Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,9 @@ Creates a new form. Options:
* `maxFilesSize` - Only relevant when `autoFiles` is `true`. Limits the
total bytes accepted for all files combined. If this value is exceeded,
an `error` event is emitted. The default is `Infinity`.
* `maxHeaderSize` - Limits the size of header names and values for each part.
If this value is exceeded, an `error` event is emitted. The default size is
16KB.
* `autoFields` - Enables `field` events and disables `part` events for fields.
This is automatically set to `true` if you add a `field` listener.
* `autoFiles` - Enables `file` events and disables `part` events for files.
Expand Down
10 changes: 5 additions & 5 deletions index.js
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ function Form(options) {
self.maxFields = opts.maxFields || 1000
self.maxFieldsSize = opts.maxFieldsSize || 2 * 1024 * 1024
self.maxFilesSize = opts.maxFilesSize || Infinity
self.maxHeadersSize = opts.maxHeadersSize || 16 * 1024
self.maxHeaderSize = opts.maxHeaderSize || 16 * 1024
self.uploadDir = opts.uploadDir || os.tmpdir()
self.encoding = opts.encoding || 'utf8'

Expand Down Expand Up @@ -462,17 +462,17 @@ Form.prototype.onParsePartBegin = function() {

Form.prototype.onParseHeaderField = function(b) {
this.partHeadersSize += b.length;
if (this.partHeadersSize > this.maxHeadersSize) {
this.handleError(createError(413, 'maxHeadersSize ' + this.maxHeadersSize + ' exceeded'));
if (this.partHeadersSize > this.maxHeaderSize) {
this.handleError(createError(413, 'maxHeaderSize ' + this.maxHeaderSize + ' exceeded'));
return;
}
this.headerField += this.headerFieldDecoder.write(b);
}

Form.prototype.onParseHeaderValue = function(b) {
this.partHeadersSize += b.length;
if (this.partHeadersSize > this.maxHeadersSize) {
this.handleError(createError(413, 'maxHeadersSize ' + this.maxHeadersSize + ' exceeded'));
if (this.partHeadersSize > this.maxHeaderSize) {
this.handleError(createError(413, 'maxHeaderSize ' + this.maxHeaderSize + ' exceeded'));
return;
}
this.headerValue += this.headerValueDecoder.write(b);
Expand Down
20 changes: 10 additions & 10 deletions test/test.js
Original file line number Diff line number Diff line change
Expand Up @@ -601,7 +601,7 @@ var standaloneTests = [
},
{
// @see https://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh
name: 'maxHeadersSize error via header value',
name: 'maxHeaderSize error via header value',
fn: function(cb) {
var client;
var partEmitted = false;
Expand All @@ -612,20 +612,20 @@ var standaloneTests = [
'v\r\n' +
'------x--\r\n';
var server = http.createServer(function (req) {
var form = new multiparty.Form({ maxHeadersSize: 32 });
var form = new multiparty.Form({ maxHeaderSize: 32 });
form.on('part', function (part) { partEmitted = true; part.resume(); });
form.on('error', function (err) {
try {
assert.ok(/maxHeadersSize/.test(err.message));
assert.ok(/maxHeaderSize/.test(err.message));
assert.strictEqual(err.status, 413);
} catch (e) { return finish(e); }
// a correct fix must not process a part after the limit error
setImmediate(function () {
finish(partEmitted ? new Error('part emitted after maxHeadersSize error') : null);
finish(partEmitted ? new Error('part emitted after maxHeaderSize error') : null);
});
});
form.on('close', function () {
finish(new Error('expected maxHeadersSize error, got close'));
finish(new Error('expected maxHeaderSize error, got close'));
});
form.parse(req);
});
Expand All @@ -648,7 +648,7 @@ var standaloneTests = [
},
{
// @see https://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh
name: 'maxHeadersSize error via header field name',
name: 'maxHeaderSize error via header field name',
fn: function(cb) {
var client;
var partEmitted = false;
Expand All @@ -660,20 +660,20 @@ var standaloneTests = [
'v\r\n' +
'------x--\r\n';
var server = http.createServer(function (req) {
var form = new multiparty.Form({ maxHeadersSize: 32 });
var form = new multiparty.Form({ maxHeaderSize: 32 });
form.on('part', function (part) { partEmitted = true; part.resume(); });
form.on('error', function (err) {
try {
assert.ok(/maxHeadersSize/.test(err.message));
assert.ok(/maxHeaderSize/.test(err.message));
assert.strictEqual(err.status, 413);
} catch (e) { return finish(e); }
// a correct fix must not process a part after the limit error
setImmediate(function () {
finish(partEmitted ? new Error('part emitted after maxHeadersSize error') : null);
finish(partEmitted ? new Error('part emitted after maxHeaderSize error') : null);
});
});
form.on('close', function () {
finish(new Error('expected maxHeadersSize error, got close'));
finish(new Error('expected maxHeaderSize error, got close'));
});
form.parse(req);
});
Expand Down
Loading