {
     const id = getGenReqId(fourOhFourContext.server, req)
     const childLogger = createChildLogger(fourOhFourContext, logger, req, id)
 
-    childLogger.info({ req }, 'incoming request')
-
     const request = new Request(id, null, req, null, childLogger, fourOhFourContext)
     const reply = new Reply(res, request, childLogger)
 
+    fourOhFourContext.server[kLogController].incomingRequest(request, reply)
+
+    // Since this could be a bug, we log it without checking if the logging is disabled
     request.log.warn('the default handler for 404 did not catch this, this is likely a fastify bug, please report it')
     request.log.warn(router.prettyPrint())
     reply.code(404).send(new FST_ERR_NOT_FOUND())

package/lib/handle-request.js

@@ -4,7 +4,11 @@ const diagnostics = require('node:diagnostics_channel')
 const wrapThenable = require('./wrap-thenable')
 const { validate: validateSchema } = require('./validation')
 const { preValidationHookRunner, preHandlerHookRunner } = require('./hooks')
-const { FST_ERR_CTP_INVALID_MEDIA_TYPE } = require('./errors')
+const {
+  FST_ERR_CTP_INVALID_MEDIA_TYPE,
+  FST_ERR_ROUTE_MISSING_CONTENT_TYPE,
+  FST_ERR_ROUTE_MISSING_CONTENT
+} = require('./errors')
 const { setErrorStatusCode } = require('./error-status')
 const {
   kReplyIsError,
@@ -14,6 +18,7 @@ const {
   kRequestContentType,
   kDiagnosticsStore
 } = require('./symbols')
+const ContentType = require('./content-type')
 
 const channels = diagnostics.tracingChannel('fastify.request.handler')
 
@@ -36,13 +41,30 @@ function handleRequest (err, request, reply) {
     const headers = request.headers
     const ctHeader = headers['content-type']
 
-    if (ctHeader === undefined) {
-      const contentLength = headers['content-length']
-      const transferEncoding = headers['transfer-encoding']
-      const isEmptyBody = transferEncoding === undefined &&
-        (contentLength === undefined || contentLength === '0')
+    if (method === 'QUERY') {
+      if (ctHeader === undefined) {
+        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
+        // Servers MUST fail the request if the Content-Type request field
+        // ([HTTP], Section 8.3) is missing or is inconsistent with the
+        // request content.
+        reply[kReplyIsError] = true
+        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT_TYPE(method))
+        return
+      }
 
-      if (isEmptyBody) {
+      if (isEmptyBody(headers)) {
+        // https://datatracker.ietf.org/doc/html/rfc10008#section-2
+        // Servers MUST fail the request if the Content-Type request field
+        // ([HTTP], Section 8.3) is missing or is inconsistent with the
+        // request content.
+        reply[kReplyIsError] = true
+        reply.status(400).send(new FST_ERR_ROUTE_MISSING_CONTENT(method))
+        return
+      }
+    }
+
+    if (ctHeader === undefined) {
+      if (isEmptyBody(headers)) {
         // Request has no body to parse
         handler(request, reply)
         return
@@ -55,7 +77,7 @@ function handleRequest (err, request, reply) {
     // Conditional assignment to avoid creating a new ContentType instance
     // It can be assigned when accessing the .mediaType in hooks
     if (!request[kRequestContentType]) {
-      request[kRequestContentType] = request[kRouteContext].contentTypeParser.getContentType(ctHeader)
+      request[kRequestContentType] = ContentType.from(ctHeader)
     }
     if (request[kRequestContentType].isValid === false) {
       reply[kReplyIsError] = true
@@ -87,6 +109,13 @@ function handler (request, reply) {
   }
 }
 
+function isEmptyBody (headers) {
+  const contentLength = headers['content-length']
+  const transferEncoding = headers['transfer-encoding']
+  return transferEncoding === undefined &&
+    (contentLength === undefined || contentLength === '0')
+}
+
 function preValidationCallback (err, request, reply) {
   if (reply.sent === true) return
 

package/lib/hooks.js

@@ -306,7 +306,11 @@ function onSendHookRunner (functions, request, reply, payload, cb) {
   }
 
   function handleResolve (newPayload) {
-    next(null, newPayload)
+    try {
+      next(null, newPayload)
+    } catch (err) {
+      cb(err, request, reply, payload)
+    }
   }
 
   function handleReject (err) {