undici 8.12.1 → 8.12.2

package/docs/docs/api/Client.md

@@ -148,8 +148,13 @@ added: v1.0.0
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
   * `eventSource` {Object} (optional) EventSource-specific configuration.
-    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
-      EventSource messages. Set to `0` to disable the limit.
+    * `maxEventSize` {number} The maximum total bytes of data and metadata
+      field values retained for a pending EventSource event. Each unfinished
+      line is separately limited to this value plus seven syntax bytes, before
+      its line ending arrives. The number of `data:` lines per event and input
+      chunks buffered for an unfinished line are each limited to
+      `min(131072, max(1024, floor(maxEventSize / 128)))` to bound object overhead.
+      Set to `0` to disable these limits.
       **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 

package/lib/core/symbols.js

@@ -6,6 +6,7 @@ module.exports = {
   kDispatch: Symbol('dispatch'),
   kUrl: Symbol('url'),
   kRequestOrigin: Symbol('request origin'),
+  kRedirectCacheControl: Symbol('redirect cache control'),
   kOriginless: Symbol('originless'),
   kWriting: Symbol('writing'),
   kResuming: Symbol('resuming'),

package/lib/dispatcher/agent.js

@@ -22,7 +22,7 @@ function defaultFactory (origin, opts) {
 }
 
 class Agent extends DispatcherBase {
-  constructor ({ factory = defaultFactory, maxOrigins = Infinity, connect, ...options } = {}) {
+  constructor ({ factory = defaultFactory, maxOrigins = Infinity, connect, tls, ...options } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
@@ -41,7 +41,11 @@ class Agent extends DispatcherBase {
       connect = { ...connect }
     }
 
-    this[kOptions] = { ...util.deepClone(options), maxOrigins, connect }
+    if (tls && typeof tls !== 'function') {
+      tls = { ...tls }
+    }
+
+    this[kOptions] = { ...util.deepClone(options), maxOrigins, connect, tls }
     this[kFactory] = factory
     this[kClients] = new Map()
     this[kOrigins] = new Set()

package/lib/dispatcher/client-h1.js

@@ -988,8 +988,6 @@ function connectH1 (client, socket) {
 }
 
 function onHttpSocketError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   const parser = this[kParser]
 
   // On Mac OS, we get an ECONNRESET even if there is a full body to be forwarded

package/lib/dispatcher/client-h2.js

@@ -600,8 +600,6 @@ function onHttp2SendPing (session) {
 }
 
 function onHttp2SessionError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   this[kSocket][kError] = err
 
   if (this[kReceivedGoAway]) {
@@ -767,8 +765,6 @@ function onHttp2SocketClose () {
 }
 
 function onHttp2SocketError (err) {
-  assert(err.code !== 'ERR_TLS_CERT_ALTNAME_INVALID')
-
   this[kError] = err
 
   if (this[kHTTP2Session]?.[kReceivedGoAway]) {

package/lib/handler/cache-handler.js

@@ -1,6 +1,7 @@
 'use strict'
 
 const util = require('../core/util')
+const { kRedirectCacheControl } = require('../core/symbols')
 const {
   parseCacheControlHeader,
   hasInvalidCacheControlDirective,
@@ -57,6 +58,19 @@ class CacheController {
   set rawTrailers (value) { this.target.rawTrailers = value }
 }
 
+/**
+ * @param {string | URL} a
+ * @param {string | URL} b
+ * @returns {boolean}
+ */
+function sameOrigin (a, b) {
+  try {
+    return new URL(String(a)).origin === new URL(String(b)).origin
+  } catch {
+    return String(a) === String(b)
+  }
+}
+
 // Status codes that we can use some heuristics on to cache
 const HEURISTICALLY_CACHEABLE_STATUS_CODES = [
   200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501
@@ -203,6 +217,14 @@ class CacheHandler {
    */
   #writeStream
 
