quickwin 1.3.0 → 2.1.0

package/lib/fetch.js

@@ -26,6 +26,27 @@ function parseHeaders(data) {
     }
     return { status, statusText, headers };
 }
+/** True when the chunked body is complete. With a declared `Trailer`,
+ *  the terminating block is followed by 0..n header lines and a final
+ *  empty line (`\r\n0\r\n<trailer...>\r\n\r\n`) instead of the bare
+ *  `\r\n0\r\n\r\n` form. */
+function chunkedEndReached(data, hasTrailer) {
+    if (!hasTrailer)
+        return _hasChunkedEnd(data);
+    const tail = '\r\n0\r\n';
+    for (let i = data.length - 1; i >= 0; i--) {
+        let j = 0;
+        while (j < tail.length && i + j < data.length && data[i + j] === tail.charCodeAt(j))
+            j++;
+        if (j === tail.length) {
+            const after = i + tail.length;
+            if (data.length >= after + 2 &&
+                data[data.length - 2] === 0x0D && data[data.length - 1] === 0x0A)
+                return true;
+        }
+    }
+    return false;
+}
 // ── State machine constants ──
 const ST_CONNECTING = 0;
 const ST_HANDSHAKE = 1;
@@ -35,6 +56,9 @@ const ST_DONE = 5;
 // ── Main fetch request ──
 async function fetchRequest(req) {
     const parsedUrl = new URL(req.url);
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        throw new TypeError('fetch: unsupported protocol "' + parsedUrl.protocol + '"');
+    }
     const method = req.method;
     const headers = new HeadersImpl(req.headers);
     const timeout = req.timeout || 30000;
@@ -76,6 +100,7 @@ async function fetchRequest(req) {
         let _controller = null;
         let headerRaw = new Uint8Array(0);
         let isChunked = false;
+        let hasTrailer = false;
         let contentLength = 0;
         let chunkedParts = [];
         let receivedBytes = 0;
@@ -168,15 +193,25 @@ async function fetchRequest(req) {
                         doReject(new Error('SSL_CTX_new failed'));
                         return;
                     }
-                    wolfssl.wolfSSL_CTX_set_verify(ctx, 0 /* wolfssl.VerifyMode.SSL_VERIFY_NONE */);
+                    if (req.rejectUnauthorized === false) {
+                        wolfssl.wolfSSL_CTX_set_verify(ctx, 0 /* wolfssl.VerifyMode.SSL_VERIFY_NONE */);
+                    }
+                    else {
+                        wolfssl.wolfSSL_CTX_set_verify(ctx, 1 /* wolfssl.VerifyMode.SSL_VERIFY_PEER */);
+                        wolfssl.loadTrustedCerts(ctx);
+                    }
                     ssl = wolfssl.wolfSSL_new(ctx);
                     if (!ssl) {
                         doReject(new Error('SSL_new failed'));
                         return;
                     }
                     wolfssl.wolfSSL_set_fd(ssl, sock.get_fd(fd));
-                    if (parsedUrl.hostname)
+                    if (parsedUrl.hostname) {
                         wolfssl.wolfSSL_UseSNI(ssl, 0 /* wolfssl.SniType.WOLFSSL_SNI_HOST_NAME */, parsedUrl.hostname);
+                        if (req.rejectUnauthorized !== false) {
+                            wolfssl.wolfSSL_check_domain_name(ssl, parsedUrl.hostname);
+                        }
+                    }
                     state = ST_HANDSHAKE;
                 }
                 else {
@@ -209,7 +244,21 @@ async function fetchRequest(req) {
                             break;
                         let data;
                         if (isHTTPS && ssl) {
-                            data = wolfssl.wolfSSL_read(ssl, 8192);
+                            const buf = new ArrayBuffer(8192);
+                            const n = wolfssl.wolfSSL_read(ssl, buf);
+                            if (n > 0) {
+                                data = buf.slice(0, n);
+                            }
+                            else {
+                                const err = wolfssl.wolfSSL_get_error(ssl, n);
+                                if (err === 2 /* wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_READ */ ||
+                                    err === 3 /* wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_WRITE */)
+                                    break;
+                                if (n === 0 || err === 6 /* wolfssl.ErrorCode.WOLFSSL_ERROR_ZERO_RETURN */)
+                                    break;
+                                doReject(new Error('TLS read failed: ' + err));
+                                return;
+                            }
                         }
                         else if (s !== null && s >= 0) {
                             data = sock.recv(s, 8192);
@@ -237,6 +286,7 @@ async function fetchRequest(req) {
                             }
