refactor(stringifyFormData): respond with 400 with invalid multipart data

Author: chimurai

src/errors.ts

@@ -4,3 +4,23 @@ export enum ERRORS {
   ERR_CONTEXT_MATCHER_INVALID_ARRAY = '[HPM] Invalid pathFilter. Plain paths (e.g. "/api") can not be mixed with globs (e.g. "/api/**"). Expecting something like: ["/api", "/ajax"] or ["/api/**", "!**.html"].',
   ERR_PATH_REWRITER_CONFIG = '[HPM] Invalid pathRewrite config. Expecting object with pathRewrite config or a rewrite function',
 }
+
+export class HttpProxyMiddlewareError extends Error {
+  code: string;
+
+  constructor(message: string, code: string) {
+    super(message);
+
+    // add custom `code` property
+    // so this can be used in src/plugins/default/error-response-plugin.ts to determine the status code to return
+    this.code = code;
+
+    // set the correct name for the error class
+    this.name = this.constructor.name;
+
+    // maintain proper stack trace (V8 environments)
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, this.constructor);
+    }
+  }
+}

src/handlers/fix-request-body-utils/stringify-form-data.ts

@@ -1,4 +1,7 @@
+import { HttpProxyMiddlewareError } from '../../errors.js';
+
 const CR_OR_LF = /[\r\n]/;
+const ERROR_CODE_PREFIX = 'HPM_ERR_INVALID_MULTIPART';
 
 /**
  * stringify FormData data
@@ -30,8 +33,9 @@ function getMultipartBoundary(contentType: string): string {
   const boundary = (boundaryMatch?.[1] ?? boundaryMatch?.[2] ?? contentType).trim();
 
   if (!boundary || CR_OR_LF.test(boundary)) {
-    throw new Error(
-      '[HPM] unsafe multipart boundary detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+    throw new HttpProxyMiddlewareError(
+      '[HPM] invalid multipart boundary detected.',
+      `${ERROR_CODE_PREFIX}_BOUNDARY`,
     );
   }
 
@@ -42,14 +46,16 @@ function validateMultipartField(fieldName: string, fieldValue: string, boundary:
   const boundaryDelimiter = `--${boundary}`;
 
   if (CR_OR_LF.test(fieldName)) {
-    throw new Error(
-      `[HPM] unsafe multipart field name "${fieldName}" detected. Request rejected per RFC 9112 obsolete line folding guidance.`,
+    throw new HttpProxyMiddlewareError(
+      `[HPM] invalid multipart field name "${fieldName}" detected.`,
+      `${ERROR_CODE_PREFIX}_FIELD_NAME`,
     );
   }
 
   if (CR_OR_LF.test(fieldValue) || fieldValue.includes(boundaryDelimiter)) {
-    throw new Error(
-      `[HPM] unsafe multipart field value for "${fieldName}" detected. Request rejected per RFC 9112 obsolete line folding guidance.`,
+    throw new HttpProxyMiddlewareError(
+      `[HPM] invalid multipart field value for "${fieldName}" detected.`,
+      `${ERROR_CODE_PREFIX}_FIELD_VALUE`,
     );
   }
 }

src/status-code.ts

@@ -3,18 +3,24 @@ export function getStatusCode(errorCode: string): number {
 
   if (/HPE_INVALID/.test(errorCode)) {
     statusCode = 502;
-  } else {
-    switch (errorCode) {
-      case 'ECONNRESET':
-      case 'ENOTFOUND':
-      case 'ECONNREFUSED':
-      case 'ETIMEDOUT':
-        statusCode = 504;
-        break;
-      default:
-        statusCode = 500;
-        break;
-    }
+    return statusCode;
+  }
+
+  if (/HPM_ERR_INVALID_MULTIPART_/.test(errorCode)) {
+    statusCode = 400;
+    return statusCode;
+  }
+
+  switch (errorCode) {
+    case 'ECONNRESET':
+    case 'ENOTFOUND':
+    case 'ECONNREFUSED':
+    case 'ETIMEDOUT':
+      statusCode = 504;
+      break;
+    default:
+      statusCode = 500;
+      break;
   }
 
   return statusCode;

