elysia 1.4.29 → 1.4.31

package/SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+**Do not open a public issue for security vulnerabilities.**
+
+Please report privately via [GitHub Security Advisories](https://github.com/elysiajs/elysia/security/advisories/new).
+
+Please include:
+
+- A description of the vulnerability and its impact
+- A minimal reproduction (an `Elysia` app + the request that triggers it)
+- The affected version(s)
+
+You should receive an initial response within 7 days. Once confirmed, a fix will be developed privately and released with a coordinated advisory. Credit is given to reporters unless anonymity is requested.
+
+The advisory will be published publicly once patch is published after ~7 days and the issue will be closed. If you have any questions, please contact maintainers eg. [saltyaom@gmail.com](mailto:saltyaom@gmail.com).
+
+## Scope
+
+In scope:
+
+- The `elysia` package (this repository)
+
+Out of scope:
+
+- Official plugins and ecosystem packages (report to their own repositories under [elysiajs](https://github.com/elysiajs))
+- Vulnerabilities in Bun or other runtimes
+- Issues requiring a malicious or misconfigured application (e.g. developer-controlled schemas or handlers), unless they cross a trust boundary for end-user input

package/dist/adapter/bun/compose.js

@@ -19,7 +19,11 @@ __export(compose_exports, {
 });
 module.exports = __toCommonJS(compose_exports);
 var import_handler = require('./handler.js'), import_sucrose = require('../../sucrose.js'), import_compose = require('../../compose.js'), import_utils = require('../../utils.js'), import_error = require('../../error.js'), import_trace = require('../../trace.js');
-const allocateIf = (value, condition) => condition ? value : "", createContext = (app, route, inference, isInline = !1) => {
+const allocateIf = (value, condition) => condition ? value : "", preserveEncodedSlashes = (params) => {
+  for (const key of Object.keys(params))
+    params[key].includes("/") && (params[key] = params[key].replaceAll("/", "%2F"));
+  return params;
+}, createContext = (app, route, inference, isInline = !1) => {
   let fnLiteral = "";
   const defaultHeaders = app.setHeaders, hasTrace = !!app.event.trace?.length;
   hasTrace && (fnLiteral += `const id=randomId()
@@ -31,8 +35,8 @@ const allocateIf = (value, condition) => condition ? value : "", createContext =
   needsQuery && (fnLiteral += getQi);
   const getPath = inference.path ? isDynamic ? "get path(){" + (needsQuery ? "" : getQi) + `if(qi===-1)return u.substring(s)
 return u.substring(s,qi)
-},` : `path:'${route.path}',` : "";
-  fnLiteral += allocateIf("const c=", !isInline) + "{request,store," + allocateIf("qi,", needsQuery) + allocateIf("params:request.params,", isDynamic) + getPath + allocateIf(
+},` : "path:route," : "";
+  fnLiteral += allocateIf("const c=", !isInline) + "{request,store," + allocateIf("qi,", needsQuery) + allocateIf("params:preserveEncodedSlashes(request.params),", isDynamic) + getPath + allocateIf(
     "url:request.url,",
     hasTrace || inference.url || needsQuery
   ) + "redirect,status,set:{headers:" + ((0, import_utils.isNotEmpty)(defaultHeaders) ? "Object.assign({},app.setHeaders)" : "Object.create(null)") + ",status:200}", inference.server && (fnLiteral += ",get server(){return app.getServer()}"), hasTrace && (fnLiteral += ",[ELYSIA_REQUEST_ID]:id");
@@ -57,7 +61,7 @@ return u.substring(s,qi)
     },
     inference
   );
-  let fnLiteral = "const handler=data.handler,app=data.app,store=data.store,decorator=data.decorator,redirect=data.redirect,route=data.route,mapEarlyResponse=data.mapEarlyResponse," + allocateIf("randomId=data.randomId,", hasTrace) + allocateIf("ELYSIA_REQUEST_ID=data.ELYSIA_REQUEST_ID,", hasTrace) + allocateIf("ELYSIA_TRACE=data.ELYSIA_TRACE,", hasTrace) + allocateIf("trace=data.trace,", hasTrace) + allocateIf("hoc=data.hoc,", hasHoc) + `status=data.status
+  let fnLiteral = "const handler=data.handler,app=data.app,store=data.store,decorator=data.decorator,preserveEncodedSlashes=data.preserveEncodedSlashes,redirect=data.redirect,route=data.route,mapEarlyResponse=data.mapEarlyResponse," + allocateIf("randomId=data.randomId,", hasTrace) + allocateIf("ELYSIA_REQUEST_ID=data.ELYSIA_REQUEST_ID,", hasTrace) + allocateIf("ELYSIA_TRACE=data.ELYSIA_TRACE,", hasTrace) + allocateIf("trace=data.trace,", hasTrace) + allocateIf("hoc=data.hoc,", hasHoc) + `status=data.status
 `;
   app.event.request?.length && (fnLiteral += `const onRequest=app.event.request.map(x=>x.fn)
 `), fnLiteral += `${app.event.request?.find(import_compose.isAsync) ? "async" : ""} function map(request){`;
@@ -76,6 +80,7 @@ return u.substring(s,qi)
     hoc: app.extender.higherOrderFunctions.map((x) => x.fn),
     store: app.store,
     decorator: app.decorator,
+    preserveEncodedSlashes,
     route: route.path,
     randomId: hasTrace ? import_utils.randomId : void 0,
     ELYSIA_TRACE: hasTrace ? import_trace.ELYSIA_TRACE : void 0,