+  /**
+   * The URLs visited while following redirects, shared by reference from the
+   * redirect handler through the request context. Carries the suppressed hops'
+   * cache-control under {@link kRedirectCacheControl}.
+   * @type {URL[] | undefined}
+   */
+  #history
+
   /**
    * @param {import('../../types/cache-interceptor.d.ts').default.CacheHandlerOptions} opts
    * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} cacheKey
@@ -220,6 +242,13 @@ class CacheHandler {
     this.#writeStream?.destroy()
     this.#writeStream = undefined
     this.#downstreamController = new CacheController(controller)
+    // The redirect handler threads the list of visited URLs through the
+    // handler-chain context. Keep a reference to it (it is mutated as redirects
+    // are followed) so onResponseStart can tell which request actually produced
+    // the response. Unlike the request options object, this reference is not
+    // broken by an interceptor that copies the options between the cache and
+    // the redirect.
+    this.#history = context?.history
     this.#handler.onRequestStart?.(this.#downstreamController, context)
   }
 
@@ -267,6 +296,35 @@ class CacheHandler {
       return downstreamOnHeaders()
     }
 
+    // A cross-origin redirect can change the origin that actually produced the
+    // final response. Keying that response on the original (trusted) origin
+    // would let a redirect target control an entry for a URL the application
+    // trusts. The final request is the last URL in the redirect history; only
+    // cache when its origin still matches the cache key origin.
+    if (this.#history && this.#history.length > 0) {
+      const finalUrl = this.#history[this.#history.length - 1]
+      if (!sameOrigin(finalUrl.origin, this.#cacheKey.origin)) {
+        return downstreamOnHeaders()
+      }
+    }
+
+    // A redirect hop that is not forwarded can still carry a restrictive
+    // storage policy (for example `no-store`, or `private` for a shared cache).
+    // Honor it, otherwise a redirect that must not be stored could be laundered
+    // into a cacheable final response under the original key.
+    const redirectCacheControl = this.#history?.[kRedirectCacheControl]
+    if (redirectCacheControl) {
+      for (const hopCacheControl of redirectCacheControl) {
+        const hopDirectives = hopCacheControl ? parseCacheControlHeader(hopCacheControl) : {}
+        if (
+          hopDirectives['no-store'] === true ||
+          (this.#cacheType === 'shared' && hopDirectives.private === true)
+        ) {
+          return downstreamOnHeaders()
+        }
+      }
+    }
+
     const cacheControlHeader = resHeaders['cache-control']
     const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
 

package/lib/handler/deduplication-handler.js

@@ -16,6 +16,7 @@ const DEFAULT_MAX_BUFFER_SIZE = 5 * 1024 * 1024
  * @property {number} bufferedBytes
  * @property {object | null} pendingTrailers
  * @property {boolean} done
+ * @property {boolean} [pendingStart] onRequestStart deferred until the primary request's context is known
  */
 
 /**
@@ -30,6 +31,20 @@ class DeduplicationHandler {
    */
   #primaryHandler
 
+  /**
+   * Whether the primary request has started (onRequestStart received). Until
+   * then the request context is unknown and cannot be given to waiting handlers.
+   * @type {boolean}
+   */
+  #requestStarted = false
+
+  /**
+   * The primary request context, replayed to waiting handlers so they observe
+   * the same redirect history as the primary.
+   * @type {any}
+   */
+  #context = null
+
   /**
    * @type {WaitingHandler[]}
    */
@@ -112,20 +127,30 @@ class DeduplicationHandler {
     const waitingController = waitingHandler.controller
 
     try {
-      handler.onRequestStart?.(waitingController, null)
+      if (this.#requestStarted) {
+        // The primary request has started, so its context (including the
+        // redirect history) is known and can be delivered immediately.
+        handler.onRequestStart?.(waitingController, this.#context)
 
-      if (waitingController.aborted) {
-        waitingHandler.done = true
-        return true
-      }
+        if (waitingController.aborted) {
+          waitingHandler.done = true
+          return true
+        }
 
