fulmine.js 5.19.2 → 5.19.4

package/src/middlewares.js

@@ -26,6 +26,7 @@ const mime = require("mime-types");
 const compressible = require("compressible");
 const ms = require("ms");
 const qs = require("qs");
+const statuses = require("statuses");
 const parseQuery = require("./parse-query.js");
 const { kGetSafe } = require("./usage.js");
 const { AsyncResource } = require("async_hooks");
@@ -48,6 +49,7 @@ const {
     NullObject,
     asStatError,
     httpError,
+    httpErrorName,
     memoizeByString,
     containsDotFile,
     negotiateEncoding,
@@ -72,17 +74,38 @@ const PRECOMPRESSED = [
     { encoding: "gzip", suffix: ".gz", flag: ENCODING_GZIP }
 ];
 
+/** @typedef {import("./request.js")} Request */
+/** @typedef {import("./response.js")} Response */
+/** @typedef {import("./utils.js").HttpError} HttpError */
+/** @typedef {import("./options").BodyParserOptions} BodyParserOptions */
+/**
+ * A decompressor from fast-zlib, carrying the flag its final flush passes, see createInflate.
+ * @typedef {(import("fast-zlib").Inflate|import("fast-zlib").Gunzip|import("fast-zlib").BrotliDecompress)
+ *   & {_finishFlag?: number}} Inflater
+ */
+/**
+ * What a parser does with the collected bytes: turns them into req.body and carries on. `body` is
+ * deliberately not a field of Request, see the comment there, so it is added here. The charset is
+ * undefined only for raw, which never decodes: the others settle it before a byte is read.
+ * @typedef {(
+ *   req: Request & {body?: unknown},
+ *   res: Response,
+ *   next: (err?: unknown) => void,
+ *   options: BodyParserOptions,
+ *   buf: Buffer,
+ *   encoding: string|undefined
+ * ) => void} BodyHandler
+ */
+
 // The failures express.static answers by moving on to the next handler rather than by reporting
 // them, when fallthrough is on. They all mean the same thing: the request is not a file here.
 //
-// serve-static decides this by remembering whether send got as far as settling on a file, and
-// forwards everything after that point. The list is the same thing said from the other side, since
-// by the time this hands over, the file has been found and stat'ed already: what is left to fail
-// is a dotfile rule or a path that will not decode.
+// serve-static decides this by remembering whether send got as far as settling on a file. The list
+// says the same from the other side: by the time this hands over the file has been found and
+// stat'ed, so what is left to fail is a dotfile rule or a path that will not decode.
 //
-// A 412 and a 416 are not on it, and that is the point of the list. Both are about a file that
-// exists and about conditions the client itself set, and falling through swallowed them: a Range
-// Not Satisfiable came back as a 404, which tells the client its file is gone when it is not.
+// A 412 and a 416 are not on it. Both are about a file that exists and about conditions the client
+// itself set, and falling through swallowed them: a Range Not Satisfiable came back as a 404.
 const FALLTHROUGH_STATUSES = new Set([400, 403, 404]);
 
 /**
@@ -122,7 +145,7 @@ let iconv;
  * iconv-lite, loaded only when a request names a charset the Buffer cannot decode, so the common
  * utf-8 request never pays for it.
  *
- * @returns {any}
+ * @returns {typeof import("iconv-lite")}
  */
 function loadIconv() {
     if (!iconv) iconv = require("iconv-lite");
@@ -199,7 +222,7 @@ function decodeBody(buf, encoding) {
         case "iso-8859-1":
             return buf.toString("latin1");
         default:
-            return loadIconv().decode(buf, encoding);
+            return loadIconv().decode(buf, /** @type {import("iconv-lite").Encoding} */ (encoding));
     }
 }
 
