got 15.0.6 → 15.0.7

package/dist/source/core/index.d.ts

@@ -99,6 +99,7 @@ export default class Request extends Duplex implements RequestEvents<Request> {
     private _request?;
     private _responseSize?;
     private _bodySize?;
+    private _nativeFormDataBody?;
     private _unproxyEvents?;
     private _triggerRead;
     private readonly _jobs;
@@ -109,6 +110,8 @@ export default class Request extends Duplex implements RequestEvents<Request> {
     private _expectedContentLength?;
     private _compressedBytesCount?;
     private _skipRequestEndInFinal;
+    private _hasWrittenBody;
+    private _hasWritableBody;
     private _incrementalDecode?;
     private readonly _requestId;
     private _requestInitialized;
@@ -140,7 +143,12 @@ export default class Request extends Duplex implements RequestEvents<Request> {
     private _endWritableRequest;
     private _stripCrossOriginState;
     private _stripUnchangedCrossOriginState;
+    private get _methodCanHaveBody();
+    private _canWriteBody;
+    private _hasBodyForRedirect;
+    private _hasUnchangedBodyForRedirect;
     private _dropBody;
+    private _destroyBody;
     private readonly _onBodyError;
     private _writeChunksToRequest;
     private _prepareCache;

package/dist/source/core/index.js

@@ -16,7 +16,7 @@ import timedOut, { TimeoutError as TimedOutTimeoutError } from './timed-out.js';
 import stripUrlAuth from './utils/strip-url-auth.js';
 import WeakableMap from './utils/weakable-map.js';
 import calculateRetryDelay from './calculate-retry-delay.js';
-import Options, { crossOriginStripHeaders, hasExplicitCredentialInUrlChange, isCrossOriginCredentialChanged, isBodyUnchanged, isSameOrigin, snapshotCrossOriginState, } from './options.js';
+import Options, { crossOriginStripHeaders, hasExplicitCredentialInUrlChange, isBodyUnchanged, isCrossOriginCredentialChanged, isSameOrigin, snapshotCrossOriginState, } from './options.js';
 import { cacheDecodedBody, decodeUint8Array, isResponseOk, isUtf8Encoding, } from './response.js';
 import isClientRequest from './utils/is-client-request.js';
 import { getUnixSocketPath } from './utils/is-unix-socket-url.js';
@@ -56,6 +56,20 @@ const proxiedRequestEvents = [
     'upgrade',
 ];
 const noop = () => { };
+const serializeNativeFormDataBody = (form) => {
+    const response = new globalThis.Response(form);
+    return {
+        body: response.body,
+        contentType: response.headers.get('content-type') ?? 'multipart/form-data',
+    };
+};
+// A body is replayable only if iterating it again restarts from the beginning.
+// Node streams, Web `ReadableStream`s, generators, and self-iterating (one-shot) iterators all yield their data only once, so they cannot be replayed on a redirect.
+const isNonReplayableBody = (body) => is.nodeStream(body)
+    || (typeof ReadableStream !== 'undefined' && body instanceof ReadableStream)
+    || is.generator(body)
+    || (is.asyncIterable(body) && body[Symbol.asyncIterator]() === body)
+    || (is.iterable(body) && body[Symbol.iterator]() === body);
 const isTransientWriteError = (error) => {
     const { code } = error;
     return typeof code === 'string' && transientWriteErrorCodes.has(code);
@@ -132,6 +146,7 @@ export default class Request extends Duplex {
     _request;
     _responseSize;
     _bodySize;
+    _nativeFormDataBody;
     _unproxyEvents;
     _triggerRead = false;
     _jobs = [];
@@ -142,6 +157,8 @@ export default class Request extends Duplex {
     _expectedContentLength;
     _compressedBytesCount;
     _skipRequestEndInFinal = false;
+    _hasWrittenBody = false;
+    _hasWritableBody = false;
     _incrementalDecode;
     _requestId = generateRequestId();
     // We need this because `this._request` if `undefined` when using cache
@@ -233,6 +250,7 @@ export default class Request extends Duplex {
             if (this.destroyed) {
                 return;
             }
+            this._hasWritableBody = this._canWriteBody();
             await this._makeRequest();
             if (this.destroyed) {
                 this._request?.destroy();
@@ -453,6 +471,7 @@ export default class Request extends Duplex {
         }
     }
     _write(chunk, encoding, callback) {
+        this._hasWrittenBody = true;
         const write = () => {
             this._writeRequest(chunk, encoding, callback);
         };
@@ -474,6 +493,7 @@ export default class Request extends Duplex {
             // We need to check if `this._request` is present,
             // because it isn't when we use cache.
