@hono/node-server 1.15.0 → 1.17.0

package/dist/serve-static.js

@@ -23,9 +23,9 @@ __export(serve_static_exports, {
   serveStatic: () => serveStatic
 });
 module.exports = __toCommonJS(serve_static_exports);
-var import_filepath = require("hono/utils/filepath");
 var import_mime = require("hono/utils/mime");
 var import_node_fs = require("fs");
+var import_node_path = require("path");
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -49,9 +49,6 @@ var createStreamBody = (stream) => {
   });
   return body;
 };
-var addCurrentDirPrefix = (path) => {
-  return `./${path}`;
-};
 var getStats = (path) => {
   let stats;
   try {
@@ -61,36 +58,35 @@ var getStats = (path) => {
   return stats;
 };
 var serveStatic = (options = { root: "" }) => {
+  const root = (0, import_node_path.resolve)(options.root || ".");
+  const optionPath = options.path;
   return async (c, next) => {
     if (c.finalized) {
       return next();
     }
     let filename;
     try {
-      filename = options.path ?? decodeURIComponent(c.req.path);
+      const rawPath = optionPath ?? c.req.path;
+      if (!optionPath) {
+        const decodedPath = decodeURIComponent(rawPath);
+        if (decodedPath.includes("..")) {
+          await options.onNotFound?.(rawPath, c);
+          return next();
+        }
+      }
+      filename = optionPath ?? decodeURIComponent(c.req.path);
     } catch {
       await options.onNotFound?.(c.req.path, c);
       return next();
     }
-    let path = (0, import_filepath.getFilePathWithoutDefaultDocument)({
-      filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-      root: options.root
-    });
-    if (path) {
-      path = addCurrentDirPrefix(path);
-    } else {
-      return next();
-    }
+    const requestPath = options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename;
+    let path = optionPath ? options.root ? (0, import_node_path.resolve)((0, import_node_path.join)(root, optionPath)) : optionPath : (0, import_node_path.resolve)((0, import_node_path.join)(root, requestPath));
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
-      path = (0, import_filepath.getFilePath)({
-        filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-        root: options.root,
-        defaultDocument: options.index ?? "index.html"
-      });
-      if (path) {
-        path = addCurrentDirPrefix(path);
-      } else {
+      const indexFile = options.index ?? "index.html";
+      path = (0, import_node_path.resolve)((0, import_node_path.join)(path, indexFile));
+      if (!optionPath && !path.startsWith(root)) {
+        await options.onNotFound?.(path, c);
         return next();
       }
       stats = getStats(path);

package/dist/serve-static.mjs

@@ -1,7 +1,7 @@
 // src/serve-static.ts
-import { getFilePath, getFilePathWithoutDefaultDocument } from "hono/utils/filepath";
 import { getMimeType } from "hono/utils/mime";
 import { createReadStream, lstatSync } from "fs";
+import { join, resolve } from "path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -25,9 +25,6 @@ var createStreamBody = (stream) => {
   });
   return body;
 };
-var addCurrentDirPrefix = (path) => {
-  return `./${path}`;
-};
 var getStats = (path) => {
   let stats;
   try {
@@ -37,36 +34,35 @@ var getStats = (path) => {
   return stats;
 };
 var serveStatic = (options = { root: "" }) => {
+  const root = resolve(options.root || ".");
+  const optionPath = options.path;
   return async (c, next) => {
     if (c.finalized) {
       return next();
     }
     let filename;
     try {
-      filename = options.path ?? decodeURIComponent(c.req.path);
+      const rawPath = optionPath ?? c.req.path;
+      if (!optionPath) {
+        const decodedPath = decodeURIComponent(rawPath);
+        if (decodedPath.includes("..")) {
+          await options.onNotFound?.(rawPath, c);
+          return next();
+        }
+      }
+      filename = optionPath ?? decodeURIComponent(c.req.path);
     } catch {
       await options.onNotFound?.(c.req.path, c);
       return next();
     }
-    let path = getFilePathWithoutDefaultDocument({
-      filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-      root: options.root
-    });
-    if (path) {
-      path = addCurrentDirPrefix(path);
-    } else {
-      return next();
-    }
+    const requestPath = options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename;
+    let path = optionPath ? options.root ? resolve(join(root, optionPath)) : optionPath : resolve(join(root, requestPath));
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
-      path = getFilePath({
-        filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-        root: options.root,
-        defaultDocument: options.index ?? "index.html"
-      });
-      if (path) {
-        path = addCurrentDirPrefix(path);
-      } else {
+      const indexFile = options.index ?? "index.html";
+      path = resolve(join(path, indexFile));
+      if (!optionPath && !path.startsWith(root)) {
+        await options.onNotFound?.(path, c);
         return next();
       }
       stats = getStats(path);

