superagent - npm Package Compare versions

Comparing version 3.6.3 to 3.7.0

History.md

@@ -0,1 +1,7 @@
+# 3.7.0 (2017-10-17)
+
+ * Limit maximum response size. Prevents zip bombs (Kornel)
+ * Catch and pass along errors in `.ok()` callback (Jeremy Ruppel)
+ * Fixed parsing of XHR headers without a newline (nsf)
+
 # 3.6.2 (2017-10-02)
@@ -2,0 +8,0 @@

lib/client.js

@@ -223,7 +223,8 @@ /**
 
-  lines.pop(); // trailing CRLF
-
   for (var i = 0, len = lines.length; i < len; ++i) {
     line = lines[i];
     index = line.indexOf(':');
+    if (index === -1) { // could be empty line, just skip it
+      continue;
+    }
     field = line.slice(0, index).toLowerCase();
@@ -424,8 +425,5 @@ val = trim(line.slice(index + 1));
         new_err = new Error(res.statusText || 'Unsuccessful HTTP response');
-        new_err.original = err;
-        new_err.response = res;
-        new_err.status = res.status;
       }
-    } catch(e) {
-      new_err = e; // #985 touching res may cause INVALID_STATE_ERR on old Android
+    } catch(custom_err) {
+      new_err = custom_err; // ok() callback can throw
     }
@@ -435,2 +433,5 @@
     if (new_err) {
+      new_err.original = err;
+      new_err.response = res;
+      new_err.status = res.status;
       self.callback(new_err, res);
@@ -437,0 +438,0 @@ } else {

lib/is-object.js

@@ -0,1 +1,3 @@
+'use strict';
+
 /**
@@ -2,0 +4,0 @@ * Check if `obj` is an object.

lib/node/agent.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -2,0 +3,0 @@ /**

lib/node/index.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -678,12 +679,16 @@ /**
   if (!err) {
-    if (this._isResponseOK(res)) {
-      return fn(err, res);
-    }
+    try {
+      if (this._isResponseOK(res)) {
+        return fn(err, res);
+      }
 
-    var msg = 'Unsuccessful HTTP response';
-    if (res) {
-      msg = http.STATUS_CODES[res.status] || msg;
+      var msg = 'Unsuccessful HTTP response';
+      if (res) {
+        msg = http.STATUS_CODES[res.status] || msg;
+      }
+      err = new Error(msg);
+      err.status = res ? res.status : undefined;
+    } catch (new_err) {
+      err = new_err;
     }
-    err = new Error(msg);
-    err.status = res ? res.status : undefined;
   }
@@ -849,2 +854,20 @@
     var parserHandlesEnd = false;
+    if (buffer) {
+      // Protectiona against zip bombs and other nuisance
+      let responseBytesLeft = self._maxResponseSize || 200000000;
+      res.on('data', function(buf) {
+        responseBytesLeft -= buf.byteLength || buf.length;
+        if (responseBytesLeft < 0) {
+          // This will propagate through error event
+          const err = Error("Maximum response size reached");
+          err.code = "ETOOLARGE";
+          // Parsers aren't required to observe error event,
+          // so would incorrectly report success
+          parserHandlesEnd = false;
+          // Will emit error event
+          res.destroy(err);
+        }
+      });
+    }
+
     if (parser) {
@@ -895,2 +918,3 @@ try {
     res.once('error', function(err){
+      parserHandlesEnd = false;
       self.callback(err, null);
@@ -897,0 +921,0 @@ });

lib/node/parsers/image.js

@@ -0,1 +1,3 @@
+'use strict';
+
 module.exports = function(res, fn){
@@ -10,2 +12,2 @@ var data = []; // Binary data needs binary storage
   });
-};
+};

lib/node/parsers/index.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -2,0 +3,0 @@ exports['application/x-www-form-urlencoded'] = require('./urlencoded');

lib/node/parsers/json.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -2,0 +3,0 @@ module.exports = function parseJSON(res, fn){

lib/node/parsers/text.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -7,2 +8,2 @@ module.exports = function(res, fn){
   res.on('end', fn);
-};
+};

lib/node/parsers/urlencoded.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -19,2 +20,2 @@ /**
   });
-};
+};

