[gmoon]

Two hardening fixes from a security review of the S3-fronting proxy. Scoped to the two highest-value findings; validated locally (lint + type-check + build + 49/49 unit tests green).

1. Error-detail leakage (MEDIUM) — src/s3-gateway.ts

mapError wrapped only NoSuchKey/NoSuchBucket→404, AccessDenied→403, InvalidRange→416 and rethrew everything else unchanged. Unmapped S3ServiceExceptions carry sensitive detail:

• PermanentRedirect → discloses the bucket's real region/endpoint
• SlowDown/InternalError → carry $metadata.requestId and often the bucket name

…and the examples render err.message straight into the response body, so a client can force these conditions and harvest AWS internals.

Fix: unmapped errors are wrapped in a generic S3ProxyError(500); the original is preserved on cause for server-side logging only. Applies to both fetch() and healthCheck() — the latter is client-reachable via the examples' /health route, so narrowing to fetch() alone would leave /health leaking.

Important

Behavior change: send()/init()/fetch() now reject with a sanitized S3ProxyError(500) for previously-unclassified errors instead of the raw error. Inspect err.cause for the original. The known mappings (404/403/416) are unchanged. Unit tests updated to assert the new contract (sanitized message + preserved cause).

2. Stream/socket leak in examples (MEDIUM) — examples/{http,express-basic,fastify-basic}.ts

.pipe(res) does not destroy the S3 source stream when the client disconnects mid-transfer, leaking the underlying S3 socket under abusive clients (open a range request, disconnect, repeat). Switched to stream.pipeline(), which destroys the source on client abort or write error. (hono-basic.ts already handles this via Readable.toWeb cancellation.)

Deliberately not included (tracked separately)

• Add buildspec.yml for integration with AWS CodeBuild #2 keyPrefix confinement — design decision (the whole bucket is currently served)
• Save mocha test results to a file #4 nosniff/content-type control — stored-XSS surface if the bucket accepts untrusted uploads
• Add javascript linting with eslint #5 403/404 enumeration — IAM-policy hardening
• Create build artifact for use in CodePipeline #6 init() double-signaling (emit + throw)

Test plan

• npm run lint / type-check / build / test:unit (49/49) green locally
• CI green
• Confirm the error-contract change is acceptable for downstream consumers

[gmoon]

Rebased onto current master (was 40 commits behind) and finished:

• Error sanitization (src/s3-gateway.ts) merged cleanly — the mapError → S3ProxyError(500) with original on cause is intact.
• Stream-leak fix relocated to the core. Master had refactored examples/express-basic.ts to the v4.1 proxy.middleware() one-liner, whose streaming lives in src/index.ts writeBody() — which still used the leaky stream.pipe(res). Moved the pipeline() fix there, so pipe() / middleware() / static-site are all covered at the source (not just the examples). http.ts and fastify-basic.ts keep their direct-fetch() pipeline() fixes.
• Minor contract refinement: a mid-stream source error now terminates (destroys) the response instead of end()-ing it — a truncated body surfaces as a broken connection rather than a silently-short success. test/pipe.test.ts updated to assert this.

Local: lint + type-check + build + 76/76 unit tests green. Verifying CI next.