[Fix] append: avoid a crash on nullish values

ljharb · ljharb · commit b70869dad201 · 2025-05-08T11:46:59.000-07:00
Fixes #577
diff --git a/lib/form_data.js b/lib/form_data.js
@@ -57,7 +57,7 @@ FormData.prototype.append = function (field, value, options) {
   var append = CombinedStream.prototype.append.bind(this);
 
   // all that streamy business can't handle numbers
-  if (typeof value === 'number') {
+  if (typeof value === 'number' || value == null) {
     value = String(value);
   }
 
@@ -231,14 +231,14 @@ FormData.prototype._getContentDisposition = function (value, options) {
   if (typeof options.filepath === 'string') {
     // custom filepath for relative paths
     filename = path.normalize(options.filepath).replace(/\\/g, '/');
-  } else if (options.filename || value.name || value.path) {
+  } else if (options.filename || (value && (value.name || value.path))) {
     /*
      * custom filename take precedence
      * formidable and the browser add a name property
      * fs- and request- streams have path property
      */
-    filename = path.basename(options.filename || value.name || value.path);
-  } else if (value.readable && hasOwn(value, 'httpVersion')) {
+    filename = path.basename(options.filename || (value && (value.name || value.path)));
+  } else if (value && value.readable && hasOwn(value, 'httpVersion')) {
     // or try http response
     filename = path.basename(value.client._httpMessage.path || '');
   }
@@ -256,17 +256,17 @@ FormData.prototype._getContentType = function (value, options) {
   var contentType = options.contentType;
 
   // or try `name` from formidable, browser
-  if (!contentType && value.name) {
+  if (!contentType && value && value.name) {
     contentType = mime.lookup(value.name);
   }
 
   // or try `path` from fs-, request- streams
-  if (!contentType && value.path) {
+  if (!contentType && value && value.path) {
     contentType = mime.lookup(value.path);
   }
 
   // or if it's http-reponse
-  if (!contentType && value.readable && hasOwn(value, 'httpVersion')) {
+  if (!contentType && value && value.readable && hasOwn(value, 'httpVersion')) {
     contentType = value.headers['content-type'];
   }
 
@@ -276,7 +276,7 @@ FormData.prototype._getContentType = function (value, options) {
   }
 
   // fallback to the default content type if `value` is not simple value
-  if (!contentType && typeof value === 'object') {
+  if (!contentType && value && typeof value === 'object') {
     contentType = FormData.DEFAULT_CONTENT_TYPE;
   }
 
diff --git a/test/integration/test-set-nonstring.js b/test/integration/test-set-nonstring.js
@@ -0,0 +1,22 @@
+'use strict';
+
+var common = require('../common');
+var assert = common.assert;
+
+var FormData = require(common.dir.lib + '/form_data');
+
+(function testSetUndefined() {
+  var form = new FormData();
+
+  assert.doesNotThrow(function () {
+    form.append('key', undefined);
+  });
+
+  var buffer = form.getBuffer();
+
+  assert.deepEqual(buffer.toString().split(form.getBoundary()), [
+    '--',
+    '\r\nContent-Disposition: form-data; name="key"\r\n\r\nundefined\r\n--',
+    '--\r\n',
+  ]);
+}());
