Repository: fastify/fastify
File: lib/handle-request.js (JavaScript)

Code before:
  }

  if (this[kSupportedHTTPMethods].bodywith.has(method)) {
    const headers = request.headers
    const ctHeader = headers['content-type']

    if (ctHeader === undefined) {
      const contentLength = headers['content-length']
      const transferEncoding = headers['transfer-encoding']
      const isEmptyBody = transferEncoding === undefined &&
        (contentLength === undefined || contentLength === '0')

      if (isEmptyBody) {
        // Request has no body to parse
        handler(request, reply)
        return
      }

      request[kRouteContext].contentTypeParser.run('', handler, request, reply)
      return
    }

    const contentType = new ContentType(ctHeader)
    if (contentType.isValid === false) {
      reply[kReplyIsError] = true
      reply.status(415).send(new FST_ERR_CTP_INVALID_MEDIA_TYPE(ctHeader))
      return
    }
    request[kRouteContext].contentTypeParser.run(contentType.toString(), handler, request, reply)
    return
  }

  // Return 404 instead of 405 see https://github.com/fastify/fastify/pull/862 for discussion
  handler(request, reply)
}

function handler (request, reply) {
  try {
    if (request[kRouteContext].preValidation !== null) {
      preValidationHookRunner(
        request[kRouteContext].preValidation,
        request,
        reply,
        preValidationCallback
      )
    } else {
      preValidationCallback(null, request, reply)
    }
  } catch (err) {
    preValidationCallback(err, request, reply)
  }

Review comment (suggestion):
This is one solution to the problem, whereby `ctHeader` get's rendered in the template instead of a raw %s.  But is there any attack surface here for malicious user input and would it be better to drop the rendering in the template altogether and leave this so that it does not pass ctHeader

Code after:
  }

  if (this[kSupportedHTTPMethods].bodywith.has(method)) {
    const headers = request.headers
    const ctHeader = headers['content-type']

    if (ctHeader === undefined) {
      const contentLength = headers['content-length']
      const transferEncoding = headers['transfer-encoding']
      const isEmptyBody = transferEncoding === undefined &&
        (contentLength === undefined || contentLength === '0')

      if (isEmptyBody) {
        // Request has no body to parse
        handler(request, reply)
        return
      }

      request[kRouteContext].contentTypeParser.run('', handler, request, reply)
      return
    }

    const contentType = new ContentType(ctHeader)
    if (contentType.isValid === false) {
      reply[kReplyIsError] = true
      reply.status(415).send(new FST_ERR_CTP_INVALID_MEDIA_TYPE())
      return
    }
    request[kRouteContext].contentTypeParser.run(contentType.toString(), handler, request, reply)
    return
  }

  // Return 404 instead of 405 see https://github.com/fastify/fastify/pull/862 for discussion
  handler(request, reply)
}

function handler (request, reply) {
  try {
    if (request[kRouteContext].preValidation !== null) {
      preValidationHookRunner(
        request[kRouteContext].preValidation,
        request,
        reply,
        preValidationCallback
      )
    } else {
      preValidationCallback(null, request, reply)
    }
  } catch (err) {
    preValidationCallback(err, request, reply)
  }