restify / restify/node-restify

Process crashes on invalid gzip body from client

Open
#1,975 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
10.7k
Forks
975
Avg merge
1d 6h
Merged PRs (30d)
5

Description

  • Used appropriate template for the issue type
  • Searched both open and closed issues for duplicates of this issue
  • Title adequately and concisely reflects the feature or the bug

Restify Version: 11.1.0
Node.js Version: v20.15.0

Expected behaviour

Badly formatted requests are rejected or gracefully handled

Actual behaviour

A badly formatted request produces an uncaught error and terminates the node process, unless you're using the deprecated handleUncaughtExceptions: true option

Repro case

const restify = require('restify')
const axios = require('axios')

const server = restify.createServer({handleUncaughtExceptions: false})
server.use(restify.plugins.bodyParser())

server.get('/hello', function (req, res, next) {
  res.send(200, {hello: 'world'})
})

server.listen(9595, function () {
  console.log(`${server.name} listening at ${server.url}`)
})

// intentionally send a request with an invalid (empty) gzip body
// this shouldn't crash the server
axios({
  method: 'get',
  url: 'http://localhost:9595/hello',
  headers: {'Content-encoding': 'gzip', 'Content-type': 'application/json'},
  validateStatus: () => true
}).then(response => {
  console.log('server response', response.status, response.data)

  server.close()
})

Cause

Possibly a bug in the bodyParser plugin?

Are you willing and able to fix this?

Yes, with some guidance on the right way to address this. Should the bodyParser plugin catch errors related to bad user input?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the restify.plugins.bodyParser() path and the handleUncaughtExceptions option, then run the supplied invalid gzip repro against the GET /hello route. Trace how the malformed request error is handled and add coverage for this case. Done means the process remains running and the request is rejected or handled gracefully.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.