Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
formidable
Advanced tools
(DEPRECATED! Install formidable@v2) A node.js module for parsing form data, especially file uploads.
The formidable npm package is a Node.js module for parsing form data, especially file uploads. It can handle multipart/form-data, which is used for uploading files through forms.
File Upload
This code creates an HTTP server that listens for POST requests on the '/upload' path. It uses formidable to parse the incoming form data and handle file uploads.
const formidable = require('formidable');
const http = require('http');
http.createServer((req, res) => {
if (req.url === '/upload' && req.method.toLowerCase() === 'post') {
const form = new formidable.IncomingForm();
form.parse(req, (err, fields, files) => {
if (err) {
res.writeHead(500, { 'content-type': 'text/plain' });
res.end('Error parsing the files');
return;
}
res.writeHead(200, { 'content-type': 'text/plain' });
res.write('Files uploaded successfully:\n');
res.end(JSON.stringify(files, null, 2));
});
}
}).listen(8080);
Form Field Parsing
This code snippet demonstrates how to use formidable to parse regular form fields (text inputs, selects, etc.) in addition to file uploads.
const formidable = require('formidable');
const http = require('http');
http.createServer((req, res) => {
if (req.url === '/submit' && req.method.toLowerCase() === 'post') {
const form = new formidable.IncomingForm();
form.parse(req, (err, fields, files) => {
if (err) {
res.writeHead(500, { 'content-type': 'text/plain' });
res.end('Error parsing the form fields');
return;
}
res.writeHead(200, { 'content-type': 'text/plain' });
res.write('Form fields submitted:\n');
res.end(JSON.stringify(fields, null, 2));
});
}
}).listen(8080);
File Upload Progress
This example shows how to track the progress of a file upload using formidable's 'progress' event, which provides the bytes received and the total bytes expected.
const formidable = require('formidable');
const http = require('http');
http.createServer((req, res) => {
if (req.url === '/upload' && req.method.toLowerCase() === 'post') {
const form = new formidable.IncomingForm();
form.on('progress', (bytesReceived, bytesExpected) => {
console.log(`Progress: ${bytesReceived}/${bytesExpected}`);
});
form.parse(req, (err, fields, files) => {
// Handle file upload and response
});
}
}).listen(8080);
Multer is another popular Node.js middleware for handling multipart/form-data, which is primarily used for uploading files. It is built on top of busboy for maximum efficiency. Unlike formidable, multer is specifically designed for use with Express applications and includes more options for file storage and manipulation.
Busboy is a low-level Node.js module for parsing multipart/form-data request bodies. Formidable is actually built on top of busboy. Busboy is faster and more efficient but requires more setup and manual handling compared to formidable, which provides a higher-level API.
Multiparty is a Node.js module for parsing multipart/form-data requests. It is similar to formidable in terms of functionality but has a different API and is known for being more memory efficient, as it streams files to disk instead of buffering them in memory.
A Node.js module for parsing form data, especially file uploads.
For more info, check the CHANGELOG on the master branch.
All v1
versions are deprecated in NPM for over 2 years. You can find it at formidable@v1
or formidable@legacy
on NPM, and on v1-legacy branch on GitHub.
We highly recommend to use v2
or v3
. Both are already in use by many, especially v2
which was on formidable@canary
for 2 years.
formidable@v2
and if still have the problem - report!latest
The v2
will be simultaneously on two places for some time - formidable@latest
and formidable@v2
.
The source code be available only on v2 branch.
If you want to use v2, it's recommended to use the v2 dist-tag formidable@v2
.
Main Differences from v1:
We recommend to use formidable@v3
, as it uses more modern Node.js Streams, has support for Promises and more stuff.
You can see more info and track some ideas on issue#635.
formidable@latest
after some time.If you have any how-to kind of questions, please read the Contributing
Guide and Code of Conduct
documents.
For bugs reports and feature requests, please create an
issue or ping @tunnckoCore
at Twitter.
This project is semantically versioned and available as part of the Tidelift Subscription for professional grade assurances, enhanced support and security. Learn more.
The maintainers of formidable
and thousands of other packages are working
with Tidelift to deliver commercial support and maintenance for the Open Source
dependencies you use to build your applications. Save time, reduce risk, and
improve code health, while paying the maintainers of the exact dependencies you
use.
This module was initially developed by @felixge for Transloadit, a service focused on uploading and encoding images and videos. It has been battle-tested against hundreds of GBs of file uploads from a large variety of clients and is considered production-ready and is used in production for years.
Currently, we are few maintainers trying to deal with it. :) More contributors are always welcome! :heart: Jump on issue #412 which is closed, but if you are interested we can discuss it and add you after strict rules, like enabling Two-Factor Auth in your npm and GitHub accounts.
npm install formidable@v1
npm install formidable@v2
npm install formidable@v3
This is a low-level package, and if you're using a high-level framework it may already be included. However, Express v4 does not include any multipart handling, nor does body-parser.
Note: Formidable requires gently to run the unit tests, but you won't need it for just using the library.
