mastercontroller 1.3.10 → 1.3.13

package/MasterControl.js

@@ -10,6 +10,7 @@ var fs = require('fs');
 var url = require('url');
 var path = require('path');
 var globSearch = require("glob");
+var crypto = require('crypto'); // CRITICAL FIX: For ETag generation
 
 // Enhanced error handling - setup global handlers
 const { setupGlobalErrorHandlers } = require('./error/MasterErrorMiddleware');
@@ -779,26 +780,107 @@ class MasterControl {
                         }
                     }
 
-                    // Read and serve the file
-                    fs.readFile(finalPath, function(err, data) {
-                        if (err) {
+                    // CRITICAL FIX: Stream large files instead of reading into memory
+                    // Files >1MB are streamed to prevent memory exhaustion and improve performance
+                    const STREAM_THRESHOLD = 1 * 1024 * 1024; // 1MB
+                    const fileSize = stats.isDirectory() ? fs.statSync(finalPath).size : stats.size;
+                    const ext = path.extname(finalPath);
+                    const mimeType = $that.router.findMimeType(ext);
+
+                    // CRITICAL FIX: Generate ETag for caching (based on file stats)
+                    // ETag format: "size-mtime" (weak ETag for better performance)
+                    const fileStats = stats.isDirectory() ? fs.statSync(finalPath) : stats;
+                    const etag = `W/"${fileStats.size}-${fileStats.mtime.getTime()}"`;
+
+                    // CRITICAL FIX: Check If-None-Match header for 304 Not Modified
+                    const clientETag = ctx.request.headers['if-none-match'];
+                    if (clientETag === etag) {
+                        // File hasn't changed, return 304 Not Modified
+                        logger.debug({
+                            code: 'MC_STATIC_304',
+                            message: 'Returning 304 Not Modified',
+                            path: finalPath,
+                            etag: etag
+                        });
+                        ctx.response.statusCode = 304;
+                        ctx.response.setHeader('ETag', etag);
+                        ctx.response.end();
+                        return;
+                    }
+
+                    // Set common headers for both streaming and buffered responses
+                    ctx.response.setHeader('Content-Type', mimeType || 'application/octet-stream');
+                    ctx.response.setHeader('X-Content-Type-Options', 'nosniff');
+                    ctx.response.setHeader('Content-Length', fileSize);
+
+                    // CRITICAL FIX: Add caching headers
+                    ctx.response.setHeader('ETag', etag);
+                    ctx.response.setHeader('Last-Modified', fileStats.mtime.toUTCString());
+
+                    // Cache-Control based on file type
+                    const cacheableExtensions = ['.js', '.css', '.jpg', '.jpeg', '.png', '.gif', '.svg', '.woff', '.woff2', '.ttf', '.eot', '.ico'];
+                    const isCacheable = cacheableExtensions.includes(ext.toLowerCase());
+
+                    if (isCacheable) {
+                        // PERFORMANCE: Cache static assets for 1 year (immutable pattern)
+                        // Use versioned URLs (e.g., app.v123.js) for cache-busting
+                        ctx.response.setHeader('Cache-Control', 'public, max-age=31536000, immutable');
+                    } else {
+                        // SECURITY: Dynamic content should revalidate
+                        ctx.response.setHeader('Cache-Control', 'public, max-age=0, must-revalidate');
+                    }
+
+                    if (fileSize > STREAM_THRESHOLD) {
+                        // PERFORMANCE: Stream large files (>1MB) to avoid memory issues
+                        logger.debug({
+                            code: 'MC_STATIC_STREAMING',
+                            message: 'Streaming large static file',
+                            path: finalPath,
+                            size: fileSize
+                        });
+
+                        const readStream = fs.createReadStream(finalPath);
+
+                        readStream.on('error', (err) => {
                             logger.error({
-                                code: 'MC_ERR_FILE_READ',
-                                message: 'Error reading static file',
+                                code: 'MC_ERR_STREAM_READ',
+                                message: 'Error streaming static file',
                                 path: finalPath,
                                 error: err.message
                             });
-                            ctx.response.statusCode = 500;
-                            ctx.response.setHeader('Content-Type', 'text/plain');
-                            ctx.response.end('Internal Server Error');
-                        } else {
-                            const ext = path.extname(finalPath);
-                            const mimeType = $that.router.findMimeType(ext);
-                            ctx.response.setHeader('Content-Type', mimeType || 'application/octet-stream');
-                            ctx.response.setHeader('X-Content-Type-Options', 'nosniff');
-                            ctx.response.end(data);
-                        }
-                    });
+
+                            // Only send error if headers not sent
+                            if (!ctx.response.headersSent) {
+                                ctx.response.statusCode = 500;
+                                ctx.response.setHeader('Content-Type', 'text/plain');
+                                ctx.response.end('Internal Server Error');
+                            } else {
+                                // Connection already started, just close it
+                                ctx.response.end();
+                            }
+                        });
+
+                        // Pipe the file stream to the response
+                        readStream.pipe(ctx.response);
+
+                    } else {
+                        // PERFORMANCE: Small files (<1MB) can be buffered for better caching
+                        fs.readFile(finalPath, function(err, data) {
+                            if (err) {
+                                logger.error({
+                                    code: 'MC_ERR_FILE_READ',
+                                    message: 'Error reading static file',
+                                    path: finalPath,
+                                    error: err.message
+                                });
+                                ctx.response.statusCode = 500;
+                                ctx.response.setHeader('Content-Type', 'text/plain');
+                                ctx.response.end('Internal Server Error');
+                            } else {
+                                ctx.response.end(data);
+                            }
+                        });
+                    }
                 });
 
                 return; // Terminal - don't call next()

package/MasterRequest.js

@@ -26,7 +26,20 @@ class MasterRequest{
      if(options){
         this.options = {};
         this.options.disableFormidableMultipartFormData = options.disableFormidableMultipartFormData === null? false : options.disableFormidableMultipartFormData;
-        this.options.formidable = options.formidable === null? {}: options.formidable;
+
+        // CRITICAL FIX: Add file upload limits to prevent DoS attacks
+        // Default formidable configuration with security limits
+        this.options.formidable = {
+            maxFiles: 10,                          // CRITICAL: Limit number of files per request
+            maxFileSize: 50 * 1024 * 1024,        // CRITICAL: 50MB per file (was unlimited)
+            maxTotalFileSize: 100 * 1024 * 1024,  // CRITICAL: 100MB total for all files
+            maxFields: 1000,                       // Limit number of fields
+            maxFieldsSize: 20 * 1024 * 1024,      // 20MB for all fields combined
+            allowEmptyFiles: false,                // Reject empty file uploads
+            minFileSize: 1,                        // Minimum 1 byte
+            ...(options.formidable || {})          // Allow user overrides
+        };
+
         // Body size limits (DoS protection)
         this.options.maxBodySize = options.maxBodySize || 10 * 1024 * 1024; // 10MB default
         this.options.maxJsonSize = options.maxJsonSize || 1 * 1024 * 1024;  // 1MB default for JSON
@@ -74,6 +87,7 @@ class MasterRequest{
                                 // Track uploaded files for cleanup on error
                                 const uploadedFiles = [];
                                 let uploadAborted = false;
+                                let totalUploadedSize = 0; // CRITICAL: Track total upload size
 
                                 $that.form.on('field', function(field, value) {
                                     $that.parsedURL.formData.fields[field] = value;
@@ -87,6 +101,30 @@ class MasterRequest{
                                 $that.form.on('file', function(field, file) {
                                     file.extension = file.name === undefined ? path.extname(file.originalFilename) : path.extname(file.name);
 
+                                    // CRITICAL: Track total uploaded size across all files
+                                    totalUploadedSize += file.size || 0;
+
+                                    // CRITICAL: Enforce maxTotalFileSize limit
+                                    const maxTotalSize = $that.options.formidable.maxTotalFileSize || 100 * 1024 * 1024;
+                                    if (totalUploadedSize > maxTotalSize) {
+                                        uploadAborted = true;
+                                        console.error(`[MasterRequest] Total upload size (${totalUploadedSize} bytes) exceeds limit (${maxTotalSize} bytes)`);
+
+                                        // Cleanup all uploaded files
+                                        uploadedFiles.forEach(f => {
+                                            if (f.filepath) {
+                                                try {
+                                                    $that.deleteFileBuffer(f.filepath);
+                                                } catch (err) {
+                                                    console.error('[MasterRequest] Cleanup failed:', err.message);
+                                                }
+                                            }
+                                        });
+
+                                        reject(new Error(`Total upload size exceeds limit (${maxTotalSize} bytes)`));
+                                        return;
+                                    }
+
                                     if(Array.isArray($that.parsedURL.formData.files[field])){
                                         $that.parsedURL.formData.files[field].push(file);
                                     }
@@ -94,6 +132,9 @@ class MasterRequest{
                                         $that.parsedURL.formData.files[field] = [];
                                         $that.parsedURL.formData.files[field].push(file);
                                     }
+
+                                    // CRITICAL: Log file upload for security audit trail
+                                    console.log(`[MasterRequest] File uploaded: ${file.originalFilename || file.name} (${file.size} bytes)`);
                                 });
 
                                 $that.form.on('error', function(err) {

package/MasterRouter.js

@@ -238,10 +238,14 @@ const isDevelopment = process.env.NODE_ENV !== 'production' && process.env.maste
         }
 };
 
-var loadScopedListClasses = function(){
+// CRITICAL FIX: Race condition - Store scoped services in context instead of shared requestList
+// Previously, concurrent requests would overwrite each other's services in the shared requestList object
+// This caused unpredictable behavior and data corruption in production environments
+var loadScopedListClasses = function(context){
     // FIXED: Use Object.entries() for safe iteration (prevents prototype pollution)
     for (const [key, className] of Object.entries(this._master._scopedList)) {
-        this._master.requestList[key] = new className();
+        // Store scoped services in the context object (request-specific) instead of shared requestList
+        context[key] = new className();
     }
 };
 
@@ -419,8 +423,11 @@ class MasterRouter {
          const requestId = `${Date.now()}-${Math.random()}`;
          performanceTracker.start(requestId, requestObject);
 
-         tools.combineObjects(this._master.requestList, requestObject);
-         requestObject = this._master.requestList;
+         // CRITICAL FIX: Create a request-specific context instead of using shared requestList
+         // This prevents race conditions where concurrent requests overwrite each other's services
+         const requestContext = Object.create(this._master.requestList);
+         tools.combineObjects(requestContext, requestObject);
+         requestObject = requestContext;
          var Control = null;
 
          try{
@@ -528,9 +535,12 @@ class MasterRouter {
     
     load(rr){ // load the the router
 
-            loadScopedListClasses.call(this);
             var $that = this;
             var requestObject = Object.create(rr);
+
+            // CRITICAL FIX: Load scoped services into request-specific context
+            // Pass requestObject so scoped services are stored per-request, not globally
+            loadScopedListClasses.call(this, requestObject);
             requestObject.pathName = requestObject.pathName.replace(/^\/|\/$/g, '').toLowerCase();
         
             var _loadEmit = new EventEmitter();