-      if (this.#responseStarted) {
-        handler.onResponseStart?.(
-          waitingController,
-          this.#statusCode,
-          this.#headers,
-          this.#statusMessage
-        )
+        if (this.#responseStarted) {
+          handler.onResponseStart?.(
+            waitingController,
+            this.#statusCode,
+            this.#headers,
+            this.#statusMessage
+          )
+        }
+      } else {
+        // The primary request has not started yet. Defer onRequestStart until
+        // its context is known, so the waiting handler observes the same
+        // redirect history as the primary (a cache handler relies on it to
+        // reject cross-origin redirect responses).
+        waitingHandler.pendingStart = true
       }
     } catch {
       // Ignore errors from waiting handlers
@@ -146,6 +171,24 @@ class DeduplicationHandler {
    */
   onRequestStart (controller, context) {
     this.#controller = controller
+    if (!this.#requestStarted) {
+      this.#requestStarted = true
+      this.#context = context
+      // Deliver the now-known context to handlers that joined before the
+      // primary request started.
+      for (const waitingHandler of this.#waitingHandlers) {
+        if (waitingHandler.pendingStart && !waitingHandler.done && !waitingHandler.controller.aborted) {
+          waitingHandler.pendingStart = false
+          try {
+            waitingHandler.handler.onRequestStart?.(waitingHandler.controller, context)
+          } catch {
+            // Ignore errors from waiting handlers
+            waitingHandler.done = true
+          }
+        }
+      }
+      this.#pruneDoneWaitingHandlers()
+    }
     this.#primaryHandler.onRequestStart?.(controller, context)
   }
 
@@ -330,7 +373,8 @@ class DeduplicationHandler {
       bufferedChunks: [],
       bufferedBytes: 0,
       pendingTrailers: null,
-      done: false
+      done: false,
+      pendingStart: false
     }
 
     const state = {

package/lib/handler/redirect-handler.js

@@ -3,7 +3,7 @@
 const util = require('../core/util')
 const assert = require('node:assert')
 const { InvalidArgumentError, MaxRedirectsError } = require('../core/errors')
-const { kRequestOrigin } = require('../core/symbols')
+const { kRequestOrigin, kRedirectCacheControl } = require('../core/symbols')
 
 const redirectableStatusCodes = [300, 301, 302, 303, 307, 308]
 
@@ -38,6 +38,15 @@ class RedirectHandler {
     this.maxRedirections = maxRedirections
     this.handler = handler
     this.history = []
+    // `cache-control` of each intermediate (suppressed) redirect hop. An outer
+    // cache uses it to preserve a hop's storage policy (e.g. `no-store`) that
+    // would otherwise be lost because the hop's response is not forwarded. It
+    // travels as a non-enumerable property of the history array so it reaches
+    // the cache without becoming part of the public request/response context.
+    Object.defineProperty(this.history, kRedirectCacheControl, {
+      value: [],
+      enumerable: false
+    })
   }
 
   onRequestStart (controller, context) {
@@ -114,6 +123,11 @@ class RedirectHandler {
       return
     }
 
+    // This hop's response is suppressed (only its Location is used). Record its
+    // cache-control so an outer cache can honor a restrictive policy that would
+    // otherwise be lost when the final response is stored.
+    this.history[kRedirectCacheControl].push(headers['cache-control'])
+
     const baseUrl = requestOrigin
       ? new URL(this.opts.path, requestOrigin)
       : undefined

package/lib/interceptor/decompress.js

@@ -223,9 +223,14 @@ class DecompressHandler extends DecoratorHandler {
             this.#decompressedSize = decompressedSize
           }
 
-          const result = super.onResponseData(this.#controller, chunk)
-          if (result === false && !this.#controller.paused) {
-            this.#controller.pause()
+          try {
+            const result = super.onResponseData(this.#controller, chunk)
+            if (result === false && !this.#controller.paused) {
+              this.#controller.pause()
+            }
+          } catch (err) {
+            this.#fail(err)
+            return
           }
         }
       } while (this.#drainRequested && !this.#terminated && !this.#controller.paused)
@@ -242,9 +247,14 @@ class DecompressHandler extends DecoratorHandler {
       return
     }
 
