@st-gr/sail-proxy 0.9.2 → 0.9.3

package/bundled/gateway/node_modules/body-parser/node_modules/qs/test/utils.js

@@ -0,0 +1,136 @@
+'use strict';
+
+var test = require('tape');
+var inspect = require('object-inspect');
+var SaferBuffer = require('safer-buffer').Buffer;
+var forEach = require('for-each');
+var utils = require('../lib/utils');
+
+test('merge()', function (t) {
+    t.deepEqual(utils.merge(null, true), [null, true], 'merges true into null');
+
+    t.deepEqual(utils.merge(null, [42]), [null, 42], 'merges null into an array');
+
+    t.deepEqual(utils.merge({ a: 'b' }, { a: 'c' }), { a: ['b', 'c'] }, 'merges two objects with the same key');
+
+    var oneMerged = utils.merge({ foo: 'bar' }, { foo: { first: '123' } });
+    t.deepEqual(oneMerged, { foo: ['bar', { first: '123' }] }, 'merges a standalone and an object into an array');
+
+    var twoMerged = utils.merge({ foo: ['bar', { first: '123' }] }, { foo: { second: '456' } });
+    t.deepEqual(twoMerged, { foo: { 0: 'bar', 1: { first: '123' }, second: '456' } }, 'merges a standalone and two objects into an array');
+
+    var sandwiched = utils.merge({ foo: ['bar', { first: '123', second: '456' }] }, { foo: 'baz' });
+    t.deepEqual(sandwiched, { foo: ['bar', { first: '123', second: '456' }, 'baz'] }, 'merges an object sandwiched by two standalones into an array');
+
+    var nestedArrays = utils.merge({ foo: ['baz'] }, { foo: ['bar', 'xyzzy'] });
+    t.deepEqual(nestedArrays, { foo: ['baz', 'bar', 'xyzzy'] });
+
+    var noOptionsNonObjectSource = utils.merge({ foo: 'baz' }, 'bar');
+    t.deepEqual(noOptionsNonObjectSource, { foo: 'baz', bar: true });
+
+    t.test(
+        'avoids invoking array setters unnecessarily',
+        { skip: typeof Object.defineProperty !== 'function' },
+        function (st) {
+            var setCount = 0;
+            var getCount = 0;
+            var observed = [];
+            Object.defineProperty(observed, 0, {
+                get: function () {
+                    getCount += 1;
+                    return { bar: 'baz' };
+                },
+                set: function () { setCount += 1; }
+            });
+            utils.merge(observed, [null]);
+            st.equal(setCount, 0);
+            st.equal(getCount, 1);
+            observed[0] = observed[0]; // eslint-disable-line no-self-assign
+            st.equal(setCount, 1);
+            st.equal(getCount, 2);
+            st.end();
+        }
+    );
+
+    t.end();
+});
+
+test('assign()', function (t) {
+    var target = { a: 1, b: 2 };
+    var source = { b: 3, c: 4 };
+    var result = utils.assign(target, source);
+
+    t.equal(result, target, 'returns the target');
+    t.deepEqual(target, { a: 1, b: 3, c: 4 }, 'target and source are merged');
+    t.deepEqual(source, { b: 3, c: 4 }, 'source is untouched');
+
+    t.end();
+});
+
+test('combine()', function (t) {
+    t.test('both arrays', function (st) {
+        var a = [1];
+        var b = [2];
+        var combined = utils.combine(a, b);
+
+        st.deepEqual(a, [1], 'a is not mutated');
+        st.deepEqual(b, [2], 'b is not mutated');
+        st.notEqual(a, combined, 'a !== combined');
+        st.notEqual(b, combined, 'b !== combined');
+        st.deepEqual(combined, [1, 2], 'combined is a + b');
+
+        st.end();
+    });
+
+    t.test('one array, one non-array', function (st) {
+        var aN = 1;
+        var a = [aN];
+        var bN = 2;
+        var b = [bN];
+
+        var combinedAnB = utils.combine(aN, b);
+        st.deepEqual(b, [bN], 'b is not mutated');
+        st.notEqual(aN, combinedAnB, 'aN + b !== aN');
+        st.notEqual(a, combinedAnB, 'aN + b !== a');
+        st.notEqual(bN, combinedAnB, 'aN + b !== bN');
+        st.notEqual(b, combinedAnB, 'aN + b !== b');
+        st.deepEqual([1, 2], combinedAnB, 'first argument is array-wrapped when not an array');
+
+        var combinedABn = utils.combine(a, bN);
+        st.deepEqual(a, [aN], 'a is not mutated');
+        st.notEqual(aN, combinedABn, 'a + bN !== aN');
+        st.notEqual(a, combinedABn, 'a + bN !== a');
+        st.notEqual(bN, combinedABn, 'a + bN !== bN');
+        st.notEqual(b, combinedABn, 'a + bN !== b');
+        st.deepEqual([1, 2], combinedABn, 'second argument is array-wrapped when not an array');
+
+        st.end();
+    });
+
+    t.test('neither is an array', function (st) {
+        var combined = utils.combine(1, 2);
+        st.notEqual(1, combined, '1 + 2 !== 1');
+        st.notEqual(2, combined, '1 + 2 !== 2');
+        st.deepEqual([1, 2], combined, 'both arguments are array-wrapped when not an array');
+
+        st.end();
+    });
+
+    t.end();
+});
+
+test('isBuffer()', function (t) {
+    forEach([null, undefined, true, false, '', 'abc', 42, 0, NaN, {}, [], function () {}, /a/g], function (x) {
+        t.equal(utils.isBuffer(x), false, inspect(x) + ' is not a buffer');
+    });
+
+    var fakeBuffer = { constructor: Buffer };
+    t.equal(utils.isBuffer(fakeBuffer), false, 'fake buffer is not a buffer');
+
+    var saferBuffer = SaferBuffer.from('abc');
+    t.equal(utils.isBuffer(saferBuffer), true, 'SaferBuffer instance is a buffer');
+
+    var buffer = Buffer.from && Buffer.alloc ? Buffer.from('abc') : new Buffer('abc');
+    t.equal(utils.isBuffer(buffer), true, 'real Buffer instance is a buffer');
+    t.end();
+});