package/dist/server.js

@@ -36,6 +36,9 @@ __export(server_exports, {
 module.exports = __toCommonJS(server_exports);
 var import_node_http = require("http");
 
+// src/listener.ts
+var import_node_http22 = require("http2");
+
 // src/request.ts
 var import_node_http2 = require("http2");
 var import_node_stream = require("stream");
@@ -64,6 +67,7 @@ var Request = class extends GlobalRequest {
     super(input, options);
   }
 };
+var wrapBodyStream = Symbol("wrapBodyStream");
 var newRequestFromIncoming = (method, url, incoming, abortController) => {
   const headerRecord = [];
   const rawHeaders = incoming.rawHeaders;
@@ -97,6 +101,23 @@ var newRequestFromIncoming = (method, url, incoming, abortController) => {
           controller.close();
         }
       });
+    } else if (incoming[wrapBodyStream]) {
+      let reader;
+      init.body = new ReadableStream({
+        async pull(controller) {
+          try {
+            reader ||= import_node_stream.Readable.toWeb(incoming).getReader();
+            const { done, value } = await reader.read();
+            if (done) {
+              controller.close();
+            } else {
+              controller.enqueue(value);
+            }
+          } catch (error) {
+            controller.error(error);
+          }
+        }
+      });
     } else {
       init.body = import_node_stream.Readable.toWeb(incoming);
     }
@@ -345,6 +366,7 @@ global.fetch = (info, init) => {
 };
 
