CodeGenieApp / CodeGenieApp/serverless-express

Unhandled Promise Rejection on ALB event

Open
#678 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
5.3k
Forks
676
PR merge metrics
No merged PRs in 30d

Description

Given an ALB event with multiValueQueryStringParameters but one of the value fails `decodeURIComponent` , the promise isnt handled at all. Expectation is that it should return an error and consumers treat that error

https://github.com/CodeGenieApp/serverless-express/blob/1376bd01e29f6bcf911f86a2b17a5cb85b2844ec/src/event-sources/aws/alb.js#L40
https://github.com/CodeGenieApp/serverless-express/blob/1376bd01e29f6bcf911f86a2b17a5cb85b2844ec/src/event-sources/aws/alb.js#L17

The below test wont even report the failure since the promise is left unhandled
```
test('serverlessExpressInstance should throw', async () => {
const multiValueQueryStringParameters = { etype: ['odp'], passurl: ['/category/'], template: ['../../../../../../../../../etc/passwd%%0000.html'] }

const event = makeEvent({
eventSourceName: 'alb',
path: '/',
httpMethod: 'GET',
multiValueQueryStringParameters
})
await expect(serverlessExpressInstance(event)).toThrow('some')
})
```

![Screenshot 2024-04-23 at 11 34 20 AM](https://github.com/CodeGenieApp/serverless-express/assets/11545334/6a2afcf4-f980-45e7-8ae2-689e554fbe05)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.