@@ -207,39 +230,60 @@ function decodeBody(buf, encoding) {
  * Runs the caller's verify hook the way body-parser does, an empty body included; a throw becomes
  * the 403 entity.verify.failed error. Answers whether parsing may continue.
  *
- * @param {any} req
- * @param {any} res
- * @param {(err?: any) => void} next
- * @param {any} options
+ * @param {Request} req
+ * @param {Response} res
+ * @param {(err?: unknown) => void} next
+ * @param {BodyParserOptions} options the parser options, settled by createBodyParser
  * @param {Buffer} buf
+ * @param {string|undefined} encoding the charset the body is about to be decoded with, undefined
+ *   for raw, which never decodes
  * @returns {boolean}
  */
-function runVerify(req, res, next, options, buf) {
+function runVerify(req, res, next, options, buf, encoding) {
     if (!options.verify) {
         return true;
     }
     try {
-        options.verify(req, res, buf);
+        // the charset goes too, as body-parser hands it over: a hook checking a signature over
+        // the decoded text needs it. raw gets null, which is what body-parser gives it there
+        options.verify(req, res, buf, encoding ?? null);
         return true;
     } catch (e) {
-        const err = /** @type {any} */ (e);
-        next(
-            asBodyError(err, err.status ?? err.statusCode ?? 403, err.type ?? "entity.verify.failed", {
-                body: buf
-            })
-        );
+        next(verifyError(e, buf));
         return false;
     }
 }
 
+/**
+ * The error a verify hook's throw becomes, as http-errors shapes it for body-parser. An Error is
+ * kept, with its own status when that is one a client can be answered with; a thrown string
+ * becomes a 403 with that message, and anything else a plain 403.
+ *
+ * @param {unknown} thrown
+ * @param {Buffer} buf the body, which rides on the error as body-parser puts it there
+ * @returns {HttpError}
+ */
+function verifyError(thrown, buf) {
+    const own = thrown instanceof Error ? /** @type {HttpError} */ (thrown) : undefined;
+    let status = own ? own.status || own.statusCode || 403 : 403;
+    // http-errors answers 500 for a status it cannot answer with: not a number, or outside 4xx
+    // and 5xx with no message of its own
+    if (typeof status !== "number" || (!statuses.message[status] && (status < 400 || status >= 600))) {
+        status = 500;
+    }
+    const err = own ?? httpError(status, typeof thrown === "string" ? thrown : undefined);
+    // read off whatever was thrown, as body-parser reads it
+    const type = /** @type {{type?: string}|null|undefined} */ (thrown)?.type || "entity.verify.failed";
+    return asBodyError(err, status, type, { body: buf });
+}
+
 /**
  * The message a strict violation gets, which is the one V8 would have produced had the body been
  * invalid JSON rather than merely not an object.
  *
- * body-parser goes to some trouble over this: it builds a string that is the body up to the
- * offending character followed by placeholder characters, asks JSON.parse to fail on that, and
- * then puts the real characters back into whatever V8 said. The point is that an application
- * showing err.message reads the same sentence either way, naming the character and its position.
+ * body-parser builds a string that is the body up to the offending character followed by
+ * placeholders, asks JSON.parse to fail on that, and puts the real characters back into what V8
+ * said, so an application showing err.message reads the same sentence either way.
  *
  * @param {string} text the body as sent
  * @param {string|undefined} char the first character that is neither whitespace nor { nor [
@@ -255,22 +299,13 @@ function strictSyntaxMessage(text, char) {
         JSON.parse(partial);
     } catch (e) {
         // put the real characters back where the placeholders were named
-        return /** @type {any} */ (e).message.replace(/#+/g, (/** @type {string} */ placeholder) =>
+        return /** @type {SyntaxError} */ (e).message.replace(/#+/g, (/** @type {string} */ placeholder) =>
             text.substring(index, index + placeholder.length)
         );
     }
     return "strict violation";
 }
 
-// The name http-errors gives each status body-parser answers with. An application reading
-// err.name, or a logger printing it, sees "PayloadTooLargeError" from Express and would have
-// seen a bare "Error" here.
-const BODY_ERROR_NAMES = {
-    400: "BadRequestError",
-    413: "PayloadTooLargeError",
-    415: "UnsupportedMediaTypeError"
-};
-
 /**
  * The error a body parser hands to next(), shaped as body-parser shapes it: with a status, since
  * `res.status(err.status || 500)` would otherwise answer 500 to a request that was merely too
@@ -283,10 +318,11 @@ const BODY_ERROR_NAMES = {
  * @returns {Error}
  */
 function bodyError(message, status, type, extra) {
-    const err = /** @type {any} */ (new Error(message));
-    if (BODY_ERROR_NAMES[status]) {
-        err.name = BODY_ERROR_NAMES[status];
-    }
+    /** @type {HttpError} */
+    const err = new Error(message);
+    // the name http-errors gives it: an application reading err.name, or a logger printing it,
+    // sees "PayloadTooLargeError" from Express and would have seen a bare "Error" here
+    err.name = httpErrorName(status);
     return asBodyError(err, status, type, extra);
 }
 