             if (!request || request.destroyed) {
+                this._hasWritableBody = false;
                 callback();
                 return;
             }
@@ -486,6 +506,7 @@ export default class Request extends Duplex {
                 if (!error) {
                     this._emitUploadComplete(request);
                 }
+                this._hasWritableBody = false;
                 callback(error);
             });
         };
@@ -604,7 +625,7 @@ export default class Request extends Duplex {
         // eslint-disable-next-line @typescript-eslint/naming-convention
         const isJSON = !is.undefined(options.json);
         const isBody = !is.undefined(options.body);
-        const cannotHaveBody = methodsWithoutBody.has(options.method) && !(options.method === 'GET' && options.allowGetBody);
+        const cannotHaveBody = !this._methodCanHaveBody;
         if (isForm || isJSON || isBody) {
             if (cannotHaveBody) {
                 throw new TypeError(`The \`${options.method}\` method cannot be used with a body`);
@@ -614,11 +635,16 @@ export default class Request extends Duplex {
             if (isBody) {
                 // Native FormData
                 if (options.body instanceof FormData) {
-                    const response = new Response(options.body);
+                    const { body, contentType } = serializeNativeFormDataBody(options.body);
+                    this._nativeFormDataBody = {
+                        form: options.body,
+                        body,
+                        contentTypeWasGenerated: noContentType,
+                    };
                     if (noContentType) {
-                        headers['content-type'] = response.headers.get('content-type') ?? 'multipart/form-data';
+                        headers['content-type'] = contentType;
                     }
-                    options.body = response.body;
+                    options.body = body;
                 }
                 else if (Object.prototype.toString.call(options.body) === '[object FormData]') {
                     throw new TypeError('Non-native FormData is not supported. Use globalThis.FormData instead.');
@@ -874,14 +900,17 @@ export default class Request extends Duplex {
                     updatedOptions.method = 'GET';
                     this._dropBody(updatedOptions);
                 }
+                else if (isDifferentOrigin
+                    && canRewrite
+                    && this._hasBodyForRedirect(updatedOptions)) {
+                    this._dropBody(updatedOptions);
+                }
                 if (isDifferentOrigin) {
-                    // Also strip body on cross-origin redirects to prevent data leakage.
-                    // 301/302 POST already drops the body (converted to GET above).
-                    // 307/308 preserve the method per RFC, but the body must not be
-                    // forwarded to a different origin.
-                    // Strip credentials embedded in the redirect URL itself
-                    // to prevent a malicious server from injecting auth to third parties.
-                    this._stripCrossOriginState(updatedOptions, redirectUrl, shouldDropBody);
+                    // On cross-origin redirects, strip sensitive headers and any credentials
+                    // embedded in the redirect URL itself to prevent a malicious server from
+                    // leaking them to a third party. The request body is preserved per RFC:
+                    // 307/308 keep the method and replayable bodies, even cross-origin.
+                    this._stripCrossOriginState(updatedOptions, redirectUrl);
                 }
                 else {
                     redirectUrl.username = updatedOptions.username;
@@ -889,6 +918,7 @@ export default class Request extends Duplex {
                 }
                 updatedOptions.url = redirectUrl;
                 this.redirectUrls.push(redirectUrl);
+                const bodyBeforeRedirectHooks = updatedOptions.body;
                 const preHookState = isDifferentOrigin
                     ? undefined
                     : {
@@ -903,14 +933,55 @@ export default class Request extends Duplex {
                     return changedState;
                 });
                 updatedOptions.clearUnchangedCookieHeader(preHookState, changedState);
+                const nativeFormDataBody = this._nativeFormDataBody;
+                if (statusCode === 307 || statusCode === 308) {
+                    const bodyUnchangedByHooks = updatedOptions.body === bodyBeforeRedirectHooks;
+                    const wasNonReplayable = isNonReplayableBody(bodyBeforeRedirectHooks);
+                    if (!bodyUnchangedByHooks && wasNonReplayable) {
+                        // A hook supplied a fresh body, so dispose of the original non-replayable one.