package/dist/adapter/bun/compose.mjs

@@ -4,7 +4,11 @@ import { createHoc, createOnRequestHandler, isAsync } from "../../compose.mjs";
 import { randomId, ELYSIA_REQUEST_ID, redirect, isNotEmpty } from "../../utils.mjs";
 import { status } from "../../error.mjs";
 import { ELYSIA_TRACE } from "../../trace.mjs";
-const allocateIf = (value, condition) => condition ? value : "", createContext = (app, route, inference, isInline = !1) => {
+const allocateIf = (value, condition) => condition ? value : "", preserveEncodedSlashes = (params) => {
+  for (const key of Object.keys(params))
+    params[key].includes("/") && (params[key] = params[key].replaceAll("/", "%2F"));
+  return params;
+}, createContext = (app, route, inference, isInline = !1) => {
   let fnLiteral = "";
   const defaultHeaders = app.setHeaders, hasTrace = !!app.event.trace?.length;
   hasTrace && (fnLiteral += `const id=randomId()
@@ -16,8 +20,8 @@ const allocateIf = (value, condition) => condition ? value : "", createContext =
   needsQuery && (fnLiteral += getQi);
   const getPath = inference.path ? isDynamic ? "get path(){" + (needsQuery ? "" : getQi) + `if(qi===-1)return u.substring(s)
 return u.substring(s,qi)
-},` : `path:'${route.path}',` : "";
-  fnLiteral += allocateIf("const c=", !isInline) + "{request,store," + allocateIf("qi,", needsQuery) + allocateIf("params:request.params,", isDynamic) + getPath + allocateIf(
+},` : "path:route," : "";
+  fnLiteral += allocateIf("const c=", !isInline) + "{request,store," + allocateIf("qi,", needsQuery) + allocateIf("params:preserveEncodedSlashes(request.params),", isDynamic) + getPath + allocateIf(
     "url:request.url,",
     hasTrace || inference.url || needsQuery
   ) + "redirect,status,set:{headers:" + (isNotEmpty(defaultHeaders) ? "Object.assign({},app.setHeaders)" : "Object.create(null)") + ",status:200}", inference.server && (fnLiteral += ",get server(){return app.getServer()}"), hasTrace && (fnLiteral += ",[ELYSIA_REQUEST_ID]:id");
@@ -42,7 +46,7 @@ return u.substring(s,qi)
     },
     inference
   );
-  let fnLiteral = "const handler=data.handler,app=data.app,store=data.store,decorator=data.decorator,redirect=data.redirect,route=data.route,mapEarlyResponse=data.mapEarlyResponse," + allocateIf("randomId=data.randomId,", hasTrace) + allocateIf("ELYSIA_REQUEST_ID=data.ELYSIA_REQUEST_ID,", hasTrace) + allocateIf("ELYSIA_TRACE=data.ELYSIA_TRACE,", hasTrace) + allocateIf("trace=data.trace,", hasTrace) + allocateIf("hoc=data.hoc,", hasHoc) + `status=data.status
+  let fnLiteral = "const handler=data.handler,app=data.app,store=data.store,decorator=data.decorator,preserveEncodedSlashes=data.preserveEncodedSlashes,redirect=data.redirect,route=data.route,mapEarlyResponse=data.mapEarlyResponse," + allocateIf("randomId=data.randomId,", hasTrace) + allocateIf("ELYSIA_REQUEST_ID=data.ELYSIA_REQUEST_ID,", hasTrace) + allocateIf("ELYSIA_TRACE=data.ELYSIA_TRACE,", hasTrace) + allocateIf("trace=data.trace,", hasTrace) + allocateIf("hoc=data.hoc,", hasHoc) + `status=data.status
 `;
   app.event.request?.length && (fnLiteral += `const onRequest=app.event.request.map(x=>x.fn)
 `), fnLiteral += `${app.event.request?.find(isAsync) ? "async" : ""} function map(request){`;
@@ -61,6 +65,7 @@ return u.substring(s,qi)
     hoc: app.extender.higherOrderFunctions.map((x) => x.fn),
     store: app.store,
     decorator: app.decorator,
+    preserveEncodedSlashes,
     route: route.path,
     randomId: hasTrace ? randomId : void 0,
     ELYSIA_TRACE: hasTrace ? ELYSIA_TRACE : void 0,

package/dist/adapter/bun/handler-native.js

@@ -19,8 +19,24 @@ __export(handler_native_exports, {
 });
 module.exports = __toCommonJS(handler_native_exports);
 var import_index = require('./index.js'), import_handler = require('./handler.js');
-const createNativeStaticHandler = (handle, hooks, set) => {
-  if (typeof handle == "function" || handle instanceof Blob) return;
+const isEmptyPipelineHook = (hooks) => {
+  for (const key in hooks) {
+    switch (key) {
+      case "detail":
+      case "tags":
+      case "start":
+      case "stop":
+      case "error":
+      case "afterResponse":
+        continue;
+    }
+    const value = hooks[key];
+    if (value !== void 0 && value !== !1 && (!Array.isArray(value) || value.length))
+      return !1;
+  }
+  return !0;
+}, createNativeStaticHandler = (handle, hooks, set) => {
+  if (typeof handle == "function" || handle instanceof Blob || !isEmptyPipelineHook(hooks)) return;
   if ((0, import_index.isHTMLBundle)(handle)) return () => handle;
   const response = (0, import_handler.mapResponse)(
     handle instanceof Response ? handle.clone() : handle instanceof Promise ? handle.then(
@@ -30,11 +46,10 @@ const createNativeStaticHandler = (handle, hooks, set) => {
       headers: {}
     }
   );
-  if (!hooks.parse?.length && !hooks.transform?.length && !hooks.beforeHandle?.length && !hooks.afterHandle?.length)
-    return response instanceof Promise ? response.then((response2) => {
-      if (response2)
-        return response2.clone();
-    }) : () => response.clone();
+  return response instanceof Promise ? response.then((response2) => {
+    if (response2)
+      return response2.clone();
+  }) : () => response.clone();
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/adapter/bun/handler-native.mjs

@@ -1,7 +1,23 @@
 import { isHTMLBundle } from "./index.mjs";
 import { mapResponse } from "./handler.mjs";
-const createNativeStaticHandler = (handle, hooks, set) => {
-  if (typeof handle == "function" || handle instanceof Blob) return;
+const isEmptyPipelineHook = (hooks) => {
+  for (const key in hooks) {
+    switch (key) {
+      case "detail":
+      case "tags":
+      case "start":
+      case "stop":
+      case "error":
+      case "afterResponse":
+        continue;
+    }
+    const value = hooks[key];
+    if (value !== void 0 && value !== !1 && (!Array.isArray(value) || value.length))
+      return !1;
+  }
+  return !0;
+}, createNativeStaticHandler = (handle, hooks, set) => {
+  if (typeof handle == "function" || handle instanceof Blob || !isEmptyPipelineHook(hooks)) return;
   if (isHTMLBundle(handle)) return () => handle;
   const response = mapResponse(
     handle instanceof Response ? handle.clone() : handle instanceof Promise ? handle.then(
@@ -11,11 +27,10 @@ const createNativeStaticHandler = (handle, hooks, set) => {
       headers: {}
     }
   );
-  if (!hooks.parse?.length && !hooks.transform?.length && !hooks.beforeHandle?.length && !hooks.afterHandle?.length)
-    return response instanceof Promise ? response.then((response2) => {
-      if (response2)
-        return response2.clone();
-    }) : () => response.clone();
+  return response instanceof Promise ? response.then((response2) => {
+    if (response2)
+      return response2.clone();
+  }) : () => response.clone();
 };
 export {
   createNativeStaticHandler

package/dist/adapter/bun/index.js

@@ -123,6 +123,9 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
       }
       const createStaticRoute = (iterator, { withAsync = !1 } = {}) => {
         const staticRoutes = {}, ops = [];
+        if (app.event.request?.length || app.event.trace?.length || // @ts-expect-error private
+        app.extender.higherOrderFunctions.length)
+          return withAsync ? Promise.resolve(staticRoutes) : staticRoutes;
         for (let [path, route] of Object.entries(iterator))
           if (path = encodeURI(path), import_utils2.supportPerMethodInlineHandler) {
             if (!route) continue;
@@ -235,7 +238,10 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
       // @ts-expect-error private property
       models: app.definitions.type,
       normalize: app.config.normalize
-    }), validateMessage = messageValidator ? messageValidator.provider === "standard" ? (data) => messageValidator.schema["~standard"].validate(data).issues : (data) => messageValidator.Check(data) === !1 : void 0, responseValidator = (0, import_schema.getSchemaValidator)(response, {
+    }), validateMessage = messageValidator ? messageValidator.provider === "standard" ? (data) => messageValidator.schema["~standard"].validate(data) : (data) => ({
+      issues: messageValidator.Check(data) === !1 || void 0,
+      value: data
+    }) : void 0, responseValidator = (0, import_schema.getSchemaValidator)(response, {
       // @ts-expect-error private property
       modules: app.definitions.typebox,
       // @ts-expect-error private property
@@ -310,19 +316,22 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
               }
             },
             message: async (ws, _message) => {
-              const message = await parseMessage(ws, _message);
-              if (validateMessage && validateMessage(message)) {
-                const validationError = new import_error.ValidationError(
-                  "message",
-                  messageValidator,
-                  message
-                );
-                return hasCustomErrorHandlers ? handleErrors(ws, validationError) : void ws.send(
-                  validationError.message
-                );
-              }
               try {
-                await handleResponse(
+                let message = await parseMessage(ws, _message);
+                const validation = validateMessage ? await validateMessage(message) : void 0;
+                if (validation?.issues) {
+                  const validationError = new import_error.ValidationError(
+                    "message",
+                    messageValidator,
+                    message,
+                    !1,
+                    messageValidator?.provider === "standard" ? validation.issues : void 0
+                  );
+                  return hasCustomErrorHandlers ? handleErrors(ws, validationError) : void ws.send(
+                    validationError.message
+                  );
+                }
+                validation && (message = validation.value), await handleResponse(
                   ws,
                   options.message?.(
                     new import_ws.ElysiaWS(