@@ -296,7 +332,7 @@ function bodyError(message, status, type, extra) {
  * its stack and any property the thrower put on it are all still there when the application
  * reads it.
  *
- * @param {any} err
+ * @param {HttpError} err the error the fields go on: JSON.parse's SyntaxError, or a verify hook's own
  * @param {number} status
  * @param {string} type body-parser's own name for the kind of failure
  * @param {object} [extra] anything else body-parser puts on that particular error
@@ -361,12 +397,12 @@ function twinsOf(filePath, ttl) {
  * The compressed twin of a file to serve in its place, or undefined when the client would rather
  * have the file itself or the twin is not there.
  *
- * The stat comes back with it, and is what sendFile then answers from: the ETag and the
- * Last-Modified of a variant are its own, which is the whole point. Two bodies sharing one ETag is
- * how a shared cache ends up handing brotli to a client that cannot read it.
+ * The stat comes back with it, and is what sendFile then answers from: the ETag and Last-Modified
+ * of a variant are its own. Two bodies sharing one ETag is how a shared cache ends up handing
+ * brotli to a client that cannot read it.
  *
- * One stat when the answer is a twin, and none at all when the last request already found there is
- * no twin to have. See twinCache above for what is remembered and what is not.
+ * One stat when the answer is a twin, none when the last request already found there is no twin.
+ * See twinCache above for what is remembered.
  *
  * @param {string} filePath absolute path of the file that was asked for
  * @param {string|undefined} accept the request's Accept-Encoding
@@ -411,7 +447,7 @@ function pickPrecompressed(filePath, accept, ttl, statTtl) {
  *
  * @param {string} dir the directory to look in
  * @param {string[]} indexList the index names, in order
- * @returns {{stat: any, name: string, candidate: string}|null} the file to serve, or null
+ * @returns {{stat: import("fs").Stats, name: string, candidate: string}|null} the file to serve, or null
  */
 function findIndexFile(dir, indexList) {
     let lastError;
@@ -445,7 +481,7 @@ function findIndexFile(dir, indexList) {
  *
  * @param {string} root directory to serve from
  * @param {import("./options").StaticOptions} [options]
- * @returns {(req: any, res: any, next: (err?: any) => void) => any}
+ * @returns {(req: Request, res: Response, next: (err?: unknown) => void) => void}
  */
 function serveStatic(root, options) {
     // serve-static's own messages, thrown where the middleware is written rather than where a
@@ -478,21 +514,22 @@ function serveStatic(root, options) {
     if (options.setHeaders !== undefined && typeof options.setHeaders !== "function") {
         throw new TypeError("option setHeaders must be function");
     }
+    // serve-static's own option, which res.sendFile does not take, so it goes down under a name
+    // only this middleware writes, see sendFile
+    options._setHeaders = options.setHeaders;
     // How long express.static remembers which twins a path has. A second is short enough that a
     // deploy is picked up while it is still going out, and long enough that the lookup costs
     // nothing under any traffic at all. { cache: false } asks the disk on every request.
     let twinTtl = 0;
     if (options.preCompressed) {
-        const cache = /** @type {any} */ (
-            typeof options.preCompressed === "object" ? options.preCompressed.cache : undefined
-        );
+        const cache = typeof options.preCompressed === "object" ? options.preCompressed.cache : undefined;
         twinTtl =
             cache === undefined
                 ? 1000
                 : cache === false
                   ? 0
                   : typeof cache === "string"
-                    ? ms(/** @type {any} */ (cache))
+                    ? ms(/** @type {import("ms").StringValue} */ (cache))
                     : cache;
         if (typeof twinTtl !== "number" || !(twinTtl >= 0)) {
             throw new TypeError("option preCompressed.cache must be a duration");
@@ -555,12 +592,11 @@ function serveStatic(root, options) {
         // Joined against the root and not normalised on its own first, which is the difference
         // between "/mount/../package.json" being refused and being served: a ".." has to climb
         // relative to the root so the check below can see it leave, and normalizing the url alone
-        // clamps it at "/" where nothing has left anywhere. Absolute because resolvedRoot is, so
-        // nothing here resolves against the working directory per request either.
-        // and without the trailing separator join keeps and resolve does not, because statTarget
-        // below puts it back only where it belongs: linux refuses a file asked for as a directory,
-        // so a mount whose root is a file answers nothing at all if the separator stays here.
-        // Windows stats it either way, which is why only the CI said so.
+        // clamps it at "/". Absolute because resolvedRoot is, so nothing resolves against the
+        // working directory per request.
+        // Without the trailing separator join keeps and resolve does not, because statTarget below
+        // puts it back only where it belongs: linux refuses a file asked for as a directory, so a
+        // mount whose root is a file would answer nothing. Windows stats it either way
         let fullpath = path.join(resolvedRoot, url);
         if (fullpath.length > resolvedRoot.length && fullpath.endsWith(path.sep)) {
             fullpath = fullpath.slice(0, -1);
@@ -570,12 +606,11 @@ function serveStatic(root, options) {
         let filePath = fullpath;
         // What serve-static hands send is this path, except that a bare "/" under a mount the
         // request did not write with one becomes "": without that rule a mount whose root is a file
-        // would ask the disk for a directory and could never answer at all.
+        // would ask the disk for a directory and could never answer.
         //
-        // Send then stats `normalize(join(root, path))`, and both of those keep a trailing
-        // separator where `resolve` takes it off. The separator is not decoration: the disk refuses
-        // a file that is asked for as a directory, and the name inside the error carries it, which
-        // is what an error handler prints when fallthrough is off.
+        // Send then stats `normalize(join(root, path))`, and both keep a trailing separator where
+        // `resolve` takes it off. The disk refuses a file asked for as a directory, and the name
+        // inside the error carries it, which is what an error handler prints
         const mountRelative = rawPath === "/" && !req.endsWithSlash ? "" : url;
         const statTarget = mountRelative.endsWith("/") && !fullpath.endsWith(path.sep) ? fullpath + path.sep : fullpath;
         if (root && !fullpath.startsWith(resolvedRoot)) {
@@ -586,14 +621,10 @@ function serveStatic(root, options) {
         }
 
