File Explorer

1'use strict'2 3const { isUSVString, bufferToLowerCasedHeaderName } = require('../../core/util')4const { utf8DecodeBytes } = require('./util')5const { HTTP_TOKEN_CODEPOINTS, isomorphicDecode } = require('./data-url')6const { isFileLike } = require('./file')7const { makeEntry } = require('./formdata')8const assert = require('node:assert')9const { File: NodeFile } = require('node:buffer')10 11const File = globalThis.File ?? NodeFile12 13const formDataNameBuffer = Buffer.from('form-data; name="')14const filenameBuffer = Buffer.from('; filename')15const dd = Buffer.from('--')16const ddcrlf = Buffer.from('--\r\n')17 18/**19 * @param {string} chars20 */21function isAsciiString (chars) {22  for (let i = 0; i < chars.length; ++i) {23    if ((chars.charCodeAt(i) & ~0x7F) !== 0) {24      return false25    }26  }27  return true28}29 30/**31 * @see https://andreubotella.github.io/multipart-form-data/#multipart-form-data-boundary32 * @param {string} boundary33 */34function validateBoundary (boundary) {35  const length = boundary.length36 37  // - its length is greater or equal to 27 and lesser or equal to 70, and38  if (length < 27 || length > 70) {39    return false40  }41 42  // - it is composed by bytes in the ranges 0x30 to 0x39, 0x41 to 0x5A, or43  //   0x61 to 0x7A, inclusive (ASCII alphanumeric), or which are 0x27 ('),44  //   0x2D (-) or 0x5F (_).45  for (let i = 0; i < length; ++i) {46    const cp = boundary.charCodeAt(i)47 48    if (!(49      (cp >= 0x30 && cp <= 0x39) ||50      (cp >= 0x41 && cp <= 0x5a) ||51      (cp >= 0x61 && cp <= 0x7a) ||52      cp === 0x27 ||53      cp === 0x2d ||54      cp === 0x5f55    )) {56      return false57    }58  }59 60  return true61}62 63/**64 * @see https://andreubotella.github.io/multipart-form-data/#multipart-form-data-parser65 * @param {Buffer} input66 * @param {ReturnType<import('./data-url')['parseMIMEType']>} mimeType67 */68function multipartFormDataParser (input, mimeType) {69  // 1. Assert: mimeType’s essence is "multipart/form-data".70  assert(mimeType !== 'failure' && mimeType.essence === 'multipart/form-data')71 72  const boundaryString = mimeType.parameters.get('boundary')73 74  // 2. If mimeType’s parameters["boundary"] does not exist, return failure.75  //    Otherwise, let boundary be the result of UTF-8 decoding mimeType’s76  //    parameters["boundary"].77  if (boundaryString === undefined) {78    return 'failure'79  }80 81  const boundary = Buffer.from(`--${boundaryString}`, 'utf8')82 83  // 3. Let entry list be an empty entry list.84  const entryList = []85 86  // 4. Let position be a pointer to a byte in input, initially pointing at87  //    the first byte.88  const position = { position: 0 }89 90  // Note: undici addition, allows leading and trailing CRLFs.91  while (input[position.position] === 0x0d && input[position.position + 1] === 0x0a) {92    position.position += 293  }94 95  let trailing = input.length96 97  while (input[trailing - 1] === 0x0a && input[trailing - 2] === 0x0d) {98    trailing -= 299  }100 101  if (trailing !== input.length) {102    input = input.subarray(0, trailing)103  }104 105  // 5. While true:106  while (true) {107    // 5.1. If position points to a sequence of bytes starting with 0x2D 0x2D108    //      (`--`) followed by boundary, advance position by 2 + the length of109    //      boundary. Otherwise, return failure.110    // Note: boundary is padded with 2 dashes already, no need to add 2.111    if (input.subarray(position.position, position.position + boundary.length).equals(boundary)) {112      position.position += boundary.length113    } else {114      return 'failure'115    }116 117    // 5.2. If position points to the sequence of bytes 0x2D 0x2D 0x0D 0x0A118    //      (`--` followed by CR LF) followed by the end of input, return entry list.119    // Note: a body does NOT need to end with CRLF. It can end with --.120    if (121      (position.position === input.length - 2 && bufferStartsWith(input, dd, position)) ||122      (position.position === input.length - 4 && bufferStartsWith(input, ddcrlf, position))123    ) {124      return entryList125    }126 127    // 5.3. If position does not point to a sequence of bytes starting with 0x0D128    //      0x0A (CR LF), return failure.129    if (input[position.position] !== 0x0d || input[position.position + 1] !== 0x0a) {130      return 'failure'131    }132 133    // 5.4. Advance position by 2. (This skips past the newline.)134    position.position += 2135 136    // 5.5. Let name, filename and contentType be the result of parsing137    //      multipart/form-data headers on input and position, if the result138    //      is not failure. Otherwise, return failure.139    const result = parseMultipartFormDataHeaders(input, position)140 141    if (result === 'failure') {142      return 'failure'143    }144 145    let { name, filename, contentType, encoding } = result146 147    // 5.6. Advance position by 2. (This skips past the empty line that marks148    //      the end of the headers.)149    position.position += 2150 151    // 5.7. Let body be the empty byte sequence.152    let body153 154    // 5.8. Body loop: While position is not past the end of input:155    // TODO: the steps here are completely wrong156    {157      const boundaryIndex = input.indexOf(boundary.subarray(2), position.position)158 159      if (boundaryIndex === -1) {160        return 'failure'161      }162 163      body = input.subarray(position.position, boundaryIndex - 4)164 165      position.position += body.length166 167      // Note: position must be advanced by the body's length before being168      // decoded, otherwise the parsing will fail.169      if (encoding === 'base64') {170        body = Buffer.from(body.toString(), 'base64')171      }172    }173 174    // 5.9. If position does not point to a sequence of bytes starting with175    //      0x0D 0x0A (CR LF), return failure. Otherwise, advance position by 2.176    if (input[position.position] !