fulmine.js 5.12.0 → 5.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.12.0",
+    "version": "5.12.1",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "bin": {

package/src/application.js

@@ -208,11 +208,11 @@ class Application extends Router {
             // a "trust proxy" this app never set is inherited from the parent, as express does:
             // the defaults are deleted so get() falls through to the parent's value
             if (
-                this.settings[trustProxyDefaultSymbol] === true &&
-                typeof parent.settings["trust proxy fn"] === "function"
+                this._settings[trustProxyDefaultSymbol] === true &&
+                typeof parent._settings["trust proxy fn"] === "function"
             ) {
-                delete this.settings["trust proxy"];
-                delete this.settings["trust proxy fn"];
+                delete this._settings["trust proxy"];
+                delete this._settings["trust proxy fn"];
             }
         });
         this.listenCalled = false;
@@ -248,20 +248,20 @@ class Application extends Router {
         this._draining = false;
         // read here, at construction, the way express does; an empty NODE_ENV means development,
         // which the ?? in the shared default would miss
-        if (typeof this.settings.env === "undefined") {
-            this.settings.env = process.env.NODE_ENV || "development";
+        if (typeof this._settings.env === "undefined") {
+            this._settings.env = process.env.NODE_ENV || "development";
         }
         for (const key in defaultSettings) {
-            if (typeof this.settings[key] === "undefined") {
+            if (typeof this._settings[key] === "undefined") {
                 if (typeof defaultSettings[key] === "function") {
-                    this.settings[key] = defaultSettings[key](this);
+                    this._settings[key] = defaultSettings[key](this);
                 } else {
-                    this.settings[key] = defaultSettings[key];
+                    this._settings[key] = defaultSettings[key];
                 }
             }
         }
         // non-enumerable, so the marker never shows up walking the settings
-        Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+        Object.defineProperty(this._settings, trustProxyDefaultSymbol, {
             configurable: true,
             value: true
         });
@@ -372,27 +372,27 @@ class Application extends Router {
             if (!value) {
                 // compiled, not deleted: an explicit false must shadow a parent's setting when
                 // this app is mounted, and a deleted key would read straight through to it
-                this.settings["trust proxy fn"] = compileTrust(false);
+                this._settings["trust proxy fn"] = compileTrust(false);
             } else {
-                this.settings["trust proxy fn"] = compileTrust(value);
+                this._settings["trust proxy fn"] = compileTrust(value);
             }
             // set explicitly, so a mount no longer inherits the parent's
-            Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+            Object.defineProperty(this._settings, trustProxyDefaultSymbol, {
                 configurable: true,
                 value: false
             });
         } else if (key === "stat cache") {
             // compiled here so the read path is a number and not a duration to parse per request
-            this.settings["stat cache ms"] = durationSetting(value, "stat cache");
+            this._settings["stat cache ms"] = durationSetting(value, "stat cache");
         } else if (key === "query parser") {
             if (value === "extended") {
-                this.settings["query parser fn"] = fastQueryParse;
+                this._settings["query parser fn"] = fastQueryParse;
             } else if (value === "simple" || value === true) {
-                this.settings["query parser fn"] = parseQuery;
+                this._settings["query parser fn"] = parseQuery;
             } else if (typeof value === "function") {
-                this.settings["query parser fn"] = value;
+                this._settings["query parser fn"] = value;
             } else if (value === false) {
-                this.settings["query parser fn"] = undefined;
+                this._settings["query parser fn"] = undefined;
             } else {
                 // express's wording, which applications match on
                 throw new TypeError("unknown value for query parser function: " + value);
@@ -414,18 +414,18 @@ class Application extends Router {
             // request. Registering a route or a middleware after listen still takes them back,
             // see router.js:1615: that is a different question, about code the analysis never saw.
             if (typeof value === "function") {
-                this.settings["etag fn"] = value;
+                this._settings["etag fn"] = value;
             } else {
                 switch (value) {
                     case true:
                     case "weak":
-                        this.settings["etag fn"] = createETagGenerator({ weak: true });
+                        this._settings["etag fn"] = createETagGenerator({ weak: true });
                         break;
                     case "strong":
-                        this.settings["etag fn"] = createETagGenerator({ weak: false });
+                        this._settings["etag fn"] = createETagGenerator({ weak: false });
                         break;
                     case false:
-                        delete this.settings["etag fn"];
+                        delete this._settings["etag fn"];
                         break;
                     default:
                         // express's wording, which applications match on
@@ -434,7 +434,7 @@ class Application extends Router {
             }
         }
 