 // src/listener.ts
+var outgoingEnded = Symbol("outgoingEnded");
 var regBuffer = /^no$/i;
 var regContentType = /^(application\/json\b|text\/(?!event-stream\b))/i;
 var handleRequestError = () => new Response(null, {
@@ -390,10 +412,12 @@ var responseViaCache = async (res, outgoing) => {
     outgoing.end(new Uint8Array(await body.arrayBuffer()));
   } else {
     flushHeaders(outgoing);
-    return writeFromReadableStream(body, outgoing)?.catch(
+    await writeFromReadableStream(body, outgoing)?.catch(
       (e) => handleResponseError(e, outgoing)
     );
   }
+  ;
+  outgoing[outgoingEnded]?.();
 };
 var responseViaResponseObject = async (res, outgoing, options = {}) => {
   if (res instanceof Promise) {
@@ -439,8 +463,11 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
     outgoing.writeHead(res.status, resHeaderRecord);
     outgoing.end();
   }
+  ;
+  outgoing[outgoingEnded]?.();
 };
 var getRequestListener = (fetchCallback, options = {}) => {
+  const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
   if (options.overrideGlobalObjects !== false && global.Request !== Request) {
     Object.defineProperty(global, "Request", {
       value: Request
@@ -453,15 +480,46 @@ var getRequestListener = (fetchCallback, options = {}) => {
     let res, req;
     try {
       req = newRequest(incoming, options.hostname);
+      let incomingEnded = !autoCleanupIncoming || incoming.method === "GET" || incoming.method === "HEAD";
+      if (!incomingEnded) {
+        ;
+        incoming[wrapBodyStream] = true;
+        incoming.on("end", () => {
+          incomingEnded = true;
+        });
+        if (incoming instanceof import_node_http22.Http2ServerRequest) {
+          ;
+          outgoing[outgoingEnded] = () => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                if (!incomingEnded) {
+                  setTimeout(() => {
+                    incoming.destroy();
+                    outgoing.destroy();
+                  });
+                }
+              });
+            }
+          };
+        }
+      }
       outgoing.on("close", () => {
         const abortController = req[abortControllerKey];
-        if (!abortController) {
-          return;
+        if (abortController) {
+          if (incoming.errored) {
+            req[abortControllerKey].abort(incoming.errored.toString());
+          } else if (!outgoing.writableFinished) {
+            req[abortControllerKey].abort("Client connection prematurely closed.");
+          }
         }
-        if (incoming.errored) {
-          req[abortControllerKey].abort(incoming.errored.toString());
-        } else if (!outgoing.writableFinished) {
-          req[abortControllerKey].abort("Client connection prematurely closed.");
+        if (!incomingEnded) {
+          setTimeout(() => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                incoming.destroy();
+              });
+            }
+          });
         }
       });
       res = fetchCallback(req, { incoming, outgoing });
@@ -497,7 +555,8 @@ var createAdaptorServer = (options) => {
   const fetchCallback = options.fetch;
   const requestListener = getRequestListener(fetchCallback, {
     hostname: options.hostname,
-    overrideGlobalObjects: options.overrideGlobalObjects
+    overrideGlobalObjects: options.overrideGlobalObjects,
+    autoCleanupIncoming: options.autoCleanupIncoming
   });
   const createServer = options.createServer || import_node_http.createServer;
   const server = createServer(options.serverOptions || {}, requestListener);

package/dist/server.mjs

@@ -1,6 +1,9 @@
 // src/server.ts
 import { createServer as createServerHTTP } from "http";
 
+// src/listener.ts
+import { Http2ServerRequest as Http2ServerRequest2 } from "http2";
+
 // src/request.ts
 import { Http2ServerRequest } from "http2";
 import { Readable } from "stream";
@@ -29,6 +32,7 @@ var Request = class extends GlobalRequest {
     super(input, options);
   }
 };
+var wrapBodyStream = Symbol("wrapBodyStream");
 var newRequestFromIncoming = (method, url, incoming, abortController) => {
   const headerRecord = [];
   const rawHeaders = incoming.rawHeaders;
@@ -62,6 +66,23 @@ var newRequestFromIncoming = (method, url, incoming, abortController) => {
           controller.close();
         }
       });
+    } else if (incoming[wrapBodyStream]) {
+      let reader;
+      init.body = new ReadableStream({
+        async pull(controller) {
+          try {
+            reader ||= Readable.toWeb(incoming).getReader();
+            const { done, value } = await reader.read();
+            if (done) {
+              controller.close();
+            } else {
+              controller.enqueue(value);
+            }
+          } catch (error) {
+            controller.error(error);
+          }
+        }
+      });
     } else {
       init.body = Readable.toWeb(incoming);
     }
@@ -310,6 +331,7 @@ global.fetch = (info, init) => {
 };
 
