fastify 6.0.0-alpha.2 → 6.0.0-alpha.3

package/test/404s.test.js

@@ -1226,7 +1226,7 @@ test('onSend hooks run when an encapsulated route invokes the notFound handler',
 
 // https://github.com/fastify/fastify/issues/713
 test('preHandler option for setNotFoundHandler', async t => {
-  t.plan(10)
+  t.plan(11)
 
   await t.test('preHandler option', (t, done) => {
     t.plan(2)
@@ -1283,6 +1283,39 @@ test('preHandler option for setNotFoundHandler', async t => {
     })
   })
 
+  // https://github.com/fastify/fastify/security/advisories/GHSA-gm8r-x7h4-fm5r
+  await t.test('preHandler hook in setNotFoundHandler should be called when callNotFound and the route is registered first', (t, done) => {
+    t.plan(3)
+    const fastify = Fastify()
+
+    // Register the route before the not-found handler so that the route's
+    // preReady callback snapshots the not-found context before its lifecycle
+    // hooks are populated.
+    fastify.post('/', function (req, reply) {
+      t.assert.strictEqual(reply.callNotFound(), reply)
+    })
+
+    fastify.setNotFoundHandler({
+      preHandler: (req, reply, done) => {
+        req.body.preHandler = true
+        done()
+      }
+    }, function (req, reply) {
+      reply.code(404).send(req.body)
+    })
+
+    fastify.inject({
+      method: 'POST',
+      url: '/',
+      payload: { hello: 'world' }
+    }, (err, res) => {
+      t.assert.ifError(err)
+      const payload = JSON.parse(res.payload)
+      t.assert.deepStrictEqual(payload, { preHandler: true, hello: 'world' })
+      done()
+    })
+  })
+
   await t.test('preHandler hook in setNotFoundHandler should accept an array of functions and be called when callNotFound', (t, done) => {
     t.plan(2)
     const fastify = Fastify()
@@ -1800,11 +1833,12 @@ test('400 in case of bad url (pre find-my-way v2.2.0 was a 404)', async t => {
       method: 'GET'
     }, (err, response) => {
       t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 404)
+      t.assert.strictEqual(response.statusCode, 400)
       t.assert.deepStrictEqual(JSON.parse(response.payload), {
-        error: 'Not Found',
-        message: 'Route GET:/%c0 not found',
-        statusCode: 404
+        error: 'Bad Request',
+        message: "'/%c0' is not a valid url component",
+        statusCode: 400,
+        code: 'FST_ERR_BAD_URL'
       })
       done()
     })
@@ -1840,12 +1874,76 @@ test('400 in case of bad url (pre find-my-way v2.2.0 was a 404)', async t => {
       method: 'GET'
     }, (err, response) => {
       t.assert.ifError(err)
-      t.assert.strictEqual(response.statusCode, 404)
-      t.assert.deepStrictEqual(response.payload, 'this was not found')
+      t.assert.strictEqual(response.statusCode, 400)
+      t.assert.deepStrictEqual(JSON.parse(response.payload), {
+        error: 'Bad Request',
+        message: "'/%c0' is not a valid url component",
+        statusCode: 400,
+        code: 'FST_ERR_BAD_URL'
+      })
       done()
     })
   })
 
+  await t.test('Bad URL does not invoke an encapsulated not found handler', async t => {
+    const fastify = Fastify()
+    let publicHandlerCalls = 0
+    let privatePreHandlerCalls = 0
+    let privateHandlerCalls = 0
+
+    fastify.register(async function (instance) {
+      instance.get('/existing', () => 'public')
+      instance.setNotFoundHandler(function (_request, reply) {
+        publicHandlerCalls++
+        reply.code(404).send('public not found')
+      })
+    }, { prefix: '/public' })
+
+    fastify.register(async function (instance) {
+      instance.setNotFoundHandler({
+        preHandler: function (request, reply, done) {
+          privatePreHandlerCalls++
+          if (request.headers.authorization !== 'Bearer valid') {
+            reply.code(401).send('unauthorized')
+          }
+          done()
+        }
+      }, function (_request, reply) {
+        privateHandlerCalls++
+        reply.send('private canary')
+      })
+    }, { prefix: '/private' })
+
+    const malformed = await fastify.inject({
+      method: 'DELETE',
+      url: '/public/%c0'
+    })
+    t.assert.strictEqual(malformed.statusCode, 400)
+    t.assert.strictEqual(JSON.parse(malformed.payload).code, 'FST_ERR_BAD_URL')
+    t.assert.strictEqual(publicHandlerCalls, 0)
+    t.assert.strictEqual(privatePreHandlerCalls, 0)
+    t.assert.strictEqual(privateHandlerCalls, 0)
+
+    const unauthorized = await fastify.inject({
+      method: 'DELETE',
+      url: '/private/missing'
+    })
+    t.assert.strictEqual(unauthorized.statusCode, 401)
+    t.assert.strictEqual(unauthorized.payload, 'unauthorized')
+    t.assert.strictEqual(privatePreHandlerCalls, 1)
+    t.assert.strictEqual(privateHandlerCalls, 0)
+
+    const authorized = await fastify.inject({
+      method: 'DELETE',
+      url: '/private/missing',
+      headers: { authorization: 'Bearer valid' }
+    })
+    t.assert.strictEqual(authorized.statusCode, 200)
+    t.assert.strictEqual(authorized.payload, 'private canary')
+    t.assert.strictEqual(privatePreHandlerCalls, 2)
+    t.assert.strictEqual(privateHandlerCalls, 1)
+  })
+
   await t.test('Bad URL with special characters should be properly JSON escaped', (t, done) => {
     t.plan(3)
     const fastify = Fastify()

