fix: body parser behaviour when multiple Content-Type present in HTTP request (#562)

Fixes #568

* Fix body parser to handle borked content type

* add extra comment, linting

---------

Co-authored-by: filmaj <[email protected]>

Author: mmrwoods

src/http/helpers/body-parser.js

@@ -14,6 +14,7 @@ module.exports = function parseBody (req) {
     // Paranoid deep copy
     let request = JSON.parse(JSON.stringify(req))
     let headers = request.headers
+    // Note: content-type header may have multiple, comma-separated values. matching w/ includes may match to multiple different types
     let contentType = type => headers?.['content-type']?.includes(type) || headers?.['Content-Type']?.includes(type)
 
     let isString = typeof request.body === 'string'
@@ -39,17 +40,14 @@ module.exports = function parseBody (req) {
         throw Error('Invalid request body encoding or invalid JSON')
       }
     }
-
-    if (isPlainText || isXml) {
+    else if (isPlainText || isXml) {
       request.body = new Buffer.from(request.body, 'base64').toString()
     }
-
-    if (isFormURLEncoded) {
+    else if (isFormURLEncoded) {
       let data = new Buffer.from(request.body, 'base64').toString()
       request.body = qs.parse(data)
     }
-
-    if (isMultiPartFormData || isOctetStream) {
+    else if (isMultiPartFormData || isOctetStream) {
       request.body = request.body.base64
         ? request.body
         : { base64: request.body }

test/unit/src/http/helpers/body-parser-test.js

@@ -20,6 +20,19 @@ let octetStream = { 'Content-Type': 'application/octet-stream' }
 let text = { 'Content-Type': 'text/plain' }
 let xmlText = { 'Content-Type': 'text/xml' }
 let xmlApp = { 'Content-Type': 'application/xml' }
+let multipleTypes = { 'Content-Type': 'application/json, text/plain' }
+
+test('Borked requests', t => {
+  t.plan(1)
+
+  let req = {
+    body: str(hi),
+    headers: multipleTypes,
+    isBase64Encoded: false,
+  }
+  t.equals(str(parseBody(req)), str(hi), `body matches ${str(req.body)}`)
+
+})
 
 test('Architect v10+ requests', t => {
   t.plan(6)