Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion src/utils/body.ts
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,17 @@ export async function readBody<
_Event extends HTTPEvent = HTTPEvent,
_T = InferEventInput<"body", _Event, T>,
>(event: _Event): Promise<undefined | _T> {
const contentType = event.req.headers.get("content-type") || "";

if (contentType.startsWith("multipart/form-data"))
Copy link
Member

@pi0 pi0 Jul 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make it opt-in by supporting event, opts?: { type: "json" | formData" } and throw an HTTPError if it is not.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should make it opt-in by supporting event, opts?: { type: "json" | formData" } and throw an HTTPError if it is not.

i support this. but my changes remain valid, right? since opts is optional. when you specify type in opts, you're specifying a certain body type, when you're not, you're parsing any body as an object or string!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As security measure we should make types opt-in other than JSON (so if no options only json)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Context: #875

return Object.fromEntries(await event.req.formData()) as _T;

const text = await event.req.text();

if (!text) {
return undefined;
}

const contentType = event.req.headers.get("content-type") || "";
if (contentType.startsWith("application/x-www-form-urlencoded")) {
return parseURLEncodedBody(text) as _T;
}
Expand Down