package/dist/adapter/bun/index.mjs

@@ -126,6 +126,9 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
       }
       const createStaticRoute = (iterator, { withAsync = !1 } = {}) => {
         const staticRoutes = {}, ops = [];
+        if (app.event.request?.length || app.event.trace?.length || // @ts-expect-error private
+        app.extender.higherOrderFunctions.length)
+          return withAsync ? Promise.resolve(staticRoutes) : staticRoutes;
         for (let [path, route] of Object.entries(iterator))
           if (path = encodeURI(path), supportPerMethodInlineHandler) {
             if (!route) continue;
@@ -238,7 +241,10 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
       // @ts-expect-error private property
       models: app.definitions.type,
       normalize: app.config.normalize
-    }), validateMessage = messageValidator ? messageValidator.provider === "standard" ? (data) => messageValidator.schema["~standard"].validate(data).issues : (data) => messageValidator.Check(data) === !1 : void 0, responseValidator = getSchemaValidator(response, {
+    }), validateMessage = messageValidator ? messageValidator.provider === "standard" ? (data) => messageValidator.schema["~standard"].validate(data) : (data) => ({
+      issues: messageValidator.Check(data) === !1 || void 0,
+      value: data
+    }) : void 0, responseValidator = getSchemaValidator(response, {
       // @ts-expect-error private property
       modules: app.definitions.typebox,
       // @ts-expect-error private property
@@ -313,19 +319,22 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
               }
             },
             message: async (ws, _message) => {
-              const message = await parseMessage(ws, _message);
-              if (validateMessage && validateMessage(message)) {
-                const validationError = new ValidationError(
-                  "message",
-                  messageValidator,
-                  message
-                );
-                return hasCustomErrorHandlers ? handleErrors(ws, validationError) : void ws.send(
-                  validationError.message
-                );
-              }
               try {
-                await handleResponse(
+                let message = await parseMessage(ws, _message);
+                const validation = validateMessage ? await validateMessage(message) : void 0;
+                if (validation?.issues) {
+                  const validationError = new ValidationError(
+                    "message",
+                    messageValidator,
+                    message,
+                    !1,
+                    messageValidator?.provider === "standard" ? validation.issues : void 0
+                  );
+                  return hasCustomErrorHandlers ? handleErrors(ws, validationError) : void ws.send(
+                    validationError.message
+                  );
+                }
+                validation && (message = validation.value), await handleResponse(
                   ws,
                   options.message?.(
                     new ElysiaWS(