package/bundled/gateway/node_modules/body-parser/package.json

@@ -1,7 +1,7 @@
 {
   "name": "body-parser",
   "description": "Node.js body parsing middleware",
-  "version": "1.20.5",
+  "version": "1.20.3",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>",
     "Jonathan Ong <me@jongleberry.com> (http://jongleberry.com)"
@@ -9,18 +9,18 @@
   "license": "MIT",
   "repository": "expressjs/body-parser",
   "dependencies": {
-    "bytes": "~3.1.2",
+    "bytes": "3.1.2",
     "content-type": "~1.0.5",
     "debug": "2.6.9",
     "depd": "2.0.0",
-    "destroy": "~1.2.0",
-    "http-errors": "~2.0.1",
-    "iconv-lite": "~0.4.24",
-    "on-finished": "~2.4.1",
-    "qs": "~6.15.1",
-    "raw-body": "~2.5.3",
+    "destroy": "1.2.0",
+    "http-errors": "2.0.0",
+    "iconv-lite": "0.4.24",
+    "on-finished": "2.4.1",
+    "qs": "6.13.0",
+    "raw-body": "2.5.2",
     "type-is": "~1.6.18",
-    "unpipe": "~1.0.0"
+    "unpipe": "1.0.0"
   },
   "devDependencies": {
     "eslint": "8.34.0",
@@ -40,6 +40,7 @@
     "lib/",
     "LICENSE",
     "HISTORY.md",
+    "SECURITY.md",
     "index.js"
   ],
   "engines": {

package/bundled/gateway/node_modules/cookie/index.js

@@ -21,7 +21,6 @@ exports.serialize = serialize;
  */
 
 var __toString = Object.prototype.toString
-var __hasOwnProperty = Object.prototype.hasOwnProperty
 
 /**
  * RegExp to match cookie-name in RFC 6265 sec 4.1.1
@@ -65,15 +64,9 @@ var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u00
  * <letter>          = any one of the 52 alphabetic characters A through Z in
  *                     upper case and a through z in lower case
  * <digit>           = any one of the ten digits 0 through 9
- *
- * Keep support for leading dot: https://github.com/jshttp/cookie/issues/173
- *
- * > (Note that a leading %x2E ("."), if present, is ignored even though that
- * character is not permitted, but a trailing %x2E ("."), if present, will
- * cause the user agent to ignore the attribute.)
  */
 