 // src/listener.ts
+var outgoingEnded = Symbol("outgoingEnded");
 var regBuffer = /^no$/i;
 var regContentType = /^(application\/json\b|text\/(?!event-stream\b))/i;
 var handleRequestError = () => new Response(null, {
@@ -355,10 +377,12 @@ var responseViaCache = async (res, outgoing) => {
     outgoing.end(new Uint8Array(await body.arrayBuffer()));
   } else {
     flushHeaders(outgoing);
-    return writeFromReadableStream(body, outgoing)?.catch(
+    await writeFromReadableStream(body, outgoing)?.catch(
       (e) => handleResponseError(e, outgoing)
     );
   }
+  ;
+  outgoing[outgoingEnded]?.();
 };
 var responseViaResponseObject = async (res, outgoing, options = {}) => {
   if (res instanceof Promise) {
@@ -404,8 +428,11 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
     outgoing.writeHead(res.status, resHeaderRecord);
     outgoing.end();
   }
+  ;
+  outgoing[outgoingEnded]?.();
 };
 var getRequestListener = (fetchCallback, options = {}) => {
+  const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
   if (options.overrideGlobalObjects !== false && global.Request !== Request) {
     Object.defineProperty(global, "Request", {
       value: Request
@@ -418,15 +445,46 @@ var getRequestListener = (fetchCallback, options = {}) => {
     let res, req;
     try {
       req = newRequest(incoming, options.hostname);
+      let incomingEnded = !autoCleanupIncoming || incoming.method === "GET" || incoming.method === "HEAD";
+      if (!incomingEnded) {
+        ;
+        incoming[wrapBodyStream] = true;
+        incoming.on("end", () => {
+          incomingEnded = true;
+        });
+        if (incoming instanceof Http2ServerRequest2) {
+          ;
+          outgoing[outgoingEnded] = () => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                if (!incomingEnded) {
+                  setTimeout(() => {
+                    incoming.destroy();
+                    outgoing.destroy();
+                  });
+                }
+              });
+            }
+          };
+        }
+      }
       outgoing.on("close", () => {
         const abortController = req[abortControllerKey];
-        if (!abortController) {
-          return;
+        if (abortController) {
+          if (incoming.errored) {
+            req[abortControllerKey].abort(incoming.errored.toString());
+          } else if (!outgoing.writableFinished) {
+            req[abortControllerKey].abort("Client connection prematurely closed.");
+          }
         }
-        if (incoming.errored) {
-          req[abortControllerKey].abort(incoming.errored.toString());
-        } else if (!outgoing.writableFinished) {
-          req[abortControllerKey].abort("Client connection prematurely closed.");
+        if (!incomingEnded) {
+          setTimeout(() => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                incoming.destroy();
+              });
+            }
+          });
         }
       });
       res = fetchCallback(req, { incoming, outgoing });
@@ -462,7 +520,8 @@ var createAdaptorServer = (options) => {
   const fetchCallback = options.fetch;
   const requestListener = getRequestListener(fetchCallback, {
     hostname: options.hostname,
-    overrideGlobalObjects: options.overrideGlobalObjects
+    overrideGlobalObjects: options.overrideGlobalObjects,
+    autoCleanupIncoming: options.autoCleanupIncoming
   });
   const createServer = options.createServer || createServerHTTP;
   const server = createServer(options.serverOptions || {}, requestListener);

package/dist/types.d.mts

@@ -35,6 +35,7 @@ type ServerOptions = createHttpOptions | createHttpsOptions | createHttp2Options
 type Options = {
     fetch: FetchCallback;
     overrideGlobalObjects?: boolean;
+    autoCleanupIncoming?: boolean;
     port?: number;
     hostname?: string;
 } & ServerOptions;

package/dist/types.d.ts

@@ -35,6 +35,7 @@ type ServerOptions = createHttpOptions | createHttpsOptions | createHttp2Options
 type Options = {
     fetch: FetchCallback;
     overrideGlobalObjects?: boolean;
+    autoCleanupIncoming?: boolean;
     port?: number;
     hostname?: string;
 } & ServerOptions;

package/dist/vercel.js

@@ -34,6 +34,9 @@ __export(vercel_exports, {
 });
 module.exports = __toCommonJS(vercel_exports);
 