Parse an incoming file upload.
var formidable = require('formidable'),
http = require('http'),
util = require('util');
http.createServer(function(req, res) {
if (req.url == '/upload' && req.method.toLowerCase() == 'post') {
// parse a file upload
var form = new formidable.IncomingForm();
form.parse(req, function(err, fields, files) {
res.writeHead(200, {'content-type': 'text/plain'});
res.write('received upload:\n\n');
res.end(util.inspect({fields: fields, files: files}));
});
return;
}
// show a file upload form
res.writeHead(200, {'content-type': 'text/html'});
res.end(
'<form action="/upload" enctype="multipart/form-data" method="post">'+
'<input type="text" name="title"><br>'+
'<input type="file" name="upload" multiple="multiple"><br>'+
'<input type="submit" value="Upload">'+
'</form>'
);
}).listen(8080);
var form = new formidable.IncomingForm()
Creates a new incoming form.
form.encoding = 'utf-8';
Sets encoding for incoming form fields.
form.uploadDir = "/my/dir";
Sets the directory for placing file uploads in. You can move them later on using
fs.rename()
. The default is os.tmpdir()
.
form.keepExtensions = false;
If you want the files written to form.uploadDir
to include the extensions of the original files, set this property to true
.
form.type
Either 'multipart' or 'urlencoded' depending on the incoming request.
form.maxFieldsSize = 20 * 1024 * 1024;
Limits the amount of memory all fields together (except files) can allocate in bytes.
If this value is exceeded, an 'error'
event is emitted. The default
size is 20MB.
form.maxFileSize = 200 * 1024 * 1024;
Limits the size of uploaded file.
If this value is exceeded, an 'error'
event is emitted. The default
size is 200MB.
form.maxFields = 1000;
Limits the number of fields that the querystring parser will decode. Defaults to 1000 (0 for unlimited).
form.hash = false;
If you want checksums calculated for incoming files, set this to either 'sha1'
or 'md5'
.
form.multiples = false;
If this option is enabled, when you call form.parse
, the files
argument will contain arrays of files for inputs which submit multiple files using the HTML5 multiple
attribute.
form.bytesReceived
The amount of bytes received for this form so far.
form.bytesExpected
The expected number of bytes in this form.
form.parse(request, [cb]);
Parses an incoming node.js request
containing form data. If cb
is provided, all fields and files are collected and passed to the callback:
form.parse(req, function(err, fields, files) {
// ...
});
form.onPart(part);
You may overwrite this method if you are interested in directly accessing the multipart stream. Doing so will disable any 'field'
/ 'file'
events processing which would occur otherwise, making you fully responsible for handling the processing.
form.onPart = function(part) {
part.addListener('data', function() {
// ...
});
}
If you want to use formidable to only handle certain parts for you, you can do so:
form.onPart = function(part) {
if (!part.filename) {
// let formidable handle all non-file parts
form.handlePart(part);
}
}
Check the code in this method for further inspiration.
file.size = 0
The size of the uploaded file in bytes. If the file is still being uploaded (see 'fileBegin'
event), this property says how many bytes of the file have been written to disk yet.
file.path = null
The path this file is being written to. You can modify this in the 'fileBegin'
event in
case you are unhappy with the way formidable generates a temporary path for your files.
file.name = null
The name this file had according to the uploading client.
file.type = null
The mime type of this file, according to the uploading client.
file.lastModifiedDate = null
A date object (or null
) containing the time this file was last written to. Mostly
here for compatibility with the W3C File API Draft.
file.hash = null
If hash calculation was set, you can read the hex digest out of this var.
This method returns a JSON-representation of the file, allowing you to
JSON.stringify()
the file which is useful for logging and responding
to requests.
Emitted after each incoming chunk of data that has been parsed. Can be used to roll your own progress bar.
form.on('progress', function(bytesReceived, bytesExpected) {
});
Emitted whenever a field / value pair has been received.
form.on('field', function(name, value) {
});
Emitted whenever a new file is detected in the upload stream. Use this event if you want to stream the file to somewhere else while buffering the upload on the file system.
form.on('fileBegin', function(name, file) {
});
Emitted whenever a field / file pair has been received. file
is an instance of File
.
form.on('file', function(name, file) {
});
Emitted when there is an error processing the incoming form. A request that experiences an error is automatically paused, you will have to manually call request.resume()
if you want the request to continue firing 'data'
events.
form.on('error', function(err) {
});
Emitted when the request was aborted by the user. Right now this can be due to a 'timeout' or 'close' event on the socket. After this event is emitted, an error
event will follow. In the future there will be a separate 'timeout' event (needs a change in the node core).
form.on('aborted', function() {
});
form.on('end', function() {
});
Emitted when the entire request has been received, and all contained files have finished flushing to disk. This is a great place for you to send your response.
multipart_parser.js
.From Felix blog post:
If the documentation is unclear or has a typo, please click on the page's Edit
button (pencil icon) and suggest a correction. If you would like to help us fix
a bug or add a new feature, please check our Contributing
Guide. Pull requests are welcome!
Formidable is licensed under the MIT License.
FAQs
A node.js module for parsing form data, especially file uploads.
The npm package formidable receives a total of 9,331,096 weekly downloads. As such, formidable popularity was classified as popular.
We found that formidable demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.