fulmine.js 5.0.0 → 5.1.1

package/src/request.js

@@ -83,6 +83,20 @@ function formatIPv6(groups) {
     return out;
 }
 
+/**
+ * Whether node would report an IPv4 peer of this app in mapped form, "::ffff:a.b.c.d". Node maps
+ * it whenever the listener is dual stack, which is every listen() not given an IPv4 address to
+ * bind. uWS already hands mapped peers over as sixteen bytes; four bytes only reach req.ip from a
+ * v4-bound native listener or through the node shim, whose server supertest binds dual stack.
+ *
+ * @param {any} app the application the request arrived at
+ * @returns {boolean}
+ */
+function mapsIPv4Peer(app) {
+    const host = app._listenHost;
+    return !(host && isIP(host) === 4);
+}
+
 const discardedDuplicates = new Set([
     "age",
     "authorization",
@@ -109,6 +123,11 @@ let key = 0;
 // 128 KB of body buffered before uWS is asked to pause
 const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
 
+// Whose headers the shared collector below is filling. uWS's forEach is synchronous and runs no
+// user code, so the handoff cannot interleave; module-level so the callback exists once instead
+// of once per request.
+let currentRequest = null;
+
 module.exports = class Request extends Readable {
     /** @type {Record<string, any>|null} */
     #cachedQuery = null;
@@ -121,7 +140,8 @@ module.exports = class Request extends Readable {
 
     // Flat, name then value: an array of pairs meant one array allocated per header on every
     // request, and a request carries eight or ten of them. Everything that reads this walks it two
-    // at a time.
+    // at a time. The names are lowercase by contract: uWS lowers them on the wire and the node
+    // shim lowers them in its forEach, so readers compare without lowering again.
     #rawHeadersEntries = [];
 
     /** @type {string|undefined|null} */
@@ -133,6 +153,30 @@ module.exports = class Request extends Readable {
 
     res;
 
+    // one function for every request, fed through currentRequest: an arrow in the constructor
+    // captured `this`, which cost a context and a function allocation per request
+    static #collectHeader = (headerKey, value) => {
+        const r = currentRequest;
+        r.#rawHeadersEntries.push(headerKey, value);
+        // spotted in the loop that is running anyway: a client asking for the connection to be
+        // closed must not be answered that it is being kept alive. The response is built right
+        // after this and reads the flag.
+        if (
+            headerKey.length === 10 &&
+            headerKey === "connection" &&
+            value.length === 5 &&
+            value.toLowerCase() === "close"
+        ) {
+            r._connectionClose = true;
+        } else if (
+            (headerKey.length === 14 && headerKey === "content-length") ||
+            (headerKey.length === 17 && headerKey === "transfer-encoding")
+        ) {
+            // noticed here so the body decision in the constructor does not build the headers object
+            r._declaresBody = true;
+        }
+    };
+
     optimizedParams;
 
     _error;
@@ -154,15 +198,9 @@ module.exports = class Request extends Readable {
         this._res = res;
         this._req = req;
         this.readable = true;
-        this._req.forEach((key, value) => {
-            this.#rawHeadersEntries.push(key, value);
-            // spotted in the loop that is running anyway: a client asking for the connection to be
-            // closed must not be answered that it is being kept alive. The response is built right
-            // after this and reads the flag.
-            if (key.length === 10 && key === "connection" && value.length === 5 && value.toLowerCase() === "close") {
-                this._connectionClose = true;
-            }
-        });
+        currentRequest = this;
+        this._req.forEach(Request.#collectHeader);
+        currentRequest = null;
         this.routeCount = 1;
         this.key = key++;
         if (key > 100000) {
@@ -206,11 +244,13 @@ module.exports = class Request extends Readable {
         // The router builds it the first time it has something to put in it.
         this._matchedMethods = this._isOptions ? new Set() : null;
         this._paramCalled = null;
-        this._stack = [];
+        // null for the same reason as the two above: a request that never enters a mount never
+        // needs either array, and the push sites materialize them
+        this._stack = null;
         // number of entries in _stack that aren't the empty path. while this is 0 the whole
         // stack joins to "", so getFullMountpath can skip the join entirely
         this._stackMounted = 0;
-        this._paramStack = [];
+        this._paramStack = null;
         this.receivedData = false;
         // reading ip is very slow in UWS, so its better to not do it unless truly needed
         if (this.app.needsIpAfterResponse || this.key < 100) {
@@ -227,32 +267,46 @@ module.exports = class Request extends Readable {
             this.method === "PUT" ||
             this.method === "PATCH" ||
             this.method === "QUERY" ||
-            (additionalMethods && additionalMethods.includes(this.method))
+            (additionalMethods && additionalMethods.includes(this.method)) ||
+            // any request that declares a body carries one, whatever the verb: a GET with
+            // content-length left unread would end this stream empty and poison the keep-alive
+            // connection with its unconsumed bytes. uWS itself discards GET bodies, so this is
+            // the node shim's path
+            /** @type {any} */ (this)._declaresBody
         ) {
-            this._res.onData((ab, isLast) => {
-                this.receivedData = true;
-                if (this.#responseEnded) {
-                    return;
-                }
-                // ab.slice(0) copies the ArrayBuffer; uWS neuters `ab` after this callback,
-                // so a Buffer.from(ab) view would corrupt data left in the Readable queue.
-                const chunk = Buffer.from(ab.slice(0));
-                const accepted = this.push(chunk);
-                // push() may synchronously end the response via a flowing-mode listener.
-                if (!accepted && !isLast && !this.#responseEnded) {
-                    this._res.pause();
-                    this.#paused = true;
-                }
-                if (isLast) {
-                    this.push(null);
-                }
-            });
+            this._subscribeBody();
         } else {
             this.receivedData = true;
             this.push(null);
         }
     }
 
