2023-02-10 16:18:27 +00:00
|
|
|
import type { Context } from '../context.ts'
|
2023-08-21 06:22:37 +00:00
|
|
|
import { getCookie } from '../helper/cookie/index.ts'
|
2023-02-13 21:21:30 +00:00
|
|
|
import type { Env, ValidationTargets, MiddlewareHandler } from '../types.ts'
|
2023-09-03 05:43:01 +00:00
|
|
|
import type { BodyData } from '../utils/body.ts'
|
|
|
|
import { bufferToFormData } from '../utils/buffer.ts'
|
2022-12-28 02:25:48 +00:00
|
|
|
|
2023-02-13 21:21:30 +00:00
|
|
|
type ValidationTargetKeysWithBody = 'form' | 'json'
|
|
|
|
type ValidationTargetByMethod<M> = M extends 'get' | 'head' // GET and HEAD request must not have a body content.
|
|
|
|
? Exclude<keyof ValidationTargets, ValidationTargetKeysWithBody>
|
|
|
|
: keyof ValidationTargets
|
2023-01-03 00:09:04 +00:00
|
|
|
|
2023-03-15 13:20:50 +00:00
|
|
|
export type ValidationFunction<
|
|
|
|
InputType,
|
|
|
|
OutputType,
|
|
|
|
E extends Env = {},
|
|
|
|
P extends string = string
|
2023-08-07 12:26:53 +00:00
|
|
|
> = (
|
|
|
|
value: InputType,
|
|
|
|
c: Context<E, P>
|
|
|
|
) => OutputType | Response | Promise<OutputType> | Promise<Response>
|
2023-03-11 13:17:08 +00:00
|
|
|
|
2022-12-29 05:59:57 +00:00
|
|
|
export const validator = <
|
2023-03-11 13:17:08 +00:00
|
|
|
InputType,
|
2023-01-22 12:21:37 +00:00
|
|
|
P extends string,
|
|
|
|
M extends string,
|
2023-02-13 21:21:30 +00:00
|
|
|
U extends ValidationTargetByMethod<M>,
|
2023-03-11 13:17:08 +00:00
|
|
|
OutputType = ValidationTargets[U],
|
2023-03-15 13:20:50 +00:00
|
|
|
P2 extends string = P,
|
2023-03-11 13:17:08 +00:00
|
|
|
V extends {
|
|
|
|
in: { [K in U]: unknown extends InputType ? OutputType : InputType }
|
|
|
|
out: { [K in U]: OutputType }
|
|
|
|
} = {
|
|
|
|
in: { [K in U]: unknown extends InputType ? OutputType : InputType }
|
|
|
|
out: { [K in U]: OutputType }
|
|
|
|
},
|
2023-01-16 13:57:47 +00:00
|
|
|
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
|
|
|
E extends Env = any
|
2022-12-29 05:59:57 +00:00
|
|
|
>(
|
2023-02-13 21:21:30 +00:00
|
|
|
target: U,
|
2023-03-14 14:43:33 +00:00
|
|
|
validationFunc: ValidationFunction<
|
|
|
|
unknown extends InputType ? ValidationTargets[U] : InputType,
|
|
|
|
OutputType,
|
2023-03-15 13:20:50 +00:00
|
|
|
E,
|
|
|
|
P2
|
2023-03-14 14:43:33 +00:00
|
|
|
>
|
2023-01-22 12:21:37 +00:00
|
|
|
): MiddlewareHandler<E, P, V> => {
|
2022-12-29 05:59:57 +00:00
|
|
|
return async (c, next) => {
|
2022-12-28 02:25:48 +00:00
|
|
|
let value = {}
|
2023-11-21 10:42:27 +00:00
|
|
|
const contentType = c.req.header('Content-Type')
|
2022-12-28 02:25:48 +00:00
|
|
|
|
2023-02-13 21:21:30 +00:00
|
|
|
switch (target) {
|
2022-12-28 02:25:48 +00:00
|
|
|
case 'json':
|
2023-11-21 10:42:27 +00:00
|
|
|
if (!contentType || !contentType.startsWith('application/json')) {
|
|
|
|
const message = `Invalid HTTP header: Content-Type=${contentType}`
|
|
|
|
console.error(message)
|
|
|
|
return c.json(
|
|
|
|
{
|
|
|
|
success: false,
|
|
|
|
message,
|
|
|
|
},
|
|
|
|
400
|
|
|
|
)
|
|
|
|
}
|
|
|
|
/**
|
|
|
|
* Get the arrayBuffer first, create JSON object via Response,
|
|
|
|
* and cache the arrayBuffer in the c.req.bodyCache.