-var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+var domainValueRegExp = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
 
 /**
  * RegExp to match path-value in RFC 6265 sec 4.1.1
@@ -92,12 +85,12 @@ var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
  * The object has the various cookies as keys(names) => values
  *
  * @param {string} str
- * @param {object} [opt]
+ * @param {object} [options]
  * @return {object}
  * @public
  */
 
-function parse(str, opt) {
+function parse(str, options) {
   if (typeof str !== 'string') {
     throw new TypeError('argument str must be a string');
   }
@@ -105,16 +98,21 @@ function parse(str, opt) {
   var obj = {};
   var len = str.length;
   // RFC 6265 sec 4.1.1, RFC 2616 2.2 defines a cookie name consists of one char minimum, plus '='.
-  if (len < 2) return obj;
+  var max = len - 2;
+  if (max < 0) return obj;
 
-  var dec = (opt && opt.decode) || decode;
+  var dec = (options && options.decode) || decode;
   var index = 0;
   var eqIdx = 0;
   var endIdx = 0;
 
   do {
     eqIdx = str.indexOf('=', index);
-    if (eqIdx === -1) break; // No more cookie pairs.
+
+    // no more cookie pairs
+    if (eqIdx === -1) {
+      break;
+    }
 
     endIdx = str.indexOf(';', index);
 
@@ -131,7 +129,7 @@ function parse(str, opt) {
     var key = str.slice(keyStartIdx, keyEndIdx);
 
     // only assign once
-    if (!__hasOwnProperty.call(obj, key)) {
+    if (undefined === obj[key]) {
       var valStartIdx = startIndex(str, eqIdx + 1, endIdx);
       var valEndIdx = endIndex(str, endIdx, valStartIdx);
 
@@ -145,7 +143,7 @@ function parse(str, opt) {
     }
 
     index = endIdx + 1
-  } while (index < len);
+  } while (index < max);
 
   return obj;
 }
@@ -177,13 +175,14 @@ function endIndex(str, index, min) {
  *
  * @param {string} name
  * @param {string} val
- * @param {object} [opt]
+ * @param {object} [options]
  * @return {string}
  * @public
  */
 
-function serialize(name, val, opt) {
-  var enc = (opt && opt.encode) || encodeURIComponent;
+function serialize(name, val, options) {
+  var opt = options || {};
+  var enc = opt.encode || encode;
 
   if (typeof enc !== 'function') {
     throw new TypeError('option encode is invalid');
@@ -195,21 +194,20 @@ function serialize(name, val, opt) {
 
   var value = enc(val);
 
-  if (!cookieValueRegExp.test(value)) {
+  if (value && !cookieValueRegExp.test(value)) {
     throw new TypeError('argument val is invalid');
   }
 
   var str = name + '=' + value;
-  if (!opt) return str;
 
   if (null != opt.maxAge) {
-    var maxAge = Math.floor(opt.maxAge);
+    var maxAge = opt.maxAge - 0;
 
     if (!isFinite(maxAge)) {
       throw new TypeError('option maxAge is invalid')
     }
 
-    str += '; Max-Age=' + maxAge;
+    str += '; Max-Age=' + Math.floor(maxAge);
   }
 
   if (opt.domain) {
@@ -252,7 +250,8 @@ function serialize(name, val, opt) {
 
   if (opt.priority) {
     var priority = typeof opt.priority === 'string'
-      ? opt.priority.toLowerCase() : opt.priority;
+      ? opt.priority.toLowerCase()
+      : opt.priority
 
     switch (priority) {
       case 'low':
@@ -307,6 +306,17 @@ function decode (str) {
     : str
 }
 
+/**
+ * URL-encode value.
+ *
+ * @param {string} val
+ * @returns {string}
+ */
+
+function encode (val) {
+  return encodeURIComponent(val)
+}
+
 /**
  * Determine if value is a Date.
  *
@@ -315,7 +325,8 @@ function decode (str) {
  */
 
 function isDate (val) {
-  return __toString.call(val) === '[object Date]';
+  return __toString.call(val) === '[object Date]' ||
+    val instanceof Date
 }
 
