fulmine.js 5.11.1 → 5.12.1

package/src/request.js

@@ -152,6 +152,30 @@ const discardedDuplicates = new Set([
 // 128 KB of body buffered before uWS is asked to pause
 const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
 
+/**
+ * Whether a content-length is a plain count of bytes, which is the only thing RFC 9112 allows.
+ *
+ * uWS trims the spaces around the value and then takes whatever is left, so "", "abc", "+1", "-1",
+ * "0x10" and "1e2" all arrive here. Every one of them makes uWS frame the request as carrying no
+ * body, and what the client sent as a body is then read as the next request on the connection.
+ * Node's parser refuses all of them outright, and so does this.
+ *
+ * @param {string} value as uWS hands it over
+ * @returns {boolean}
+ */
+function isByteCount(value) {
+    if (value.length === 0) {
+        return false;
+    }
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x30 || code > 0x39) {
+            return false;
+        }
+    }
+    return true;
+}
+
 // Whose headers the shared collector below is filling. uWS's forEach is synchronous and runs no
 // user code, so the handoff cannot interleave; module-level so the callback exists once instead
 // of once per request.
@@ -336,6 +360,15 @@ module.exports = class Request extends LazyReadable {
             (headerKey.length === 14 && headerKey === "content-length") ||
             (headerKey.length === 17 && headerKey === "transfer-encoding")
         ) {
+            if (headerKey.length === 14) {
+                // a second content-length whatever it says, and one that is not a count of bytes:
+                // both make uWS frame the request differently from what is on the wire, see
+                // _badFraming and isByteCount
+                if (r._sawContentLength || !isByteCount(value)) {
+                    r._badFraming = true;
+                }
+                r._sawContentLength = true;
+            }
             // saying anything about framing at all, "0" included. A parser that can see a
             // content-length answers about the body it describes, even an empty one: a zero length
             // with a charset nobody can decode is a 415 in express and here, so a chain may only
@@ -439,6 +472,33 @@ module.exports = class Request extends LazyReadable {
      */
     _hasBodyHeaders;
 
+    /**
+     * Whether a content-length has already been copied, so a second one is spotted. Declared for
+     * the same reason as rawIp.
+     * @type {boolean|undefined}
+     */
+    _sawContentLength;
+
+    /**
+     * Whether the request said two different things about how long its body is, so uWS may have
+     * framed it differently from the client that sent it and the proxy that forwarded it. Two
+     * shapes reach this, and node's parser refuses both outright:
+     *
+     *   a repeated content-length     uWS frames on the first and drops the rest, so a proxy in
+     *                                 front reading the last one instead forwards bytes uWS then
+     *                                 answers as a second, pipelined request
+     *   one that is not a byte count  uWS keeps whatever is left after trimming, an empty value
+     *                                 included, and frames the request as carrying no body at all,
+     *                                 which turns the body the client sent into that same second
+     *                                 request. See isByteCount
+     *
+     * Either way it is request smuggling, and the request is refused rather than routed. Declared
+     * for the same reason as rawIp.
+     *
+     * @type {boolean|undefined}
+     */
+    _badFraming;
+
     /**
      * Whether the client asked for the connection to be closed. Declared for the same reason.
      * @type {boolean|undefined}
@@ -504,10 +564,18 @@ module.exports = class Request extends LazyReadable {
             // which is 0.2us on a request that is about to read a body.
             const length = req.getHeader("content-length");
             const transferEncoding = req.getHeader("transfer-encoding");
+            // A content-length of "0" declares no body and used to stay on the cheap side, but
+            // getHeader only ever returns the first of a repeated header, so a duplicate cannot be
+            // seen from here, and a duplicate has to be refused rather than routed: see
+            // _badFraming. Anything that says a word about framing takes the full copy instead.
+            //
+            // One shape stays invisible here, a content-length present with an empty value: uWS
+            // answers "" for that and for a header that was never sent, and nothing in its API
+            // tells them apart. It frames both as carrying no body, which is the right reading of
+            // the second, so this server stays consistent with itself either way. The full copy
+            // below does refuse it, which is every request except a GET whose whole chain provably
+            // reads no header at all.
             if (length !== "" || transferEncoding !== "") {
-                this._hasBodyHeaders = true;
-            }
-            if ((length !== "" && length !== "0") || transferEncoding !== "") {
                 currentRequest = this;
                 this._req.forEach(Request.#collectHeader);
                 currentRequest = null;
@@ -592,6 +660,10 @@ module.exports = class Request extends LazyReadable {
             this._isOptions = this.method === "OPTIONS";
             this._isHead = this.method === "HEAD";
         }
+        // the folded _opPath and the percent scan of _originalPath, built on the hop that first
+        // wants them and dropped by every rewrite, see _pathMatches and Walk#dispatch
+        this._opPathLower = null;
+        this._mayFailDecode = null;
         this.params = {};
 