test/e2e/http-proxy-middleware.spec.ts

@@ -167,7 +167,7 @@ describe('E2E http-proxy-middleware', () => {
           .post('/api')
           .set('Content-Type', 'application/x-www-form-urlencoded')
           .send(`user=${encodeURIComponent(injectedValue)}`)
-          .expect(500);
+          .expect(400);
 
         expect(response.text).toContain('Error occurred while trying to proxy');
         expect(targetSpy).toHaveBeenCalledTimes(0);

test/unit/fix-request-body-utils/stringify-form-data.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
+import { HttpProxyMiddlewareError } from '../../../src/errors.js';
 import { stringifyFormData } from '../../../src/handlers/fix-request-body-utils/stringify-form-data.js';
 
 describe('stringifyFormData', () => {
@@ -77,31 +78,43 @@ describe('stringifyFormData', () => {
           user: 'alice',
         }),
       ).toThrow(
-        '[HPM] unsafe multipart boundary detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart boundary detected.',
+          'HPM_ERR_INVALID_MULTIPART_BOUNDARY',
+        ),
       );
     });
 
     it('should reject unsafe multipart boundary containing CR only', () => {
       expect(() =>
         stringifyFormData('multipart/form-data; boundary="BB\rX"', { user: 'alice' }),
       ).toThrow(
-        '[HPM] unsafe multipart boundary detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart boundary detected.',
+          'HPM_ERR_INVALID_MULTIPART_BOUNDARY',
+        ),
       );
     });
 
     it('should reject unsafe multipart boundary containing LF only', () => {
       expect(() =>
         stringifyFormData('multipart/form-data; boundary="BB\nX"', { user: 'alice' }),
       ).toThrow(
-        '[HPM] unsafe multipart boundary detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart boundary detected.',
+          'HPM_ERR_INVALID_MULTIPART_BOUNDARY',
+        ),
       );
     });
 
     it('should reject unsafe multipart boundary when empty after trimming', () => {
       expect(() =>
         stringifyFormData('multipart/form-data; boundary=   ', { user: 'alice' }),
       ).toThrow(
-        '[HPM] unsafe multipart boundary detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart boundary detected.',
+          'HPM_ERR_INVALID_MULTIPART_BOUNDARY',
+        ),
       );
     });
 
@@ -111,7 +124,10 @@ describe('stringifyFormData', () => {
           'bad\nname': 'alice',
         }),
       ).toThrow(
-        '[HPM] unsafe multipart field name "bad\nname" detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart field name "bad\nname" detected.',
+          'HPM_ERR_INVALID_MULTIPART_FIELD_NAME',
+        ),
       );
     });
 
@@ -121,7 +137,10 @@ describe('stringifyFormData', () => {
           'bad\rname': 'alice',
         }),
       ).toThrow(
-        '[HPM] unsafe multipart field name "bad\rname" detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart field name "bad\rname" detected.',
+          'HPM_ERR_INVALID_MULTIPART_FIELD_NAME',
+        ),
       );
     });
 
@@ -131,7 +150,10 @@ describe('stringifyFormData', () => {
           user: 'alice\r\nadmin',
         }),
       ).toThrow(
-        '[HPM] unsafe multipart field value for "user" detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart field value for "user" detected.',
+          'HPM_ERR_INVALID_MULTIPART_FIELD_VALUE',
+        ),
       );
     });
 
@@ -141,7 +163,10 @@ describe('stringifyFormData', () => {
           user: 'alice\radmin',
         }),
       ).toThrow(
-        '[HPM] unsafe multipart field value for "user" detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart field value for "user" detected.',
+          'HPM_ERR_INVALID_MULTIPART_FIELD_VALUE',
+        ),
       );
     });
 
@@ -151,7 +176,10 @@ describe('stringifyFormData', () => {
           user: 'prefix --BB suffix',
         }),
       ).toThrow(
-        '[HPM] unsafe multipart field value for "user" detected. Request rejected per RFC 9112 obsolete line folding guidance.',
+        new HttpProxyMiddlewareError(
+          '[HPM] invalid multipart field value for "user" detected.',
+          'HPM_ERR_INVALID_MULTIPART_FIELD_VALUE',
+        ),
       );
     });
   });