hc-proxy - npm Package Compare versions

Comparing version 2.0.16 to 2.0.17-beta

index.js

@@ -226,3 +226,3 @@ 'use strict';
             let fileMid = multer({
-              storage: multer.memoryStorage(),
+              storage: multer.diskStorage({}),
               limits: {
@@ -229,0 +229,0 @@ fileSize: _.get(file, 'maxFileSize')

lib/service_client.js

 'use strict';
+const fs = require('fs');
 const qs = require('qs');
@@ -81,6 +82,22 @@ const url = require('url');
 
+    const isUploadFile = (u.file || (req.files && req.files.length)) && req.headers['content-type'].indexOf('multipart/form-data') !== -1;
+
+    /**
+     * 清除 multer 中缓存到 /tmp 下的文件
+     */
+    const cleanTmpFile = () => {
+      if(!isUploadFile) {
+        return;
+      }
+
+      Array.isArray(req.files) && req.files.forEach(f => {
+        const filepath = f.path;
+        fs.unlink(filepath, (e) => log.warn(`clean multer cache file failed: ${e && e.message}`));
+      });
+    }
+
     if (pipe) {
       options.headers = req.headers;
       options.stream = req;
-    } else if ((u.file || (req.files && req.files.length)) && req.headers['content-type'].indexOf('multipart/form-data') !== -1) {  // upload file
+    } else if (isUploadFile) {  // upload file
       const form = formstream();
@@ -105,3 +122,4 @@ const data = options.data || {};
       Array.isArray(req.files) && req.files.forEach(f => {
-        form.buffer(f.fieldname, f.buffer, f.originalname);
+        const filepath = f.path;
+        form.stream(f.fieldname, fs.createReadStream(filepath), f.originalname);
       });
@@ -120,2 +138,3 @@
     }
+
     Object.assign(options, u.urllibOption);
@@ -132,2 +151,4 @@ options.url = endpoint + qpath;
     });
+
+
     Object.assign(options, u.serviceOpt);
@@ -142,2 +163,5 @@ serviceClient.request(options.url, options, function (err, data, apiRes) {
       }
+
+      // 清理 multer tmp file
+      cleanTmpFile();
     });
@@ -144,0 +168,0 @@ }

lib/urllib.js

 'use strict';
 
+const fs = require('fs');
+const qs = require('qs');
+const url = require('url');
 const urllib = require('urllib');
+const formstream = require('formstream');
 const pathToRegexp = require('path-to-regexp');
-const qs = require('qs');
+
 const utils = require('./utils');
-const url = require('url');
-const formstream = require('formstream');
+
 const debug = require('debug')('hc-proxy');
@@ -52,4 +55,20 @@
 
+    const isUploadFile = u.file && req.files && req.files.length;
+
+    /**
+     * 清除 multer 中缓存到 /tmp 下的文件
+     */
+    const cleanTmpFile = () => {
+      if(!isUploadFile) {
+        return;
+      }
+
+      Array.isArray(req.files) && req.files.forEach(f => {
+        const filepath = f.path;
+        fs.unlink(filepath, (e) => log.warn(`clean multer cache file failed: ${e && e.message}`));
+      });
+    }
+
     // upload file
-    if (u.file && req.files && req.files.length) {
+    if (isUploadFile) {
       const form = formstream();
@@ -60,5 +79,8 @@ const data = options.data || {};
       });
+
       options.data = null;
       req.files.forEach(f => {
-        form.buffer(f.fieldname, f.buffer, f.originalname);
+        const path = f.path;
+
+        form.stream(f.fieldname, fs.createReadStream(path), f.originalname);
       });
@@ -92,4 +114,6 @@
       }
+
+      cleanTmpFile();
     });
   }
 }

package.json

 {
   "name": "hc-proxy",
-  "version": "2.0.16",
+  "version": "2.0.17-beta",
   "description": "honeycomb api proxy express middleware.",
@@ -5,0 +5,0 @@ "main": "index.js",

test/main.test.js

@@ -88,3 +88,4 @@ const errorProxy = require('./server/error_proxy');
         .attach('file', './test/main.test.js')
-        .expect(200).end(function (err, res) {
+        .expect(200)
+        .end(function (err, res) {
           assert(res.body[0].originalname === 'main.test.js');
@@ -100,3 +101,4 @@ done();
         .attach('file', './test/main.test.js')
-        .expect(500).end(function (err, res) {
+        .expect(500)
+        .end(function (err, res) {
           done();
@@ -103,0 +105,0 @@ });

test/server/http_server.js

@@ -19,2 +19,3 @@ 'use strict';
         });
+
         res.setHeader('Content-Type', 'application/json');
@@ -21,0 +22,0 @@ res.end(JSON.stringify(req.files, null, 2));

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

187643

0.57%

Lines of code

5089

0.69%

Worsened metrics

Number of low quality alerts

2

100%

Number of low supply chain risk alerts

4

100%

No dependency changes