+                        this._destroyBody(bodyBeforeRedirectHooks);
+                    }
+                    else if (bodyUnchangedByHooks
+                        && nativeFormDataBody !== undefined
+                        && updatedOptions.body === nativeFormDataBody.body) {
+                        // Native FormData generates a fresh stream and boundary, so re-serialize it to replay the upload.
+                        const { body, contentType } = serializeNativeFormDataBody(nativeFormDataBody.form);
+                        nativeFormDataBody.body = body;
+                        updatedOptions.body = body;
+                        if (changedState.has('content-type')) {
+                            nativeFormDataBody.contentTypeWasGenerated = false;
+                        }
+                        else if (nativeFormDataBody.contentTypeWasGenerated) {
+                            updatedOptions.setInternalHeader('content-type', contentType);
+                        }
+                    }
+                    else if (bodyUnchangedByHooks
+                        && (wasNonReplayable || (is.undefined(updatedOptions.body) && (this._hasWrittenBody || this._hasWritableBody)))) {
+                        // 307/308 redirects must replay the body, so follow the HTTP spec and other clients by failing for unchanged non-replayable bodies. Hooks may supply a fresh body.
+                        this._dropBody(updatedOptions);
+                        this._beforeError(new RequestError('Cannot follow redirect with a non-replayable body', {}, this));
+                        return;
+                    }
+                }
                 // If a beforeRedirect hook changed the URL to a different origin,
                 // strip sensitive headers that were preserved for the original origin.
                 // When isDifferentOrigin was already true, headers were already stripped above.
                 if (!isDifferentOrigin) {
                     const state = preHookState;
                     const hookUrl = updatedOptions.url;
-                    if (!isSameOrigin(state.url, hookUrl)) {
-                        this._stripUnchangedCrossOriginState(updatedOptions, hookUrl, shouldDropBody, {
+                    const hookChangedOrigin = !isSameOrigin(state.url, hookUrl);
+                    if (hookChangedOrigin
+                        && (statusCode === 301 || statusCode === 302)
+                        && updatedOptions.method === 'POST') {
+                        updatedOptions.method = 'GET';
+                        this._dropBody(updatedOptions);
+                    }
+                    if (hookChangedOrigin) {
+                        if (canRewrite
+                            && this._hasUnchangedBodyForRedirect(updatedOptions, state, changedState)) {
+                            this._dropBody(updatedOptions);
+                        }
+                        this._stripUnchangedCrossOriginState(updatedOptions, hookUrl, {
                             ...state,
                             changedState,
                             preserveUsername: hasExplicitCredentialInUrlChange(changedState, hookUrl, 'username')
@@ -1173,17 +1244,18 @@ export default class Request extends Duplex {
         else if (is.asyncIterable(body) || (is.iterable(body) && !is.string(body) && !isBuffer(body))) {
             (async () => {
                 const isInitialRequest = currentRequest === this;
+                const bodyOptions = this.options;
                 try {
                     for await (const chunk of body) {
-                        if (this.options.body !== body) {
+                        if (this.options !== bodyOptions || this.options.body !== body) {
                             return;
                         }
                         await this._asyncWrite(chunk, currentRequest);
-                        if (this.options.body !== body) {
+                        if (this.options !== bodyOptions || this.options.body !== body) {
                             return;
                         }
                     }
-                    if (this.options.body === body) {
+                    if (this.options === bodyOptions && this.options.body === body) {
                         if (isInitialRequest) {
                             super.end();
                             return;
@@ -1192,7 +1264,7 @@ export default class Request extends Duplex {
                     }
                 }
                 catch (error) {
-                    if (this.options.body !== body) {
+                    if (this.options !== bodyOptions || this.options.body !== body) {
