A streaming parser for HTML form data for node.js
Installations
npm install busboyDeveloper Guide
Typescript
No
Module System
CommonJS
Min. Node Version
>=10.16.0
Node Version
10.22.1
NPM Version
6.14.6
Score
99.6
Supply Chain
99.6
Quality
76
Maintenance
100
Vulnerability
100
License
Releases
Unable to fetch releases
Contributors
Languages
JavaScript (100%)
Developer
mscdex
Download Statistics
Total Downloads
1,828,588,280
Last Day
2,631,746
Last Week
12,153,909
Last Month
53,097,311
Last Year
622,909,094
GitHub Statistics
2,894 Stars
201 Commits
212 Forks
46 Watching
1 Branches
16 Contributors
Bundle Size
22.93 kB
Minified
5.16 kB
Minified + Gzipped
Maintainers
Package Meta Information
Latest Version
1.6.0
Package Id
busboy@1.6.0
Unpacked Size
121.48 kB
Size
19.67 kB
File Count
29
NPM Version
6.14.6
Node Version
10.22.1
Total Downloads
Cumulative downloads
Total Downloads
1,828,588,280
Last day
-1.8%
2,631,746
Compared to previous day
Last week
-13.3%
12,153,909
Compared to previous week
Last month
4.1%
53,097,311
Compared to previous month
Last year
27.8%
622,909,094
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Dev Dependencies
2
Description
A node.js module for parsing incoming HTML form data.
Changes (breaking or otherwise) in v1.0.0 can be found here.
Requirements
- node.js -- v10.16.0 or newer
Install
npm install busboy
Examples
- Parsing (multipart) with default options:
1const http = require('http'); 2 3const busboy = require('busboy'); 4 5http.createServer((req, res) => { 6 if (req.method === 'POST') { 7 console.log('POST request'); 8 const bb = busboy({ headers: req.headers }); 9 bb.on('file', (name, file, info) => { 10 const { filename, encoding, mimeType } = info; 11 console.log( 12 `File [${name}]: filename: %j, encoding: %j, mimeType: %j`, 13 filename, 14 encoding, 15 mimeType 16 ); 17 file.on('data', (data) => { 18 console.log(`File [${name}] got ${data.length} bytes`); 19 }).on('close', () => { 20 console.log(`File [${name}] done`); 21 }); 22 }); 23 bb.on('field', (name, val, info) => { 24 console.log(`Field [${name}]: value: %j`, val); 25 }); 26 bb.on('close', () => { 27 console.log('Done parsing form!'); 28 res.writeHead(303, { Connection: 'close', Location: '/' }); 29 res.end(); 30 }); 31 req.pipe(bb); 32 } else if (req.method === 'GET') { 33 res.writeHead(200, { Connection: 'close' }); 34 res.end(` 35 <html> 36 <head></head> 37 <body> 38 <form method="POST" enctype="multipart/form-data"> 39 <input type="file" name="filefield"><br /> 40 <input type="text" name="textfield"><br /> 41 <input type="submit"> 42 </form> 43 </body> 44 </html> 45 `); 46 } 47}).listen(8000, () => { 48 console.log('Listening for requests'); 49}); 50 51// Example output: 52// 53// Listening for requests 54// < ... form submitted ... > 55// POST request 56// File [filefield]: filename: "logo.jpg", encoding: "binary", mime: "image/jpeg" 57// File [filefield] got 11912 bytes 58// Field [textfield]: value: "testing! :-)" 59// File [filefield] done 60// Done parsing form!
- Save all incoming files to disk:
1const { randomFillSync } = require('crypto'); 2const fs = require('fs'); 3const http = require('http'); 4const os = require('os'); 5const path = require('path'); 6 7const busboy = require('busboy'); 8 9const random = (() => { 10 const buf = Buffer.alloc(16); 11 return () => randomFillSync(buf).toString('hex'); 12})(); 13 14http.createServer((req, res) => { 15 if (req.method === 'POST') { 16 const bb = busboy({ headers: req.headers }); 17 bb.on('file', (name, file, info) => { 18 const saveTo = path.join(os.tmpdir(), `busboy-upload-${random()}`); 19 file.pipe(fs.createWriteStream(saveTo)); 20 }); 21 bb.on('close', () => { 22 res.writeHead(200, { 'Connection': 'close' }); 23 res.end(`That's all folks!`); 24 }); 25 req.pipe(bb); 26 return; 27 } 28 res.writeHead(404); 29 res.end(); 30}).listen(8000, () => { 31 console.log('Listening for requests'); 32});
API
Exports
busboy exports a single function:
( function )(< object >config) - Creates and returns a new Writable form parser stream.