-        this.settings[key] = value;
+        this._settings[key] = value;
         // any app's hot-settings copy may resolve through this one, see Router#_hot
         settingsEpoch.n++;
         return this;
@@ -529,6 +529,9 @@ class Application extends Router {
     _serveGeneric(res, req) {
         const request = this.handleRequest(res, req);
         const response = request.res;
+        if (request._badFraming === true) {
+            return this._refuseFraming(response);
+        }
         try {
             this._routeRequestDirect(request, response);
         } finally {

package/src/middlewares.js

@@ -538,7 +538,7 @@ function serveStatic(root, options) {
                 filePath,
                 req.headers["accept-encoding"],
                 twinTtl,
-                req.app.settings["stat cache ms"]
+                req.app._settings["stat cache ms"]
             );
             if (twin) {
                 stat = twin.stat;
@@ -546,7 +546,7 @@ function serveStatic(root, options) {
         }
         try {
             if (stat === undefined) {
-                stat = cachedStat(statTarget, req.app.settings["stat cache ms"]);
+                stat = cachedStat(statTarget, req.app._settings["stat cache ms"]);
             }
         } catch (err) {
             // the one to report when nothing is found: send hands each failed attempt to the next
@@ -656,7 +656,12 @@ function serveStatic(root, options) {
             // already found before the stat below, on the ordinary path
             const variant =
                 twin ??
-                pickPrecompressed(filePath, req.headers["accept-encoding"], twinTtl, req.app.settings["stat cache ms"]);
+                pickPrecompressed(
+                    filePath,
+                    req.headers["accept-encoding"],
+                    twinTtl,
+                    req.app._settings["stat cache ms"]
+                );
             if (variant) {
                 _path += variant.suffix;
                 stat = variant.stat;

package/src/request.js

@@ -152,6 +152,30 @@ const discardedDuplicates = new Set([
 // 128 KB of body buffered before uWS is asked to pause
 const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
 
+/**
+ * Whether a content-length is a plain count of bytes, which is the only thing RFC 9112 allows.
+ *
+ * uWS trims the spaces around the value and then takes whatever is left, so "", "abc", "+1", "-1",
+ * "0x10" and "1e2" all arrive here. Every one of them makes uWS frame the request as carrying no
+ * body, and what the client sent as a body is then read as the next request on the connection.
+ * Node's parser refuses all of them outright, and so does this.
+ *
+ * @param {string} value as uWS hands it over
+ * @returns {boolean}
+ */
+function isByteCount(value) {
+    if (value.length === 0) {
+        return false;
+    }
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code < 0x30 || code > 0x39) {
+            return false;
+        }
+    }
+    return true;
+}
+
 // Whose headers the shared collector below is filling. uWS's forEach is synchronous and runs no
 // user code, so the handoff cannot interleave; module-level so the callback exists once instead
 // of once per request.
@@ -336,6 +360,15 @@ module.exports = class Request extends LazyReadable {
             (headerKey.length === 14 && headerKey === "content-length") ||
             (headerKey.length === 17 && headerKey === "transfer-encoding")
         ) {
+            if (headerKey.length === 14) {
+                // a second content-length whatever it says, and one that is not a count of bytes:
+                // both make uWS frame the request differently from what is on the wire, see
+                // _badFraming and isByteCount
+                if (r._sawContentLength || !isByteCount(value)) {
+                    r._badFraming = true;
+                }
+                r._sawContentLength = true;
+            }
             // saying anything about framing at all, "0" included. A parser that can see a
             // content-length answers about the body it describes, even an empty one: a zero length
             // with a charset nobody can decode is a 415 in express and here, so a chain may only
@@ -439,6 +472,33 @@ module.exports = class Request extends LazyReadable {
      */
     _hasBodyHeaders;
 
