apigee-127 / swagger-node-runner

The heart of Swagger-Node
MIT License
102 stars 123 forks source link

Corrupted multipart/form-data crashes a server #117

Open AlexPikalov opened 6 years ago

AlexPikalov commented 6 years ago

Steps for reproduction:

  1. create a route that consumes multipart/form-data with two parametes of type string and file (this is more or less what I had)

  2. start node server

  3. make a request via Postman or other http client. This request should contain modified Content-Length header with value that is less than a true one (length 1 is good for demonstration)

Actual result: server is crashed completely with status 7 and following error

Error: req.body must be provided for 'formData' parameters
    at Parameter.getValue (/Users/xxx/Projects/zzz/node_modules/sway/lib/types/parameter.js:147:15)
    at /Users/xxx/Projects/zzz/node_modules/swagger-node-runner/fittings/swagger_params_parser.js:40:44
    at Array.forEach (<anonymous>)
    at /Users/xxx/Projects/zzz/node_modules/swagger-node-runner/fittings/swagger_params_parser.js:39:46
    at finishedParseBody (/Users/xxx/Projects/zzz/node_modules/swagger-node-runner/fittings/swagger_params_parser.js:128:12)
    at /Users/xxx/Projects/zzz/node_modules/async/lib/async.js:726:13
    at /Users/xxx/Projects/zzz/node_modules/async/lib/async.js:52:16
    at /Users/xxx/Projects/zzz/node_modules/async/lib/async.js:269:32
    at /Users/xxx/Projects/zzz/node_modules/async/lib/async.js:44:16
    at /Users/xxx/Projects/zzz/node_modules/async/lib/async.js:723:17
npm ERR! code ELIFECYCLE
npm ERR! errno 7
npm ERR! zzz@1.0.0 start: `node ./src/index.js`
npm ERR! Exit status 7
npm ERR! 
npm ERR! Failed at the zzz@1.0.0 start script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:

As a quick fix I've wrapped value getting into try/catch, somethink like


try {
  req.swagger.operation.parameterObjects.forEach(function(parameter) {
    params[parameter.name] = parameter.getValue(req); // note: we do not check for errors here
   });

   next(null, params);
} catch (err) {
   next(err);
}