-    this.#terminated = true
     this.#cleanupDecompressors()
-    super.onResponseEnd(this.#controller, this.#trailers)
+    try {
+      super.onResponseEnd(this.#controller, this.#trailers)
+    } catch (err) {
+      this.#fail(err)
+      return
+    }
+    this.#terminated = true
   }
 
   #onDecompressionEnd () {

package/lib/web/eventsource/eventsource-stream.js

@@ -31,12 +31,11 @@ const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
 const RETRY = Buffer.from('retry')
 
-// The longest prefix a `data:` field can have before its value: "data:" plus a
-// single leading U+0020 SPACE. Used when bounding an unterminated line against
-// maxEventSize so a server cannot force unbounded buffering by never sending a
-// line terminator, while still accepting a terminated data line whose value is
-// exactly maxEventSize bytes.
-const DATA_FIELD_PREFIX_SIZE = DATA.length + 2
+// Each data field creates a string node, and each unconsumed input chunk keeps
+// a Buffer wrapper. The absolute ceiling protects the large default byte limit.
+const minParserItems = 1024
+const maxParserItems = 131072
+const bytesPerParserItem = 128
 
 function isASCIINumberBytes (buffer, start) {
   if (start >= buffer.length) {
@@ -130,9 +129,13 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
-  eventDataSize = 0
-  currentLineSize = 0
+  lineLength = 0
+  eventSize = 0
+  eventFieldSizes = { data: 0, event: 0, id: 0, retry: 0 }
+  dataLineCount = 0
   maxEventSize
+  maxDataLines
+  maxBufferedChunks
 
   event = {
     data: undefined,
@@ -157,6 +160,11 @@ class EventSourceStream extends Transform {
 
     this.state = options.eventSourceSettings || {}
     this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
+    const parserItemLimit = this.maxEventSize > 0
+      ? Math.min(maxParserItems, Math.max(minParserItems, Math.floor(this.maxEventSize / bytesPerParserItem)))
+      : 0
+    this.maxDataLines = parserItemLimit
+    this.maxBufferedChunks = parserItemLimit
     if (options.push) {
       this.push = options.push
     }
@@ -174,6 +182,14 @@ class EventSourceStream extends Transform {
       return
     }
 
+    // A leading line ending can immediately release the currently buffered
+    // line, even when it uses the final allowed chunk slot.
+    if (this.maxEventSize > 0 &&
+        this.chunks.length >= this.maxBufferedChunks &&
+        chunk[0] !== LF && chunk[0] !== CR) {
+      callback(createMaxEventSizeExceededError())
+      return
+    }
     this.chunks.push(chunk)
 
     // Strip leading byte-order-mark if we opened the stream and started
@@ -266,21 +282,25 @@ class EventSourceStream extends Transform {
         continue
       }
 
-      this.advanceCursor()
-      this.currentLineSize++
-
-      // An unterminated line never reaches parseLine(), so enforce the configured
-      // maxEventSize here to prevent unbounded buffering when a server streams a
-      // field that never contains a line terminator.
-      if (this.currentLineSize > this.getMaxEventSizeLineLength()) {
+      // readLine() is only called after CR or LF. Reject an unfinished line
+      // before it can retain an unbounded number of decoded chunks. The seven
+      // extra bytes allow the longest field prefix ("event: " or "retry: ").
+      if (this.maxEventSize > 0 && ++this.lineLength > this.maxEventSize + 7) {
         callback(createMaxEventSizeExceededError())
         return
       }
+      this.advanceCursor()
     }
 
     callback()
   }
 
+  _destroy (error, callback) {
+    this.chunks.length = 0
+    this.clearEvent()
+    super._destroy(error, callback)
+  }
+
   /**
    * @param {Buffer} line
    * @param {EventSourceStreamEvent} event
@@ -317,12 +337,12 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
-      const valueBytes = line.length - valueStart
-      const eventDataSize = this.eventDataSize + (event.data === undefined ? 0 : 1) + valueBytes
-
-      if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+      if (this.maxEventSize > 0 && this.dataLineCount >= this.maxDataLines) {
         throw createMaxEventSizeExceededError()
       }
+      const valueBytes = line.length - valueStart
+      const dataSize = this.eventFieldSizes.data + (event.data === undefined ? 0 : 1) + valueBytes
+      this.setEventFieldSize('data', dataSize)
 
       const value = line.toString('utf8', valueStart)
 
