@hono/node-server 1.16.0 → 1.17.0

package/README.md

@@ -128,6 +128,7 @@ serve({
 ### `autoCleanupIncoming`
 
 The default value is `true`. The Node.js Adapter automatically cleans up (explicitly call `destroy()` method) if application is not finished to consume the incoming request. If you don't want to do that, set `false`.
+
 If the application accepts connections from arbitrary clients, this cleanup must be done otherwise incomplete requests from clients may cause the application to stop responding. If your application only accepts connections from trusted clients, such as in a reverse proxy environment and there is no process that returns a response without reading the body of the POST request all the way through, you can improve performance by setting it to `false`.
 
 ```ts
@@ -167,7 +168,7 @@ import { serveStatic } from '@hono/node-server/serve-static'
 app.use('/static/*', serveStatic({ root: './' }))
 ```
 
-Note that `root` must be _relative_ to the current working directory from which the app was started. Absolute paths are not supported.
+If using a relative path, `root` will be relative to the current working directory from which the app was started.
 
 This can cause confusion when running your application locally.
 

package/dist/globals.d.mts

@@ -1,2 +1,2 @@
 
-export { }
+export {  }

package/dist/globals.d.ts

@@ -1,2 +1,2 @@
 
-export { }
+export {  }

package/dist/request.d.mts

@@ -22,4 +22,4 @@ declare const abortControllerKey: unique symbol;
 declare const getAbortController: unique symbol;
 declare const newRequest: (incoming: IncomingMessage | Http2ServerRequest, defaultHostname?: string) => any;
 
-export { GlobalRequest, IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };
+export { GlobalRequest, type IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };

package/dist/request.d.ts

@@ -22,4 +22,4 @@ declare const abortControllerKey: unique symbol;
 declare const getAbortController: unique symbol;
 declare const newRequest: (incoming: IncomingMessage | Http2ServerRequest, defaultHostname?: string) => any;
 
-export { GlobalRequest, IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };
+export { GlobalRequest, type IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };

package/dist/response.d.mts

@@ -23,4 +23,4 @@ declare class Response {
     get ok(): boolean;
 }
 
-export { GlobalResponse, InternalCache, Response, cacheKey };
+export { GlobalResponse, type InternalCache, Response, cacheKey };

package/dist/response.d.ts

@@ -23,4 +23,4 @@ declare class Response {
     get ok(): boolean;
 }
 
-export { GlobalResponse, InternalCache, Response, cacheKey };
+export { GlobalResponse, type InternalCache, Response, cacheKey };

package/dist/serve-static.d.mts

@@ -14,4 +14,4 @@ type ServeStaticOptions<E extends Env = Env> = {
 };
 declare const serveStatic: <E extends Env = any>(options?: ServeStaticOptions<E>) => MiddlewareHandler<E>;
 
-export { ServeStaticOptions, serveStatic };
+export { type ServeStaticOptions, serveStatic };

package/dist/serve-static.d.ts

@@ -14,4 +14,4 @@ type ServeStaticOptions<E extends Env = Env> = {
 };
 declare const serveStatic: <E extends Env = any>(options?: ServeStaticOptions<E>) => MiddlewareHandler<E>;
 
-export { ServeStaticOptions, serveStatic };
+export { type ServeStaticOptions, serveStatic };

package/dist/serve-static.js

@@ -23,9 +23,9 @@ __export(serve_static_exports, {
   serveStatic: () => serveStatic
 });
 module.exports = __toCommonJS(serve_static_exports);
-var import_filepath = require("hono/utils/filepath");
 var import_mime = require("hono/utils/mime");
 var import_node_fs = require("fs");
+var import_node_path = require("path");
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -49,9 +49,6 @@ var createStreamBody = (stream) => {
   });
   return body;
 };
-var addCurrentDirPrefix = (path) => {
-  return `./${path}`;
-};
 var getStats = (path) => {
   let stats;
   try {
@@ -61,36 +58,35 @@ var getStats = (path) => {
   return stats;
 };
 var serveStatic = (options = { root: "" }) => {
+  const root = (0, import_node_path.resolve)(options.root || ".");
+  const optionPath = options.path;
   return async (c, next) => {
     if (c.finalized) {
       return next();
     }
     let filename;
     try {
-      filename = options.path ?? decodeURIComponent(c.req.path);
+      const rawPath = optionPath ?? c.req.path;
+      if (!optionPath) {
+        const decodedPath = decodeURIComponent(rawPath);
+        if (decodedPath.includes("..")) {
+          await options.onNotFound?.(rawPath, c);
+          return next();
+        }
+      }
+      filename = optionPath ?? decodeURIComponent(c.req.path);
     } catch {
       await options.onNotFound?.(c.req.path, c);
       return next();
     }
-    let path = (0, import_filepath.getFilePathWithoutDefaultDocument)({
-      filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-      root: options.root
-    });
-    if (path) {
-      path = addCurrentDirPrefix(path);
-    } else {
-      return next();
-    }
+    const requestPath = options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename;
+    let path = optionPath ? options.root ? (0, import_node_path.resolve)((0, import_node_path.join)(root, optionPath)) : optionPath : (0, import_node_path.resolve)((0, import_node_path.join)(root, requestPath));
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
-      path = (0, import_filepath.getFilePath)({
-        filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-        root: options.root,
-        defaultDocument: options.index ?? "index.html"
-      });
-      if (path) {
-        path = addCurrentDirPrefix(path);
-      } else {
+      const indexFile = options.index ?? "index.html";
+      path = (0, import_node_path.resolve)((0, import_node_path.join)(path, indexFile));
+      if (!optionPath && !path.startsWith(root)) {
+        await options.onNotFound?.(path, c);
         return next();
       }
       stats = getStats(path);