package/test/router-options.test.js

@@ -469,6 +469,30 @@ test('Should honor routerOptions.onBadUrl', async t => {
   t.assert.strictEqual(res.payload, 'Bad URL: /hello/%world')
 })
 
+test('Should honor routerOptions.onBadUrl when no method tree exists', async t => {
+  t.plan(3)
+  const fastify = Fastify({
+    routerOptions: {
+      onBadUrl: function (path, _, res) {
+        t.assert.ok('bad url called')
+        res.statusCode = 400
+        res.end(`Bad URL: ${path}`)
+      }
+    }
+  })
+
+  fastify.get('/hello/:id', (req, res) => {
+    res.send({ hello: 'world' })
+  })
+
+  const res = await fastify.inject({
+    method: 'DELETE',
+    url: '/hello/%world'
+  })
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(res.payload, 'Bad URL: /hello/%world')
+})
+
 test('Should honor routerOptions.onMaxParamLength', async t => {
   t.plan(3)
   const fastify = Fastify({

package/test/schema-feature.test.js

@@ -471,6 +471,164 @@ test('Should emit a warning for every route with undefined schema', (t, testDone
   })
 })
 
+test('Default validator compiler is initialized for a route whose only schema is false', async (t) => {
+  t.plan(2)
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  fastify.post('/body', {
+    handler: echoBody,
+    schema: {
+      body: false
+    }
+  })
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/body',
+    payload: {}
+  })
+
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.ok(fastify.validatorCompiler, 'validator compiler is initialized')
+})
+
+test('Boolean false request schemas reject every request and no handler executes', async (t) => {
+  t.plan(5)
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  let bodyExecuted = false
+  let qsExecuted = false
+  let paramsExecuted = false
+  let headersExecuted = false
+
+  fastify.post('/body', {
+    handler: async () => { bodyExecuted = true; return { protectedActionExecuted: true } },
+    schema: { body: false }
+  })
+  fastify.get('/querystring', {
+    handler: async () => { qsExecuted = true; return { protectedActionExecuted: true } },
+    schema: { querystring: false }
+  })
+  fastify.post('/params/:id', {
+    handler: async () => { paramsExecuted = true; return { protectedActionExecuted: true } },
+    schema: { params: false }
+  })
+  fastify.post('/headers', {
+    handler: async () => { headersExecuted = true; return { protectedActionExecuted: true } },
+    schema: { headers: false }
+  })
+
+  const r1 = await fastify.inject({ method: 'POST', url: '/body', payload: {} })
+  t.assert.strictEqual(r1.statusCode, 400)
+  const r2 = await fastify.inject({ method: 'GET', url: '/querystring' })
+  t.assert.strictEqual(r2.statusCode, 400)
+  const r3 = await fastify.inject({ method: 'POST', url: '/params/1' })
+  t.assert.strictEqual(r3.statusCode, 400)
+  const r4 = await fastify.inject({ method: 'POST', url: '/headers' })
+  t.assert.strictEqual(r4.statusCode, 400)
+
+  t.assert.deepStrictEqual({
+    bodyExecuted,
+    qsExecuted,
+    paramsExecuted,
+    headersExecuted
+  }, {
+    bodyExecuted: false,
+    qsExecuted: false,
+    paramsExecuted: false,
+    headersExecuted: false
+  })
+})
+
+test('Custom validator compiler receives the literal boolean false schema', async (t) => {
+  t.plan(3)
+  const received = []
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  fastify.post('/body', {
+    handler: async () => ({ ok: true }),
+    schema: { body: false },
+    validatorCompiler: ({ schema, httpPart }) => {
+      received.push({ schema, httpPart })
+      return () => { throw new Error('should not validate') }
+    }
+  })
+
+  await fastify.ready()
+  t.assert.strictEqual(received.length, 1)
+  t.assert.strictEqual(received[0].schema, false)
+  t.assert.strictEqual(received[0].httpPart, 'body')
+})
+
+test('FSTWRN001 is emitted only for explicitly undefined schemas, not boolean false', async (t) => {
+  t.plan(4)
+  const spyData = spyWarning(FSTWRN001)
+  t.after(spyData.restore)
+
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  fastify.post('/false-body', {
+    handler: async () => ({ ok: true }),
+    schema: { body: false }
+  })
+  fastify.post('/undefined-body', {
+    handler: async () => ({ ok: true }),
+    schema: { body: undefined }
+  })
+
+  await fastify.ready()
+  t.assert.strictEqual(spyData.callCount(), 1)
+  t.assert.deepStrictEqual(spyData.calls[0], { arguments: ['body', 'POST', '/undefined-body'], result: true })
+
+  const r1 = await fastify.inject({ method: 'POST', url: '/false-body', payload: {} })
+  t.assert.strictEqual(r1.statusCode, 400)
+  const r2 = await fastify.inject({ method: 'POST', url: '/undefined-body', payload: {} })
+  t.assert.strictEqual(r2.statusCode, 200)
+})
+
+test('Invalid null schema fails closed during schema compilation', async (t) => {
+  t.plan(3)
+  const fastify = Fastify({ exposeHeadRoutes: false })
+
+  let handlerExecuted = false
+  fastify.post('/null-body', {
+    handler: async () => { handlerExecuted = true; return { ok: true } },
+    schema: { body: null }
+  })
+
+  await t.assert.rejects(fastify.ready(), (err) => {
+    t.assert.strictEqual(err.code, 'FST_ERR_SCH_VALIDATION_BUILD')
+    return true
+  })
+  t.assert.strictEqual(handlerExecuted, false)
+})
+
+test('Boolean false request schema via the query alias rejects every request', async (t) => {
+  const fastify = Fastify()
+  let handlerExecuted = false
+
+  // `query` is a documented alias for `querystring`; a deny-all `false` must be
+  // aliased and enforced just like the canonical key.
+  fastify.get('/', {
+    handler: async () => { handlerExecuted = true; return { protectedActionExecuted: true } },
+    schema: { query: false }
+  })
+
+  const res = await fastify.inject({ method: 'GET', url: '/?x=1' })
+
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(handlerExecuted, false)
+})
+
+test('Setting both query and querystring still throws (boolean false included)', async (t) => {
+  const fastify = Fastify()
+  fastify.get('/', {
+    handler: async () => ({ ok: true }),
+    schema: { query: false, querystring: false }
+  })
+  await t.assert.rejects(fastify.ready())
+})
+
 test('First level $ref', (t, testDone) => {
   t.plan(2)
   const fastify = Fastify()