         // Before the stat, because send judges the path before it looks at the disk: a hidden
-        // segment anywhere in a path that does not exist answers what the dotfiles rule says and
-        // not the ENOENT the disk would have given. sendFile applies the same rule below, and
-        // reaches it only for paths that do exist.
-        // normalized first, as send normalizes before it judges: a ".." segment is not a hidden
-        // file, and resolving it away is what tells the two apart
-        // and these are the segments path.normalize(url) would have produced, taken off the joined
-        // path rather than walked again: the check above has just proved it starts with the root,
-        // so what follows the root is the url in normal form
+        // segment in a path that does not exist answers what the dotfiles rule says and not the
+        // ENOENT the disk would have given. Normalized first, as send normalizes before it judges:
+        // a ".." segment is not a hidden file. These are the segments path.normalize(url) would
+        // have produced, taken off the joined path rather than walked again
         if (containsDotFile(fullpath.slice(resolvedRoot.length).split(/[\\/]/))) {
             const refusal = options.dotfiles === "deny" ? 403 : options.dotfiles === "allow" ? 0 : 404;
             if (refusal !== 0 && !(options.dotfiles === "ignore_files" && !path.basename(url).startsWith("."))) {
@@ -668,7 +699,7 @@ function serveStatic(root, options) {
                     // error handler with its errno, code, syscall and path still on it, and an
                     // error handler doing res.send(err) sends those as JSON. Passing the string
                     // sent an HTML page instead.
-                    return next(asStatError(statError));
+                    return next(asStatError(/** @type {HttpError} */ (statError)));
                 } else return next();
             }
         }
@@ -689,13 +720,11 @@ function serveStatic(root, options) {
         if (stat.isDirectory() || req.endsWithSlash) {
             if (!req.endsWithSlash) {
                 if (options.redirect) {
-                    // The query goes along, and the leading slashes are collapsed. Both were
-                    // wrong: "/docs?page=3" redirected to "/docs/" and lost the page, and a
-                    // request for "//assets" answered "Location: //assets/", which a browser
-                    // reads as a protocol-relative URL and follows to the host "assets". A
-                    // redirect that leaves this server is not a redirect this server meant.
-                    // serve-static locks its redirect page down the way it locks an error page:
-                    // the body names the target, and the target came from the request
+                    // The query goes along and the leading slashes are collapsed. Both were wrong:
+                    // "/docs?page=3" redirected to "/docs/" and lost the page, and "//assets"
+                    // answered "Location: //assets/", which a browser reads as protocol-relative
+                    // and follows to the host "assets". serve-static locks its redirect page down
+                    // the way it locks an error page: the body names a target the request supplied
                     res.setHeader("Content-Security-Policy", "default-src 'none'");
                     res.setHeader("X-Content-Type-Options", "nosniff");
                     return res.redirect(301, collapseLeadingSlashes(req._originalPath + "/") + req.urlQuery, true);
@@ -715,7 +744,7 @@ function serveStatic(root, options) {
                         res.status(404);
                         // the fs error, as above: the index file is missing and the error handler
                         // is told which one and where
-                        return next(asStatError(err));
+                        return next(asStatError(/** @type {HttpError} */ (err)));
                     } else return next();
                 }
                 if (found === null) {
@@ -786,7 +815,7 @@ function serveStatic(root, options) {
  * encoding nobody knows throws, since decoding it wrong is worse than refusing.
  *
  * @param {string|undefined} contentEncoding
- * @returns {any|undefined}
+ * @returns {Inflater|false|undefined}
  */
 function createInflate(contentEncoding) {
     const encoding = (contentEncoding || "identity").toLowerCase();
@@ -807,21 +836,20 @@ function createInflate(contentEncoding) {
             return false;
     }
     // the flag the final flush passes, so a truncated stream errors instead of resolving empty
-    /** @type {any} */ (stream)._finishFlag =
+    /** @type {Inflater} */ (stream)._finishFlag =
         encoding === "br" ? zlib.constants.BROTLI_OPERATION_FINISH : zlib.constants.Z_FINISH;
     return stream;
 }
 