@@ -331,12 +351,13 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
-      this.eventDataSize = eventDataSize
+      this.dataLineCount++
       return
     }
 
     if (isFieldName(line, fieldLength, RETRY)) {
       if (isASCIINumberBytes(line, valueStart)) {
+        this.setEventFieldSize('retry', line.length - valueStart)
         event.retry = line.toString('utf8', valueStart)
       }
       return
@@ -344,20 +365,29 @@ class EventSourceStream extends Transform {
 
     if (isFieldName(line, fieldLength, ID)) {
       if (isValidLastEventIdBytes(line, valueStart)) {
+        this.setEventFieldSize('id', line.length - valueStart)
         event.id = line.toString('utf8', valueStart)
       }
       return
     }
 
     if (isFieldName(line, fieldLength, EVENT)) {
-      const value = line.toString('utf8', valueStart)
-
-      if (value.length > 0) {
-        event.event = value
+      if (valueStart < line.length) {
+        this.setEventFieldSize('event', line.length - valueStart)
+        event.event = line.toString('utf8', valueStart)
       }
     }
   }
 
+  setEventFieldSize (field, size) {
+    const eventSize = this.eventSize - this.eventFieldSizes[field] + size
+    if (this.maxEventSize > 0 && eventSize > this.maxEventSize) {
+      throw createMaxEventSizeExceededError()
+    }
+    this.eventSize = eventSize
+    this.eventFieldSizes[field] = size
+  }
+
   /**
    * @param {EventSourceStreamEvent} event
    */
@@ -388,7 +418,12 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
-    this.eventDataSize = 0
+    this.eventSize = 0
+    this.dataLineCount = 0
+    this.eventFieldSizes.data = 0
+    this.eventFieldSizes.event = 0
+    this.eventFieldSizes.id = 0
+    this.eventFieldSizes.retry = 0
   }
 
   hasPendingEvent () {
@@ -424,29 +459,16 @@ class EventSourceStream extends Transform {
   syncLineStartToCursor () {
     this.lineChunkIndex = this.chunkIndex
     this.linePos = this.pos
-    this.currentLineSize = 0
+    this.lineLength = 0
     this.dropConsumedChunks()
   }
 
-  /**
-   * @returns {number} The maximum length, in bytes, of the currently buffered
-   * (possibly unterminated) line. The extra {@link DATA_FIELD_PREFIX_SIZE}
-   * accounts for the longest `data:` field prefix, so a terminated data line
-   * carrying exactly {@link maxEventSize} value bytes remains accepted.
-   */
-  getMaxEventSizeLineLength () {
-    if (this.maxEventSize <= 0) {
-      return Infinity
-    }
-
-    return this.maxEventSize + DATA_FIELD_PREFIX_SIZE
-  }
-
   dropConsumedChunks () {
-    while (this.lineChunkIndex > 0) {
-      this.chunks.shift()
-      this.lineChunkIndex--
-      this.chunkIndex--
+    if (this.lineChunkIndex > 0) {
+      const consumed = this.lineChunkIndex
+      this.chunks.splice(0, consumed)
+      this.lineChunkIndex = 0
+      this.chunkIndex -= consumed
     }
 
     if (this.chunkIndex === this.chunks.length) {

package/lib/web/fetch/index.js

@@ -2280,8 +2280,6 @@ async function httpNetworkFetch (
             appendHeadersListFromResponseHeaders(headersList, headers, rawHeaders)
             const location = headersList.get('location', true)
 