         // Two Sets per request, for two things almost no request needs.
@@ -812,7 +884,7 @@ module.exports = class Request extends LazyReadable {
      * meant to carry one value, but nothing stops a proxy from appending.
      */
     get #authority() {
-        const trust = this.app.get("trust proxy fn");
+        const trust = this.app._hot().trustProxyFn;
         // parsedIp is what connection.remoteAddress carries, without building the socket stand-in
         const isTrusted = !!(trust && trust(this.parsedIp, 0));
         const rawHeader = (isTrusted && this.headers["x-forwarded-host"]) || this.headers["host"];
@@ -886,7 +958,7 @@ module.exports = class Request extends LazyReadable {
      * @returns {string|undefined} undefined on a unix socket, which has no address
      */
     get ip() {
-        const trust = this.app.get("trust proxy fn");
+        const trust = this.app._hot().trustProxyFn;
         if (!trust) {
             return this.parsedIp;
         }
@@ -899,7 +971,7 @@ module.exports = class Request extends LazyReadable {
      * @returns {string[]}
      */
     get ips() {
-        const trust = this.app.get("trust proxy fn");
+        const trust = this.app._hot().trustProxyFn;
         if (!trust) {
             return [];
         }
@@ -918,7 +990,7 @@ module.exports = class Request extends LazyReadable {
         // own ssl flag answers when nothing has built the stand-in yet
         const conn = this.#cachedConnection;
         const proto = (conn ? conn.encrypted : this.app.ssl) ? "https" : "http";
-        const trust = this.app.get("trust proxy fn");
+        const trust = this.app._hot().trustProxyFn;
         if (!trust) {
             return proto;
         }
@@ -956,6 +1028,8 @@ module.exports = class Request extends LazyReadable {
         this.path = newPath;
         this.endsWithSlash = newPath.charCodeAt(newPath.length - 1) === 0x2f;
         this._opPath = newPath;
+        this._opPathLower = null;
+        this._mayFailDecode = null;
         this._lastUrl = newUrl;
     }
 
@@ -985,7 +1059,7 @@ module.exports = class Request extends LazyReadable {
      * @returns {Record<string, any>}
      */
     get query() {
-        const qp = this.app.get("query parser fn");
+        const qp = this.app._hot().queryParserFn;
         // the vendored default already answers on a bare null prototype, so it goes out as is;
         // any other parser is copied onto one, which is what kept fast-querystring's result from
         // inspecting as "Empty <[Object: null prototype] {}>" where Express shows the bare form
@@ -1053,7 +1127,7 @@ module.exports = class Request extends LazyReadable {
      */
     _readRawIp() {
         const uwsRes = this._res;
-        if (this.app.get("trust proxy protocol")) {
+        if (this.app._hot().trustProxyProtocol) {
             const proxied = uwsRes.getProxiedRemoteAddress();
             // empty unless a preamble arrived, which is the only thing that tells the two apart
             if (proxied.byteLength !== 0) {

package/src/response.js

@@ -31,6 +31,9 @@ const {
     isPreconditionFailure,
     isRangeFresh,
     escapeHtml,
+    validateHeaderName,
+    validateHeaderValue,
+    headerIsWritable,
     withDefaultCharset,
     withUtf8Charset,
     asStatError,
@@ -293,7 +296,7 @@ module.exports = class Response extends LazyWritable {
         // "connection headers" off advertises neither, which Express always does: see below for
         // the one this still writes.
         this.headers =
-            res._nodeRes || app.settings["connection headers"] === false
+            res._nodeRes || app._settings["connection headers"] === false
                 ? {}
                 : {
                       connection: "keep-alive",
@@ -305,7 +308,7 @@ module.exports = class Response extends LazyWritable {
         if (req._connectionClose) {
             this.headers.connection = "close";
         }
-        if (this.app.get("x-powered-by")) {
+        if (app._hot().xPoweredBy) {
             this.headers["x-powered-by"] = "Fulmine";
         }
 
