http-proxy-middleware 3.0.3 → 3.0.4

package/README.md

@@ -38,9 +38,9 @@ import type { Filter, Options, RequestHandler } from 'http-proxy-middleware';
 const app = express();
 
 const proxyMiddleware = createProxyMiddleware<Request, Response>({
-    target: 'http://www.example.org/api',
-    changeOrigin: true,
-  }),
+  target: 'http://www.example.org/api',
+  changeOrigin: true,
+});
 
 app.use('/api', proxyMiddleware);
 
@@ -48,7 +48,6 @@ app.listen(3000);
 
 // proxy and keep the same base path "/api"
 // http://127.0.0.1:3000/api/foo/bar -> http://www.example.org/api/foo/bar
-
 ```
 
 _All_ `http-proxy` [options](https://github.com/nodejitsu/node-http-proxy#options) can be used, along with some extra `http-proxy-middleware` [options](#options).
@@ -645,4 +644,4 @@ $ yarn spellcheck
 
 The MIT License (MIT)
 
-Copyright (c) 2015-2024 Steven Chim
+Copyright (c) 2015-2025 Steven Chim

package/dist/handlers/fix-request-body.d.ts

@@ -1,8 +1,9 @@
 import type * as http from 'http';
+import type { Options } from '../types';
 export type BodyParserLikeRequest = http.IncomingMessage & {
-    body: any;
+    body?: any;
 };
 /**
  * Fix proxied body if bodyParser is involved.
  */
-export declare function fixRequestBody<TReq = http.IncomingMessage>(proxyReq: http.ClientRequest, req: TReq): void;
+export declare function fixRequestBody<TReq extends BodyParserLikeRequest = BodyParserLikeRequest>(proxyReq: http.ClientRequest, req: TReq, res: http.ServerResponse<http.IncomingMessage>, options: Options): void;

package/dist/handlers/fix-request-body.js

@@ -2,24 +2,68 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fixRequestBody = fixRequestBody;
 const querystring = require("querystring");
+const logger_1 = require("../logger");
 /**
  * Fix proxied body if bodyParser is involved.
  */
-function fixRequestBody(proxyReq, req) {
+function fixRequestBody(proxyReq, req, res, options) {
     const requestBody = req.body;
     if (!requestBody) {
         return;
     }
     const contentType = proxyReq.getHeader('Content-Type');
+    if (!contentType) {
+        return;
+    }
+    const logger = (0, logger_1.getLogger)(options);
+    // Handle bad request when unexpected "Connect: Upgrade" header is provided
+    if (/upgrade/gi.test(proxyReq.getHeader('Connection'))) {
+        handleBadRequest({ proxyReq, req, res });
+        logger.error(`[HPM] HPM_UNEXPECTED_CONNECTION_UPGRADE_HEADER. Aborted request: ${req.url}`);
+        return;
+    }
+    // Handle bad request when invalid request body is provided
+    if (hasInvalidKeys(requestBody)) {
+        handleBadRequest({ proxyReq, req, res });
+        logger.error(`[HPM] HPM_INVALID_REQUEST_DATA. Aborted request: ${req.url}`);
+        return;
+    }
     const writeBody = (bodyData) => {
-        // deepcode ignore ContentLengthInCode: bodyParser fix
         proxyReq.setHeader('Content-Length', Buffer.byteLength(bodyData));
         proxyReq.write(bodyData);
     };
-    if (contentType && (contentType.includes('application/json') || contentType.includes('+json'))) {
+    // Use if-elseif to prevent multiple writeBody/setHeader calls:
+    // Error: "Cannot set headers after they are sent to the client"
+    if (contentType.includes('application/json') || contentType.includes('+json')) {
         writeBody(JSON.stringify(requestBody));
     }
-    if (contentType && contentType.includes('application/x-www-form-urlencoded')) {
+    else if (contentType.includes('application/x-www-form-urlencoded')) {
         writeBody(querystring.stringify(requestBody));
     }
+    else if (contentType.includes('multipart/form-data')) {
+        writeBody(handlerFormDataBodyData(contentType, requestBody));
+    }
+}
+/**
+ * format FormData data
+ * @param contentType
+ * @param data
+ * @returns
+ */
+function handlerFormDataBodyData(contentType, data) {
+    const boundary = contentType.replace(/^.*boundary=(.*)$/, '$1');
+    let str = '';
+    for (const [key, value] of Object.entries(data)) {
+        str += `--${boundary}\r\nContent-Disposition: form-data; name="${key}"\r\n\r\n${value}\r\n`;
+    }
+    return str;
+}
+function hasInvalidKeys(obj) {
+    return Object.keys(obj).some((key) => /[\n\r]/.test(key));
+}
+function handleBadRequest({ proxyReq, req, res }) {
+    res.writeHead(400);
+    res.end('Bad Request');
+    proxyReq.destroy();
+    req.destroy();
 }

package/dist/http-proxy-middleware.js

@@ -60,10 +60,17 @@ class HttpProxyMiddleware {
             }
         };
         this.handleUpgrade = async (req, socket, head) => {
-            if (this.shouldProxy(this.proxyOptions.pathFilter, req)) {
-                const activeProxyOptions = await this.prepareProxyRequest(req);
-                this.proxy.ws(req, socket, head, activeProxyOptions);
-                (0, debug_1.Debug)('server upgrade event received. Proxying WebSocket');
