fulmine.js 5.19.5 → 5.19.7

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.19.5",
+    "version": "5.19.7",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {

package/src/middlewares.js

@@ -1082,8 +1082,11 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 return beforeReturn(req, res, next, options, empty, encoding);
             }
 
-            // skip reading too large body; NaN compares false, so no declared length passes
-            if (lengthNumber > limit) {
+            // skip reading too large body; NaN compares false, so no declared length passes.
+            // Not while inflating: content-length counts the compressed bytes and the limit is
+            // about the ones that come out, which body-parser says by leaving the length unset.
+            // The limit is still enforced per chunk as they inflate, see keepChunk
+            if (!inflate && lengthNumber > limit) {
                 return next(
                     bodyError("request entity too large", 413, "entity.too.large", {
                         expected: lengthNumber,

package/src/response.js

@@ -76,6 +76,12 @@ function invalidChunkError(chunk) {
         `The "chunk" argument must be of type string or an instance of Buffer or Uint8Array. Received ${received}`
     );
     err.code = "ERR_INVALID_ARG_TYPE";
+    // node stamps the code into the stack's first line and then puts the name back, so err.name
+    // reads TypeError while the error page, which prints the stack, shows the bracketed form
+    err.name = "TypeError [ERR_INVALID_ARG_TYPE]";
+    void err.stack;
+    // through the index signature: name is not optional on Error, so a plain delete is a type error
+    delete (/** @type {Record<string, unknown>} */ (/** @type {unknown} */ (err)).name);
     return err;
 }
 const { sign } = require("cookie-signature");
@@ -842,6 +848,25 @@ module.exports = class Response extends LazyWritable {
      * @returns {this}
      */
     send(body) {
+        // undefined means nothing was passed, and Express treats that differently from a value
+        // that happens to be empty: no content-type and no ETag for send(), both for send(null)
+        // and send(""). It writes no header for it either, so it does not refuse a head that has
+        // gone out: after a res.write(), express answers this and we hung up on it.
+        if (body === undefined) {
+            if (!this.headersSent) {
+                // freshness and the bodiless statuses, as every express send goes through: a 204
+                // answered with json(undefined) loses the type json had set
+                if (this.req.fresh) {
+                    this.status(304);
+                }
+                if (this.statusCode === 204 || this.statusCode === 304) {
+                    delete this.headers["content-type"];
+                    delete this.headers["content-length"];
+                    delete this.headers["transfer-encoding"];
+                }
+            }
+            return this.end("");
+        }
         if (this.headersSent) {
             // what express's send meets first once the head is out is setHeader's refusal
             throw headersSentError("set");
@@ -854,22 +879,6 @@ module.exports = class Response extends LazyWritable {
             body = Buffer.from(body.buffer, body.byteOffset, body.byteLength);
         }
         const isBuffer = Buffer.isBuffer(body);
-        // undefined means nothing was passed, and Express treats that differently from a value
-        // that happens to be empty: no content-type and no ETag for send(), both for send(null)
-        // and send("").
-        if (body === undefined) {
-            // still through freshness and the bodiless statuses, as every express send is: a 204
-            // answered with json(undefined) loses the type json had set
-            if (this.req.fresh) {
-                this.status(304);
-            }
-            if (this.statusCode === 204 || this.statusCode === 304) {
-                delete this.headers["content-type"];
-                delete this.headers["content-length"];
-                delete this.headers["transfer-encoding"];
-            }
-            return this.end("");
-        }
         // null is an object as far as Express's switch is concerned, so it becomes the empty
         // string without ever reaching the branch that gives a string its content-type. It still
         // earns an ETag. send("") takes the string branch and does get one.

package/src/utils.js

@@ -416,6 +416,10 @@ function patternToRegex(pattern, isPrefix = false, caseSensitive = true, strict
                 }
                 groupContent += pattern[i++];
             }
+            // a group nobody closed, which express refuses rather than reading to the end
+            if (braceDepth > 0) {
+                throw new Error(`Unexpected end at index ${len}, expected }: ${pattern}`);
+            }
             i++;
 
             // When a :parameter precedes this group, that parameter is the one that gives ground
@@ -512,12 +516,12 @@ function patternToRegex(pattern, isPrefix = false, caseSensitive = true, strict
 
         // these have no meaning in a path, and the route is refused rather than matching them
         // literally: a path that quietly stops matching is worse than one that fails at startup.
-        // Escape them to use them as literals.
-        if ("?+()[]!".includes(ch)) {
+        // Escape them to use them as literals. A } here closes a group nobody opened.
+        if ("?+()[]!}".includes(ch)) {
             throw new Error(`Unexpected ${ch} at index ${i}: ${pattern}`);
         }
 
-        if (".^$|}".includes(ch)) {
+        if (".^$|".includes(ch)) {
             regexPattern += "\\" + ch;
         } else {
             regexPattern += ch;
@@ -556,9 +560,20 @@ function escapePathLiteral(literal) {
     return literal.replace(/[:*{}?+()[\]!.^$|\\]/g, "\\$&");
 }
 
+// Everything path-to-regexp gives a meaning to: a parameter, a wildcard, a group, a character it
+// reserves, and the backslash that makes one of them literal. A dot or a dash is not in here, so
+// the ordinary path stays a string compare.
+const PATH_SYNTAX = /[:*{}?+()[\]!\\]/;
+
 /**
  * Whether a path has anything in it that a string comparison cannot answer, which is a parameter,
- * a wildcard or an optional group. A regular expression is already compiled, so it needs nothing.
+ * a wildcard, an optional group, or a reserved character. A regular expression is already
+ * compiled, so it needs nothing.
+ *
+ * The escapes are what the short list of three used to miss: "/\\(a\\)" is the way to ask for a
+ * literal parenthesis, and comparing it as text looked for the backslashes on the wire and
+ * answered 404. A reserved character written bare, "/(a)", has to reach the compiler too, which
+ * is what refuses it the way express does.
  *
  * @param {string|RegExp} pattern
  * @returns {boolean}
@@ -568,7 +583,7 @@ function needsConversionToRegex(pattern) {
         return false;
     }
 
-    return pattern.includes("*") || pattern.includes(":") || pattern.includes("{");
+    return PATH_SYNTAX.test(pattern);
 }
 
 /**