fix: precompile x-forwarded-host regexp (#1203)

Signed-off-by: ferhat elmas <elmas.ferhat@gmail.com>

Author: ferhatelmas

src/http/plugins/tenant-id.ts

@@ -1,3 +1,4 @@
+import { getXForwardedHostRegExp } from '@internal/http/x-forwarded-host'
 import fastifyPlugin from 'fastify-plugin'
 import { getConfig } from '../../config'
 
@@ -7,13 +8,15 @@ declare module 'fastify' {
   }
 }
 
-const { isMultitenant, tenantId: defaultTenantId, requestXForwardedHostRegExp } = getConfig()
+const { isMultitenant, tenantId: defaultTenantId } = getConfig()
+
+const xForwardedHostRegExp = getXForwardedHostRegExp()
 
 export const tenantId = fastifyPlugin(
   async (fastify) => {
     fastify.decorateRequest('tenantId', defaultTenantId)
     fastify.addHook('onRequest', (request, _reply, done) => {
-      if (!isMultitenant || !requestXForwardedHostRegExp) {
+      if (!isMultitenant || !xForwardedHostRegExp) {
         done()
         return
       }
@@ -24,7 +27,7 @@ export const tenantId = fastifyPlugin(
         return
       }
 
-      const result = xForwardedHost.match(requestXForwardedHostRegExp)
+      const result = xForwardedHost.match(xForwardedHostRegExp)
       if (!result) {
         done()
         return

src/internal/database/client.ts

@@ -1,10 +1,13 @@
 import { Cluster } from '@internal/cluster'
 import { ERRORS } from '@internal/errors'
+import { getXForwardedHostRegExp } from '@internal/http/x-forwarded-host'
 import { getConfig } from '../../config'
 import { PgTenantConnection } from './pg-connection'
 import { User } from './pool'
 import { getTenantConfig } from './tenant'
 
+const xForwardedHostRegExp = getXForwardedHostRegExp()
+
 interface ConnectionOptions {
   host: string
   tenantId: string
@@ -38,13 +41,7 @@ async function getDbSettings(
   host: string | undefined,
   options?: { disableHostCheck?: boolean }
 ) {
-  const {
-    isMultitenant,
-    databasePoolURL,
-    databaseURL,
-    databaseMaxConnections,
-    requestXForwardedHostRegExp,
-  } = getConfig()
+  const { isMultitenant, databasePoolURL, databaseURL, databaseMaxConnections } = getConfig()
 
   let dbUrl = databasePoolURL || databaseURL
   let maxConnections = databaseMaxConnections
@@ -55,16 +52,18 @@ async function getDbSettings(
       throw ERRORS.InvalidTenantId()
     }
 
-    if (requestXForwardedHostRegExp && !options?.disableHostCheck) {
-      const xForwardedHost = host
+    if (!options?.disableHostCheck) {
+      if (xForwardedHostRegExp) {
+        const xForwardedHost = host
 
-      if (typeof xForwardedHost !== 'string') {
-        throw ERRORS.InvalidXForwardedHeader('X-Forwarded-Host header is not a string')
-      }
-      if (!new RegExp(requestXForwardedHostRegExp).test(xForwardedHost)) {
-        throw ERRORS.InvalidXForwardedHeader(
-          'X-Forwarded-Host header does not match regular expression'
-        )
+        if (typeof xForwardedHost !== 'string') {
+          throw ERRORS.InvalidXForwardedHeader('X-Forwarded-Host header is not a string')
+        }
+        if (!xForwardedHostRegExp.test(xForwardedHost)) {
+          throw ERRORS.InvalidXForwardedHeader(
+            'X-Forwarded-Host header does not match regular expression'
+          )
+        }
       }
     }
 

src/internal/http/index.ts

@@ -1,2 +1,3 @@
 export * from './agent'
 export * from './header'
+export * from './x-forwarded-host'

