@fastify/multipart - npm Package Compare versions

Comparing version 8.3.0 to 8.3.1

index.js

@@ -455,9 +455,10 @@ 'use strict'
     this.tmpUploads = []
+    let i = 0
     for await (const file of files) {
-      const filepath = path.join(tmpdir, generateId() + path.extname(file.filename))
+      const filepath = path.join(tmpdir, generateId() + path.extname(file.filename || ('file' + i++)))
       const target = createWriteStream(filepath)
       try {
+        this.tmpUploads.push(filepath)
         await pump(file.file, target)
         this.savedRequestFiles.push({ ...file, filepath })
-        this.tmpUploads.push(filepath)
       } catch (err) {
@@ -464,0 +465,0 @@ this.log.error({ err }, 'save request file')

package.json

 {
   "name": "@fastify/multipart",
-  "version": "8.3.0",
+  "version": "8.3.1",
   "description": "Multipart plugin for Fastify",
@@ -9,5 +9,5 @@ "main": "index.js",
   "dependencies": {
-    "@fastify/busboy": "^2.1.0",
-    "@fastify/deepmerge": "^1.0.0",
-    "@fastify/error": "^3.0.0",
+    "@fastify/busboy": "^3.0.0",
+    "@fastify/deepmerge": "^2.0.0",
+    "@fastify/error": "^4.0.0",
     "fastify-plugin": "^4.0.0",
@@ -20,3 +20,3 @@ "secure-json-parse": "^2.4.0",
     "@fastify/swagger": "^8.10.1",
-    "@fastify/swagger-ui": "^3.0.0",
+    "@fastify/swagger-ui": "^4.0.0",
     "@types/node": "^20.1.0",
@@ -69,2 +69,2 @@ "@typescript-eslint/eslint-plugin": "^7.1.0",
   }
-}
+}

test/big.test.js

@@ -46,4 +46,4 @@ 'use strict'
     const memory = process.memoryUsage()
-    t.ok(memory.rss < 400 * 1024 * 1024) // 200MB
-    t.ok(memory.heapTotal < 400 * 1024 * 1024) // 200MB
+    t.ok(memory.rss < 500 * 1024 * 1024)
+    t.ok(memory.heapTotal < 500 * 1024 * 1024)
 
@@ -50,0 +50,0 @@ reply.send()

test/multipart-incomplete-upload.test.js

 'use strict'
 
-const util = require('node:util')
 const test = require('tap').test
@@ -9,2 +8,3 @@ const FormData = require('form-data')
 const http = require('node:http')
+const util = require('node:util')
 const sleep = util.promisify(setTimeout)
@@ -14,4 +14,6 @@ const { writableNoopStream } = require('noop-stream')
 const pipeline = util.promisify(stream.pipeline)
+const { once } = require('node:events')
+const fs = require('node:fs/promises')
 
-test('should finish with error on partial upload', async function (t) {
+test('should finish with error on partial upload - files api', async function (t) {
   t.plan(4)
@@ -65,1 +67,48 @@
 })
+
+test('should finish with error on partial upload - saveRequestFiles', async function (t) {
+  t.plan(3)
+
+  const fastify = Fastify()
+  t.teardown(fastify.close.bind(fastify))
+
+  await fastify.register(multipart)
+
+  let tmpUploads
+  fastify.post('/', async function (req) {
+    t.ok(req.isMultipart())
+    try {
+      await req.saveRequestFiles()
+    } finally {
+      tmpUploads = req.tmpUploads
+    }
+  })
+
+  await fastify.listen({ port: 0 })
+  const dataSize = 1024 * 1024 * 1024
+
+  // request
+  const form = new FormData()
+  form.append('upload', Buffer.alloc(dataSize))
+  const opts = {
+    protocol: 'http:',
+    hostname: 'localhost',
+    port: fastify.server.address().port,
+    path: '/',
+    headers: form.getHeaders(),
+    method: 'POST'
+  }
+
+  const req = http.request(opts)
+  const data = form.getBuffer()
+  req.write(data.slice(0, dataSize / 4))
+  req.write(data.slice(dataSize / 4, dataSize / 2))
+  req.end()
+
+  const [res] = await once(req, 'response')
+  t.equal(res.statusCode, 500)
+
+  for (const tmpUpload of tmpUploads) {
+    await t.rejects(fs.access(tmpUpload))
+  }
+})

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

157728

0.76%

Lines of code

4518

0.92%

Number of medium supply chain risk alerts

0

-100%

Dependency changes

• + Added

  @fastify/busboy@3.2.0
  (transitive)

• + Added

  @fastify/deepmerge@2.0.2
  (transitive)

• + Added

  @fastify/error@4.2.0
  (transitive)

• - Removed

  @fastify/busboy@2.1.1
  (transitive)

• - Removed

  @fastify/deepmerge@1.3.0
  (transitive)

• - Removed

  @fastify/error@3.4.1
  (transitive)

• Updated

  @fastify/busboy@^3.0.0

• Updated

  @fastify/deepmerge@^2.0.0

• Updated

  @fastify/error@^4.0.0