-
Valid
configproperties:-
headers - object - These are the HTTP headers of the incoming request, which are used by individual parsers.
-
highWaterMark - integer - highWaterMark to use for the parser stream. Default: node's stream.Writable default.
-
fileHwm - integer - highWaterMark to use for individual file streams. Default: node's stream.Readable default.
-
defCharset - string - Default character set to use when one isn't defined. Default:
'utf8'. -
defParamCharset - string - For multipart forms, the default character set to use for values of part header parameters (e.g. filename) that are not extended parameters (that contain an explicit charset). Default:
'latin1'. -
preservePath - boolean - If paths in filenames from file parts in a
'multipart/form-data'request shall be preserved. Default:false. -
limits - object - Various limits on incoming data. Valid properties are:
-
fieldNameSize - integer - Max field name size (in bytes). Default:
100. -
fieldSize - integer - Max field value size (in bytes). Default:
1048576(1MB). -
fields - integer - Max number of non-file fields. Default:
Infinity. -
fileSize - integer - For multipart forms, the max file size (in bytes). Default:
Infinity. -
files - integer - For multipart forms, the max number of file fields. Default:
Infinity. -
parts - integer - For multipart forms, the max number of parts (fields + files). Default:
Infinity. -
headerPairs - integer - For multipart forms, the max number of header key-value pairs to parse. Default:
2000(same as node's http module).
-
-
This function can throw exceptions if there is something wrong with the values in config. For example, if the Content-Type in headers is missing entirely, is not a supported type, or is missing the boundary for 'multipart/form-data' requests.
(Special) Parser stream events
-
file(< string >name, < Readable >stream, < object >info) - Emitted for each new file found.
namecontains the form field name.streamis a Readable stream containing the file's data. No transformations/conversions (e.g. base64 to raw binary) are done on the file's data.infocontains the following properties:-
filename- string - If supplied, this contains the file's filename. WARNING: You should almost never use this value as-is (especially if you are usingpreservePath: truein yourconfig) as it could contain malicious input. You are better off generating your own (safe) filenames, or at the very least using a hash of the filename. -
encoding- string - The file's'Content-Transfer-Encoding'value. -
mimeType- string - The file's'Content-Type'value.
Note: If you listen for this event, you should always consume the
streamwhether you care about its contents or not (you can simply dostream.resume();if you want to discard/skip the contents), otherwise the'finish'/'close'event will never fire on the busboy parser stream. However, if you aren't accepting files, you can either simply not listen for the'file'event at all or setlimits.filesto0, and any/all files will be automatically skipped (these skipped files will still count towards any configuredlimits.filesandlimits.partslimits though).Note: If a configured
limits.fileSizelimit was reached for a file,streamwill both have a boolean propertytruncatedset totrue(best checked at the end of the stream) and emit a'limit'event to notify you when this happens. -
-
field(< string >name, < string >value, < object >info) - Emitted for each new non-file field found.
namecontains the form field name.valuecontains the string value of the field.infocontains the following properties:-
nameTruncated- boolean - Whethernamewas truncated or not (due to a configuredlimits.fieldNameSizelimit) -
valueTruncated- boolean - Whethervaluewas truncated or not (due to a configuredlimits.fieldSizelimit) -
encoding- string - The field's'Content-Transfer-Encoding'value. -
mimeType- string - The field's'Content-Type'value.
-
-
partsLimit() - Emitted when the configured
limits.partslimit has been reached. No more'file'or'field'events will be emitted. -
filesLimit() - Emitted when the configured
limits.fileslimit has been reached. No more'file'events will be emitted. -
fieldsLimit() - Emitted when the configured
limits.fieldslimit has been reached. No more'field'events will be emitted.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
Found 0/30 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
no SAST tool detected
Details
- Warn: no pull requests merged into dev branch
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/ci.yml:1
- Warn: no topLevel permission defined: .github/workflows/lint.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/mscdex/busboy/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/mscdex/busboy/ci.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/mscdex/busboy/lint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/mscdex/busboy/lint.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:32
- Warn: npmCommand not pinned by hash: .github/workflows/lint.yml:26
- Info: 0 out of 4 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 2 npmCommand dependencies pinned
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Score
3.4
/10
Last Scanned on 2025-01-27
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More