package/test/schema-special-usage.test.js

@@ -939,6 +939,87 @@ test('Supports async AJV validation', (t, testDone) => {
   completion.patience.then(testDone)
 })
 
+// @see https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
+test('async validation result must not replace the request body (value collision)', async (t) => {
+  const fastify = Fastify()
+  fastify.post('/', {
+    schema: {
+      body: {
+        $async: true,
+        type: 'object',
+        additionalProperties: true,
+        properties: { hello: { type: 'string' } }
+      }
+    },
+    handler: async (request) => request.body
+  })
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ hello: 'world', value: { hello: 'evil' } })
+  })
+
+  t.assert.strictEqual(res.statusCode, 200)
+  // The validated body must be preserved; a `value` key must NOT replace it.
+  t.assert.deepStrictEqual(res.json(), { hello: 'world', value: { hello: 'evil' } })
+})
+
+// @see https://github.com/fastify/fastify/security/advisories/GHSA-667r-xxjv-c9mm
+test('async validation result must not be treated as an error (error collision)', async (t) => {
+  const fastify = Fastify()
+  fastify.post('/', {
+    schema: {
+      body: {
+        $async: true,
+        type: 'object',
+        additionalProperties: true,
+        properties: { hello: { type: 'string' } }
+      }
+    },
+    handler: async (request) => request.body
+  })
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ hello: 'world', error: 'boom' })
+  })
+
+  // An `error` key in the payload must NOT be treated as a validation failure.
+  t.assert.strictEqual(res.statusCode, 200)
+  t.assert.deepStrictEqual(res.json(), { hello: 'world', error: 'boom' })
+})
+
+test('async custom validator resolving false uses its validation errors', async t => {
+  const fastify = Fastify()
+  fastify.setValidatorCompiler(() => {
+    const validate = () => Promise.resolve(false)
+    validate.errors = [{
+      instancePath: '',
+      schemaPath: '#/custom',
+      keyword: 'custom',
+      params: {},
+      message: 'must pass custom validation'
+    }]
+    return validate
+  })
+  fastify.post('/', {
+    schema: { body: { type: 'object' } }
+  }, async () => ({ ok: true }))
+
+  const res = await fastify.inject({
+    method: 'POST',
+    url: '/',
+    payload: {}
+  })
+
+  t.assert.strictEqual(res.statusCode, 400)
+  t.assert.strictEqual(res.json().code, 'FST_ERR_VALIDATION')
+})
+
 test('Check all the async AJV validation paths', async (t) => {
   const fastify = Fastify({
     exposeHeadRoutes: false,