== 0x0d || input[position.position + 1] !== 0x0a) {177      return 'failure'178    } else {179      position.position += 2180    }181 182    // 5.10. If filename is not null:183    let value184 185    if (filename !== null) {186      // 5.10.1. If contentType is null, set contentType to "text/plain".187      contentType ??= 'text/plain'188 189      // 5.10.2. If contentType is not an ASCII string, set contentType to the empty string.190 191      // Note: `buffer.isAscii` can be used at zero-cost, but converting a string to a buffer is a high overhead.192      // Content-Type is a relatively small string, so it is faster to use `String#charCodeAt`.193      if (!isAsciiString(contentType)) {194        contentType = ''195      }196 197      // 5.10.3. Let value be a new File object with name filename, type contentType, and body body.198      value = new File([body], filename, { type: contentType })199    } else {200      // 5.11. Otherwise:201 202      // 5.11.1. Let value be the UTF-8 decoding without BOM of body.203      value = utf8DecodeBytes(Buffer.from(body))204    }205 206    // 5.12. Assert: name is a scalar value string and value is either a scalar value string or a File object.207    assert(isUSVString(name))208    assert((typeof value === 'string' && isUSVString(value)) || isFileLike(value))209 210    // 5.13. Create an entry with name and value, and append it to entry list.211    entryList.push(makeEntry(name, value, filename))212  }213}214 215/**216 * @see https://andreubotella.github.io/multipart-form-data/#parse-multipart-form-data-headers217 * @param {Buffer} input218 * @param {{ position: number }} position219 */220function parseMultipartFormDataHeaders (input, position) {221  // 1. Let name, filename and contentType be null.222  let name = null223  let filename = null224  let contentType = null225  let encoding = null226 227  // 2. While true:228  while (true) {229    // 2.1. If position points to a sequence of bytes starting with 0x0D 0x0A (CR LF):230    if (input[position.position] === 0x0d && input[position.position + 1] === 0x0a) {231      // 2.1.1. If name is null, return failure.232      if (name === null) {233        return 'failure'234      }235 236      // 2.1.2. Return name, filename and contentType.237      return { name, filename, contentType, encoding }238    }239 240    // 2.2. Let header name be the result of collecting a sequence of bytes that are241    //      not 0x0A (LF), 0x0D (CR) or 0x3A (:), given position.242    let headerName = collectASequenceOfBytes(243      (char) => char !== 0x0a && char !== 0x0d && char !== 0x3a,244      input,245      position246    )247 248    // 2.3. Remove any HTTP tab or space bytes from the start or end of header name.249    headerName = removeChars(headerName, true, true, (char) => char === 0x9 || char === 0x20)250 251    // 2.4. If header name does not match the field-name token production, return failure.252    if (!HTTP_TOKEN_CODEPOINTS.test(headerName.toString())) {253      return 'failure'254    }255 256    // 2.5. If the byte at position is not 0x3A (:), return failure.257    if (input[position.position] !== 0x3a) {258      return 'failure'259    }260 261    // 2.6. Advance position by 1.262    position.position++263 264    // 2.7. Collect a sequence of bytes that are HTTP tab or space bytes given position.265    //      (Do nothing with those bytes.)266    collectASequenceOfBytes(267      (char) => char === 0x20 || char === 0x09,268      input,269      position270    )271 272    // 2.8. Byte-lowercase header name and switch on the result:273    switch (bufferToLowerCasedHeaderName(headerName)) {274      case 'content-disposition': {275        // 1. Set name and filename to null.276        name = filename = null277 278        // 2. If position does not point to a sequence of bytes starting with279        //    `form-data; name="`, return failure.280        if (!bufferStartsWith(input, formDataNameBuffer, position)) {281          return 'failure'282        }283 284        // 3. Advance position so it points at the byte after the next 0x22 (")285        //    byte (the one in the sequence of bytes matched above).286        position.position += 17287 288        // 4. Set name to the result of parsing a multipart/form-data name given289        //    input and position, if the result is not failure. Otherwise, return290        //    failure.291        name = parseMultipartFormDataName(input, position)292 293        if (name === null) {294          return 'failure'295        }296 297        // 5. If position points to a sequence of bytes starting with `; filename="`:298        if (bufferStartsWith(input, filenameBuffer, position)) {299          // Note: undici also handles filename*300          let check = position.position + filenameBuffer.length301 302          if (input[check] === 0x2a) {303            position.position += 1304            check += 1305          }306 307          if (input[check] !