30825450288

Committed 03 Aug 2026 03:00PM UTC coverage: 60.991% (-19.4%) from 80.366%

Build # 30825450288

Build Type

Pull #1293

github

Committed by

web-flow

Commit Message

Merge 838eef931 into 1e33d8708

Pull Request Pull Request #1293: fix: hardening for non-json object reply

Coverage Stats

3709 of 6900 branches covered (53.75%)

Branch coverage included in aggregate %.

22 of 32 new or added lines in 5 files covered. (68.75%)

2204 existing lines in 109 files now uncovered.

7686 of 11783 relevant lines covered (65.23%)

384.33 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

55.26

/src/http/plugins/header-validator.ts

import { ERRORS } from '@internal/errors'
import { hasInvalidHeaderValueChars } from '@internal/http/header'
import { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'
import fastifyPlugin from 'fastify-plugin'

interface HeaderValidatorOptions {
  excludeUrls?: Set<string>
}

/**
 * Validates response headers before they're sent to prevent ERR_INVALID_CHAR crashes.
 *
 * Node.js throws ERR_INVALID_CHAR during writeHead() if headers contain control characters.
 * This hook validates headers in onSend (before writeHead) and throws InvalidHeaderChar error
 */
export const headerValidator = (options: HeaderValidatorOptions = {}) =>
  fastifyPlugin(
    async function headerValidatorPlugin(fastify: FastifyInstance) {
      const excludeUrls = options.excludeUrls?.size ? options.excludeUrls : undefined

      fastify.addHook('onSend', (request: FastifyRequest, reply: FastifyReply, payload, done) => {
        if (excludeUrls?.has(request.url)) {
          done(null, payload)
          return
        }

        const headers = reply.getHeaders()
        for (const key in headers) {
          if (!Object.prototype.hasOwnProperty.call(headers, key)) {
            continue
          }
          const value = headers[key]
          if (typeof value === 'string') {
            if (hasInvalidHeaderValueChars(value)) {
              throw ERRORS.InvalidHeaderChar(key, value)
            }
          } else if (Array.isArray(value)) {
            for (let j = 0; j < value.length; j++) {
              const item = value[j]
              if (typeof item === 'string' && hasInvalidHeaderValueChars(item)) {
                throw ERRORS.InvalidHeaderChar(key, item)
              }
            }
          }
        }

        done(null, payload)
      })
    },
    { name: 'header-validator' }
  )

1	import { ERRORS } from '@internal/errors'
2	import { hasInvalidHeaderValueChars } from '@internal/http/header'
3	import { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'
4	import fastifyPlugin from 'fastify-plugin'
5
6	interface HeaderValidatorOptions {
7	excludeUrls?: Set<string>
8	}
9
10	/**
11	* Validates response headers before they're sent to prevent ERR_INVALID_CHAR crashes.
12	*
13	* Node.js throws ERR_INVALID_CHAR during writeHead() if headers contain control characters.
14	* This hook validates headers in onSend (before writeHead) and throws InvalidHeaderChar error
15	*/
16	export const headerValidator = (options: HeaderValidatorOptions = {}) =>	29✔
17	fastifyPlugin(	294✔
18	async function headerValidatorPlugin(fastify: FastifyInstance) {
19	const excludeUrls = options.excludeUrls?.size ? options.excludeUrls : undefined	294!
20
21	fastify.addHook('onSend', (request: FastifyRequest, reply: FastifyReply, payload, done) => {	294✔
22	if (excludeUrls?.has(request.url)) {	1,372!
23	done(null, payload)	×
24	return	×
25	}
26
27	const headers = reply.getHeaders()	1,372✔
28	for (const key in headers) {	1,372✔
29	if (!Object.prototype.hasOwnProperty.call(headers, key)) {	1,592!
30	continue	×
31	}
32	const value = headers[key]	1,592✔
33	if (typeof value === 'string') {	1,592✔
34	if (hasInvalidHeaderValueChars(value)) {	1,552!
UNCOV 35	throw ERRORS.InvalidHeaderChar(key, value)	×
36	}
37	} else if (Array.isArray(value)) {	40!
UNCOV 38	for (let j = 0; j < value.length; j++) {	×
UNCOV 39	const item = value[j]	×
UNCOV 40	if (typeof item === 'string' && hasInvalidHeaderValueChars(item)) {	×
UNCOV 41	throw ERRORS.InvalidHeaderChar(key, item)	×
42	}
43	}
44	}
45	}
46
47	done(null, payload)	1,372✔
48	})
49	},
50	{ name: 'header-validator' }
51	)

supabase / storage / 30825450288

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous