Merge fastify/send

[bjohansebas]

No description provided.

In general, to fix this type of issue you must avoid sending raw exception strings (which may embed user-controlled values) directly to the HTTP response in a way that can be interpreted as HTML. Instead, either (a) avoid including the message entirely, (b) send a static, generic error message, or (c) escape/encode the message according to the context (HTML-escape for HTML, JSON-encode for JSON, etc.) before writing it.

Here, the best minimal fix without changing existing functionality is to HTML-escape the error string before passing it to res.end. The project already uses the escape-html library in lib/send.js, which is a standard and appropriate library for this purpose. We can reuse it in test/utils.js by adding a require('escape-html') import and wrapping the error string as escapeHtml(String(err)). This keeps the content of the message visible (just safely escaped) and should not break the tests, as they likely don’t rely on the exact raw characters of the error payload.

Concretely:

• In test/utils.js, add an import near the top: const escapeHtml = require('escape-html').
• Then, in the catch (err) block inside createServer, change res.end(String(err)) to res.end(escapeHtml(String(err))).
  No other files (lib/send.js, lib/parseTokenList.js) need modification because they’re not directly writing exception text to HTTP responses; the vulnerable sink is in test/utils.js.

In general, to fix information exposure through stack traces, you should avoid sending the raw error (or its stack) back to the client. Instead, log the full error details on the server (console, logger, etc.) and send a generic, non-sensitive message in the HTTP response. This maintains visibility for developers while preventing attackers from learning internal implementation details.

For this specific code in test/utils.js, we should modify the catch block inside module.exports.createServer so that it no longer does res.end(String(err)). The best minimal-change fix is:

• Log the error using console.error(err) (built-in, no new dependencies).
• Respond with a generic error message string such as "Internal Server Error" or "An internal error occurred" that does not include any details from err.

Concretely:

• In module.exports.createServer, lines 26–29, keep the catch (err) and res.statusCode = 500, but replace res.end(String(err)) with a call to console.error(err) followed by res.end('Internal Server Error') (or similar). This preserves behavior that a 500 is returned on error, but stops exposing stack trace information to the client while still logging it for debugging.

No additional imports or method definitions are needed; we only use the standard console object.

---

[coveralls]

Pull Request Test Coverage Report for Build 21231906690

Details

• 1073 of 1073 (100.0%) changed or added relevant lines in 11 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 100.0%

---

Totals
Change from base Build 21218235726:	0.0%
Covered Lines:	1094
Relevant Lines:	1094

---

💛 - Coveralls