                         return;
                     }
                     this._beforeError(normalizeError(error));
@@ -1201,8 +1273,7 @@ export default class Request extends Duplex {
         }
         else if (is.undefined(body)) {
             // No body to send, end the request
-            const cannotHaveBody = methodsWithoutBody.has(this.options.method) && !(this.options.method === 'GET' && this.options.allowGetBody);
-            if ((this._noPipe ?? false) || cannotHaveBody || currentRequest !== this) {
+            if ((this._noPipe ?? false) || !this._methodCanHaveBody || currentRequest !== this) {
                 currentRequest.end();
             }
         }
@@ -1305,7 +1376,7 @@ export default class Request extends Duplex {
             });
         });
     }
-    _stripCrossOriginState(options, urlToClear, bodyAlreadyDropped) {
+    _stripCrossOriginState(options, urlToClear) {
         for (const header of crossOriginStripHeaders) {
             options.deleteInternalHeader(header);
         }
@@ -1313,11 +1384,8 @@ export default class Request extends Duplex {
         options.password = '';
         urlToClear.username = '';
         urlToClear.password = '';
-        if (!bodyAlreadyDropped) {
-            this._dropBody(options);
-        }
     }
-    _stripUnchangedCrossOriginState(options, urlToClear, bodyAlreadyDropped, state) {
+    _stripUnchangedCrossOriginState(options, urlToClear, state) {
         const headers = options.getInternalHeaders();
         for (const header of crossOriginStripHeaders) {
             if (!state.changedState.has(header) && headers[header] === state.headers[header]) {
@@ -1332,23 +1400,44 @@ export default class Request extends Duplex {
             options.password = '';
             urlToClear.password = '';
         }
-        if (!bodyAlreadyDropped
-            && !state.changedState.has('body')
-            && !state.changedState.has('json')
-            && !state.changedState.has('form')
-            && isBodyUnchanged(options, state)) {
-            this._dropBody(options);
-        }
+    }
+    get _methodCanHaveBody() {
+        return !methodsWithoutBody.has(this.options.method) || (this.options.method === 'GET' && this.options.allowGetBody);
+    }
+    _canWriteBody() {
+        return !this._noPipe && !this.isReadonly && this._methodCanHaveBody;
+    }
+    _hasBodyForRedirect(options) {
+        return !is.undefined(options.body) || !is.undefined(options.json) || !is.undefined(options.form) || this._hasWrittenBody || this._hasWritableBody;
+    }
+    _hasUnchangedBodyForRedirect(options, state, changedState) {
+        return !changedState.has('body')
+            && !changedState.has('json')
+            && !changedState.has('form')
+            && this._hasBodyForRedirect(options)
+            && isBodyUnchanged(options, state);
     }
     _dropBody(updatedOptions) {
         const { body } = this.options;
         const hadOptionBody = !is.undefined(body) || !is.undefined(this.options.json) || !is.undefined(this.options.form);
         this.options.clearBody();
+        this._destroyBody(body);
+        if (!hadOptionBody && !this.writableEnded) {
+            this._skipRequestEndInFinal = true;
+            super.end();
+        }
+        updatedOptions.clearBody();
+        this._bodySize = undefined;
+        this._hasWrittenBody = false;
+        this._hasWritableBody = false;
+    }
+    _destroyBody(body) {
         if (is.nodeStream(body)) {
-            body.off('error', this._onBodyError);
-            body.unpipe();
-            body.on('error', noop);
-            body.destroy();
+            const bodyStream = body;
+            bodyStream.off('error', this._onBodyError);
+            bodyStream.unpipe();
+            bodyStream.on('error', noop);
+            bodyStream.destroy();
         }
         else if (is.asyncIterable(body) || (is.iterable(body) && !is.string(body) && !isBuffer(body))) {
             const iterableBody = body;
@@ -1366,12 +1455,6 @@ export default class Request extends Duplex {
                 catch { }
             }
         }
-        else if (!hadOptionBody && !this.writableEnded) {
-            this._skipRequestEndInFinal = true;
-            super.end();
-        }
-        updatedOptions.clearBody();
-        this._bodySize = undefined;
     }
     _onBodyError = (error) => {
         if (this._flushed) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "got",
-	"version": "15.0.6",
+	"version": "15.0.7",
 	"description": "Human-friendly and powerful HTTP request library for Node.js",
 	"license": "MIT",
 	"repository": "sindresorhus/got",