lib/node/response.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -2,0 +3,0 @@ /**

lib/node/unzip.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -69,2 +70,2 @@ /**
   };
-};
+};

lib/request-base.js

@@ -0,1 +1,3 @@
+'use strict';
+
 /**
@@ -417,2 +419,17 @@ * Module of mixed-in functions shared between node and client code
 /**
+ * Maximum size of buffered response body, in bytes. Counts uncompressed size.
+ * Default 200MB.
+ *
+ * @param {Number} n
+ * @return {Request} for chaining
+ */
+RequestBase.prototype.maxResponseSize = function(n){
+  if ('number' !== typeof n) {
+    throw TypeError("Invalid argument");
+  }
+  this._maxResponseSize = n;
+  return this;
+};
+
+/**
  * Convert to a plain javascript object (not JSON string) of scalar properties.
@@ -419,0 +436,0 @@ * Note as this method is designed to return a useful non-this value,

lib/response-base.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -2,0 +3,0 @@ /**

lib/should-retry.js

@@ -0,1 +1,3 @@
+'use strict';
+
 var ERROR_CODES = [
@@ -2,0 +4,0 @@ 'ECONNRESET',

lib/utils.js

@@ -0,1 +1,2 @@
+'use strict';
 
@@ -68,2 +69,2 @@ /**
   return header;
-};
+};

package.json

 {
   "name": "superagent",
-  "version": "3.6.3",
+  "version": "3.7.0",
   "description": "elegant & feature rich browser / node HTTP with a fluent API",
@@ -5,0 +5,0 @@ "scripts": {

superagent.js

 (function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.superagent = f()}})(function(){var define,module,exports;return (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){
+'use strict';
+
 /**
@@ -17,2 +19,4 @@ * Check if `obj` is an object.
 },{}],2:[function(require,module,exports){
+'use strict';
+
 /**
@@ -434,2 +438,17 @@ * Module of mixed-in functions shared between node and client code
 /**
+ * Maximum size of buffered response body, in bytes. Counts uncompressed size.
+ * Default 200MB.
+ *
+ * @param {Number} n
+ * @return {Request} for chaining
+ */
+RequestBase.prototype.maxResponseSize = function(n){
+  if ('number' !== typeof n) {
+    throw TypeError("Invalid argument");
+  }
+  this._maxResponseSize = n;
+  return this;
+};
+
+/**
  * Convert to a plain javascript object (not JSON string) of scalar properties.
@@ -641,2 +660,3 @@ * Note as this method is designed to return a useful non-this value,
 },{"./is-object":1}],3:[function(require,module,exports){
+'use strict';
 
@@ -777,2 +797,4 @@ /**
 },{"./utils":5}],4:[function(require,module,exports){
+'use strict';
+
 var ERROR_CODES = [
@@ -803,2 +825,3 @@ 'ECONNRESET',
 },{}],5:[function(require,module,exports){
+'use strict';
 
@@ -872,2 +895,3 @@ /**
 };
+
 },{}],6:[function(require,module,exports){
@@ -1261,7 +1285,8 @@
 
-  lines.pop(); // trailing CRLF
-
   for (var i = 0, len = lines.length; i < len; ++i) {
     line = lines[i];
     index = line.indexOf(':');
+    if (index === -1) { // could be empty line, just skip it
+      continue;
+    }
     field = line.slice(0, index).toLowerCase();
@@ -1462,8 +1487,5 @@ val = trim(line.slice(index + 1));
         new_err = new Error(res.statusText || 'Unsuccessful HTTP response');
-        new_err.original = err;
-        new_err.response = res;
-        new_err.status = res.status;
       }
-    } catch(e) {
-      new_err = e; // #985 touching res may cause INVALID_STATE_ERR on old Android
+    } catch(custom_err) {
+      new_err = custom_err; // ok() callback can throw
     }
@@ -1473,2 +1495,5 @@
     if (new_err) {
+      new_err.original = err;
+      new_err.response = res;
+      new_err.status = res.status;
       self.callback(new_err, res);
@@ -1475,0 +1500,0 @@ } else {

No alert changes

Improved metrics

Total package byte prevSize

385383

increased by1.79%

Lines of code

4554

increased by1.74%

No dependency changes