+    /**
+     * Subscribes to the uWS body stream. Out of the constructor so a bodyless request allocates
+     * no closure at all there; must still run during the constructor call, since uWS only feeds a
+     * handler registered before the route handler returns.
+     */
+    _subscribeBody() {
+        this._res.onData((ab, isLast) => {
+            this.receivedData = true;
+            if (this.#responseEnded) {
+                return;
+            }
+            // ab.slice(0) copies the ArrayBuffer; uWS neuters `ab` after this callback,
+            // so a Buffer.from(ab) view would corrupt data left in the Readable queue.
+            const chunk = Buffer.from(ab.slice(0));
+            const accepted = this.push(chunk);
+            // push() may synchronously end the response via a flowing-mode listener.
+            if (!accepted && !isLast && !this.#responseEnded) {
+                this._res.pause();
+                this.#paused = true;
+            }
+            if (isLast) {
+                this.push(null);
+            }
+        });
+    }
+
     /**
      * Whether there is any point still reading the body: once the response is finished or the
      * connection is gone, uWS has nothing left to hand over.
@@ -405,7 +459,10 @@ module.exports = class Request extends Readable {
      * @returns {string}
      */
     get protocol() {
-        const proto = this.app.ssl ? "https" : "http";
+        // express reads socket.encrypted, and middleware does assign to the stand-in; the app's
+        // own ssl flag answers when nothing has built the stand-in yet
+        const conn = this.#cachedConnection;
+        const proto = (conn ? conn.encrypted : this.app.ssl) ? "https" : "http";
         const trust = this.app.get("trust proxy fn");
         if (!trust) {
             return proto;
@@ -481,7 +538,7 @@ module.exports = class Request extends Readable {
 
     /**
      * The hostname's subdomains, furthest from the root first, dropping the last
-     * "subdomain offset" labels. Empty for an IP address.
+     * "subdomain offset" labels. An IP host is one label, never split on its dots.
      * @returns {string[]}
      */
     get subdomains() {
@@ -490,15 +547,14 @@ module.exports = class Request extends Readable {
         }
 
         const hostname = this.hostname;
-        if (!hostname || isIP(hostname)) {
+        if (!hostname) {
             return (this.#cachedSubdomains = []);
         }
 
         const offset = this.app.get("subdomain offset");
-        const parts = hostname.split(".");
-        const subdomains = parts.reverse().slice(offset);
+        const parts = isIP(hostname) ? [hostname] : hostname.split(".").reverse();
 
-        return (this.#cachedSubdomains = subdomains);
+        return (this.#cachedSubdomains = parts.slice(offset));
     }
 
     /**
@@ -531,7 +587,7 @@ module.exports = class Request extends Readable {
         if (!this.rawIp) {
             if (finished) {
                 // fallback once
-                return "127.0.0.1";
+                return mapsIPv4Peer(this.app) ? "::ffff:127.0.0.1" : "127.0.0.1";
             }
             this.rawIp = this._res.getRemoteAddress();
         }
@@ -540,6 +596,9 @@ module.exports = class Request extends Readable {
         if (this.rawIp.byteLength === 4) {
             // ipv4
             ip = new Uint8Array(this.rawIp).join(".");
+            if (mapsIPv4Peer(this.app)) {
+                ip = "::ffff:" + ip;
+            }
         } else if (this.rawIp.byteLength === 16) {
             // ipv6
             const dv = new DataView(this.rawIp);
@@ -607,10 +666,10 @@ module.exports = class Request extends Readable {
                 const entries = this.#rawHeadersEntries;
                 for (let i = 0, len = entries.length; i < len; i += 2) {
                     const key = entries[i];
-                    // 'if-none-match'.length === 13, 'if-modified-since'.length === 17
+                    // 'if-none-match'.length === 13, 'if-modified-since'.length === 17; the
+                    // entries carry lowercase names by contract, so this compares them as they are
                     if (key.length === 13 || key.length === 17) {
-                        const lower = key.toLowerCase();
-                        if (lower === "if-none-match" || lower === "if-modified-since") {
+                        if (key === "if-none-match" || key === "if-modified-since") {
                             hasConditional = true;
                             break;
                         }
@@ -794,7 +853,8 @@ module.exports = class Request extends Readable {
         const entries = this.#rawHeadersEntries;
         for (let index = 0, len = entries.length; index < len; index += 2) {
             const value = entries[index + 1];
-            const key = entries[index].toLowerCase();
+            // lowercase by the entries' contract, see the field declaration
+            const key = entries[index];
             if (Object.hasOwn(headers, key)) {
                 if (discardedDuplicates.has(key)) {
                     continue;