fix: route body limit

plugin.js

@@ -56,16 +56,22 @@ function rawBody (fastify, opts, next) {
   next()
 
   function preparsingRawBody (request, reply, payload, done) {
+    const applyLimit = request.context._parserOptions.limit || fastify.initialConfig.bodyLimit
+
     getRawBody(runFirst ? request.raw : payload, {
       length: null, // avoid content lenght check: fastify will do it
-      limit: fastify.initialConfig.bodyLimit, // limit to avoid memory leak or DoS
+      limit: applyLimit, // limit to avoid memory leak or DoS
       encoding
     }, function (err, string) {
       if (err) {
         /**
          * the error is managed by fastify server
          * so the request object will not have any
-         * `body` parsed
+         * `body` parsed.
+         *
+         * The preparsingRawBody decorates the request
+         * meanwhile the `payload` is processed by
+         * the fastify server.
          */
         return
       }
@@ -84,15 +90,15 @@ function rawBody (fastify, opts, next) {
     }
 
     try {
-      var json = secureJson.parse(body.toString('utf8'), {
+      const json = secureJson.parse(body.toString('utf8'), {
         protoAction: fastify.initialConfig.onProtoPoisoning,
         constructorAction: fastify.initialConfig.onConstructorPoisoning
       })
+      done(null, json)
     } catch (err) {
       err.statusCode = 400
       return done(err)
     }
-    done(null, json)
   }
 }
 

test/plugin.test.js

@@ -415,6 +415,12 @@ t.test('body limit', async t => {
     payload
   })
   t.equal(res.statusCode, 413)
+  t.same(res.json(), {
+    statusCode: 413,
+    code: 'FST_ERR_CTP_BODY_TOO_LARGE',
+    error: 'Payload Too Large',
+    message: 'Request body is too large'
+  })
 })
 
 t.test('empty body', async t => {

test/route-limit.test.js

@@ -0,0 +1,85 @@
+'use strict'
+
+const t = require('tap')
+const Fastify = require('fastify')
+const rawBody = require('../plugin')
+
+t.test('body limit per route', async t => {
+  const app = Fastify({ bodyLimit: 5 })
+
+  const payload = { hello: '123456789012345678901234567890' }
+
+  await app.register(rawBody, {
+    field: 'rawBody',
+    global: false,
+    runFirst: false
+  })
+
+  app.post('/100', {
+    config: { rawBody: true },
+    bodyLimit: 100
+  }, (req, reply) => {
+    t.pass('body is ok')
+    return req.rawBody
+  })
+
+  app.post('/50', {
+    config: {
+      rawBody: true
+    },
+    bodyLimit: 41
+  }, (req, reply) => {
+    t.fail('body is not ok')
+  })
+
+  app.post('/server-limit', {
+    config: {
+      rawBody: true
+    }
+  }, (req, reply) => {
+    t.fail('body is not ok')
+  })
+
+  await t.test('must not throw if body is smaller than limit', async t => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/100',
+      payload
+    })
+
+    t.equal(res.statusCode, 200)
+    t.equal(res.payload, JSON.stringify(payload))
+  })
+
+  await t.test('must reject if body is bigger than limit', async t => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/50',
+      payload
+    })
+
+    t.equal(res.statusCode, 413)
+    t.same(res.json(), {
+      statusCode: 413,
+      code: 'FST_ERR_CTP_BODY_TOO_LARGE',
+      error: 'Payload Too Large',
+      message: 'Request body is too large'
+    })
+  })
+
+  await t.test('must reject if body is bigger then the server limit', async t => {
+    const res = await app.inject({
+      method: 'POST',
+      url: '/server-limit',
+      payload: { hello: '1' }
+    })
+
+    t.equal(res.statusCode, 413)
+    t.same(res.json(), {
+      statusCode: 413,
+      code: 'FST_ERR_CTP_BODY_TOO_LARGE',
+      error: 'Payload Too Large',
+      message: 'Request body is too large'
+    })
+  })
+})