node-restify icon indicating copy to clipboard operation
node-restify copied to clipboard

Process crashes on invalid gzip body from client

Open hashtagchris opened this issue 7 months ago • 0 comments

  • [x] Used appropriate template for the issue type
  • [x] Searched both open and closed issues for duplicates of this issue
  • [x] Title adequately and concisely reflects the feature or the bug

Restify Version: 11.1.0 Node.js Version: v20.15.0

Expected behaviour

Badly formatted requests are rejected or gracefully handled

Actual behaviour

A badly formatted request produces an uncaught error and terminates the node process, unless you're using the deprecated handleUncaughtExceptions: true option

Repro case

const restify = require('restify')
const axios = require('axios')

const server = restify.createServer({handleUncaughtExceptions: false})
server.use(restify.plugins.bodyParser())

server.get('/hello', function (req, res, next) {
  res.send(200, {hello: 'world'})
})

server.listen(9595, function () {
  console.log(`${server.name} listening at ${server.url}`)
})

// intentionally send a request with an invalid (empty) gzip body
// this shouldn't crash the server
axios({
  method: 'get',
  url: 'http://localhost:9595/hello',
  headers: {'Content-encoding': 'gzip', 'Content-type': 'application/json'},
  validateStatus: () => true
}).then(response => {
  console.log('server response', response.status, response.data)

  server.close()
})

Cause

Possibly a bug in the bodyParser plugin?

Are you willing and able to fix this?

Yes, with some guidance on the right way to address this. Should the bodyParser plugin catch errors related to bad user input?

hashtagchris avatar Jul 11 '24 14:07 hashtagchris