@suveren/gateway 0.7.3 → 0.7.6

package/node_modules/hono/dist/types/utils/url.d.ts

@@ -19,6 +19,10 @@ export declare const tryDecode: (str: string, decoder: Decoder) => string;
  */
 export declare const tryDecodeURI: (str: string) => string;
 export declare const getPath: (request: Request) => string;
+/**
+ * @deprecated
+ * Use the `URL` API instead.
+ */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
 /**

package/node_modules/hono/dist/utils/body.js

@@ -1,5 +1,7 @@
 // src/utils/body.ts
 import { bufferToFormData } from "./buffer.js";
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -32,6 +34,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -44,7 +47,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -67,23 +70,32 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 export {
   parseBody
 };

package/node_modules/hono/dist/utils/cookie.js

@@ -77,7 +77,7 @@ var parseSigned = async (cookie, secret, name) => {
   const secretKey = await getCryptoKey(secret);
   for (const [key, value] of Object.entries(parse(cookie, name))) {
     const signatureStartPos = value.lastIndexOf(".");
-    if (signatureStartPos < 1) {
+    if (signatureStartPos < 0) {
       continue;
     }
     const signedValue = value.substring(0, signatureStartPos);

package/node_modules/hono/dist/utils/ipaddr.js

@@ -1,12 +1,14 @@
 // src/utils/ipaddr.ts
 var expandIPv6 = (ipV6) => {
   const sections = ipV6.split(":");
-  if (IPV4_REGEX.test(sections.at(-1))) {
+  const lastSection = sections.at(-1);
+  if (IPV4_REGEX.test(lastSection)) {
+    const octets = lastSection.split(".").map(Number);
     sections.splice(
       -1,
       1,
-      ...convertIPv6BinaryToString(convertIPv4ToBinary(sections.at(-1))).substring(2).split(":")
-      // => ['7f00', '0001']
+      (octets[0] << 8 | octets[1]).toString(16),
+      (octets[2] << 8 | octets[3]).toString(16)
     );
   }
   for (let i = 0; i < sections.length; i++) {

package/node_modules/hono/dist/utils/stream.js

@@ -75,7 +75,13 @@ var StreamingApi = class {
   abort() {
     if (!this.aborted) {
       this.aborted = true;
-      this.abortSubscribers.forEach((subscriber) => subscriber());
+      this.abortSubscribers.forEach((subscriber) => {
+        try {
+          void Promise.resolve(subscriber()).catch(() => {
+          });
+        } catch {
+        }
+      });
     }
   }
 };

package/node_modules/hono/dist/utils/url.js

@@ -85,7 +85,11 @@ var getPath = (request) => {
 };
 var getQueryStrings = (url) => {
   const queryIndex = url.indexOf("?", 8);
-  return queryIndex === -1 ? "" : "?" + url.slice(queryIndex + 1);
+  if (queryIndex === -1) {
+    return "";
+  }
+  const hashIndex = url.indexOf("#", 8);
+  return hashIndex === -1 ? url.slice(queryIndex) : queryIndex < hashIndex ? url.slice(queryIndex, hashIndex) : "";
 };
 var getPathNoStrict = (request) => {
   const result = getPath(request);
@@ -108,13 +112,13 @@ var checkOptionalParameter = (path) => {
     if (segment !== "" && !/\:/.test(segment)) {
       basePath += "/" + segment;
     } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+      if (segment.charCodeAt(segment.length - 1) === 63) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment.slice(0, -1);
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {
@@ -132,6 +136,10 @@ var _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 var _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.1",
+  "version": "4.13.5",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",