feat: default request body limit to 2 MiB

docs/_api/plugins.md

@@ -425,8 +425,9 @@ All bodyParsers support the following options:
 #### Parameters
 
 -   `options` **[Object][81]?** an option object
-    -   `options.maxBodySize` **[Number][86]?** The maximum size in bytes allowed in
-        the HTTP body. Useful for limiting clients from hogging server memory.
+    -   `options.maxBodySize` **[Number][86]** The maximum size in
+        bytes allowed in the HTTP body. The default is 2 MiB. Set to `0` to disable
+        the limit. (optional, default `2*1024*1024`)
     -   `options.mapParams` **[Boolean][88]?** if `req.params` should be filled with
         parsed parameters from HTTP body.
     -   `options.mapFiles` **[Boolean][88]?** if `req.params` should be filled with
@@ -478,7 +479,7 @@ All bodyParsers support the following options:
         only.
         Limits the amount of memory all fields together (except files)
         can allocate in bytes.
-        The default size is `2 * 1024 * 1024` bytes _(2MB)_. (optional, default `2*1024*1024`)
+        The default size is `2 * 1024 * 1024` bytes _(2 MiB)_. (optional, default `2*1024*1024`)
     -   `options.arrayLimit` **[Number][86]** `urlEncodedBodyParser` only. Only
         transform `a[$index]=b` to an array if `$index` is less than `arrayLimit`. (optional, default `20`)
     -   `options.throwOnLimitExceeded` **[Boolean][88]** `urlEncodedBodyParser`
@@ -490,7 +491,7 @@ All bodyParsers support the following options:
 
 ```javascript
 server.use(restify.plugins.bodyParser({
-    maxBodySize: 0,
+    maxBodySize: 2 * 1024 * 1024,
     mapParams: true,
     mapFiles: false,
     overrideParams: false,

lib/plugins/bodyParser.js

@@ -41,8 +41,9 @@ var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError;
  * @function bodyParser
  * @throws   {UnsupportedMediaTypeError}
  * @param {Object} [options] - an option object
- * @param {Number} [options.maxBodySize] - The maximum size in bytes allowed in
- * the HTTP body. Useful for limiting clients from hogging server memory.
+ * @param {Number} [options.maxBodySize=2 * 1024 * 1024] - The maximum size in
+ * bytes allowed in the HTTP body. The default is 2 MiB. Set to `0` to disable
+ * the limit.
  * @param {Boolean} [options.mapParams] - if `req.params` should be filled with
  * parsed parameters from HTTP body.
  * @param {Boolean} [options.mapFiles] - if `req.params` should be filled with
@@ -94,7 +95,7 @@ var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError;
  * only.
  * Limits the amount of memory all fields together (except files)
  * can allocate in bytes.
- * The default size is `2 * 1024 * 1024` bytes *(2MB)*.
+ * The default size is `2 * 1024 * 1024` bytes *(2 MiB)*.
  * @param {Number} [options.arrayLimit=20] - `urlEncodedBodyParser` only. Only
  * transform `a[$index]=b` to an array if `$index` is less than `arrayLimit`.
  * @param {Boolean} [options.throwOnLimitExceeded=false] - `urlEncodedBodyParser`
@@ -104,7 +105,7 @@ var UnsupportedMediaTypeError = errors.UnsupportedMediaTypeError;
  * @returns  {Function} Handler
  * @example
  * server.use(restify.plugins.bodyParser({
- *     maxBodySize: 0,
+ *     maxBodySize: 2 * 1024 * 1024,
  *     mapParams: true,
  *     mapFiles: false,
  *     overrideParams: false,

lib/plugins/bodyReader.js

@@ -66,7 +66,8 @@ function bodyReader(options) {
     var opts = options || {};
     assert.object(opts, 'opts');
 
-    var maxBodySize = opts.maxBodySize || 0;
+    var maxBodySize =
+        opts.maxBodySize === undefined ? 2 * 1024 * 1024 : opts.maxBodySize;
 
     function readBody(req, res, originalNext) {
         var next = once(originalNext);

test/plugins/jsonBodyParser.test.js

@@ -141,7 +141,7 @@
         });
     });
 
     // TODO: router param mapping runs later
     it('should map req.body onto req.params', function(done) {
         SERVER.use(
             restify.plugins.jsonBodyParser({
@@ -413,6 +413,77 @@
         client.end();
     });
 
+    it('limits request body size to 2 MiB by default', function(done) {
+        SERVER.use(restify.plugins.bodyParser());
+
+        SERVER.post('/', function(req, res, next) {
+            res.send(200, { length: req.body.length });
+            next();
+        });
+
+        var opts = {
+            hostname: '127.0.0.1',
+            port: PORT,
+            path: '/',
+            method: 'POST',
+            agent: false,
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+                'transfer-encoding': 'chunked'
+            }
+        };
+        var client = http.request(opts, function(res) {
+            assert.equal(res.statusCode, 413);
+            res.once('end', done);
+            res.resume();
+        });
+        client.write(Buffer.alloc(2 * 1024 * 1024 + 1, 'x'));
+        client.end();
+    });
+
+    it('accepts a 2 MiB request body by default', function(done) {
+        SERVER.use(restify.plugins.bodyParser());
+
+        SERVER.post('/', function(req, res, next) {
+            res.send(200, { length: req.body.length });
+            next();
+        });
+
+        var body = JSON.stringify('x'.repeat(2 * 1024 * 1024 - 2));
+        assert.equal(Buffer.byteLength(body), 2 * 1024 * 1024);
+
+        var client = http.request(
+            {
+                hostname: '127.0.0.1',
+                port: PORT,
+                path: '/',
+                method: 'POST',
+                agent: false,
+                headers: {
+                    'content-type': 'application/json',
+                    'content-length': Buffer.byteLength(body)
+                }
+            },
+            function(res) {
+                var responseBody = '';
+                res.on('data', function(chunk) {
+                    responseBody += chunk;
+                });
+                res.once('end', function() {
+                    assert.equal(res.statusCode, 200);
+                    assert.equal(
+                        JSON.parse(responseBody).length,
+                        body.length - 2
+                    );
+                    done();
+                });
+            }
+        );
+        client.on('error', done);
+        client.end(body);
+    });
+
     it('restify-GH-149 limit request body size (json)', function(done) {
         SERVER.use(restify.plugins.bodyParser({ maxBodySize: 1024 }));