+    /**
+     * Whether a content-length has already been copied, so a second one is spotted. Declared for
+     * the same reason as rawIp.
+     * @type {boolean|undefined}
+     */
+    _sawContentLength;
+
+    /**
+     * Whether the request said two different things about how long its body is, so uWS may have
+     * framed it differently from the client that sent it and the proxy that forwarded it. Two
+     * shapes reach this, and node's parser refuses both outright:
+     *
+     *   a repeated content-length     uWS frames on the first and drops the rest, so a proxy in
+     *                                 front reading the last one instead forwards bytes uWS then
+     *                                 answers as a second, pipelined request
+     *   one that is not a byte count  uWS keeps whatever is left after trimming, an empty value
+     *                                 included, and frames the request as carrying no body at all,
+     *                                 which turns the body the client sent into that same second
+     *                                 request. See isByteCount
+     *
+     * Either way it is request smuggling, and the request is refused rather than routed. Declared
+     * for the same reason as rawIp.
+     *
+     * @type {boolean|undefined}
+     */
+    _badFraming;
+
     /**
      * Whether the client asked for the connection to be closed. Declared for the same reason.
      * @type {boolean|undefined}
@@ -504,10 +564,18 @@ module.exports = class Request extends LazyReadable {
             // which is 0.2us on a request that is about to read a body.
             const length = req.getHeader("content-length");
             const transferEncoding = req.getHeader("transfer-encoding");
+            // A content-length of "0" declares no body and used to stay on the cheap side, but
+            // getHeader only ever returns the first of a repeated header, so a duplicate cannot be
+            // seen from here, and a duplicate has to be refused rather than routed: see
+            // _badFraming. Anything that says a word about framing takes the full copy instead.
+            //
+            // One shape stays invisible here, a content-length present with an empty value: uWS
+            // answers "" for that and for a header that was never sent, and nothing in its API
+            // tells them apart. It frames both as carrying no body, which is the right reading of
+            // the second, so this server stays consistent with itself either way. The full copy
+            // below does refuse it, which is every request except a GET whose whole chain provably
+            // reads no header at all.
             if (length !== "" || transferEncoding !== "") {
-                this._hasBodyHeaders = true;
-            }
-            if ((length !== "" && length !== "0") || transferEncoding !== "") {
                 currentRequest = this;
                 this._req.forEach(Request.#collectHeader);
                 currentRequest = null;

package/src/response.js

@@ -296,7 +296,7 @@ module.exports = class Response extends LazyWritable {
         // "connection headers" off advertises neither, which Express always does: see below for
         // the one this still writes.
         this.headers =
-            res._nodeRes || app.settings["connection headers"] === false
+            res._nodeRes || app._settings["connection headers"] === false
                 ? {}
                 : {
                       connection: "keep-alive",
@@ -1066,7 +1066,7 @@ module.exports = class Response extends LazyWritable {
         let stat = options._stat;
         if (!stat) {
             try {
-                stat = cachedStat(fullpath, this.app.settings["stat cache ms"]);
+                stat = cachedStat(fullpath, this.app._settings["stat cache ms"]);
             } catch (err) {
                 // the fs error itself, carrying its errno and path, with send's status written on
                 // it: a missing file is the request's 404, an unreadable one is the server's 500

package/src/router.js

@@ -178,7 +178,10 @@ class Walk {
         // inside the route. req.next itself is left alone: making it mean this everywhere is what
         // express does, and it breaks express own res.format and app.routes.error tests here, so
         // that stays open rather than half done.
-        this.leaveRoute = this.stepOutOfRoute.bind(this);
+        //
+        // Null here and bound on the first route that has more than one callback, which is the
+        // only shape that ever reads it: a request that never meets one paid a bind for nothing
+        this.leaveRoute = null;
     }
 
     /**
@@ -362,7 +365,7 @@ class Walk {
         // express hands res.format's handlers the next its own layer received, and its test asserts
         // that identity. With more than one callback the two differ for real, and what express
         // hands over is the one that leaves the route
-        req._leaveRoute = route.callbacks.length > 1 ? this.leaveRoute : this.next;
+        req._leaveRoute = route.callbacks.length > 1 ? (this.leaveRoute ??= this.stepOutOfRoute.bind(this)) : this.next;
         if (continueRoute === "route") {
             this.step("route");
         } else if (continueRoute) {
@@ -475,7 +478,7 @@ class Walk {
                 rememberApp(this, route, req);
                 useApp(req, callback);
             }
-            const pushedParams = callback.settings.mergeParams;
+            const pushedParams = callback._settings.mergeParams;
             if (pushedParams) {
                 (req._paramStack ??= []).push(req.params);
             }
@@ -679,7 +682,7 @@ function setMountedPath(req) {
  */
 function mergesParams(route, fallback) {
     const owner = route.owner ?? fallback;
-    return Boolean(owner?.settings?.mergeParams);
+    return Boolean(owner?._settings?.mergeParams);
 }
 
 /**
@@ -819,6 +822,46 @@ function onNativeAborted() {
     response.socket?.emit("error", err);
 }
 