@@ -613,6 +616,10 @@ module.exports = class Response extends LazyWritable {
      * not one of them: uWS wants the length through tryEnd or endWithoutBody, so it is taken out
      * here and kept on totalSize, where it also turns chunked framing off.
      *
+     * One writeHeader per header on purpose. Packing the whole head into a single writeStatus
+     * works on the wire, and was measured slower: constant header strings cross the boundary
+     * already flat, while the packed head is concatenated fresh per response, see issue #11.
+     *
      * @param {boolean} utf8 unused, kept because node's equivalent takes it and the two callers
      *   differ on what they know about the body
      */
@@ -881,8 +888,18 @@ module.exports = class Response extends LazyWritable {
         // req.fresh, which compares If-None-Match against it.
         // body is defined by the time it gets here, so an empty one still earns an ETag. Testing
         // its truthiness instead meant send("") and send(null) came back without one.
-        const etagFn = this.app.get("etag fn");
-        if (etagFn && !this.headers["etag"] && !this.req.noEtag) {
+        // Every method by default, not only GET and HEAD: gating it looked safe, freshness being
+        // defined over those two alone, and express's own suite failed on it, "should send ETag
+        // in response to <METHOD> request" exists per method. The "etag methods" setting is that
+        // gate as an opt-in, see issue #10.
+        const hot = this.app._hot();
+        const etagFn = hot.etagFn;
+        if (
+            etagFn &&
+            !this.headers["etag"] &&
+            !this.req.noEtag &&
+            (hot.etagMethods === null || hot.etagMethods.has(this.req.method))
+        ) {
             const etag = etagFn(body);
             // an application's own etag function is allowed to decline: returning nothing means no
             // header, rather than a header saying "undefined"
@@ -1049,7 +1066,7 @@ module.exports = class Response extends LazyWritable {
         let stat = options._stat;
         if (!stat) {
             try {
-                stat = cachedStat(fullpath, this.app.settings["stat cache ms"]);
+                stat = cachedStat(fullpath, this.app._settings["stat cache ms"]);
             } catch (err) {
                 // the fs error itself, carrying its errno and path, with send's status written on
                 // it: a missing file is the request's 404, an unreadable one is the server's 500
@@ -1318,27 +1335,51 @@ module.exports = class Response extends LazyWritable {
      * @param {any} value an array sends the header once per entry
      * @returns {this}
      * @throws {Error} once the headers have gone out
-     * @throws {TypeError} if the name is not a string
+     * @throws {TypeError} if the name is not a token, the value is undefined, or the value holds a
+     *   character that cannot go on the wire
      */
     setHeader(field, value) {
         if (this.headersSent) {
             throw new Error("Cannot set headers after they are sent to the client");
         }
-        if (typeof field !== "string") {
-            throw new TypeError("Header name must be a valid HTTP token");
-        } else {
-            field = field.toLowerCase();
-            if (Array.isArray(value)) {
-                // each entry as text, as node serialises them: a raw number reaching uWS's
-                // writeHeader would throw mid-response
-                this.headers[field] = value.map(String);
-                return this;
-            }
-            this.headers[field] = String(value);
+        validateHeaderName(field);
+        if (value === undefined) {
+            /** @type {NodeJS.ErrnoException} */
+            const err = new TypeError(`Invalid value "undefined" for header "${field}"`);
+            err.code = "ERR_HTTP_INVALID_HEADER_VALUE";
+            throw err;
         }
+        // each entry as text, as node serialises them: a raw number reaching uWS's writeHeader
+        // would throw mid-response. Coerced before it is checked, since that is the string the
+        // wire gets, and checked before it is stored: a value that got in here would be written by
+        // whatever flushes next, and on the error path that is a second throw with nobody left to
+        // catch it
+        const out = Array.isArray(value) ? value.map(String) : String(value);
+        validateHeaderValue(field, out);
+        this.headers[field.toLowerCase()] = out;
         return this;
     }
 