package/dist/adapter/utils.js

@@ -285,25 +285,70 @@ const createResponseHandler = (handler) => {
   };
 };
 async function tee(source, branches = 2) {
-  const buffer = [];
-  let done = !1, waiting = [];
-  (async () => {
-    for await (const value of source)
-      buffer.push(value), waiting.forEach((w) => w.resolve()), waiting = [];
-    done = !0, waiting.forEach((w) => w.resolve());
-  })();
-  async function* makeIterator() {
-    let i = 0;
-    for (; ; )
-      if (i < buffer.length)
-        yield buffer[i++];
-      else {
-        if (done)
-          return;
-        await new Promise((resolve) => waiting.push({ resolve }));
+  const state = Array.from({ length: branches }, () => ({
+    active: !0,
+    consumed: !0
+  }));
+  if (!state.length) return [];
+  const iterator = source[Symbol.asyncIterator]?.() ?? source[Symbol.iterator]();
+  let active = state.length, current, hasValue = !1, remaining = 0, done = !1, failed = !1, sourceError, pulling, waiting = [];
+  const wake = () => {
+    const pending = waiting;
+    waiting = [];
+    for (const resolve of pending) resolve();
+  }, wait = () => new Promise((resolve) => waiting.push(resolve)), pull = () => {
+    pulling ??= Promise.resolve().then(() => iterator.next()).then((result) => {
+      if (result.done || !active || done) {
+        done = !0;
+        return;
       }
-  }
-  return Array.from({ length: branches }, makeIterator);
+      current = result.value, hasValue = !0, remaining = active;
+      for (const branch of state)
+        branch.active && (branch.consumed = !1);
+    }).catch((error) => {
+      !active || done || (failed = done = !0, sourceError = error);
+    }).finally(() => {
+      pulling = void 0, wake();
+    });
+  }, stop = () => {
+    if (!done) {
+      done = !0, wake();
+      try {
+        Promise.resolve(iterator.return?.()).catch(() => {
+        });
+      } catch {
+      }
+    }
+  }, close = (index) => {
+    const branch = state[index];
+    return branch.active ? (branch.active = !1, active--, hasValue && !branch.consumed && --remaining === 0 && (hasValue = !1, wake()), !0) : !1;
+  }, next = async (index) => {
+    const branch = state[index];
+    for (; branch.active; ) {
+      if (failed)
+        throw close(index), sourceError;
+      if (hasValue && !branch.consumed) {
+        branch.consumed = !0;
+        const result = { done: !1, value: current };
+        return --remaining === 0 && (hasValue = !1, wake()), result;
+      }
+      if (done) {
+        close(index);
+        break;
+      }
+      hasValue || pull(), await wait();
+    }
+    return { done: !0, value: void 0 };
+  };
+  return state.map((_, index) => ({
+    next: () => next(index),
+    async return(finalValue) {
+      return close(index) && (index === 0 || !active) && stop(), { done: !0, value: finalValue };
+    },
+    [Symbol.asyncIterator]() {
+      return this;
+    }
+  }));
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/adapter/utils.mjs

@@ -258,25 +258,70 @@ const createResponseHandler = (handler) => {
   };
 };
 async function tee(source, branches = 2) {
-  const buffer = [];
-  let done = !1, waiting = [];
-  (async () => {
-    for await (const value of source)
-      buffer.push(value), waiting.forEach((w) => w.resolve()), waiting = [];
-    done = !0, waiting.forEach((w) => w.resolve());
-  })();
-  async function* makeIterator() {
-    let i = 0;
-    for (; ; )
-      if (i < buffer.length)
-        yield buffer[i++];
-      else {
-        if (done)
-          return;
-        await new Promise((resolve) => waiting.push({ resolve }));
+  const state = Array.from({ length: branches }, () => ({
+    active: !0,
+    consumed: !0
+  }));
+  if (!state.length) return [];
+  const iterator = source[Symbol.asyncIterator]?.() ?? source[Symbol.iterator]();
+  let active = state.length, current, hasValue = !1, remaining = 0, done = !1, failed = !1, sourceError, pulling, waiting = [];
+  const wake = () => {
+    const pending = waiting;
+    waiting = [];
+    for (const resolve of pending) resolve();
+  }, wait = () => new Promise((resolve) => waiting.push(resolve)), pull = () => {
+    pulling ??= Promise.resolve().then(() => iterator.next()).then((result) => {
+      if (result.done || !active || done) {
+        done = !0;
+        return;
       }
-  }
-  return Array.from({ length: branches }, makeIterator);
+      current = result.value, hasValue = !0, remaining = active;
+      for (const branch of state)
+        branch.active && (branch.consumed = !1);
+    }).catch((error) => {
+      !active || done || (failed = done = !0, sourceError = error);
+    }).finally(() => {
+      pulling = void 0, wake();
+    });
+  }, stop = () => {
+    if (!done) {
+      done = !0, wake();
+      try {
+        Promise.resolve(iterator.return?.()).catch(() => {
+        });
+      } catch {
+      }
+    }
+  }, close = (index) => {
+    const branch = state[index];
+    return branch.active ? (branch.active = !1, active--, hasValue && !branch.consumed && --remaining === 0 && (hasValue = !1, wake()), !0) : !1;
+  }, next = async (index) => {
+    const branch = state[index];
+    for (; branch.active; ) {
+      if (failed)
+        throw close(index), sourceError;
+      if (hasValue && !branch.consumed) {
+        branch.consumed = !0;
+        const result = { done: !1, value: current };
+        return --remaining === 0 && (hasValue = !1, wake()), result;
+      }
+      if (done) {
+        close(index);
+        break;
+      }
+      hasValue || pull(), await wait();
+    }
+    return { done: !0, value: void 0 };
+  };
+  return state.map((_, index) => ({
+    next: () => next(index),
+    async return(finalValue) {
+      return close(index) && (index === 0 || !active) && stop(), { done: !0, value: finalValue };
+    },
+    [Symbol.asyncIterator]() {
+      return this;
+    }
+  }));
 }
 export {
   createResponseHandler,

