Skip to content

Incompatible brotli and gzip levels #14

@danielszuk

Description

@danielszuk

Hi! 👋

Firstly, thank you for your work on this project! 🙂

The issue
As possible gzip compression quality levels (1-9) and possible brotli compression quality levels (0-11) are not compatible with each other, the common level option property is an issue here as we can set a number (e.g. 11) which will work on brotli compression, but will throw on gzip compression.

Steps to reproduce

  1. Set the level property to 11 .use(compression({ level: 11 }))
  2. Run the server
  3. Request an endpoint (with compression) with the header Accept-Encoding: gzip set to gzip only
  4. The server will throw and die

Severity
As most of the consumers using this middleware without wrapping it inside an error handler, anybody can kill the whole server with the above settings with a well-formed request, so I would consider it serious

Suggestions
Imo the level option value should only take one of the following values:

  • MAX (which will resolve to 11 for brotli and 9 for gzip)
  • MIN (0 for brotli, 1 for gzip)
  • DEFAULT (6 for both)
  • { brotli: number; gzip: number }

There should also be a validator at the very beginning of the default export function, which validates both number if they are in the corresponding compression type's valid range.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions