Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(fetch): raise AbortSignal max event listeners #1910

Merged
merged 1 commit into from Feb 7, 2023

Conversation

KhafraDev
Copy link
Member

@codecov-commenter
Copy link

codecov-commenter commented Feb 6, 2023

Codecov Report

Base: 90.41% // Head: 90.42% // Increases project coverage by +0.00% 🎉

Coverage data is based on head (7615308) compared to base (9dceb21).
Patch coverage: 100.00% of modified lines in pull request are covered.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #1910   +/-   ##
=======================================
  Coverage   90.41%   90.42%           
=======================================
  Files          71       71           
  Lines        6096     6099    +3     
=======================================
+ Hits         5512     5515    +3     
  Misses        584      584           
Impacted Files Coverage Δ
lib/fetch/request.js 87.98% <100.00%> (+0.15%) ⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lgtm

@ricardocosta
Copy link

@KhafraDev According to remix-run/react-router#10118, this PR introduces errors when using React Router because getEventListeners doesn't support signals of type AbortSignal , whilst signal can be of that type.

Is there any issue/plan to fix this?

@KhafraDev
Copy link
Member Author

getEventListeners does work on a nodejs AbortSignal, since it extends EventTarget. If you have a minimal repro that would be helpful.

@joshkel
Copy link

joshkel commented Mar 10, 2023

@KhafraDev, thank you for looking into this. However, I'm still having problems; depending on how quickly my loop runs, Node.js might add >200 event listeners, so I still get these warnings spammed to the console. I tried raising the warning limit myself (setMaxListeners(Infinity, this.controller.signal)); however, this PR overrides any warning limit that was already set.

For a repro for remix-run/react-router#10118, see https://github.com/joshkel/vitest-undici-abort-bug. The problem arises because testing frameworks such as Vitest may cause jsdom's AbortController to be used with undici's fetch.

@KhafraDev
Copy link
Member Author

So it does seem like an issue in vitest - overriding some globals is bound to cause issues (see jest...). Although we should offer support for 3rd party AbortControllers, so this is a bug. We also shouldn't be changing the max listeners if the amount was changed, but there's no way of checking so there isn't much to do with that.

@camsjams
Copy link

camsjams commented Mar 21, 2023

The heavily used third-party WHATWG implementation of an AbortController interface called abort-controller, also fails the test for getEventListeners.

For those that can, just update to use native one: https://nodejs.org/dist/latest-v18.x/docs/api/globals.html#class-abortcontroller

@KhafraDev
Copy link
Member Author

this was already fixed in undici v5.21.0, node v19.6.0 is using undici v5.19.1.

@camsjams
Copy link

So does mainline Node have to update?

@KhafraDev
Copy link
Member Author

KhafraDev commented Mar 21, 2023

node v19.8+ has the fix

@camsjams
Copy link

Sorry by mainline I guess I meant LTS (Node 18)

@sangaman
Copy link

node v19.8+ has the fix

I'm still seeing this MaxListenersExceededWarning with AbortSignal on v19.8.1, it appears to be triggered by calling the native fetch a handful of times in a test suite.

@himself65
Copy link
Member

is there any hotpatch for nodejs 18?

@ba55ie
Copy link

ba55ie commented Apr 7, 2023

is there any hotpatch for nodejs 18?

You can patch globalThis.fetch with the latest version from undici:

import { fetch } from 'undici';

globalThis.fetch = fetch;

That's how I fixed our tests in node v18.15.0:

import { fetch } from 'undici';
import { beforeAll, afterAll, test } from 'your-test-lib';

let originalFetch;

beforeAll(() => {
  originalFetch = globalThis.fetch;
  globalThis.fetch = fetch;
});

afterAll(() => {
  globalThis.fetch = originalFetch;
});

// Run your tests using fetch.

@IanVS
Copy link

IanVS commented Apr 14, 2023

Looks like this is now included in node 18.16.0 as well. 👍

neurosnap added a commit to aptible/app-ui that referenced this pull request May 4, 2023
neurosnap added a commit to aptible/app-ui that referenced this pull request May 8, 2023
neurosnap added a commit to aptible/app-ui that referenced this pull request May 9, 2023
* chore(ftux): full integration test

* chore: update node for tests

Addresses: nodejs/undici#1910
metcoder95 pushed a commit to metcoder95/undici that referenced this pull request Jul 21, 2023
@thw0rted
Copy link

I'm still seeing this with Jest tests on Node 18.16.1:

(node:10904) MaxListenersExceededWarning: Possible EventTarget memory leak detected. 11 abort listeners added to [AbortSignal]. Use events.setMaxListeners() to increase limit

Is this PR supposed to address the warning automatically, or am I meant to be manually increasing setMaxListeners?

@Maxlitv
Copy link

Maxlitv commented Sep 6, 2023

Looks like this is now included in node 18.16.0 as well. 👍

I love you.

kodiakhq bot pushed a commit to X-oss-byte/Canary-nextjs that referenced this pull request Sep 18, 2023
[![Mend Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [undici](https://undici.nodejs.org) ([source](https://togithub.com/nodejs/undici)) | [`5.14.0` -> `5.19.1`](https://renovatebot.com/diffs/npm/undici/5.14.0/5.19.1) | [![age](https://developer.mend.io/api/mc/badges/age/npm/undici/5.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/undici/5.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/undici/5.14.0/5.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/undici/5.14.0/5.19.1?slim=true)](https://docs.renovatebot.com/merge-confidence/) |

### GitHub Vulnerability Alerts

#### [CVE-2023-23936](https://togithub.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff)

### Impact

undici library does not protect `host` HTTP header from CRLF injection vulnerabilities.

### Patches

This issue was patched in Undici v5.19.1.

### Workarounds

Sanitize the `headers.host` string before passing to undici.

### References

Reported at https://hackerone.com/reports/1820955.

### Credits

Thank you to Zhipeng Zhang ([@&#8203;timon8](https://hackerone.com/timon8)) for reporting this vulnerability.

---

### Release Notes

<details>
<summary>nodejs/undici (undici)</summary>

### [`v5.19.1`](https://togithub.com/nodejs/undici/releases/tag/v5.19.1)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.19.0...v5.19.1)

#### ⚠️ Security Release ⚠️

-   [Regular Expression Denial of Service in Headers](https://togithub.com/nodejs/undici/security/advisories/GHSA-r6ch-mqf9-qc9w) with CVE-2023-24807
-   [CRLF Injection in Nodejs ‘undici’ via host](https://togithub.com/nodejs/undici/security/advisories/GHSA-5r9g-qh6m-jxff) with CVE-2023-23936

This release is part of the Node.js security release train: https://nodejs.org/en/blog/vulnerability/february-2023-security-releases/

### [`v5.19.0`](https://togithub.com/nodejs/undici/releases/tag/v5.19.0)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.18.0...v5.19.0)

#### What's Changed

-   fix(fetch): raise AbortSignal max event listeners by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1910
-   fix: content-disposition header parsing by [@&#8203;climba03003](https://togithub.com/climba03003) in [nodejs/undici#1911
-   fix: remove test by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1916
-   feat: add Headers.prototype.getSetCookie by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1915
-   fix(headers): clone getSetCookie list & add getSetCookie type by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1917
-   doc(mock): update out-of-date reply documentation by [@&#8203;p9f](https://togithub.com/p9f) in [nodejs/undici#1913
-   fix(types): add missing keepAlive params by [@&#8203;SkeLLLa](https://togithub.com/SkeLLLa) in [nodejs/undici#1918
-   Make the fetch() abort test pass locally, on Linux and Mac, Node 18/19. by [@&#8203;mcollina](https://togithub.com/mcollina) in [nodejs/undici#1927

#### New Contributors

-   [@&#8203;climba03003](https://togithub.com/climba03003) made their first contribution in [nodejs/undici#1911
-   [@&#8203;p9f](https://togithub.com/p9f) made their first contribution in [nodejs/undici#1913

**Full Changelog**: nodejs/undici@v5.18.0...v5.19.0

### [`v5.18.0`](https://togithub.com/nodejs/undici/releases/tag/v5.18.0)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.17.1...v5.18.0)

##### What's Changed

-   Add ability to set TCP keepalive by [@&#8203;xconverge](https://togithub.com/xconverge) in [nodejs/undici#1904
-   use faster timers by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1908
-   fix: ensure header value is a string by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1899

**Full Changelog**: nodejs/undici@v5.17.1...v5.18.0

### [`v5.17.1`](https://togithub.com/nodejs/undici/releases/tag/v5.17.1)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.17.0...v5.17.1)

#### What's Changed

-   fix: bad buffer slice (nodejs/undici@d2be675)

**Full Changelog**: nodejs/undici@v5.17.0...v5.17.1

### [`v5.17.0`](https://togithub.com/nodejs/undici/releases/tag/v5.17.0)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.16.0...v5.17.0)

#### What's Changed

-   fix(wpts): Blob is a global getter in >=v19.x.x by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1880
-   doc: fix anchor links dispatcher.stream by [@&#8203;RafaelGSS](https://togithub.com/RafaelGSS) in [nodejs/undici#1881
-   wpt: make runner more resilient by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1884
-   Make test pass in v19.x by [@&#8203;mcollina](https://togithub.com/mcollina) in [nodejs/undici#1879
-   Correct the type of DispatchOptions\["headers"] by [@&#8203;pan93412](https://togithub.com/pan93412) in [nodejs/undici#1896
-   perf(content-type parser): faster string collector by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1894
-   feat: expose content-type parser by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1895
-   fix(types): Update DispatchOptions type for missing "blocking" by [@&#8203;xconverge](https://togithub.com/xconverge) in [nodejs/undici#1889
-   fix(types): update error type definitions by [@&#8203;rafaelcr](https://togithub.com/rafaelcr) in [nodejs/undici#1888
-   fix: ensure connection header is a string by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1900
-   fix: throw if invalid content-type header by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1901
-   fix(fetch): use semicolon for Cookie header delimiter by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1906
-   Use FastBuffer by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1907