package/dist/adapter/web-standard/index.js

@@ -54,62 +54,10 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
 `;
       },
       formData(isOptional) {
-        let fnLiteral = `
-c.body={}
-`;
+        let fnLiteral = "";
         return isOptional ? fnLiteral += "let form;try{form=await c.request.formData()}catch{}" : fnLiteral += `const form=await c.request.formData()
-`, fnLiteral + `const dangerousKeys=new Set(['__proto__','constructor','prototype'])
-const isDangerousKey=(k)=>{if(dangerousKeys.has(k))return true;const m=k.match(/^(.+)\\[(\\d+)\\]$/);return m?dangerousKeys.has(m[1]):false}
-const parseArrayKey=(k)=>{const m=k.match(/^(.+)\\[(\\d+)\\]$/);return m?{name:m[1],index:parseInt(m[2],10)}:null}
-const grouped=new Map()
-form.forEach((v,k)=>{const l=grouped.get(k);if(l)l.push(v);else grouped.set(k,[v])})
-for(const [key,value] of grouped){if(c.body[key])continue
-let finalValue
-if(value.length===1){
-const sv=value[0]
-if(typeof sv==='string'&&(sv.charCodeAt(0)===123||sv.charCodeAt(0)===91)){
-try{
-const p=JSON.parse(sv)
-if(p&&typeof p==='object')finalValue=p
-}catch{}
-}
-if(finalValue===undefined)finalValue=sv
-}else finalValue=value
-if(Array.isArray(finalValue)){
-const stringValue=finalValue.find((entry)=>typeof entry==='string')
-const files=typeof File==='undefined'?[]:finalValue.filter((entry)=>entry instanceof File)
-if(stringValue&&files.length&&stringValue.charCodeAt(0)===123){
-try{
-const parsed=JSON.parse(stringValue)
-if(parsed&&typeof parsed==='object'&&!Array.isArray(parsed)){
-if(!('file' in parsed)&&files.length===1)parsed.file=files[0]
-else if(!('files' in parsed)&&files.length>1)parsed.files=files
-finalValue=parsed
-}
-}catch{}
-}
-}
-if(key.includes('.')||key.includes('[')){const keys=key.split('.')
-const lastKey=keys.pop()
-if(isDangerousKey(lastKey)||keys.some(isDangerousKey))continue
-let current=c.body
-for(const k of keys){const arrayInfo=parseArrayKey(k)
-if(arrayInfo){if(!Array.isArray(current[arrayInfo.name]))current[arrayInfo.name]=[]
-const existing=current[arrayInfo.name][arrayInfo.index]
-const isFile=typeof File!=='undefined'&&existing instanceof File
-if(!existing||typeof existing!=='object'||Array.isArray(existing)||isFile){
-let parsed
-if(typeof existing==='string'&&existing.charCodeAt(0)===123){
-try{parsed=JSON.parse(existing)
-if(!parsed||typeof parsed!=='object'||Array.isArray(parsed))parsed=undefined}catch{}
-}
-current[arrayInfo.name][arrayInfo.index]=parsed||{}
-}
-current=current[arrayInfo.name][arrayInfo.index]}else{if(!current[k]||typeof current[k]!=='object')current[k]={}
-current=current[k]}}
-const arrayInfo=parseArrayKey(lastKey)
-if(arrayInfo){if(!Array.isArray(current[arrayInfo.name]))current[arrayInfo.name]=[]
-current[arrayInfo.name][arrayInfo.index]=finalValue}else{current[lastKey]=finalValue}}else c.body[key]=finalValue}`;
+`, fnLiteral + `c.body=parseFormData(form)
+`;
       }
     }
   },

