@xhmikosr/downloader 16.1.3 → 16.3.0

package/index.js

@@ -1,14 +1,15 @@
+import {createHash} from 'node:crypto';
 import events from 'node:events';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import process from 'node:process';
+import {buffer, text} from 'node:stream/consumers';
 import {parse} from 'content-disposition';
 import archiveType from '@xhmikosr/archive-type';
 import decompress from '@xhmikosr/decompress';
 import extName from 'ext-name';
 import {fileTypeFromBuffer} from 'file-type';
 import filenamify from 'filenamify';
-import getStream, {getStreamAsBuffer} from 'get-stream';
 import got from 'got';
 
 const defaultGotOptions = {
@@ -63,6 +64,31 @@ const filterEvents = async (emitter, event) => {
 	}
 };
 
+const verifyHash = (data, hash) => {
+	if (!hash) {
+		return;
+	}
+
+	const colon = typeof hash === 'string' ? hash.indexOf(':') : -1;
+	const algorithm = colon === -1 ? '' : hash.slice(0, colon);
+	const value = colon === -1 ? '' : hash.slice(colon + 1);
+
+	if (!algorithm || !value) {
+		throw new Error('Invalid `hash` option, expected "<algorithm>:<hex>".');
+	}
+
+	let actual;
+	try {
+		actual = createHash(algorithm).update(data).digest('hex');
+	} catch {
+		throw new Error(`Unsupported hash algorithm: ${algorithm}`);
+	}
+
+	if (actual.toLowerCase() !== value.toLowerCase()) {
+		throw new Error(`Hash mismatch, expected ${algorithm} ${value.toLowerCase()} but got ${actual}`);
+	}
+};
+
 const mergeDefinedOptions = (defaults, overrides = {}) => {
 	const merged = {...defaults};
 
@@ -91,9 +117,11 @@ const download = (uri, output, options = {}) => {
 
 	const promise = (async () => {
 		const response = await filterEvents(stream, 'response');
-		const streamData = options.got.responseType === 'buffer' ? getStreamAsBuffer(stream) : getStream(stream);
+		const streamData = options.got.responseType === 'buffer' ? buffer(stream) : text(stream);
 		const data = await streamData;
 
+		verifyHash(data, options.hash);
+
 		const hasArchiveData = options.extract && await archiveType(data);
 
 		if (!output) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@xhmikosr/downloader",
-	"version": "16.1.3",
+	"version": "16.3.0",
 	"description": "Download and extract files",
 	"license": "MIT",
 	"repository": {
@@ -42,26 +42,29 @@
 		"url"
 	],
 	"dependencies": {
-		"@xhmikosr/archive-type": "^8.0.1",
+		"@xhmikosr/archive-type": "^8.1.0",
 		"@xhmikosr/decompress": "^11.1.3",
 		"content-disposition": "^2.0.1",
 		"ext-name": "^5.0.0",
 		"file-type": "^21.3.4",
-		"filenamify": "^7.0.1",
-		"get-stream": "^9.0.1",
+		"filenamify": "^7.0.2",
 		"got": "^14.6.6"
 	},
 	"devDependencies": {
-		"@xhmikosr/decompress-unzip": "^8.1.1",
+		"@xhmikosr/decompress-unzip": "^8.2.1",
 		"ava": "^7.0.0",
 		"c8": "^11.0.0",
-		"nock": "^14.0.15",
+		"nock": "^14.0.16",
 		"xo": "^2.0.2"
 	},
 	"xo": {
 		"rules": {
 			"promise/prefer-await-to-then": "off",
+			"require-unicode-regexp": "off",
 			"unicorn/prevent-abbreviations": "off"
 		}
+	},
+	"allowScripts": {
+		"unrs-resolver@1.11.1": true
 	}
 }

package/readme.md

@@ -36,7 +36,7 @@ To work with proxies, read the [`got documentation`](https://github.com/sindreso
 
 ### SSL
 
-TLS certificate verification is enabled by default. It honors npm's [`strict-ssl`](https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl) config, so running `npm config set strict-ssl false` disables it for self-signed certificates or proxy setups. Override per call with [`options.got.https.rejectUnauthorized`]https://github.com/sindresorhus/got/blob/v14.6.6/documentation/5-https.md).
+TLS certificate verification is enabled by default. It honors npm's [`strict-ssl`](https://docs.npmjs.com/cli/v11/using-npm/config#strict-ssl) config, so running `npm config set strict-ssl false` disables it for self-signed certificates or proxy setups. Override per call with [`options.got.https.rejectUnauthorized`](https://github.com/sindresorhus/got/blob/v14.6.6/documentation/5-https.md).
 
 ## API
 
@@ -80,3 +80,15 @@ If set to `true`, try extracting the file using [`decompress`](https://github.co
 Type: `string`
 
 Name of the saved file.
+
+##### options.hash
+
+Type: `string`
+
+Expected hash of the downloaded data as `"<algorithm>:<hex>"`, checked before it's extracted or written. A mismatch throws. `algorithm` is any digest [`crypto.createHash`](https://nodejs.org/api/crypto.html#cryptocreatehashalgorithm-options) accepts.
+
+```js
+await download('http://unicorn.com/foo.tar.gz', 'dist', {
+	hash: 'sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08'
+});
+```