+// src/listener.ts
+var import_node_http22 = require("http2");
+
 // src/request.ts
 var import_node_http2 = require("http2");
 var import_node_stream = require("stream");
@@ -62,6 +65,7 @@ var Request = class extends GlobalRequest {
     super(input, options);
   }
 };
+var wrapBodyStream = Symbol("wrapBodyStream");
 var newRequestFromIncoming = (method, url, incoming, abortController) => {
   const headerRecord = [];
   const rawHeaders = incoming.rawHeaders;
@@ -95,6 +99,23 @@ var newRequestFromIncoming = (method, url, incoming, abortController) => {
           controller.close();
         }
       });
+    } else if (incoming[wrapBodyStream]) {
+      let reader;
+      init.body = new ReadableStream({
+        async pull(controller) {
+          try {
+            reader ||= import_node_stream.Readable.toWeb(incoming).getReader();
+            const { done, value } = await reader.read();
+            if (done) {
+              controller.close();
+            } else {
+              controller.enqueue(value);
+            }
+          } catch (error) {
+            controller.error(error);
+          }
+        }
+      });
     } else {
       init.body = import_node_stream.Readable.toWeb(incoming);
     }
@@ -343,6 +364,7 @@ global.fetch = (info, init) => {
 };
 
 // src/listener.ts
+var outgoingEnded = Symbol("outgoingEnded");
 var regBuffer = /^no$/i;
 var regContentType = /^(application\/json\b|text\/(?!event-stream\b))/i;
 var handleRequestError = () => new Response(null, {
@@ -388,10 +410,12 @@ var responseViaCache = async (res, outgoing) => {
     outgoing.end(new Uint8Array(await body.arrayBuffer()));
   } else {
     flushHeaders(outgoing);
-    return writeFromReadableStream(body, outgoing)?.catch(
+    await writeFromReadableStream(body, outgoing)?.catch(
       (e) => handleResponseError(e, outgoing)
     );
   }
+  ;
+  outgoing[outgoingEnded]?.();
 };
 var responseViaResponseObject = async (res, outgoing, options = {}) => {
   if (res instanceof Promise) {
@@ -437,8 +461,11 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
     outgoing.writeHead(res.status, resHeaderRecord);
     outgoing.end();
   }
+  ;
+  outgoing[outgoingEnded]?.();
 };
 var getRequestListener = (fetchCallback, options = {}) => {
+  const autoCleanupIncoming = options.autoCleanupIncoming ?? true;
   if (options.overrideGlobalObjects !== false && global.Request !== Request) {
     Object.defineProperty(global, "Request", {
       value: Request
@@ -451,15 +478,46 @@ var getRequestListener = (fetchCallback, options = {}) => {
     let res, req;
     try {
       req = newRequest(incoming, options.hostname);
+      let incomingEnded = !autoCleanupIncoming || incoming.method === "GET" || incoming.method === "HEAD";
+      if (!incomingEnded) {
+        ;
+        incoming[wrapBodyStream] = true;
+        incoming.on("end", () => {
+          incomingEnded = true;
+        });
+        if (incoming instanceof import_node_http22.Http2ServerRequest) {
+          ;
+          outgoing[outgoingEnded] = () => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                if (!incomingEnded) {
+                  setTimeout(() => {
+                    incoming.destroy();
+                    outgoing.destroy();
+                  });
+                }
+              });
+            }
+          };
+        }
+      }
       outgoing.on("close", () => {
         const abortController = req[abortControllerKey];
-        if (!abortController) {
-          return;
+        if (abortController) {
+          if (incoming.errored) {
+            req[abortControllerKey].abort(incoming.errored.toString());
+          } else if (!outgoing.writableFinished) {
+            req[abortControllerKey].abort("Client connection prematurely closed.");
+          }
         }
-        if (incoming.errored) {
-          req[abortControllerKey].abort(incoming.errored.toString());
-        } else if (!outgoing.writableFinished) {
-          req[abortControllerKey].abort("Client connection prematurely closed.");
+        if (!incomingEnded) {
+          setTimeout(() => {
+            if (!incomingEnded) {
+              setTimeout(() => {
+                incoming.destroy();
+              });
+            }
+          });
         }
       });
       res = fetchCallback(req, { incoming, outgoing });