== 0x3d || input[check + 1] !== 0x22) { // ="308            return 'failure'309          }310 311          // 1. Advance position so it points at the byte after the next 0x22 (") byte312          //    (the one in the sequence of bytes matched above).313          position.position += 12314 315          // 2. Set filename to the result of parsing a multipart/form-data name given316          //    input and position, if the result is not failure. Otherwise, return failure.317          filename = parseMultipartFormDataName(input, position)318 319          if (filename === null) {320            return 'failure'321          }322        }323 324        break325      }326      case 'content-type': {327        // 1. Let header value be the result of collecting a sequence of bytes that are328        //    not 0x0A (LF) or 0x0D (CR), given position.329        let headerValue = collectASequenceOfBytes(330          (char) => char !== 0x0a && char !== 0x0d,331          input,332          position333        )334 335        // 2. Remove any HTTP tab or space bytes from the end of header value.336        headerValue = removeChars(headerValue, false, true, (char) => char === 0x9 || char === 0x20)337 338        // 3. Set contentType to the isomorphic decoding of header value.339        contentType = isomorphicDecode(headerValue)340 341        break342      }343      case 'content-transfer-encoding': {344        let headerValue = collectASequenceOfBytes(345          (char) => char !== 0x0a && char !== 0x0d,346          input,347          position348        )349 350        headerValue = removeChars(headerValue, false, true, (char) => char === 0x9 || char === 0x20)351 352        encoding = isomorphicDecode(headerValue)353 354        break355      }356      default: {357        // Collect a sequence of bytes that are not 0x0A (LF) or 0x0D (CR), given position.358        // (Do nothing with those bytes.)359        collectASequenceOfBytes(360          (char) => char !== 0x0a && char !== 0x0d,361          input,362          position363        )364      }365    }366 367    // 2.9. If position does not point to a sequence of bytes starting with 0x0D 0x0A368    //      (CR LF), return failure. Otherwise, advance position by 2 (past the newline).369    if (input[position.position] !== 0x0d && input[position.position + 1] !== 0x0a) {370      return 'failure'371    } else {372      position.position += 2373    }374  }375}376 377/**378 * @see https://andreubotella.github.io/multipart-form-data/#parse-a-multipart-form-data-name379 * @param {Buffer} input380 * @param {{ position: number }} position381 */382function parseMultipartFormDataName (input, position) {383  // 1. Assert: The byte at (position - 1) is 0x22 (").384  assert(input[position.position - 1] === 0x22)385 386  // 2. Let name be the result of collecting a sequence of bytes that are not 0x0A (LF), 0x0D (CR) or 0x22 ("), given position.387  /** @type {string | Buffer} */388  let name = collectASequenceOfBytes(389    (char) => char !== 0x0a && char !== 0x0d && char !== 0x22,390    input,391    position392  )393 394  // 3. If the byte at position is not 0x22 ("), return failure. Otherwise, advance position by 1.395  if (input[position.position] !== 0x22) {396    return null // name could be 'failure'397  } else {398    position.position++399  }400 401  // 4. Replace any occurrence of the following subsequences in name with the given byte:402  // - `%0A`: 0x0A (LF)403  // - `%0D`: 0x0D (CR)404  // - `%22`: 0x22 (")405  name = new TextDecoder().decode(name)406    .replace(/%0A/ig, '\n')407    .replace(/%0D/ig, '\r')408    .replace(/%22/g, '"')409 410  // 5. Return the UTF-8 decoding without BOM of name.411  return name412}413 414/**415 * @param {(char: number) => boolean} condition416 * @param {Buffer} input417 * @param {{ position: number }} position418 */419function collectASequenceOfBytes (condition, input, position) {420  let start = position.position421 422  while (start < input.length && condition(input[start])) {423    ++start424  }425 426  return input.subarray(position.position, (position.position = start))427}428 429/**430 * @param {Buffer} buf431 * @param {boolean} leading432 * @param {boolean} trailing433 * @param {(charCode: number) => boolean} predicate434 * @returns {Buffer}435 */436function removeChars (buf, leading, trailing, predicate) {437  let lead = 0438  let trail = buf.length - 1439 440  if (leading) {441    while (lead < buf.length && predicate(buf[lead])) lead++442  }443 444  if (trailing) {445    while (trail > 0 && predicate(buf[trail])) trail--446  }447 448  return lead === 0 && trail === buf.length - 1 ? buf : buf.subarray(lead, trail + 1)449}450 451/**452 * Checks if {@param buffer} starts with {@param start}453 * @param {Buffer} buffer454 * @param {Buffer} start455 * @param {{ position: number }} position456 */457function bufferStartsWith (buffer, start, position) {458  if (buffer.length < start.length) {459    return false460  }461 462  for (let i = 0; i < start.length; i++) {463    if (start[i] !== buffer[position.position + i]) {464      return false465    }466  }467 468  return true469}470 471module.exports = {472  multipartFormDataParser,473  validateBoundary474}475