Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Return error for multipart file exceeding maxBytes #26

Merged
merged 4 commits into from Apr 6, 2016
Merged

Return error for multipart file exceeding maxBytes #26

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d661f07
error for multipart file outputs too big
johnbrett Apr 2, 2016
bceb673
remove forgotten log
johnbrett Apr 2, 2016
920ace5
Return errors if any multipart payload exceeds maxBytes
johnbrett Apr 2, 2016
450ae63
pass maxBytes to Pez
johnbrett Apr 6, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 13 additions & 0 deletions lib/index.js
View file
Open in desktop
Expand Up @@ -52,6 +52,7 @@ internals.Parser.prototype.read = function () {
// Content size

const req = this.req;

const contentLength = req.headers['content-length'];
if (this.settings.maxBytes !== undefined &&
contentLength &&
Expand Down Expand Up @@ -288,6 +289,18 @@ internals.Parser.prototype.multipart = function (source, contentType) {
next = Hoek.once(next); // Modify next() for async events
this.next = next;

if (this.settings.maxBytes !== undefined) {
let bytesUsed = 0;

source.on('data', (data) => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Isn't this triggering old streams push mode ?


bytesUsed += Buffer.byteLength(data);
if (bytesUsed > this.settings.maxBytes) {
return next(Boom.badRequest('Payload content length greater than maximum allowed: ' + this.settings.maxBytes));
}
});
}

// Set stream timeout

const clientTimeout = this.settings.timeout;
Expand Down
100 changes: 100 additions & 0 deletions test/index.js
View file
Open in desktop
Expand Up @@ -1010,6 +1010,22 @@ describe('parse()', () => {
});
});

it('error for a multipart file that exceeds maxBytes', (done) => {

const path = Path.join(__dirname, './file/image.jpg');

const form = new FormData();
form.append('my_file', Fs.createReadStream(path));
form.headers = form.getHeaders();

Subtext.parse(form, null, { parse: true, output: 'file', maxBytes: 12 }, (err, parsed) => {

expect(err).to.exist();
expect(err.message).to.equal('Payload content length greater than maximum allowed: 12');
done();
});
});

it('parses multiple files as files', (done) => {

const path = Path.join(__dirname, './file/image.jpg');
Expand Down Expand Up @@ -1229,6 +1245,90 @@ describe('parse()', () => {
});
});

it('allows a multipart payload not exceeding specified maxBytes', (done) => {

const payload =
'--AaB03x\r\n' +
'content-disposition: form-data; name="x"\r\n' +
'\r\n' +
'First\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="x"\r\n' +
'\r\n' +
'Second\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="x"\r\n' +
'\r\n' +
'Third\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="field1"\r\n' +
'\r\n' +
'Joe Blow\r\nalmost tricked you!\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="field1"\r\n' +
'\r\n' +
'Repeated name segment\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="pics"; filename="file1.txt"\r\n' +
'Content-Type: text/plain\r\n' +
'\r\n' +
'... contents of file1.txt ...\r\r\n' +
'--AaB03x--\r\n';

const request = Wreck.toReadableStream(payload);
request.headers = {
'content-type': 'multipart/form-data; boundary=AaB03x'
};

Subtext.parse(request, null, { parse: true, output: 'data', maxBytes: 600 }, (err, parsed) => {

expect(err).to.not.exist();
done();
});
});

it('errors for a multipart payload exceeding specified maxBytes', (done) => {

const payload =
'--AaB03x\r\n' +
'content-disposition: form-data; name="x"\r\n' +
'\r\n' +
'First\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="x"\r\n' +
'\r\n' +
'Second\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="x"\r\n' +
'\r\n' +
'Third\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="field1"\r\n' +
'\r\n' +
'Joe Blow\r\nalmost tricked you!\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="field1"\r\n' +
'\r\n' +
'Repeated name segment\r\n' +
'--AaB03x\r\n' +
'content-disposition: form-data; name="pics"; filename="file1.txt"\r\n' +
'Content-Type: text/plain\r\n' +
'\r\n' +
'... contents of file1.txt ...\r\r\n' +
'--AaB03x--\r\n';

const request = Wreck.toReadableStream(payload);
request.headers = {
'content-type': 'multipart/form-data; boundary=AaB03x'
};

Subtext.parse(request, null, { parse: true, output: 'data', maxBytes: 500 }, (err, parsed) => {

expect(err).to.exist();
done();
});
});

it('parses a file correctly on stream mode', (done) => {

const path = Path.join(__dirname, './file/image.jpg');
Expand Down