Parsing form data with unexpected Content-Length (#2305)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: Arda TANRIKULU <[email protected]>

Author: 3 people

.changeset/@whatwg-node_node-fetch-2305-dependencies.md

@@ -0,0 +1,6 @@
+---
+"@whatwg-node/node-fetch": patch
+---
+dependencies updates:
+  - Added dependency [`@fastify/busboy@^3.1.1` ↗︎](https://www.npmjs.com/package/@fastify/busboy/v/3.1.1) (to `dependencies`)
+  - Removed dependency [`busboy@^1.6.0` ↗︎](https://www.npmjs.com/package/busboy/v/1.6.0) (from `dependencies`)

.changeset/chatty-years-say.md

@@ -0,0 +1,5 @@
+---
+'@whatwg-node/server': patch
+---
+
+Handle request abort signals with streamed body on uWS adapter

.changeset/curvy-geese-beg.md

@@ -0,0 +1,5 @@
+---
+'@whatwg-node/node-fetch': patch
+---
+
+Abort parsing form data if the request is aborted

.changeset/short-loops-invite.md

@@ -0,0 +1,5 @@
+---
+'@whatwg-node/node-fetch': patch
+---
+
+Handle parsing form data when supplied Content-Length header value is smaller than the actual data

packages/node-fetch/package.json

@@ -34,13 +34,12 @@
   },
   "typings": "dist/typings/index.d.ts",
   "dependencies": {
+    "@fastify/busboy": "^3.1.1",
     "@whatwg-node/disposablestack": "^0.0.6",
     "@whatwg-node/promise-helpers": "^1.2.5",
-    "busboy": "^1.6.0",
     "tslib": "^2.6.3"
   },
   "devDependencies": {
-    "@types/busboy": "1.5.4",
     "@types/pem": "^1.14.0",
     "pem": "^1.14.8"
   },

packages/node-fetch/src/Body.ts

@@ -1,8 +1,8 @@
 /* eslint-disable @typescript-eslint/ban-ts-comment */
 import { Buffer } from 'node:buffer';
 import { IncomingMessage } from 'node:http';
-import { Readable } from 'node:stream';
-import busboy from 'busboy';
+import { addAbortSignal, Readable } from 'node:stream';
+import { Busboy, BusboyFileStream } from '@fastify/busboy';
 import { handleMaybePromise, MaybePromise } from '@whatwg-node/promise-helpers';
 import { hasArrayBufferMethod, hasBufferMethod, hasBytesMethod, PonyfillBlob } from './Blob.js';
 import { PonyfillFile } from './File.js';
@@ -244,59 +244,104 @@ export class PonyfillBody<TJSON = any> implements Body {
       ...opts?.formDataLimits,
     };
     return new Promise((resolve, reject) => {
-      const bb = busboy({
+      const stream = this.body?.readable;
+      if (!stream) {
+        return reject(new Error('No stream available'));
+      }
+
+      // form data file that is currently being processed, it's
+      // important to keep track of it in case the stream ends early
+      let currFile: BusboyFileStream | null = null;
+
+      const bb = new Busboy({
         headers: {
+          'content-length':
+            typeof this.contentLength === 'number'
+              ? this.contentLength.toString()
+              : this.contentLength || '',
           'content-type': this.contentType || '',
         },
         limits: formDataLimits,
-        defParamCharset: 'utf-8',
+        defCharset: 'utf-8',
       });
-      bb.on('field', (name, value, { nameTruncated, valueTruncated }) => {
-        if (nameTruncated) {
-          reject(new Error(`Field name size exceeded: ${formDataLimits?.fieldNameSize} bytes`));
+
+      if (this.signal) {
+        addAbortSignal(this.signal, bb);
+      }
+
+      let completed = false;
+      const complete = (err: unknown) => {
+        if (completed) return;
+        completed = true;
+        stream!.unpipe(bb);
+        bb.destroy();
+        if (currFile) {
+          currFile.destroy();
+          currFile = null;
+        }
+        if (err) {
+          reject(err);
+        } else {
+          // no error occured, this is a successful end/complete/finish
+          resolve(this._formData!);
+        }
+      };
+
+      // we dont need to listen to the stream close event because bb will close or error when necessary
+      // stream.on('close', complete);
+
+      // stream can be aborted, for example
+      stream.on('error', complete);
+
+      bb.on('field', (name, value, fieldnameTruncated, valueTruncated) => {
+        if (fieldnameTruncated) {
+          return complete(
+            new Error(`Field name size exceeded: ${formDataLimits?.fieldNameSize} bytes`),
+          );
         }
         if (valueTruncated) {
-          reject(new Error(`Field value size exceeded: ${formDataLimits?.fieldSize} bytes`));
+          return complete(
+            new Error(`Field value size exceeded: ${formDataLimits?.fieldSize} bytes`),
+          );
         }
         this._formData!.set(name, value);
       });
+
+      bb.on('file', (name, fileStream, filename, _transferEncoding, mimeType) => {
+        currFile = fileStream;
+        const chunks: BlobPart[] = [];
+        fileStream.on('data', chunk => {
+          chunks.push(chunk);
+        });
+        fileStream.on('error', complete);
+        fileStream.on('limit', () => {
+          complete(new Error(`File size limit exceeded: ${formDataLimits?.fileSize} bytes`));
+        });
+        fileStream.on('close', () => {
+          if (fileStream.truncated) {
+            complete(new Error(`File size limit exceeded: ${formDataLimits?.fileSize} bytes`));
+          }
+          currFile = null;
+          const file = new PonyfillFile(chunks, filename, { type: mimeType });
+          this._formData!.set(name, file);
+        });
+      });
+
       bb.on('fieldsLimit', () => {
-        reject(new Error(`Fields limit exceeded: ${formDataLimits?.fields}`));
+        complete(new Error(`Fields limit exceeded: ${formDataLimits?.fields}`));
       });
-      bb.on(
-        'file',
-        (name, fileStream: Readable & { truncated: boolean }, { filename, mimeType }) => {
-          const chunks: BlobPart[] = [];
-          fileStream.on('limit', () => {
-            reject(new Error(`File size limit exceeded: ${formDataLimits?.fileSize} bytes`));
-          });
-          fileStream.on('data', chunk => {
-            chunks.push(chunk);
-          });
-          fileStream.on('close', () => {
-            if (fileStream.truncated) {
-              reject(new Error(`File size limit exceeded: ${formDataLimits?.fileSize} bytes`));
-            }
-            const file = new PonyfillFile(chunks, filename, { type: mimeType });
-            this._formData!.set(name, file);
-          });
-        },
-      );
       bb.on('filesLimit', () => {
-        reject(new Error(`Files limit exceeded: ${formDataLimits?.files}`));
+        complete(new Error(`Files limit exceeded: ${formDataLimits?.files}`));
       });
       bb.on('partsLimit', () => {
-        reject(new Error(`Parts limit exceeded: ${formDataLimits?.parts}`));
+        complete(new Error(`Parts limit exceeded: ${formDataLimits?.parts}`));
       });
-      bb.on('close', () => {
-        resolve(this._formData!);
-      });
-      bb.on('error', (err: any = 'An error occurred while parsing the form data') => {
-        const errMessage = err.message || err.toString();
-        // @ts-ignore - `cause` is in `TypeError`in node
-        reject(new TypeError(errMessage, err.cause));
-      });
-      _body?.readable.pipe(bb);
+      bb.on('end', complete);
+      bb.on('finish', complete);
+      bb.on('close', complete);
+      bb.on('error', complete);
+
+      stream.pipe(bb);
     });
   }
 