src/internal/http/x-forwarded-host.test.ts

@@ -0,0 +1,107 @@
+const xForwardedHostEnvKeys = [
+  'MULTI_TENANT',
+  'IS_MULTITENANT',
+  'REQUEST_X_FORWARDED_HOST_REGEXP',
+  'X_FORWARDED_HOST_REGEXP',
+] as const
+
+const originalEnv = Object.fromEntries(
+  xForwardedHostEnvKeys.map((key) => [key, process.env[key]])
+) as Record<(typeof xForwardedHostEnvKeys)[number], string | undefined>
+
+async function loadXForwardedHostRegExp({
+  isMultitenant,
+  pattern,
+}: {
+  isMultitenant: boolean
+  pattern?: string
+}) {
+  vi.resetModules()
+
+  process.env.MULTI_TENANT = isMultitenant ? 'true' : 'false'
+  process.env.IS_MULTITENANT = isMultitenant ? 'true' : 'false'
+  process.env.X_FORWARDED_HOST_REGEXP = ''
+
+  if (pattern === undefined) {
+    process.env.REQUEST_X_FORWARDED_HOST_REGEXP = ''
+  } else {
+    process.env.REQUEST_X_FORWARDED_HOST_REGEXP = pattern
+  }
+
+  return await import('./x-forwarded-host')
+}
+
+function restoreXForwardedHostEnv() {
+  for (const key of xForwardedHostEnvKeys) {
+    const value = originalEnv[key]
+    if (value === undefined) {
+      delete process.env[key]
+    } else {
+      process.env[key] = value
+    }
+  }
+}
+
+afterEach(() => {
+  restoreXForwardedHostEnv()
+  vi.resetModules()
+})
+
+describe('getXForwardedHostRegExp', () => {
+  it('skips compiling the host pattern when multitenancy is disabled', async () => {
+    const { getXForwardedHostRegExp } = await loadXForwardedHostRegExp({
+      isMultitenant: false,
+      pattern: '[',
+    })
+
+    expect(getXForwardedHostRegExp()).toBeUndefined()
+  })
+
+  it('returns undefined when no host pattern is configured', async () => {
+    const { getXForwardedHostRegExp } = await loadXForwardedHostRegExp({
+      isMultitenant: true,
+    })
+
+    expect(getXForwardedHostRegExp()).toBeUndefined()
+  })
+
+  it('reuses the compiled regexp from startup config', async () => {
+    const { getXForwardedHostRegExp } = await loadXForwardedHostRegExp({
+      isMultitenant: true,
+      pattern: '^([a-z]+)\\.local$',
+    })
+
+    const first = getXForwardedHostRegExp()
+    const second = getXForwardedHostRegExp()
+
+    expect(second).toBe(first)
+    expect('tenant.local'.match(first!)).toBeTruthy()
+  })
+
+  it('does not recompile when config is reloaded after module load', async () => {
+    const { getXForwardedHostRegExp } = await loadXForwardedHostRegExp({
+      isMultitenant: true,
+      pattern: '^([a-z]+)\\.local$',
+    })
+    const previous = getXForwardedHostRegExp()
+
+    process.env.REQUEST_X_FORWARDED_HOST_REGEXP = '^([0-9]+)\\.local$'
+    const { getConfig } = await import('../../config')
+    getConfig({ reload: true })
+
+    const current = getXForwardedHostRegExp()
+
+    expect(current).toBe(previous)
+    expect('tenant.local'.match(current!)).toBeTruthy()
+    expect('123.local'.match(current!)).toBeFalsy()
+  })
+
+  it('throws while loading the helper when the configured pattern is invalid', async () => {
+    await expect(
+      loadXForwardedHostRegExp({
+        isMultitenant: true,
+        pattern: '[',
+      })
+    ).rejects.toThrow(SyntaxError)
+  })
+})

src/internal/http/x-forwarded-host.ts

@@ -0,0 +1,16 @@
+import { getConfig } from '../../config'
+
+const xForwardedHostRegExp = createXForwardedHostRegExp()
+
+function createXForwardedHostRegExp(): RegExp | undefined {
+  const { isMultitenant, requestXForwardedHostRegExp } = getConfig()
+  if (!isMultitenant || !requestXForwardedHostRegExp) {
+    return undefined
+  }
+
+  return new RegExp(requestXForwardedHostRegExp)
+}
+
+export function getXForwardedHostRegExp(): RegExp | undefined {
+  return xForwardedHostRegExp
+}

src/internal/monitoring/otel-tracing.ts

@@ -1,16 +1,18 @@
+import { getXForwardedHostRegExp } from '@internal/http/x-forwarded-host'
 import { getConfig } from '../../config'
 
 const {
   version,
   requestTraceHeader,
   isMultitenant,
-  requestXForwardedHostRegExp,
   tenantId: defaultTenantId,
   region,
   serviceName,
   storageS3InternalTracesEnabled,
 } = getConfig()
 
+const xForwardedHostRegExp = getXForwardedHostRegExp()
+
 import { FastifyOtelInstrumentation } from '@fastify/otel'
 import * as grpc from '@grpc/grpc-js'
 import { logger, logSchema } from '@internal/monitoring/logger'
@@ -154,11 +156,11 @@ if (tracingEnabled && traceExporter && spanProcessors.length > 0) {
         startIncomingSpanHook: (req) => {
           let tenantId = ''
           if (isMultitenant) {
-            if (requestXForwardedHostRegExp) {
+            if (xForwardedHostRegExp) {
               const serverRequest = req
               const xForwardedHost = serverRequest.headers['x-forwarded-host']
               if (typeof xForwardedHost !== 'string') return {}
-              const result = xForwardedHost.match(requestXForwardedHostRegExp)
+              const result = xForwardedHost.match(xForwardedHostRegExp)
               if (!result) return {}
               tenantId = result[1]
             }