restify / restify/node-restify
Process crashes on invalid gzip body from client
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.7k
- Forks
- 975
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 5
Description
- Used appropriate template for the issue type
- Searched both open and closed issues for duplicates of this issue
- Title adequately and concisely reflects the feature or the bug
Restify Version: 11.1.0
Node.js Version: v20.15.0
Expected behaviour
Badly formatted requests are rejected or gracefully handled
Actual behaviour
A badly formatted request produces an uncaught error and terminates the node process, unless you're using the deprecated handleUncaughtExceptions: true option
Repro case
const restify = require('restify')
const axios = require('axios')
const server = restify.createServer({handleUncaughtExceptions: false})
server.use(restify.plugins.bodyParser())
server.get('/hello', function (req, res, next) {
res.send(200, {hello: 'world'})
})
server.listen(9595, function () {
console.log(`${server.name} listening at ${server.url}`)
})
// intentionally send a request with an invalid (empty) gzip body
// this shouldn't crash the server
axios({
method: 'get',
url: 'http://localhost:9595/hello',
headers: {'Content-encoding': 'gzip', 'Content-type': 'application/json'},
validateStatus: () => true
}).then(response => {
console.log('server response', response.status, response.data)
server.close()
})
Cause
Possibly a bug in the bodyParser plugin?
Are you willing and able to fix this?
Yes, with some guidance on the right way to address this. Should the bodyParser plugin catch errors related to bad user input?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the restify.plugins.bodyParser() path and the handleUncaughtExceptions option, then run the supplied invalid gzip repro against the GET /hello route. Trace how the malformed request error is handled and add coverage for this case. Done means the process remains running and the request is rejected or handled gracefully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100