feat: port upstream security fixes

lib/error.js

@@ -6,6 +6,7 @@ const Codes = {
   LIMIT_FIELD_VALUE: 'LIMIT_FIELD_VALUE',
   LIMIT_FIELD_COUNT: 'LIMIT_FIELD_COUNT',
   LIMIT_UNEXPECTED_FILE: 'LIMIT_UNEXPECTED_FILE',
+  MISSING_FIELD_NAME: 'MISSING_FIELD_NAME',
   CLIENT_CLOSED_REQUEST: 'CLIENT_CLOSED_REQUEST'
 }
 
@@ -19,6 +20,7 @@ const statuses = new Map([
   [Codes.LIMIT_FIELD_VALUE, 413],
   [Codes.LIMIT_FIELD_COUNT, 413],
   [Codes.LIMIT_UNEXPECTED_FILE, 400],
+  [Codes.MISSING_FIELD_NAME, 400],
   [Codes.CLIENT_CLOSED_REQUEST, 499]
 ])
 

lib/index.d.ts

@@ -18,6 +18,7 @@ export enum Codes {
   LIMIT_FIELD_VALUE = 'LIMIT_FIELD_VALUE',
   LIMIT_FIELD_COUNT = 'LIMIT_FIELD_COUNT',
   LIMIT_UNEXPECTED_FILE = 'LIMIT_UNEXPECTED_FILE',
+  MISSING_FIELD_NAME = 'MISSING_FIELD_NAME',
   CLIENT_CLOSED_REQUEST = 'CLIENT_CLOSED_REQUEST'
 }
 

lib/read-body.js

@@ -12,6 +12,13 @@ const collectFields = (busboy, limits) => new Promise((resolve, reject) => {
   const result = []
 
   busboy.on('field', (fieldname, value, fieldnameTruncated, valueTruncated) => {
+    if (fieldname == null || fieldname === '') {
+      return reject(new MulterError(
+        Codes.MISSING_FIELD_NAME,
+        'Field name is required.'
+      ))
+    }
+
     if (
       fieldnameTruncated ||
       (typeof limits.fieldNameSize === 'number' &&
@@ -45,6 +52,14 @@ const collectFiles = (busboy, limits, fileFilter) => new Promise((resolve, rejec
   const fileTasks = []
 
   busboy.on('file', async (fieldname, fileStream, filename, encoding, mimetype) => {
+    if (fieldname == null || fieldname === '') {
+      fileStream.resume()
+      return reject(new MulterError(
+        Codes.MISSING_FIELD_NAME,
+        'Field name is required.'
+      ))
+    }
+
     if (
       typeof limits.fieldNameSize === 'number' &&
       fieldname.length > limits.fieldNameSize
@@ -171,7 +186,7 @@ const readBody = async (req, limits, fileFilter) => {
   } catch (err) {
     req.unpipe(busboy)
     req.removeListener('error', requestError)
-    busboy.removeAllListeners()
+    setImmediate(() => busboy.removeAllListeners())
     setImmediate(() => req.resume())
 
     // Wait for request to close, finish, or error

test/error-handling.js

@@ -194,5 +194,32 @@ describe('Error Handling', () => {
       util.submitForm(parser, form),
       hasCode(Codes.LIMIT_FILE_SIZE)
     )
-  })
+  });
+
+  ['""', ''].forEach((name) =>
+    it(`should notify of missing field name for file upload (name=${name})`, async () => {
+      const req = new stream.PassThrough()
+      const upload = new Multer().any()
+      const boundary = 'AaB03x'
+      const body = [
+        `--${boundary}`,
+        `Content-Disposition: form-data; name=${name}; filename="test.dat"`,
+        'Content-Type: application/octet-stream',
+        '',
+        'hello',
+        `--${boundary}--`
+      ].join('\r\n')
+
+      req.headers = {
+        'content-type': `multipart/form-data; boundary=${boundary}`,
+        'content-length': body.length
+      }
+
+      req.end(body)
+
+      await assert.rejects(
+        pify(upload)(req, null),
+        hasCode(Codes.MISSING_FIELD_NAME)
+      )
+    }))
 })