                             const trailingBodyBytes = headerRaw.subarray(headerEnd + 4);
                             isChunked = (parsed.headers.get('transfer-encoding') || '').toLowerCase().includes('chunked');
+                            hasTrailer = parsed.headers.get('trailer') != null;
                             contentLength = isChunked ? 0 : parseInt(parsed.headers.get('content-length') || '0', 10);
                             _controller = null;
                             stream = new ReadableStream({
@@ -246,7 +296,7 @@ async function fetchRequest(req) {
                             if (trailingBodyBytes.length > 0) {
                                 if (isChunked) {
                                     chunkedParts = [trailingBodyBytes];
-                                    if (_hasChunkedEnd(trailingBodyBytes)) {
+                                    if (chunkedEndReached(trailingBodyBytes, hasTrailer)) {
                                         const decoded = decodeChunked(trailingBodyBytes);
                                         _controller.enqueue(decoded);
                                         _controller.close();
@@ -281,7 +331,31 @@ async function fetchRequest(req) {
                             break;
                         let data;
                         if (isHTTPS && ssl) {
-                            data = wolfssl.wolfSSL_read(ssl, 8192);
+                            const buf = new ArrayBuffer(8192);
+                            const n = wolfssl.wolfSSL_read(ssl, buf);
+                            if (n > 0) {
+                                data = buf.slice(0, n);
+                            }
+                            else {
+                                const err = wolfssl.wolfSSL_get_error(ssl, n);
+                                if (err === 2 /* wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_READ */ ||
+                                    err === 3 /* wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_WRITE */)
+                                    break;
+                                if (n === 0 || err === 6 /* wolfssl.ErrorCode.WOLFSSL_ERROR_ZERO_RETURN */)
+                                    break;
+                                // Fatal TLS error mid-body: the response already
+                                // resolved, so fail the body stream instead of
+                                // silently waiting for an FD event that never comes.
+                                if (_controller) {
+                                    try {
+                                        _controller.error(new Error('TLS read failed: ' + err));
+                                    }
+                                    catch { /* already closed */ }
+                                }
+                                stream = null;
+                                cleanupSocket();
+                                return;
+                            }
                         }
                         else if (s !== null && s >= 0) {
                             data = sock.recv(s, 8192);
@@ -294,7 +368,7 @@ async function fetchRequest(req) {
                         if (isChunked) {
                             chunkedParts.push(new Uint8Array(data));
                             const combined = _concat(chunkedParts);
-                            if (_hasChunkedEnd(combined)) {
+                            if (chunkedEndReached(combined, hasTrailer)) {
                                 const decoded = decodeChunked(combined);
                                 _controller.enqueue(decoded);
                                 _controller.close();
@@ -329,7 +403,14 @@ async function fetchRequest(req) {
                             break;
                         let data;
                         if (isHTTPS && ssl) {
-                            data = wolfssl.wolfSSL_read(ssl, 8192);
+                            const buf = new ArrayBuffer(8192);
+                            const n = wolfssl.wolfSSL_read(ssl, buf);
+                            // Best-effort drain: any non-data result (EOF, WANT_*,
+                            // late error) ends the drain — the stream closes below.
+                            if (n > 0)
+                                data = buf.slice(0, n);
+                            else
+                                break;
                         }
                         else if (s !== null && s >= 0) {
                             data = sock.recv(s, 8192);

package/lib/fetch.ts

@@ -47,6 +47,25 @@ function parseHeaders(data: string): ParsedResponse | null {
     return { status, statusText, headers }
 }
 