-            this.body = new Readable({ read: () => controller.resume() })
-
             const willFollow = location && request.redirect === 'follow' &&
               redirectStatusSet.has(status)
 
@@ -2299,7 +2297,7 @@ async function httpNetworkFetch (
               // CVE fix similar to urllib3 (GHSA-gm62-xv2j-4w53) and curl (CVE-2022-32206).
               const maxContentEncodings = 5
               if (codings.length > maxContentEncodings) {
-                reject(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
+                controller.abort(new Error(`too many content-encodings in response: ${codings.length}, maximum allowed is ${maxContentEncodings}`))
                 return
               }
 
@@ -2341,6 +2339,8 @@ async function httpNetworkFetch (
               }
             }
 
+            this.body = new Readable({ read: () => controller.resume() })
+
             const onError = (err) => this.onResponseError(controller, err)
 
             resolve({

package/lib/web/subresource-integrity/subresource-integrity.js

@@ -2,6 +2,7 @@
 
 const assert = require('node:assert')
 const { runtimeFeatures } = require('../../util/runtime-features.js')
+const { asciiLowercase } = require('../infra/index.js')
 
 /**
  * @typedef {object} Metadata
@@ -66,14 +67,12 @@ const getSRIHashAlgorithmIndex = /** @type {GetSRIHashAlgorithmIndex} */ (Map.pr
 
 /**
  * @typedef IsValidSRIHashAlgorithm
+ * @see https://w3c.github.io/webappsec-subresource-integrity/#valid-sri-hash-algorithm-token
  * @type {(algorithm: string) => algorithm is SRIHashAlgorithm}
  * @param {*} algorithm
  * @returns {algorithm is SRIHashAlgorithm}
  */
-
-const isValidSRIHashAlgorithm = /** @type {IsValidSRIHashAlgorithm} */ (
-  Map.prototype.has.bind(validSRIHashAlgorithmTokenSet)
-)
+const isValidSRIHashAlgorithm = (algorithm) => validSRIHashAlgorithmTokenSet.has(asciiLowercase(algorithm))
 
 /**
  * @param {Uint8Array} bytes
@@ -229,7 +228,8 @@ function parseMetadata (metadata) {
     // 8. Let metadata be the ordered map
     // «["alg" → algorithm, "val" → base64-value]».
     const metadata = {
-      alg: algorithm,
+      // Possible spec bug?
+      alg: asciiLowercase(algorithm),
       val: base64Value
     }
 

package/lib/web/websocket/receiver.js

@@ -252,6 +252,19 @@ class ByteParser extends Writable {
         if (isControlFrame(this.#info.opcode)) {
           this.#loop = this.parseControlFrame(body)
           this.#state = parserStates.INFO
+
+          // If the automatic PONG/CLOSE reply filled the socket's write buffer,
+          // stop parsing and resume on drain so a PING flood cannot grow the
+          // outbound queue without bound.
+          if (this.#loop && this.#handler.socket.writableNeedDrain) {
+            this.#loop = false
+            this.#handler.socket.once('drain', () => {
+              if (this.destroyed) return
+              this.#loop = true
+              this.run(callback)
+            })
+            return
+          }
         } else {
           if (!this.#info.compressed) {
             if (!this.writeFragments(body)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.12.1",
+  "version": "8.12.2",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/types/client.d.ts

@@ -175,8 +175,12 @@ export declare namespace Client {
   }
   export interface EventSourceOptions {
     /**
-     * Maximum allowed event size in bytes for EventSource messages.
-     * Set to 0 to disable the limit.
+     * Maximum total bytes of data and metadata field values retained for a
+     * pending EventSource event. Each unfinished line is separately bounded
+     * to this value plus seven syntax bytes. The number of data lines per
+     * event and buffered input chunks are each limited to
+     * min(131072, max(1024, floor(maxEventSize / 128))).
+     * Set to 0 to disable these limits.
      * @default buffer.kStringMaxLength
      */
     maxEventSize?: number;