package/dist/adapter/web-standard/index.mjs

@@ -39,62 +39,10 @@ for(const [k,v] of c.request.headers.entries())c.headers[k]=v
 `;
       },
       formData(isOptional) {
-        let fnLiteral = `
-c.body={}
-`;
+        let fnLiteral = "";
         return isOptional ? fnLiteral += "let form;try{form=await c.request.formData()}catch{}" : fnLiteral += `const form=await c.request.formData()
-`, fnLiteral + `const dangerousKeys=new Set(['__proto__','constructor','prototype'])
-const isDangerousKey=(k)=>{if(dangerousKeys.has(k))return true;const m=k.match(/^(.+)\\[(\\d+)\\]$/);return m?dangerousKeys.has(m[1]):false}
-const parseArrayKey=(k)=>{const m=k.match(/^(.+)\\[(\\d+)\\]$/);return m?{name:m[1],index:parseInt(m[2],10)}:null}
-const grouped=new Map()
-form.forEach((v,k)=>{const l=grouped.get(k);if(l)l.push(v);else grouped.set(k,[v])})
-for(const [key,value] of grouped){if(c.body[key])continue
-let finalValue
-if(value.length===1){
-const sv=value[0]
-if(typeof sv==='string'&&(sv.charCodeAt(0)===123||sv.charCodeAt(0)===91)){
-try{
-const p=JSON.parse(sv)
-if(p&&typeof p==='object')finalValue=p
-}catch{}
-}
-if(finalValue===undefined)finalValue=sv
-}else finalValue=value
-if(Array.isArray(finalValue)){
-const stringValue=finalValue.find((entry)=>typeof entry==='string')
-const files=typeof File==='undefined'?[]:finalValue.filter((entry)=>entry instanceof File)
-if(stringValue&&files.length&&stringValue.charCodeAt(0)===123){
-try{
-const parsed=JSON.parse(stringValue)
-if(parsed&&typeof parsed==='object'&&!Array.isArray(parsed)){
-if(!('file' in parsed)&&files.length===1)parsed.file=files[0]
-else if(!('files' in parsed)&&files.length>1)parsed.files=files
-finalValue=parsed
-}
-}catch{}
-}
-}
-if(key.includes('.')||key.includes('[')){const keys=key.split('.')
-const lastKey=keys.pop()
-if(isDangerousKey(lastKey)||keys.some(isDangerousKey))continue
-let current=c.body
-for(const k of keys){const arrayInfo=parseArrayKey(k)
-if(arrayInfo){if(!Array.isArray(current[arrayInfo.name]))current[arrayInfo.name]=[]
-const existing=current[arrayInfo.name][arrayInfo.index]
-const isFile=typeof File!=='undefined'&&existing instanceof File
-if(!existing||typeof existing!=='object'||Array.isArray(existing)||isFile){
-let parsed
-if(typeof existing==='string'&&existing.charCodeAt(0)===123){
-try{parsed=JSON.parse(existing)
-if(!parsed||typeof parsed!=='object'||Array.isArray(parsed))parsed=undefined}catch{}
-}
-current[arrayInfo.name][arrayInfo.index]=parsed||{}
-}
-current=current[arrayInfo.name][arrayInfo.index]}else{if(!current[k]||typeof current[k]!=='object')current[k]={}
-current=current[k]}}
-const arrayInfo=parseArrayKey(lastKey)
-if(arrayInfo){if(!Array.isArray(current[arrayInfo.name]))current[arrayInfo.name]=[]
-current[arrayInfo.name][arrayInfo.index]=finalValue}else{current[lastKey]=finalValue}}else c.body[key]=finalValue}`;
+`, fnLiteral + `c.body=parseFormData(form)
+`;
       }
     }
   },