-
Notifications
You must be signed in to change notification settings - Fork 1
Description
Hi! 👋
Firstly, thank you for your work on this project! 🙂
The issue
As possible gzip compression quality levels (1-9) and possible brotli compression quality levels (0-11) are not compatible with each other, the common level option property is an issue here as we can set a number (e.g. 11) which will work on brotli compression, but will throw on gzip compression.
Steps to reproduce
- Set the level property to 11
.use(compression({ level: 11 })) - Run the server
- Request an endpoint (with compression) with the header
Accept-Encoding: gzipset to gzip only - The server will throw and die
Severity
As most of the consumers using this middleware without wrapping it inside an error handler, anybody can kill the whole server with the above settings with a well-formed request, so I would consider it serious
Suggestions
Imo the level option value should only take one of the following values:
MAX(which will resolve to 11 for brotli and 9 for gzip)MIN(0 for brotli, 1 for gzip)DEFAULT(6 for both){ brotli: number; gzip: number }
There should also be a validator at the very beginning of the default export function, which validates both number if they are in the corresponding compression type's valid range.