+    /**
+     * Throws away any header that could not be written, so that flushing this response cannot fail
+     * on one. setHeader refuses these on the way in, but `res.headers` is the live object, so an
+     * assignment into that still gets a value in here.
+     *
+     * Only the error page calls it. A throw out of the flush there is not recoverable: the error
+     * page is what runs after a throw, so it would be the second one, with nobody left to catch
+     * it, and on the node shim that is the process. Everything writable is left alone, since a
+     * middleware's own headers belong on the error response too.
+     *
+     * @returns {void}
+     */
+    _dropUnwritableHeaders() {
+        for (const header in this.headers) {
+            if (!headerIsWritable(header, this.headers[header])) {
+                delete this.headers[header];
+            }
+        }
+    }
+
     /**
      * Hands the status line and the headers over now, without waiting for a body, which is node's
      * flushHeaders(). Callers use it to let the client start on the head while the body is still
@@ -1387,10 +1428,6 @@ module.exports = class Response extends LazyWritable {
      * @param {() => void} [callback]
      * @returns {void}
      */
-
-    /**
-     *
-     */
     writeEarlyHints(hints, callback) {
         this.#refuseInformationAfterHead();
         // node writes the hints first and calls back after, so a caller that sequences work on it
@@ -1460,7 +1497,7 @@ module.exports = class Response extends LazyWritable {
     }
 
     /**
-     * node's `assignSocket` and `detachSocket`, which the http server uses when a response is
+     * node's `assignSocket`, which the http server uses when a response is
      * handed a raw socket. There is no such socket here.
      *
      * @param {any} [socket]
@@ -1469,6 +1506,8 @@ module.exports = class Response extends LazyWritable {
     assignSocket(socket) {}
 
     /**
+     * node's `detachSocket`, which the http server uses when a response is
+     * handed a raw socket. There is no such socket here.
      * @param {any} [socket]
      * @returns {void}
      */
@@ -1595,11 +1634,11 @@ module.exports = class Response extends LazyWritable {
                 this.set(header, field[header]);
             }
         } else {
-            field = field.toLowerCase();
+            const name = field.toLowerCase();
             // a header is text on the wire whatever it was here, and Express coerces at this point,
             // so res.get answers what was sent rather than the number or object it was given
             let out = Array.isArray(value) ? value.map(String) : String(value);
-            if (field === "content-type") {
+            if (name === "content-type") {
                 if (Array.isArray(out)) {
                     throw new TypeError("Content-Type cannot be set to an Array");
                 }
@@ -1607,6 +1646,9 @@ module.exports = class Response extends LazyWritable {
                 // missing application/manifest+json among others, which Express does charset.
                 out = withDefaultCharset(out);
             }
+            // the name as it was written, not the lowercased one: setHeader lowercases it itself,
+            // and it is the name that a refused header is reported by, which Express takes from
+            // what the caller passed
             this.setHeader(field, out);
         }
         return this;
@@ -1643,12 +1685,15 @@ module.exports = class Response extends LazyWritable {
     }
 
     /**
-     * Every header set so far, as the object they are kept in rather than a copy, so writing to
-     * it writes to the response.
+     * Every header set so far, as a shallow copy on a null prototype, which is what node's
+     * OutgoingMessage answers. It used to hand out the live object, and a write into that
+     * reached the wire without setHeader's validation, see issue #6; nothing in here or in the
+     * middleware that was checked relies on the live one, so the copy costs an allocation on a
+     * method the framework itself never calls.
      * @returns {Record<string, any>}
      */
     getHeaders() {
-        return this.headers;
+        return Object.assign({ __proto__: null }, this.headers);
     }
 
     /**
@@ -1837,10 +1882,8 @@ module.exports = class Response extends LazyWritable {
         if (!this.headers["content-type"]) {
             this.headers["content-type"] = "application/json; charset=utf-8";
         }
-        const escape = this.app.get("json escape");
-        const replacer = this.app.get("json replacer");
-        const spaces = this.app.get("json spaces");
-        return this.send(stringify(body, replacer, spaces, escape));
+        const hot = this.app._hot();
+        return this.send(stringify(body, hot.jsonReplacer, hot.jsonSpaces, hot.jsonEscape));
     }
 
     /**
@@ -2002,7 +2045,8 @@ module.exports = class Response extends LazyWritable {
     type(type) {
         const ct = type.indexOf("/") === -1 ? contentTypeFor(type) : type;
 
-        return this.set("content-type", ct);
+        // the name Express passes, since a refused value is reported by the name it was set under
+        return this.set("Content-Type", ct);
     }
 
     /**