+/**
+ * What app.settings is wrapped in, so a write that never went through set() still tells the hot
+ * copies they are out of date. Only writes are trapped: a missing trap is the plain operation on
+ * the object itself, so reads through here behave exactly as they did.
+ *
+ * defineProperty is here for the trust proxy default marker, which set() writes that way, and for
+ * anything else reaching for Object.defineProperty rather than an assignment.
+ */
+const settingsWriteTraps = {
+    /**
+     * @param {any} target
+     * @param {string|symbol} key
+     * @param {any} value
+     */
+    set(target, key, value) {
+        target[key] = value;
+        settingsEpoch.n++;
+        return true;
+    },
+    /**
+     * @param {any} target
+     * @param {string|symbol} key
+     */
+    deleteProperty(target, key) {
+        delete target[key];
+        settingsEpoch.n++;
+        return true;
+    },
+    /**
+     * @param {any} target
+     * @param {string|symbol} key
+     * @param {any} descriptor
+     */
+    defineProperty(target, key, descriptor) {
+        Object.defineProperty(target, key, descriptor);
+        settingsEpoch.n++;
+        return true;
+    }
+};
+
 /**
  * The per-request constants of a fully literal native registration. µWS matched the URL byte for
  * byte against this exact pattern and dispatches by method, so the request constructor can take
@@ -1294,19 +1337,26 @@ module.exports = class Router extends EventEmitter {
         // an array when mounted on several paths at once, as Express allows
         /** @type {string|string[]} */
         this.mountpath = "/";
-        this.settings = settings;
+        // The settings twice: the plain object everything inside here reads, and the Proxy the
+        // outside gets. Express lets an application write app.settings["x"] straight, which set()
+        // never sees, so the hot copies in _hot() would keep answering the old value until an
+        // unrelated set() happened to bump the epoch and the change landed by surprise. The trap
+        // bumps it on the spot. Reading through a Proxy costs about 20ns, which is why the inside
+        // never does: _settings is the same object without the wrapper.
+        this._settings = settings;
+        this.settings = new Proxy(settings, settingsWriteTraps);
         // the base classes; an Application replaces these with its own per-app subclasses, and a
         // plain router has no request/response prototype layer, as in Express
         this._request = Request;
         this._response = Response;
 
         if (typeof settings.caseSensitive !== "undefined") {
-            this.settings["case sensitive routing"] = settings.caseSensitive;
-            delete this.settings.caseSensitive;
+            settings["case sensitive routing"] = settings.caseSensitive;
+            delete settings.caseSensitive;
         }
         if (typeof settings.strict !== "undefined") {
-            this.settings["strict routing"] = settings.strict;
-            delete this.settings.strict;
+            settings["strict routing"] = settings.strict;
+            delete settings.strict;
         }
     }
 
@@ -1393,7 +1443,8 @@ module.exports = class Router extends EventEmitter {
     get(path, ...callbacks) {
         if (typeof path === "string" && callbacks.length === 0) {
             const key = path;
-            const res = this.settings[key];
+            // the raw object, not the Proxy: see the constructor
+            const res = this._settings[key];
             if (typeof res === "undefined" && this.parent) {
                 return this.parent.get(key);
             } else {
@@ -1441,7 +1492,7 @@ module.exports = class Router extends EventEmitter {
      * @returns {boolean}
      */
     _routingFlag(key) {
-        const own = this.settings[key];
+        const own = this._settings[key];
         if (typeof own !== "undefined") {
             return Boolean(own);
         }
@@ -2014,6 +2065,30 @@ module.exports = class Router extends EventEmitter {
         return request;
     }
 
+    /**
+     * Refuses a request whose framing cannot be trusted and hangs up without answering. No route
+     * runs, so nothing downstream can be reached by one.
+     *
+     * Hanging up is the whole point: uWS has already read what followed the body it believed in as
+     * a second, pipelined request, and it dispatches that one unless the socket goes. Node answers
+     * 400 and then closes, and this cannot do both: uWS only skips the queued request when the
+     * response is closed rather than completed, and any of writeStatus, end or endWithoutBody
+     * completes it. Measured every combination, and delivering the 400 always let the smuggled
+     * request through, so the close wins and the client gets nothing. Nothing legitimate sends two
+     * content-lengths, so there is no well-behaved client to explain it to.
+     *
+     * Called once handleRequest has fully returned, never from inside it: an Application links the
+     * response into its pending list after the base call, and the 'close' emitted here is what
+     * takes it back out again.
+     *
+     * @param {any} response
+     */
+    _refuseFraming(response) {
+        response.finished = true;
+        response._res.close();
+        response.emit("close");
+    }
+
     /**
      * Tells uWS whom to call on a client abort. Out of handleRequest, because uWS only needs it
      * for a response that outlives its handler callback: the native handler arms it in its
@@ -2120,6 +2195,9 @@ module.exports = class Router extends EventEmitter {
                 }
                 const request = this.handleRequest(res, req, preset, skipHolder);
                 const response = request.res;
+                if (request._badFraming === true) {
+                    return this._refuseFraming(response);
+                }
                 if (optimizedParams) {
                     request.optimizedParams = new NullObject();
                     for (let i = 0; i < optimizedParams.length; i++) {