 /**
- * Builds one of the body parsers. All four share the same work, which is deciding whether this
- * request has a body worth reading, collecting it within the size limit, decompressing it and
- * handing the bytes over; they differ only in the content type they claim by default and in what
- * they turn the bytes into.
+ * Builds one of the body parsers. All four share the same work: deciding whether this request has
+ * a body worth reading, collecting it within the size limit, decompressing it and handing the
+ * bytes over. They differ in the content type they claim and in what they turn the bytes into.
  *
  * @param {string} defaultType the type matched when the caller names none
- * @param {(...args: any[]) => any} beforeReturn turns the collected bytes into req.body. Called
- *   with the request, the response, next, the options, the body and its charset
- * @param {(options: any) => void} [checkOptions] whatever this parser alone has to check
+ * @param {BodyHandler} beforeReturn turns the collected bytes into req.body. Called with the
+ *   request, the response, next, the options, the body and its charset
+ * @param {(options: BodyParserOptions) => void} [checkOptions] whatever this parser alone has to check
  * @param {string} [charsetPolicy] which charsets this parser accepts, as body-parser draws the
  *   lines: "utf" (json, utf-* only), "urlencoded" (utf-8 and iso-8859-1), "any" (anything iconv
  *   knows), or undefined for a parser that never decodes (raw)
@@ -881,12 +909,12 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
         // Whether a content-type is one this parser claims, remembered per parser.
         //
         // Only reached when the caller asked for a wildcard or a list, since a plain type takes the
-        // simpleType shortcut above and never calls type-is at all. For those callers type-is was
-        // 513 ns to reach the same answer about the same string on every request, against 4 ns for
-        // an answer already worked out. The header is the client's, so the memo needs its ceiling.
+        // simpleType shortcut above. For those callers type-is was 513ns to reach the same answer
+        // about the same string on every request, against 4ns for one already worked out. The
+        // header is the client's, so the memo needs its ceiling.
         //
         // typeis.is and not typeis(req, ...): the request form first checks that there is a body,
-        // and the caller below has established that already.
+        // which the caller below has established.
         const claimsType = memoizeByString(
             (contentType) => !!typeis.is(contentType, /** @type {string[]} */ (options.type))
         );
@@ -908,12 +936,10 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             }
 