packages/node-fetch/tests/Body.spec.ts

@@ -66,7 +66,7 @@ describe('Body', () => {
     expect(result).toBe('hello world');
   });
 
-  it('throws a TypeError if the body is unable to parse as FormData', async () => {
+  it('throws an error if the body is unable to parse as FormData', async () => {
     const formStr =
       '--Boundary_with_capital_letters\r\n' +
       'Content-Type: application/json\r\n' +
@@ -80,11 +80,13 @@ describe('Body', () => {
         type: 'multipart/form-data; boundary=Boundary_with_capital_letters',
       }),
     );
+
+    let err;
     try {
       await body.formData();
-      expect(true).toBe(false);
     } catch (e) {
-      expect(e).toBeInstanceOf(TypeError);
+      err = e;
     }
+    expect(String(err)).toContain('Unexpected end of multipart data');
   });
 });

packages/node-fetch/tests/FormData.spec.ts

@@ -134,12 +134,9 @@ describe('Form Data', () => {
         fileSize: 1,
       },
     });
-    try {
-      await requestWillParse.formData();
-      expect(true).toBe(false);
-    } catch (error: any) {
-      expect(error.message).toBe('File size limit exceeded: 1 bytes');
-    }
+    const err = await requestWillParse.formData().catch(e => e);
+    expect(err).toBeInstanceOf(Error);
+    expect(err).toHaveProperty('message', 'File size limit exceeded: 1 bytes');
   });
   it('support native Blob', async () => {
     const formData = new PonyfillFormData();

packages/node-fetch/tests/non-http-fetch.spec.ts

@@ -20,6 +20,8 @@ describe('File protocol', () => {
     expect(response.status).toBe(404);
   });
   it('returns 403 if file is not accessible', async () => {
+    // this can yield a false negative if the test is run with sufficient privileges
+    // TODO: consistent behavior across platforms
     const response = await fetchPonyfill(pathToFileURL('/root/private_data.txt'));
     expect(response.status).toBe(403);
   });

packages/server/package.json

@@ -47,6 +47,7 @@
     "@types/node": "22.14.1",
     "express": "5.1.0",
     "fastify": "5.3.0",
+    "form-data": "^4.0.2",
     "koa": "^2.15.3",
     "react": "19.1.0",
     "react-dom": "19.1.0"