#### New Contributors

-   [@&#8203;pan93412](https://togithub.com/pan93412) made their first contribution in [nodejs/undici#1896
-   [@&#8203;rafaelcr](https://togithub.com/rafaelcr) made their first contribution in [nodejs/undici#1888

**Full Changelog**: nodejs/undici@v5.16.0...v5.17.0

### [`v5.16.0`](https://togithub.com/nodejs/undici/releases/tag/v5.16.0)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.15.2...v5.16.0)

#### What's Changed

-   Add feature to specify custom headers for proxies by [@&#8203;Sebmaster](https://togithub.com/Sebmaster) in [nodejs/undici#1877

#### New Contributors

-   [@&#8203;Sebmaster](https://togithub.com/Sebmaster) made their first contribution in [nodejs/undici#1877

**Full Changelog**: nodejs/undici@v5.15.2...v5.16.0

### [`v5.15.2`](https://togithub.com/nodejs/undici/compare/9d5f23177408dc16d3d4cbb8cebf463081c54e16...9457c9719029945ef9ff36b71d58557443730942)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.15.1...v5.15.2)

### [`v5.15.1`](https://togithub.com/nodejs/undici/releases/tag/v5.15.1)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.15.0...v5.15.1)

#### What's Changed

-   fix(websocket): simplify typedarray copying by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1854
-   fix: wpts on node v18.13.0+ by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1859
-   perf: allow keep alive for HEAD requests by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1858
-   fix: flaky abort test by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1863

**Full Changelog**: nodejs/undici@v5.15.0...v5.15.1

### [`v5.15.0`](https://togithub.com/nodejs/undici/releases/tag/v5.15.0)

[Compare Source](https://togithub.com/nodejs/undici/compare/v5.14.0...v5.15.0)

#### What's Changed

-   \[types] update ProxyAgent Options (timeout) by [@&#8203;sosoba](https://togithub.com/sosoba) in [nodejs/undici#1801
-   feat: implement websockets by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1795
-   feat(websocket): handle ping/pong frames & fix fragmented frames by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1809
-   docs: add basic fetch & company docs by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1810
-   make formdata body immutable and encode it only once by [@&#8203;jimmywarting](https://togithub.com/jimmywarting) in [nodejs/undici#1814
-   test: add regression test for [#&#8203;1814](https://togithub.com/nodejs/undici/issues/1814) by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1815
-   feat(websocket): only consume necessary bytes by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1812
-   websocket: use Buffer.allocUnsafe by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1817
-   build(deps-dev): bump [@&#8203;sinonjs/fake-timers](https://togithub.com/sinonjs/fake-timers) from 9.1.2 to 10.0.2 by [@&#8203;dependabot](https://togithub.com/dependabot) in [nodejs/undici#1819
-   fix(websocket): deprecation warning & 64-bit unsigned int body length by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1818
-   Use nodejs.stream.destroyed symbol by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1816
-   fetch: removal of redundant condition by [@&#8203;debadree25](https://togithub.com/debadree25) in [nodejs/undici#1821
-   fix(request): request headers array by [@&#8203;jd-carroll](https://togithub.com/jd-carroll) in [nodejs/undici#1807
-   fix(websocket): validate payload length received by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1822
-   fix(websocket): run parser in loop, instead of recursively by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1828
-   fix(fetch): weaker refs by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1824
-   websocket: add tests for opening handshake by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1831
-   websocket: add tests for constructor, close, and send by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1832
-   websocket: more test coverage by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1833
-   fix(WPTs): flaky abort test by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1835
-   wpt: add test by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1836
-   fix: don't send keep-alive if we want reset by [@&#8203;ronag](https://togithub.com/ronag) in [nodejs/undici#1846
-   fetch: update body consume to match spec by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1847
-   feat: allow connection header in request by [@&#8203;metcoder95](https://togithub.com/metcoder95) in [nodejs/undici#1829
-   feat: add cookie parsing ability by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1848
-   fix(cookie): add docs & expose in node v16 by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1849
-   fix(cookies): work with global Headers by [@&#8203;KhafraDev](https://togithub.com/KhafraDev) in [nodejs/undici#1850
-   docs(Dispatcher): adjust documentation for reset flag by [@&#8203;metcoder95](https://togithub.com/metcoder95) in [nodejs/undici#1852
-   Fix broken interceptor test by [@&#8203;mcollina](https://togithub.com/mcollina) in [nodejs/undici#1853

#### New Contributors

-   [@&#8203;sosoba](https://togithub.com/sosoba) made their first contribution in [nodejs/undici#1801
-   [@&#8203;debadree25](https://togithub.com/debadree25) made their first contribution in [nodejs/undici#1821
-   [@&#8203;jd-carroll](https://togithub.com/jd-carroll) made their first contribution in [nodejs/undici#1807

**Full Changelog**: nodejs/undici@v5.14.0...v5.15.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/sammyfilly/Canary-nextjs).
crysmags pushed a commit to crysmags/undici that referenced this pull request Feb 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

"MaxListenersExceededWarning: Possible EventTarget memory leak detected" from fetch with AbortSignal