+/** True when the chunked body is complete. With a declared `Trailer`,
+ *  the terminating block is followed by 0..n header lines and a final
+ *  empty line (`\r\n0\r\n<trailer...>\r\n\r\n`) instead of the bare
+ *  `\r\n0\r\n\r\n` form. */
+function chunkedEndReached(data: Uint8Array, hasTrailer: boolean): boolean {
+    if (!hasTrailer) return _hasChunkedEnd(data)
+    const tail = '\r\n0\r\n'
+    for (let i = data.length - 1; i >= 0; i--) {
+        let j = 0
+        while (j < tail.length && i + j < data.length && data[i + j] === tail.charCodeAt(j)) j++
+        if (j === tail.length) {
+            const after = i + tail.length
+            if (data.length >= after + 2 &&
+                data[data.length - 2] === 0x0D && data[data.length - 1] === 0x0A) return true
+        }
+    }
+    return false
+}
+
 // ── State machine constants ──
 
 const ST_CONNECTING = 0
@@ -59,6 +78,9 @@ const ST_DONE = 5
 
 async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
     const parsedUrl = new URL(req.url)
+    if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {
+        throw new TypeError('fetch: unsupported protocol "' + parsedUrl.protocol + '"')
+    }
     const method = req.method
     const headers = new HeadersImpl(req.headers)
     const timeout = req.timeout || 30000
@@ -101,6 +123,7 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
     let _controller: ReadableStreamDefaultController<Uint8Array> | null = null
     let headerRaw: Uint8Array = new Uint8Array(0)
     let isChunked = false
+    let hasTrailer = false
     let contentLength = 0
     let chunkedParts: Uint8Array[] = []
     let receivedBytes = 0
@@ -163,11 +186,21 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                     const tlsMethod = wolfssl.wolfTLSv1_2_client_method()
                     ctx = wolfssl.wolfSSL_CTX_new(tlsMethod)
                     if (!ctx) { doReject(new Error('SSL_CTX_new failed')); return }
-                    wolfssl.wolfSSL_CTX_set_verify(ctx, wolfssl.VerifyMode.SSL_VERIFY_NONE)
+                    if (req.rejectUnauthorized === false) {
+                        wolfssl.wolfSSL_CTX_set_verify(ctx, wolfssl.VerifyMode.SSL_VERIFY_NONE)
+                    } else {
+                        wolfssl.wolfSSL_CTX_set_verify(ctx, wolfssl.VerifyMode.SSL_VERIFY_PEER)
+                        wolfssl.loadTrustedCerts(ctx)
+                    }
                     ssl = wolfssl.wolfSSL_new(ctx)
                     if (!ssl) { doReject(new Error('SSL_new failed')); return }
                     wolfssl.wolfSSL_set_fd(ssl, sock.get_fd(fd))
-                    if (parsedUrl.hostname) wolfssl.wolfSSL_UseSNI(ssl, wolfssl.SniType.WOLFSSL_SNI_HOST_NAME, parsedUrl.hostname)
+                    if (parsedUrl.hostname) {
+                        wolfssl.wolfSSL_UseSNI(ssl, wolfssl.SniType.WOLFSSL_SNI_HOST_NAME, parsedUrl.hostname)
+                        if (req.rejectUnauthorized !== false) {
+                            wolfssl.wolfSSL_check_domain_name(ssl, parsedUrl.hostname)
+                        }
+                    }
                     state = ST_HANDSHAKE
                 } else {
                     sock.send(fd, httpRequest)
@@ -195,7 +228,18 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                         if (s !== null && s < 0 && !ssl) break
                         let data: ArrayBuffer | null
                         if (isHTTPS && ssl) {
-                            data = wolfssl.wolfSSL_read(ssl, 8192)
+                            const buf = new ArrayBuffer(8192)
+                            const n = wolfssl.wolfSSL_read(ssl, buf)
+                            if (n > 0) {
+                                data = buf.slice(0, n)
+                            } else {
+                                const err = wolfssl.wolfSSL_get_error(ssl, n)
+                                if (err === wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_READ ||
+                                    err === wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_WRITE) break
+                                if (n === 0 || err === wolfssl.ErrorCode.WOLFSSL_ERROR_ZERO_RETURN) break
+                                doReject(new Error('TLS read failed: ' + err))
+                                return
+                            }
                         } else if (s !== null && s >= 0) {
                             data = sock.recv(s, 8192)
                         } else { break }
@@ -217,6 +261,7 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                             const trailingBodyBytes = headerRaw.subarray(headerEnd + 4)
 