             // The property goes on the request before anything is decided, and its value stays
-            // undefined: body-parser's read() does exactly this, and the two halves both matter.
-            // Undefined, so a handler can still tell "nothing parsed this" from "the body was
-            // empty", which seeding an empty object would lose. Present, because `"body" in req`
-            // is how a library asks whether a parser has run at all: Apollo's express middleware
-            // refuses the request with a 500 when the property is missing, and tRPC's adapter
-            // reads the body itself when it is, so getting either half wrong breaks one of them.
+            // undefined: body-parser's read() does the same, and both halves matter. Undefined, so
+            // a handler can tell "nothing parsed this" from "the body was empty". Present, because
+            // `"body" in req` is how a library asks whether a parser has run: Apollo's express
+            // middleware answers 500 when it is missing, and tRPC's adapter reads the body itself
             if (!("body" in req)) {
                 req.body = undefined;
             }
@@ -983,7 +1009,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             if (lengthNumber === 0) {
                 req.bodyRead = true;
                 const empty = Buffer.alloc(0);
-                if (!runVerify(req, res, next, options, empty)) {
+                if (!runVerify(req, res, next, options, empty, encoding)) {
                     return;
                 }
                 return beforeReturn(req, res, next, options, empty, encoding);
@@ -1013,7 +1039,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 return next();
             }
 
-            const abs = [];
+            /** @type {Inflater|false|undefined} */
             let inflate;
             let totalSize = 0;
             const rawContentEncoding = req._rawHeader("content-encoding");
@@ -1047,11 +1073,9 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             next = bindContext(next);
 
             // with nothing to decompress, uWS can collect the whole body in native code: one
-            // callback instead of one per chunk, the limit enforced before any byte reaches JS,
-            // and no copy at all - the parsers turn the bytes into req.body before the callback
-            // returns, so a view over uWS's own memory is enough. A declared length was the
-            // original case; a chunked body accumulates in the same native vector and only loses
-            // the length check, since there is no declaration to hold it to
+            // callback instead of one per chunk, the limit enforced before any byte reaches JS, and
+            // no copy at all, since the parsers turn the bytes into req.body before the callback
+            // returns. A chunked body uses the same native vector and only loses the length check
             const declared = lengthNumber;
             const declaresLength = !Number.isNaN(declared) && declared > 0;
             if (!req.receivedData && !inflate && req._res.collectBody && (declaresLength || isNaN(declared))) {
@@ -1084,7 +1108,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                     if (copyBody) {
                         buf = Buffer.from(buf);
                     }
-                    if (!runVerify(req, res, next, options, buf)) {
+                    if (!runVerify(req, res, next, options, buf, encoding)) {
                         return;
                     }
                     beforeReturn(req, res, next, options, buf, encoding);
@@ -1093,12 +1117,11 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             }
 
             // uWS neuters its ArrayBuffer after the callback, so every chunk has to be copied out of
-            // it - and then Buffer.concat copied the whole body a second time. when content-length is
-            // known and we aren't inflating, the final size is known up front, so chunks can go
-            // straight into one buffer and the body is copied once.
-            // the cap means a client that declares a body and never sends it costs no more than one
-            // that actually sends a body that size, and content-length above limit was
-            // already rejected above
+            // it, and then Buffer.concat copied the whole body a second time. When content-length is
+            // known and we are not inflating, the final size is known up front, so chunks go
+            // straight into one buffer and the body is copied once. The cap means a client that
+            // declares a body and never sends it costs no more than one that sends it
+            const abs = [];
             const declaredLength = inflate ? -1 : Number(length);
             let target =
                 declaredLength > 0 && declaredLength <= MAX_PREALLOCATED_BODY
@@ -1116,16 +1139,15 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             /**
              * A zlib throw becomes the 400 body-parser answers a corrupt body with.
              *
-             * zlib reports it twice: process() throws, and the stream emits 'error' a tick
-             * later. fast-zlib removes its own listeners on the way out, so that second one
-             * lands on nothing, and an unhandled 'error' event ends the process: a corrupt
-             * gzip body was enough to take the server down. The listener goes on after the
-             * throw, since process() would have removed it.
+             * zlib reports it twice: process() throws, and the stream emits 'error' a tick later.
+             * fast-zlib removes its own listeners on the way out, so that second one lands on
+             * nothing, and an unhandled 'error' event ends the process. The listener goes on after
+             * the throw, since process() would have removed it.
              *
-             * @param {any} err what inflate.process threw
+             * @param {HttpError} err what inflate.process threw
              */
             function failInflate(err) {
-                /** @type {any} */ (inflate).instance?.on?.("error", () => {});
+                /** @type {Inflater} */ (inflate).instance?.on?.("error", () => {});
                 finished = true;
                 abs.length = 0;
                 target = null;
@@ -1178,7 +1200,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
              * finished flag matters: uWS goes on delivering chunks after an oversized body has
              * been refused, and without it every further chunk would answer the request again.
              *
-             * @param {any} buf a Buffer, or an ArrayBuffer straight from uWS
+             * @param {Buffer|ArrayBuffer} buf a Buffer, or an ArrayBuffer straight from uWS
              */
             function onData(buf) {
                 if (finished) {
@@ -1193,7 +1215,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                     } catch (e) {
                         // a body that does not decompress is the client's mistake, and zlib
                         // throwing here used to escape into whatever called us
-                        return failInflate(e);
+                        return failInflate(/** @type {HttpError} */ (e));
                     }
                 }
 