|
|
|
|
*/
|
2023-01-02 23:15:23 +00:00
|
|
|
try {
|
2023-09-03 05:43:01 +00:00
|
|
|
const arrayBuffer = c.req.bodyCache.arrayBuffer ?? (await c.req.raw.arrayBuffer())
|
|
|
|
value = await new Response(arrayBuffer).json()
|
|
|
|
c.req.bodyCache.json = value
|
|
|
|
c.req.bodyCache.arrayBuffer = arrayBuffer
|
2023-01-02 23:15:23 +00:00
|
|
|
} catch {
|
|
|
|
console.error('Error: Malformed JSON in request body')
|
|
|
|
return c.json(
|
|
|
|
{
|
|
|
|
success: false,
|
|
|
|
message: 'Malformed JSON in request body',
|
|
|
|
},
|
|
|
|
400
|
|
|
|
)
|
|
|
|
}
|
2022-12-28 02:25:48 +00:00
|
|
|
break
|
2023-09-03 05:43:01 +00:00
|
|
|
case 'form': {
|
fix: return status 500 when using validator 'form' (#1554)
* fix: return status 500 when using validator 'form'
When using `validator('form', ...)` hono is returning a 500 status
when receiving a POST request with a JSON in request body, instead
of a bad request 400, .
This is happenning due to a unhandled error in an
underlying library (@miniflare).
https://github.com/cloudflare/miniflare/pull/711
The code changes in this PR are responsible to prepare the code to
handle possible TypeError that can be thrown in the future, by the lib
doing the FormData parsing, as per, https://fetch.spec.whatwg.org/#dom-body-formdata.
This PR should wait for bugfix on @miniflare.
* fix: json validator allowing Content-Type value other than json/application
Forgery attacks will try to avoid preflight requests when POSTing JSON
payloads manipulating the HTTP header Content-Type. For example, it will
send a JSON payload with `Content-Type=text/plain`, but the request stills
containing a JSON in its body. Those requests must be rejected.
Thus, when using the validator with the target set to `json`, we must
check the Content-Type header.
* fix: change check for json Content-Type header
Change JSON validation to only allow Content-Type header starting with
'application/json'.
Change from regexp test to starsWith builtin function, to make code more
expressive.
---------
Co-authored-by: Bruno Nascimento <bruno.nascimento@csghq.com>
2023-10-11 15:21:01 +00:00
|
|
|
try {
|
|
|
|
const contentType = c.req.header('Content-Type')
|
|
|
|
if (contentType) {
|
|
|
|
const arrayBuffer = c.req.bodyCache.arrayBuffer ?? (await c.req.raw.arrayBuffer())
|
|
|
|
const formData = await bufferToFormData(arrayBuffer, contentType)
|
|
|
|
const form: BodyData = {}
|
|
|
|
formData.forEach((value, key) => {
|
|
|
|
form[key] = value
|
|
|
|
})
|
|
|
|
value = form
|
|
|
|
c.req.bodyCache.formData = formData
|
|
|
|
c.req.bodyCache.arrayBuffer = arrayBuffer
|
|
|
|
}
|
|
|
|
} catch (e) {
|
|
|
|
let message = 'Malformed FormData request.'
|
|
|
|
message += e instanceof Error ? ` ${e.message}` : ` ${String(e)}`
|
|
|
|
return c.json(
|
|
|
|
{
|
|
|
|
success: false,
|
|
|
|
message,
|
|
|
|
},
|
|
|
|
400
|
|
|
|
)
|
2023-09-03 05:43:01 +00:00
|
|
|
}
|
2022-12-28 02:25:48 +00:00
|
|
|
break
|
2023-09-03 05:43:01 +00:00
|
|
|
}
|
2022-12-28 02:25:48 +00:00
|
|
|
case 'query':
|
2023-03-16 12:49:28 +00:00
|
|
|
value = Object.fromEntries(
|
|
|
|
Object.entries(c.req.queries()).map(([k, v]) => {
|
|
|
|
return v.length === 1 ? [k, v[0]] : [k, v]
|
|
|
|
})
|
|
|
|
)
|
2022-12-28 02:25:48 +00:00
|
|
|
break
|
|
|
|
case 'queries':
|
|
|
|
value = c.req.queries()
|
2023-08-19 08:50:50 +00:00
|
|
|
console.log('Warnings: Validate type `queries` is deprecated. Use `query` instead.')
|
2022-12-28 02:25:48 +00:00
|
|
|
break
|
2023-03-15 13:20:50 +00:00
|
|
|
case 'param':
|
|
|
|
value = c.req.param() as Record<string, string>
|
|
|
|
break
|
2023-08-19 09:23:04 +00:00
|
|
|
case 'header':
|
|
|
|
value = c.req.header()
|
|
|
|
break
|
|
|
|
case 'cookie':
|
|
|
|
value = getCookie(c)
|
|
|
|
break
|
2022-12-28 02:25:48 +00:00
|
|
|
}
|
|
|
|
|
2023-08-07 12:26:53 +00:00
|
|
|
const res = await validationFunc(value as never, c as never)
|
2022-12-28 02:25:48 +00:00
|
|
|
|
2023-08-07 12:26:53 +00:00
|
|
|
if (res instanceof Response) {
|
2022-12-28 02:25:48 +00:00
|
|
|
return res
|
|
|
|
}
|
|
|
|
|
2023-02-13 21:21:30 +00:00
|
|
|
c.req.addValidatedData(target, res as never)
|
2022-12-28 02:25:48 +00:00
|
|
|
|
|
|
|
await next()
|
|
|
|
}
|
|
|
|
}
|