                             isChunked = (parsed.headers.get('transfer-encoding') || '').toLowerCase().includes('chunked')
+                            hasTrailer = parsed.headers.get('trailer') != null
                             contentLength = isChunked ? 0 : parseInt(
                                 parsed.headers.get('content-length') || '0', 10
                             )
@@ -228,7 +273,7 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                             if (trailingBodyBytes.length > 0) {
                                 if (isChunked) {
                                     chunkedParts = [trailingBodyBytes]
-                                    if (_hasChunkedEnd(trailingBodyBytes)) {
+                                    if (chunkedEndReached(trailingBodyBytes, hasTrailer)) {
                                         const decoded = decodeChunked(trailingBodyBytes)
                                         _controller!.enqueue(decoded)
                                         _controller!.close()
@@ -264,7 +309,23 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                         if (s !== null && s < 0 && !ssl) break
                         let data: ArrayBuffer | null
                         if (isHTTPS && ssl) {
-                            data = wolfssl.wolfSSL_read(ssl, 8192)
+                            const buf = new ArrayBuffer(8192)
+                            const n = wolfssl.wolfSSL_read(ssl, buf)
+                            if (n > 0) {
+                                data = buf.slice(0, n)
+                            } else {
+                                const err = wolfssl.wolfSSL_get_error(ssl, n)
+                                if (err === wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_READ ||
+                                    err === wolfssl.ErrorCode.WOLFSSL_ERROR_WANT_WRITE) break
+                                if (n === 0 || err === wolfssl.ErrorCode.WOLFSSL_ERROR_ZERO_RETURN) break
+                                // Fatal TLS error mid-body: the response already
+                                // resolved, so fail the body stream instead of
+                                // silently waiting for an FD event that never comes.
+                                if (_controller) { try { _controller.error(new Error('TLS read failed: ' + err)) } catch { /* already closed */ } }
+                                stream = null
+                                cleanupSocket()
+                                return
+                            }
                         } else if (s !== null && s >= 0) {
                             data = sock.recv(s, 8192)
                         } else { break }
@@ -272,7 +333,7 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                         if (isChunked) {
                             chunkedParts.push(new Uint8Array(data))
                             const combined = _concat(chunkedParts)
-                            if (_hasChunkedEnd(combined)) {
+                            if (chunkedEndReached(combined, hasTrailer)) {
                                 const decoded = decodeChunked(combined)
                                 _controller!.enqueue(decoded)
                                 _controller!.close()
@@ -304,7 +365,12 @@ async function fetchRequest(req: RequestImpl): Promise<ResponseImpl> {
                         if (s !== null && s < 0 && !ssl) break
                         let data: ArrayBuffer | null
                         if (isHTTPS && ssl) {
-                            data = wolfssl.wolfSSL_read(ssl, 8192)
+                            const buf = new ArrayBuffer(8192)
+                            const n = wolfssl.wolfSSL_read(ssl, buf)
+                            // Best-effort drain: any non-data result (EOF, WANT_*,
+                            // late error) ends the drain — the stream closes below.
+                            if (n > 0) data = buf.slice(0, n)
+                            else break
                         } else if (s !== null && s >= 0) {
                             data = sock.recv(s, 8192)
                         } else { break }