restify - npm Package Compare versions

Comparing version 1.4.2 to 1.4.3

CHANGES.md

 # restify Changelog
 
-## 1.4.2 (not yet released)
+## 1.4.4 (not yet released)
 
+## 1.4.3
+
+- update dependencies to latest (notably dtrace-provider)
+- GH-158 res.charSet broken (Tamas Daniel)
+- GH-154 bodyParser work with PATCH (Domenic Denicola)
+- GH-153 bodyParser can reject or allow unknown content-types (Domenic Denicola)
+- GH-152 Send JSON on HttpError (Domenic Denicola)
+- GH-149 allow setting of max body size (and return 413) (Simon Sturmer)
+- GH-146 allow setting of route regex flags when path is not a RegExp
+- Support SSL CAs (Paul Bouzakis)
+- body parser should return 415 when content-type not known (Simon Sturmer)
+
+
+## 1.4.2
+
 - Add Route.realize( Domenic Denicola)
@@ -6,0 +21,0 @@ - defaultResponseHeaders setter was setting the wrong method (Harry Marr)

lib/errors/http_error.js

@@ -56,3 +56,3 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
   this.message = message || '';
-  this.body = body || message || '';
+  this.body = body || (message ? { message: message } : '');
   this.statusCode = this.httpCode = code;
@@ -59,0 +59,0 @@ }

lib/plugins/body_parser.js

@@ -7,3 +7,7 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
 
+var errors = require('../errors');
 
+var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError;
+
+
 function bodyParser(options) {
@@ -16,2 +20,5 @@
   return function parseBody(req, res, next) {
+    if (req.method !== 'POST' && req.method !== 'PUT' && req.method !== 'PATCH')
+      return next();
+
     if (req.contentLength === 0 && !req.chunked)
@@ -26,2 +33,5 @@ return next();
       return parseMultipart(req, res, next);
+    } else if (options.rejectUnknown !== false) {
+      return next(new UnsupportedMediaTypeError('Unsupported Content-Type: ' +
+                                                req.contentType));
     }
@@ -28,0 +38,0 @@

lib/plugins/form_body_parser.js

@@ -14,2 +14,3 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
 var InvalidContentError = errors.InvalidContentError;
+var RequestEntityTooLargeError = errors.RequestEntityTooLargeError;
 
@@ -45,6 +46,9 @@
 
+    var bytesReceived = 0, maxBodySize = options.maxBodySize || 0;
     req.body = '';
-    req.setEncoding('utf8');
     req.on('data', function (chunk) {
-      req.body += chunk;
+      bytesReceived += chunk.length;
+      if (maxBodySize && bytesReceived > maxBodySize)
+        return;
+      req.body += chunk.toString('utf8');
       if (hash)
@@ -57,2 +61,6 @@ hash.update(chunk);
     req.on('end', function () {
+      if (maxBodySize && bytesReceived > maxBodySize)
+        return next(new RequestEntityTooLargeError('Request body size exceeds '
+                                                   + maxBodySize));
+
       if (!req.body)
@@ -59,0 +67,0 @@ return next();

lib/plugins/json_body_parser.js

@@ -13,2 +13,3 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
 var InvalidContentError = errors.InvalidContentError;
+var RequestEntityTooLargeError = errors.RequestEntityTooLargeError;
 
@@ -44,6 +45,9 @@
 
+    var bytesReceived = 0, maxBodySize = options.maxBodySize || 0;
     req.body = '';
-    req.setEncoding('utf8');
     req.on('data', function (chunk) {
-      req.body += chunk;
+      bytesReceived += chunk.length;
+      if (maxBodySize && bytesReceived > maxBodySize)
+        return;
+      req.body += chunk.toString('utf8');
       if (hash)
@@ -56,2 +60,6 @@ hash.update(chunk);
     req.on('end', function () {
+      if (maxBodySize && bytesReceived > maxBodySize)
+        return next(new RequestEntityTooLargeError('Request body size exceeds '
+                                                   + maxBodySize));
+
       if (!req.body)
@@ -58,0 +66,0 @@ return next();

lib/response.js

@@ -347,4 +347,4 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
 
-  if (!this.header('Content-Type') && this.contentType) {
-    var type = this.contentType;
+  if (this.header('Content-Type') || this.contentType) {
+    var type = this.header('Content-Type') || this.contentType;
     if (this.charSet)
@@ -355,2 +355,3 @@ type += '; charset=' + this.charSet;
 
+
   var now = new Date();
@@ -357,0 +358,0 @@ if (!this.getHeader('Date'))

lib/route.js

@@ -179,3 +179,3 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
     self.pattern = '^';
-    self.flags = '';
+    self.flags = options.flags || '';
     self.params = [];
@@ -182,0 +182,0 @@ self._url.split('/').forEach(function (fragment) {

lib/server.js

@@ -138,6 +138,7 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
     secure = true;
-    this.server = https.createServer({
-      cert: options.certificate,
-      key: options.key
-    });
+    var httpsOptions = { cert: options.certificate, key: options.key };
+    if (options.ca)
+      httpsOptions.ca = options.ca;
+
+    this.server = https.createServer(httpsOptions);
   } else {
@@ -421,2 +422,3 @@ this.server = http.createServer();
     url: options.path || options.url,
+    flags: options.flags,
     handlers: chain,
@@ -423,0 +425,0 @@ name: options.name,

package.json

@@ -5,2 +5,3 @@ {
     "Dominic Barnes",
+    "Tamas Daniel",
     "Domenic Denicola",
@@ -18,2 +19,3 @@ "Paul Bouzakis",
     "Matt Smillie",
+    "Simon Sturmer",
     "Diego Torres",
@@ -25,3 +27,3 @@ "Mike Williams"
   "description": "REST framework",
-  "version": "1.4.2",
+  "version": "1.4.3",
   "repository": {
@@ -40,18 +42,18 @@ "type": "git",
   "dependencies": {
-    "async": "0.1.18",
-    "bunyan": "0.6.8",
+    "async": "0.1.22",
+    "bunyan": "0.8.0",
     "byline": "2.0.2",
-    "formidable": "1.0.9",
-    "dtrace-provider": "0.0.6",
+    "formidable": "1.0.11",
+    "dtrace-provider": "0.0.8",
     "http-signature": "0.9.9",
-    "lru-cache": "1.0.5",
+    "lru-cache": "1.1.0",
     "mime": "1.2.5",
     "node-uuid": "1.3.3",
-    "qs": "0.4.2",
+    "qs": "0.5.0",
     "retry": "0.6.0",
-    "semver": "1.0.13"
+    "semver": "1.0.14"
   },
   "devDependencies": {
     "filed": "0.0.6",
-    "tap": "0.2.4"
+    "tap": "0.2.5"
   },
@@ -58,0 +60,0 @@ "optionalDependencies": {

test/server.test.js

@@ -530,2 +530,28 @@ // Copyright 2012 Mark Cavage, Inc.  All rights reserved.
 
+test('path+flags ok', function (t) {
+  var server = restify.createServer({ dtrace: DTRACE, log: LOGGER });
+
+  server.get({path: '/foo', flags: 'i'}, function tester(req, res, next) {
+    res.send('hi there');
+    return next();
+  });
+
+  server.listen(PORT, function () {
+    var opts = {
+      hostname: 'localhost',
+      port: PORT,
+      path: '/FOO',
+      method: 'GET',
+      agent: false
+    };
+    http.request(opts, function (res) {
+      t.equal(res.statusCode, 200);
+      server.close(function () {
+        t.end();
+      });
+    }).end();
+  });
+});
+
+
 test('GH-56 streaming with filed (download)', function (t) {
@@ -1040,1 +1066,73 @@ var server = restify.createServer({ dtrace: DTRACE, log: LOGGER });
 //
+
+
+test('GH-149 limit request body size (form)', function (t) {
+  var server = restify.createServer();
+  server.use(restify.bodyParser({maxBodySize: 1024}));
+
+  server.post('/', function (req, res, next) {
+    res.send(200, {length: req.body.length});
+    return next();
+  });
+
+  server.listen(PORT, function () {
+    var opts = {
+      hostname: 'localhost',
+      port: PORT,
+      path: '/',
+      method: 'POST',
+      agent: false,
+      headers: {
+        'accept': 'application/json',
+        'content-type': 'application/x-www-form-urlencoded',
+        'transfer-encoding': 'chunked'
+      }
+    };
+    var req = http.request(opts, function (res) {
+      t.equal(res.statusCode, 413);
+      res.on('end', function () {
+        server.close(function () {
+          t.end();
+        });
+      });
+    });
+    req.write(new Array(1026).join('x'));
+    req.end();
+  });
+});
+
+
+test('GH-149 limit request body size (json)', function (t) {
+  var server = restify.createServer();
+  server.use(restify.bodyParser({maxBodySize: 1024}));
+
+  server.post('/', function (req, res, next) {
+    res.send(200, {length: req.body.length});
+    return next();
+  });
+
+  server.listen(PORT, function () {
+    var opts = {
+      hostname: 'localhost',
+      port: PORT,
+      path: '/',
+      method: 'POST',
+      agent: false,
+      headers: {
+        'accept': 'application/json',
+        'content-type': 'application/json',
+        'transfer-encoding': 'chunked'
+      }
+    };
+    var req = http.request(opts, function (res) {
+      t.equal(res.statusCode, 413);
+      res.on('end', function () {
+        server.close(function () {
+          t.end();
+        });
+      });
+    });
+    req.write('{"a":[' + new Array(512).join('1,') + '0]}');
+    req.end();
+  });
+});

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

169122

increased by1.6%

Lines of code

5089

increased by0.99%

Number of low supply chain risk alerts

8

decreased by-20%

Number of medium supply chain risk alerts

12

decreased by-7.69%

Worsened metrics

Number of package files

37

decreased by-2.63%

Dependency changes

• + Addedasync@0.1.22(transitive)

• + Addedbunyan@0.8.0(transitive)

• + Addeddtrace-provider@0.0.8(transitive)

• + Addedformidable@1.0.11(transitive)

• + Addedlru-cache@1.1.0(transitive)

• + Addedqs@0.5.0(transitive)

• + Addedsemver@1.0.14(transitive)

• - Removedasync@0.1.18(transitive)

• - Removedbunyan@0.6.8(transitive)

• - Removeddtrace-provider@0.0.6(transitive)

• - Removedformidable@1.0.9(transitive)

• - Removedlru-cache@1.0.5(transitive)

• - Removedqs@0.4.2(transitive)

• - Removedsemver@1.0.13(transitive)

• Updatedasync@0.1.22

• Updatedbunyan@0.8.0

• Updateddtrace-provider@0.0.8

• Updatedformidable@1.0.11

• Updatedlru-cache@1.1.0

• Updatedqs@0.5.0

• Updatedsemver@1.0.14