+            try {
+                if (this.shouldProxy(this.proxyOptions.pathFilter, req)) {
+                    const activeProxyOptions = await this.prepareProxyRequest(req);
+                    this.proxy.ws(req, socket, head, activeProxyOptions);
+                    (0, debug_1.Debug)('server upgrade event received. Proxying WebSocket');
+                }
+            }
+            catch (err) {
+                // This error does not include the URL as the fourth argument as we won't
+                // have the URL if `this.prepareProxyRequest` throws an error.
+                this.proxy.emit('error', err, req, socket);
             }
         };
         /**

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export * from './factory';
 export * from './handlers';
-export type { Filter, Options, RequestHandler } from './types';
+export type { Plugin, Filter, Options, RequestHandler } from './types';
 /**
  * Default plugins
  */

package/dist/plugins/default/error-response-plugin.js

@@ -2,18 +2,29 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.errorResponsePlugin = void 0;
 const status_code_1 = require("../../status-code");
+function isResponseLike(obj) {
+    return obj && typeof obj.writeHead === 'function';
+}
+function isSocketLike(obj) {
+    return obj && typeof obj.write === 'function' && !('writeHead' in obj);
+}
 const errorResponsePlugin = (proxyServer, options) => {
     proxyServer.on('error', (err, req, res, target) => {
         // Re-throw error. Not recoverable since req & res are empty.
         if (!req && !res) {
             throw err; // "Error: Must provide a proper URL as target"
         }
-        if ('writeHead' in res && !res.headersSent) {
-            const statusCode = (0, status_code_1.getStatusCode)(err.code);
-            res.writeHead(statusCode);
+        if (isResponseLike(res)) {
+            if (!res.headersSent) {
+                const statusCode = (0, status_code_1.getStatusCode)(err.code);
+                res.writeHead(statusCode);
+            }
+            const host = req.headers && req.headers.host;
+            res.end(`Error occurred while trying to proxy: ${host}${req.url}`);
+        }
+        else if (isSocketLike(res)) {
+            res.destroy();
         }
-        const host = req.headers && req.headers.host;
-        res.end(`Error occurred while trying to proxy: ${host}${req.url}`);
     });
 };
 exports.errorResponsePlugin = errorResponsePlugin;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "http-proxy-middleware",
   "type": "commonjs",
-  "version": "3.0.3",
+  "version": "3.0.4",
   "description": "The one-liner node.js proxy middleware for connect, express, next.js and more",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -20,7 +20,7 @@
     "build": "tsc --build",
     "test": "jest",
     "coverage": "jest --coverage",
-    "prepare": "husky",
+    "prepare": "husky && patch-package",
     "prepack": "yarn clean && yarn test && yarn build",
     "spellcheck": "npx --yes cspell --show-context --show-suggestions '**/*.*'"
   },
@@ -56,37 +56,38 @@
   },
   "homepage": "https://github.com/chimurai/http-proxy-middleware#readme",
   "devDependencies": {
-    "@commitlint/cli": "19.4.1",
-    "@commitlint/config-conventional": "19.4.1",
-    "@eslint/js": "9.9.1",
+    "@commitlint/cli": "19.8.0",
+    "@commitlint/config-conventional": "19.8.0",
+    "@eslint/js": "9.23.0",
     "@types/debug": "4.1.12",
     "@types/eslint": "9.6.1",
-    "@types/eslint__js": "8.42.3",
     "@types/express": "4.17.21",
     "@types/is-glob": "4.0.4",
-    "@types/jest": "29.5.12",
+    "@types/jest": "29.5.14",
     "@types/micromatch": "4.0.9",
-    "@types/node": "22.5.1",
+    "@types/node": "22.10.2",
     "@types/supertest": "6.0.2",
-    "@types/ws": "8.5.12",
-    "body-parser": "1.20.2",
-    "eslint": "9.9.1",
-    "eslint-config-prettier": "9.1.0",
-    "eslint-plugin-prettier": "5.2.1",
-    "express": "4.19.2",
+    "@types/ws": "8.18.0",
+    "body-parser": "1.20.3",
+    "eslint": "9.23.0",
+    "eslint-config-prettier": "10.1.1",
+    "eslint-plugin-prettier": "5.2.3",
+    "express": "4.21.2",
     "get-port": "5.1.1",
-    "globals": "15.9.0",
-    "husky": "9.1.5",
+    "globals": "16.0.0",
+    "husky": "9.1.7",
     "jest": "29.7.0",
-    "lint-staged": "15.2.9",
-    "mockttp": "3.15.2",
+    "lint-staged": "15.5.0",
+    "mockttp": "3.17.0",
     "open": "8.4.2",
-    "prettier": "3.3.3",
-    "supertest": "7.0.0",
-    "ts-jest": "29.2.5",
-    "typescript": "5.5.4",
-    "typescript-eslint": "8.3.0",
-    "ws": "8.18.0"
+    "patch-package": "8.0.0",
+    "pkg-pr-new": "0.0.41",
+    "prettier": "3.5.3",
+    "supertest": "7.1.0",
+    "ts-jest": "29.2.6",
+    "typescript": "5.8.2",
+    "typescript-eslint": "8.27.0",
+    "ws": "8.18.1"
   },
   "dependencies": {
     "@types/http-proxy": "^1.17.15",