package/dist/serve-static.mjs

@@ -1,7 +1,7 @@
 // src/serve-static.ts
-import { getFilePath, getFilePathWithoutDefaultDocument } from "hono/utils/filepath";
 import { getMimeType } from "hono/utils/mime";
 import { createReadStream, lstatSync } from "fs";
+import { join, resolve } from "path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
 var ENCODINGS = {
   br: ".br",
@@ -25,9 +25,6 @@ var createStreamBody = (stream) => {
   });
   return body;
 };
-var addCurrentDirPrefix = (path) => {
-  return `./${path}`;
-};
 var getStats = (path) => {
   let stats;
   try {
@@ -37,36 +34,35 @@ var getStats = (path) => {
   return stats;
 };
 var serveStatic = (options = { root: "" }) => {
+  const root = resolve(options.root || ".");
+  const optionPath = options.path;
   return async (c, next) => {
     if (c.finalized) {
       return next();
     }
     let filename;
     try {
-      filename = options.path ?? decodeURIComponent(c.req.path);
+      const rawPath = optionPath ?? c.req.path;
+      if (!optionPath) {
+        const decodedPath = decodeURIComponent(rawPath);
+        if (decodedPath.includes("..")) {
+          await options.onNotFound?.(rawPath, c);
+          return next();
+        }
+      }
+      filename = optionPath ?? decodeURIComponent(c.req.path);
     } catch {
       await options.onNotFound?.(c.req.path, c);
       return next();
     }
-    let path = getFilePathWithoutDefaultDocument({
-      filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-      root: options.root
-    });
-    if (path) {
-      path = addCurrentDirPrefix(path);
-    } else {
-      return next();
-    }
+    const requestPath = options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename;
+    let path = optionPath ? options.root ? resolve(join(root, optionPath)) : optionPath : resolve(join(root, requestPath));
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
-      path = getFilePath({
-        filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-        root: options.root,
-        defaultDocument: options.index ?? "index.html"
-      });
-      if (path) {
-        path = addCurrentDirPrefix(path);
-      } else {
+      const indexFile = options.index ?? "index.html";
+      path = resolve(join(path, indexFile));
+      if (!optionPath && !path.startsWith(root)) {
+        await options.onNotFound?.(path, c);
         return next();
       }
       stats = getStats(path);

package/dist/types.d.mts

@@ -1,5 +1,5 @@
-import { IncomingMessage, ServerResponse, Server, ServerOptions as ServerOptions$1, createServer } from 'node:http';
-import { Http2ServerRequest, Http2ServerResponse, Http2Server, Http2SecureServer, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer } from 'node:http2';
+import { IncomingMessage, ServerResponse, ServerOptions as ServerOptions$1, createServer, Server } from 'node:http';
+import { Http2ServerRequest, Http2ServerResponse, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer, Http2Server, Http2SecureServer } from 'node:http2';
 import { ServerOptions as ServerOptions$2, createServer as createServer$1 } from 'node:https';
 
 type HttpBindings = {
@@ -41,4 +41,4 @@ type Options = {
 } & ServerOptions;
 type CustomErrorHandler = (err: unknown) => void | Response | Promise<void | Response>;
 
-export { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };
+export type { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };

package/dist/types.d.ts

@@ -1,5 +1,5 @@
-import { IncomingMessage, ServerResponse, Server, ServerOptions as ServerOptions$1, createServer } from 'node:http';
-import { Http2ServerRequest, Http2ServerResponse, Http2Server, Http2SecureServer, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer } from 'node:http2';
+import { IncomingMessage, ServerResponse, ServerOptions as ServerOptions$1, createServer, Server } from 'node:http';
+import { Http2ServerRequest, Http2ServerResponse, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer, Http2Server, Http2SecureServer } from 'node:http2';
 import { ServerOptions as ServerOptions$2, createServer as createServer$1 } from 'node:https';
 
 type HttpBindings = {
@@ -41,4 +41,4 @@ type Options = {
 } & ServerOptions;
 type CustomErrorHandler = (err: unknown) => void | Response | Promise<void | Response>;
 
-export { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };
+export type { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };

package/dist/utils.d.mts

@@ -1,7 +1,7 @@
 import { OutgoingHttpHeaders } from 'node:http';
 import { Writable } from 'node:stream';
 
-declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<void> | undefined;
+declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<undefined> | undefined;
 declare const buildOutgoingHttpHeaders: (headers: Headers | HeadersInit | null | undefined) => OutgoingHttpHeaders;
 
 export { buildOutgoingHttpHeaders, writeFromReadableStream };

package/dist/utils.d.ts

@@ -1,7 +1,7 @@
 import { OutgoingHttpHeaders } from 'node:http';
 import { Writable } from 'node:stream';
 
-declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<void> | undefined;
+declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<undefined> | undefined;
 declare const buildOutgoingHttpHeaders: (headers: Headers | HeadersInit | null | undefined) => OutgoingHttpHeaders;
 
 export { buildOutgoingHttpHeaders, writeFromReadableStream };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hono/node-server",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Node.js Adapter for Hono",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -54,7 +54,7 @@
     }
   },
   "scripts": {
-    "test": "node --expose-gc ./node_modules/.bin/jest",
+    "test": "node --expose-gc node_modules/jest/bin/jest.js",
     "build": "tsup --external hono",
     "watch": "tsup --watch",
     "postbuild": "publint",