diff --git a/docs/_api/plugins.md b/docs/_api/plugins.md index 5df4aefaf..9dcfc0d21 100644 --- a/docs/_api/plugins.md +++ b/docs/_api/plugins.md @@ -425,8 +425,9 @@ All bodyParsers support the following options: #### Parameters - `options` **[Object][81]?** an option object - - `options.maxBodySize` **[Number][86]?** The maximum size in bytes allowed in - the HTTP body. Useful for limiting clients from hogging server memory. + - `options.maxBodySize` **[Number][86]** The maximum size in + bytes allowed in the HTTP body. The default is 2 MiB. Set to `0` to disable + the limit. (optional, default `2*1024*1024`) - `options.mapParams` **[Boolean][88]?** if `req.params` should be filled with parsed parameters from HTTP body. - `options.mapFiles` **[Boolean][88]?** if `req.params` should be filled with @@ -478,7 +479,7 @@ All bodyParsers support the following options: only. Limits the amount of memory all fields together (except files) can allocate in bytes. - The default size is `2 * 1024 * 1024` bytes _(2MB)_. (optional, default `2*1024*1024`) + The default size is `2 * 1024 * 1024` bytes _(2 MiB)_. (optional, default `2*1024*1024`) - `options.arrayLimit` **[Number][86]** `urlEncodedBodyParser` only. Only transform `a[$index]=b` to an array if `$index` is less than `arrayLimit`. (optional, default `20`) - `options.throwOnLimitExceeded` **[Boolean][88]** `urlEncodedBodyParser` @@ -490,7 +491,7 @@ All bodyParsers support the following options: ```javascript server.use(restify.plugins.bodyParser({ - maxBodySize: 0, + maxBodySize: 2 * 1024 * 1024, mapParams: true, mapFiles: false, overrideParams: false, diff --git a/lib/plugins/bodyParser.js b/lib/plugins/bodyParser.js index 49170dac8..6167b0acf 100644 --- a/lib/plugins/bodyParser.js +++ b/lib/plugins/bodyParser.js @@ -41,8 +41,9 @@ var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError; * @function bodyParser * @throws {UnsupportedMediaTypeError} * @param {Object} [options] - an option object - * @param {Number} [options.maxBodySize] - The maximum size in bytes allowed in - * the HTTP body. Useful for limiting clients from hogging server memory. + * @param {Number} [options.maxBodySize=2 * 1024 * 1024] - The maximum size in + * bytes allowed in the HTTP body. The default is 2 MiB. Set to `0` to disable + * the limit. * @param {Boolean} [options.mapParams] - if `req.params` should be filled with * parsed parameters from HTTP body. * @param {Boolean} [options.mapFiles] - if `req.params` should be filled with @@ -94,7 +95,7 @@ var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError; * only. * Limits the amount of memory all fields together (except files) * can allocate in bytes. - * The default size is `2 * 1024 * 1024` bytes *(2MB)*. + * The default size is `2 * 1024 * 1024` bytes *(2 MiB)*. * @param {Number} [options.arrayLimit=20] - `urlEncodedBodyParser` only. Only * transform `a[$index]=b` to an array if `$index` is less than `arrayLimit`. * @param {Boolean} [options.throwOnLimitExceeded=false] - `urlEncodedBodyParser` @@ -104,7 +105,7 @@ var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError; * @returns {Function} Handler * @example * server.use(restify.plugins.bodyParser({ - * maxBodySize: 0, + * maxBodySize: 2 * 1024 * 1024, * mapParams: true, * mapFiles: false, * overrideParams: false, diff --git a/lib/plugins/bodyReader.js b/lib/plugins/bodyReader.js index eb6c10682..21c19628e 100644 --- a/lib/plugins/bodyReader.js +++ b/lib/plugins/bodyReader.js @@ -66,7 +66,8 @@ function bodyReader(options) { var opts = options || {}; assert.object(opts, 'opts'); - var maxBodySize = opts.maxBodySize || 0; + var maxBodySize = + opts.maxBodySize === undefined ? 2 * 1024 * 1024 : opts.maxBodySize; function readBody(req, res, originalNext) { var next = once(originalNext); diff --git a/test/plugins/jsonBodyParser.test.js b/test/plugins/jsonBodyParser.test.js index 431b477f3..306fd8efc 100644 --- a/test/plugins/jsonBodyParser.test.js +++ b/test/plugins/jsonBodyParser.test.js @@ -413,6 +413,77 @@ describe('JSON body parser', function() { client.end(); }); + it('limits request body size to 2 MiB by default', function(done) { + SERVER.use(restify.plugins.bodyParser()); + + SERVER.post('/', function(req, res, next) { + res.send(200, { length: req.body.length }); + next(); + }); + + var opts = { + hostname: '127.0.0.1', + port: PORT, + path: '/', + method: 'POST', + agent: false, + headers: { + accept: 'application/json', + 'content-type': 'application/x-www-form-urlencoded', + 'transfer-encoding': 'chunked' + } + }; + var client = http.request(opts, function(res) { + assert.equal(res.statusCode, 413); + res.once('end', done); + res.resume(); + }); + client.write(Buffer.alloc(2 * 1024 * 1024 + 1, 'x')); + client.end(); + }); + + it('accepts a 2 MiB request body by default', function(done) { + SERVER.use(restify.plugins.bodyParser()); + + SERVER.post('/', function(req, res, next) { + res.send(200, { length: req.body.length }); + next(); + }); + + var body = JSON.stringify('x'.repeat(2 * 1024 * 1024 - 2)); + assert.equal(Buffer.byteLength(body), 2 * 1024 * 1024); + + var client = http.request( + { + hostname: '127.0.0.1', + port: PORT, + path: '/', + method: 'POST', + agent: false, + headers: { + 'content-type': 'application/json', + 'content-length': Buffer.byteLength(body) + } + }, + function(res) { + var responseBody = ''; + res.on('data', function(chunk) { + responseBody += chunk; + }); + res.once('end', function() { + assert.equal(res.statusCode, 200); + assert.equal( + JSON.parse(responseBody).length, + body.length - 2 + ); + done(); + }); + } + ); + client.on('error', done); + client.end(body); + }); + it('restify-GH-149 limit request body size (json)', function(done) { SERVER.use(restify.plugins.bodyParser({ maxBodySize: 1024 }));