fix: prevent process crash when fileFilter calls its callback more than once (fixes #950)#1427
Open
spokodev wants to merge 1 commit into
Open
fix: prevent process crash when fileFilter calls its callback more than once (fixes #950)#1427spokodev wants to merge 1 commit into
spokodev wants to merge 1 commit into
Conversation
With upload.fields(), if a fileFilter invokes its callback more than once asynchronously, removePlaceholder runs twice for the same field: the first call deletes req.files[fieldname], the second reads .length of undefined and throws an uncaught TypeError that crashes the process. Break out when the field entry is already gone, matching the array strategy. Fixes expressjs#950.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #950.
With
upload.fields(), if afileFilterinvokes its callback more than once and does so asynchronously, Multer crashes the whole Node process with an uncaught exception:A placeholder is inserted synchronously when the file event fires, then removed asynchronously from the
fileFiltercallback. When the callback runs twice,removePlaceholderruns twice for the same field: the first call sees length 1 and deletesreq.files[fieldname]; the second call reads.lengthof the now-missing entry and throws on a later tick, where there is no surrounding try/catch, so the process dies. This has been reported repeatedly (#950, #1093, #1205).Only the
OBJECTstrategy (upload.fields()) is affected; theARRAYstrategy (upload.array()) already tolerates a double callback becausearrayRemoveno-ops on a missing entry.Fix
Break out of the
OBJECTbranch when the field entry is already gone, matching the null-safety theARRAYbranch already has. The single-callback path and behavior are unchanged.Testing
Added a test to
test/file-filter.js: a.fields()parser whosefileFiltercalls the callback twice viasetImmediate(the asynchronous case). It crashes the process on the current code and passes with the fix. Full suite stays green (81 passing).