@@ -1214,7 +1236,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                     try {
                         tail = inflate.process(EMPTY_BUFFER, inflate._finishFlag);
                     } catch (e) {
-                        return failInflate(e);
+                        return failInflate(/** @type {HttpError} */ (e));
                     }
                     if (tail.length && !keepChunk(tail)) {
                         return;
@@ -1242,7 +1264,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                     : abs.length === 1
                       ? abs[0]
                       : Buffer.concat(abs);
-                if (!runVerify(req, res, next, options, buf)) {
+                if (!runVerify(req, res, next, options, buf, encoding)) {
                     return;
                 }
                 beforeReturn(req, res, next, options, buf, encoding);
@@ -1290,7 +1312,7 @@ const json = createBodyParser(
         // either: it decodes through iconv, which strips it, so by the time the first character is
         // looked at the mark is gone. JSON.parse would refuse it, so without this a body saved by
         // an editor that writes a BOM is answered 400 here and 200 by Express.
-        const text = stripBom(decodeBody(buf, encoding));
+        const text = stripBom(decodeBody(buf, /** @type {string} */ (encoding)));
 
         // "strict" means only an object or an array is a body, which is body-parser's default and
         // was not honoured here at all: the check read req.body before this function had parsed
@@ -1318,7 +1340,7 @@ const json = createBodyParser(
         } catch (e) {
             // V8's own error, which is what body-parser hands on: its message says where the parse
             // gave up, and it is still the SyntaxError an application may be testing for
-            const err = /** @type {any} */ (e);
+            const err = /** @type {SyntaxError} */ (e);
             return next(asBodyError(err, 400, "entity.parse.failed", { body: text }));
         }
 
@@ -1345,7 +1367,7 @@ const text = createBodyParser(
     "text/plain",
     function (req, res, next, options, buf, encoding) {
         try {
-            req.body = decodeBody(buf, encoding);
+            req.body = decodeBody(buf, /** @type {string} */ (encoding));
         } catch (e) {
             return next(e);
         }
@@ -1387,7 +1409,7 @@ const urlencoded = createBodyParser(
     "application/x-www-form-urlencoded",
     function (req, res, next, options, buf, encoding) {
         try {
-            const body = decodeBody(buf, encoding);
+            const body = decodeBody(buf, /** @type {string} */ (encoding));
             // Express 5 defaults extended to false, so nested keys need opting in
             const extended = typeof options.extended !== "undefined" ? options.extended : false;
             // qs has to know the charset itself for anything but utf-8, and the sentinel options
@@ -1403,7 +1425,8 @@ const urlencoded = createBodyParser(
                 }
                 req.body = parsed;
             } else {
-                const count = parameterCount(body, options.parameterLimit);
+                // settled by the check below the parser, so it is a number by the time a body arrives
+                const count = parameterCount(body, /** @type {number} */ (options.parameterLimit));
                 if (count === undefined) {
                     return next(bodyError("too many parameters", 413, "parameters.too.many"));
                 }
@@ -1417,7 +1440,7 @@ const urlencoded = createBodyParser(
                         arrayLimit: Math.max(100, count + 1),
                         charsetSentinel: options.charsetSentinel,
                         interpretNumericEntities: options.interpretNumericEntities,
-                        charset: encoding,
+                        charset: /** @type {"utf-8"|"iso-8859-1"} */ (encoding),
                         parameterLimit: options.parameterLimit
                     };
                     req.body = needsQs
@@ -1435,7 +1458,7 @@ const urlencoded = createBodyParser(
                             strictDepth: true,
                             charsetSentinel: options.charsetSentinel,
                             interpretNumericEntities: options.interpretNumericEntities,
-                            charset: encoding,
+                            charset: /** @type {"utf-8"|"iso-8859-1"} */ (encoding),
                             parameterLimit: options.parameterLimit
                         })
                     );