 /**

package/bundled/gateway/node_modules/cookie/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cookie",
   "description": "HTTP server cookie parsing and serialization",
-  "version": "0.7.2",
+  "version": "0.7.0",
   "author": "Roman Shtylman <shtylman@gmail.com>",
   "contributors": [
     "Douglas Christopher Wilson <doug@somethingdoug.com>"

package/bundled/gateway/node_modules/cookie-signature/History.md

@@ -1,14 +1,10 @@
-1.0.7 / 2023-04-12
-==================
-
-* backport the buffer support from the 1.2.x release branch (thanks @FadhiliNjagi!)
-
 1.0.6 / 2015-02-03
 ==================
 
 * use `npm test` instead of `make test` to run tests
 * clearer assertion messages when checking input
 
+
 1.0.5 / 2014-09-05
 ==================
 

package/bundled/gateway/node_modules/cookie-signature/index.js

@@ -8,14 +8,14 @@ var crypto = require('crypto');
  * Sign the given `val` with `secret`.
  *
  * @param {String} val
- * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret
+ * @param {String} secret
  * @return {String}
  * @api private
  */
 
 exports.sign = function(val, secret){
-  if ('string' !== typeof val) throw new TypeError("Cookie value must be provided as a string.");
-  if (null == secret) throw new TypeError("Secret key must be provided.");
+  if ('string' != typeof val) throw new TypeError("Cookie value must be provided as a string.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
   return val + '.' + crypto
     .createHmac('sha256', secret)
     .update(val)
@@ -28,14 +28,14 @@ exports.sign = function(val, secret){
  * returning `false` if the signature is invalid.
  *
  * @param {String} val
- * @param {String|NodeJS.ArrayBufferView|crypto.KeyObject} secret
+ * @param {String} secret
  * @return {String|Boolean}
  * @api private
  */
 
 exports.unsign = function(val, secret){
-  if ('string' !== typeof val) throw new TypeError("Signed cookie string must be provided.");
-  if (null == secret) throw new TypeError("Secret key must be provided.");
+  if ('string' != typeof val) throw new TypeError("Signed cookie string must be provided.");
+  if ('string' != typeof secret) throw new TypeError("Secret string must be provided.");
   var str = val.slice(0, val.lastIndexOf('.'))
     , mac = exports.sign(str, secret);
   

package/bundled/gateway/node_modules/cookie-signature/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cookie-signature",
-  "version": "1.0.7",
+  "version": "1.0.6",
   "description": "Sign and unsign cookies",
   "keywords": ["cookie", "sign", "unsign"],
   "author": "TJ Holowaychuk <tj@learnboost.com>",
@@ -15,4 +15,4 @@
     "test": "mocha --require should --reporter spec"
   },
   "main": "index"
-}
+}

package/bundled/gateway/node_modules/express/History.md

@@ -1,46 +1,3 @@
-4.22.2 / 2026-05-011
-==========
-
-* fix: restore >20 array parsing for `req.query` repeated keys ([`8d09bfe6`](https://github.com/expressjs/express/commit/8d09bfe6d88983da5c3e12cfdd54782c4dc675db))
-  * This also unifies array-cap behavior across notations. Indexed notation (`a[0]=...`) was historically capped at qs's default `arrayLimit` of 20 even in older qs versions; after this change it also allows up to 1000 items.
-* deps: qs@~6.15.1
-* deps: body-parser@~1.20.5
-
-4.22.1 / 2025-12-01
-==========
-
-  * Revert security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))
-    * The prior release (4.22.0) included an erroneous breaking change related to the extended query parser. There is no actual security vulnerability associated with this behavior (CVE-2024-51999 has been rejected). The change has been fully reverted in this release.
-
-4.22.0 / 2025-12-01
-==========
-  * Security fix for [CVE-2024-51999](https://www.cve.org/CVERecord?id=CVE-2024-51999) ([GHSA-pj86-cfqh-vqx6](https://github.com/expressjs/express/security/advisories/GHSA-pj86-cfqh-vqx6))
-  * deps: use tilde notation for dependencies
-  * deps: qs@6.14.0
-
-4.21.2 / 2024-11-06
-==========
-
-  * deps: path-to-regexp@0.1.12
-    - Fix backtracking protection
-  * deps: path-to-regexp@0.1.11
-    - Throws an error on invalid path values
-
-4.21.1 / 2024-10-08
-==========
-
-  * Backported a fix for [CVE-2024-47764](https://nvd.nist.gov/vuln/detail/CVE-2024-47764)
-
-
-4.21.0 / 2024-09-11
-==========
-
-  * Deprecate `res.location("back")` and `res.redirect("back")` magic string
-  * deps: serve-static@1.16.2
-    * includes send@0.19.0
-  * deps: finalhandler@1.3.1
-  * deps: qs@6.13.0
-
 4.20.0 / 2024-09-10
 ==========
   * deps: serve-static@0.16.0

package/bundled/gateway/node_modules/express/lib/response.js

@@ -916,7 +916,6 @@ res.location = function location(url) {
 
   // "back" is an alias for the referrer
   if (url === 'back') {
-    deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
     loc = this.req.get('Referrer') || '/';
   } else {
     loc = String(url);

package/bundled/gateway/node_modules/express/lib/utils.js

@@ -287,8 +287,7 @@ function createETagGenerator (options) {
 
 function parseExtendedQueryString(str) {
   return qs.parse(str, {
-    allowPrototypes: true,
-    arrayLimit: 1000
+    allowPrototypes: true
   });
 }
 

package/bundled/gateway/node_modules/express/node_modules/qs/.editorconfig

@@ -0,0 +1,43 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+max_line_length = 160
+quote_type = single
+
+[test/*]
+max_line_length = off
+
+[LICENSE.md]
+indent_size = off
+
+[*.md]
+max_line_length = off
+
+[*.json]
+max_line_length = off
+
+[Makefile]
+max_line_length = off
+
+[CHANGELOG.md]
+indent_style = space
+indent_size = 2
+
+[LICENSE]
+indent_size = 2
+max_line_length = off
+
+[coverage/**/*]
+indent_size = off
+indent_style = off
+indent = off
+max_line_length = off
+
+[.nycrc]
+indent_style = tab

package/bundled/gateway/node_modules/express/node_modules/qs/.eslintrc

@@ -0,0 +1,38 @@
+{
+    "root": true,
+
+    "extends": "@ljharb",
+
+    "ignorePatterns": [
+        "dist/",
+    ],
+
+    "rules": {
+        "complexity": 0,
+        "consistent-return": 1,
+        "func-name-matching": 0,
+        "id-length": [2, { "min": 1, "max": 25, "properties": "never" }],
+        "indent": [2, 4],
+        "max-lines-per-function": [2, { "max": 150 }],
+        "max-params": [2, 16],
+        "max-statements": [2, 53],
+        "multiline-comment-style": 0,
+        "no-continue": 1,
+        "no-magic-numbers": 0,
+        "no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],
+    },
+
+    "overrides": [
+        {
+            "files": "test/**",
+            "rules": {
+                "function-paren-newline": 0,
+                "max-lines-per-function": 0,
+                "max-statements": 0,
+                "no-buffer-constructor": 0,
+                "no-extend-native": 0,
+                "no-throw-literal": 0,
+            },
+        },
+    ],
+}

package/bundled/gateway/node_modules/express/node_modules/qs/.github/FUNDING.yml

@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: [ljharb]
+patreon: # Replace with a single Patreon username
+open_collective: # Replace with a single Open Collective username
+ko_fi: # Replace with a single Ko-fi username
+tidelift: npm/qs
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: # Replace with a single custom sponsorship URL

package/bundled/gateway/node_modules/express/node_modules/qs/.nycrc

@@ -0,0 +1,13 @@
+{
+	"all": true,
+	"check-coverage": false,
+	"reporter": ["text-summary", "text", "html", "json"],
+	"lines": 86,
+	"statements": 85.93,
+	"functions": 82.43,
+	"branches": 76.06,
+	"exclude": [
+		"coverage",
+		"dist"
+	]
+}