formstream 1.5.1 → 1.5.3

package/README.md

@@ -92,6 +92,12 @@ fs.stat(filepath, function (err, stat) {
 
 ## API Doc
 
+Field names and filenames use percent encoding for carriage returns (`%0D`),
+line feeds (`%0A`), and double quotes (`%22`) in multipart headers.
+Other characters and field contents remain unchanged.
+The `field()`, `buffer()`, and `stream()` methods throw a `TypeError` synchronously
+if a supplied MIME type contains a carriage return or line feed.
+
 ### formstream([options])
 
 Create a form instance.
@@ -104,7 +110,7 @@ Create a form instance.
 
 Form - form instance
 
-### FormStream#field(name, value)
+### FormStream#field(name, value[, mimeType])
 
 Add a normal field to the form.
 
@@ -112,6 +118,7 @@ Add a normal field to the form.
 
 - **name** String - Name of field
 - **value** String - Value of field
+- ***mimeType*** String - Optional. Content-Type of the field
 
 #### Returns
 
@@ -200,18 +207,45 @@ Emitted when the stream has received no more 'data' events will happen.
 
 See [Node.js Documentation](http://nodejs.org/api/stream.html#stream_event_end) for more.
 
+## Releasing
+
+Maintainers prepare releases through a pull request that updates the version in
+`package.json` and describes the changes in `CHANGELOG.md`. To update the version
+without creating a commit or tag, run `npm version patch --no-git-tag-version`
+(or use `minor`, `major`, or an explicit version).
+
+After the PR merges into `master`, `release.yml` compares the package versions
+before and after the push. It publishes only when the version changes. The
+workflow skips versions already on npm, runs the project checks, and publishes
+with npm trusted publishing and provenance. Stable versions use the `latest`
+dist-tag; prerelease versions use `next`.
+
+After npm publishing succeeds, the workflow creates a GitHub release with a
+`v<version>` tag at the commit that triggered the workflow and automatically
+generated release notes. Prerelease versions are marked as GitHub prereleases.
+To retry a failed release, rerun the failed workflow in GitHub Actions. If the
+version is already on npm, the workflow still creates the missing GitHub release.
+Existing GitHub releases remain unchanged.
+
+Configure the `formstream` package's trusted publisher on npm with these values:
+
+- Provider: GitHub Actions
+- Organization: `node-modules`
+- Repository: `formstream`
+- Workflow filename: `release.yml`
+- Environment: leave empty
+- Allow direct publishing with `npm publish`
+
+The workflow uses OIDC and does not require an `NPM_TOKEN` or `GIT_TOKEN` secret.
+See the [npm trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/)
+for package configuration instructions.
+
 ## License
 
 [MIT](LICENSE)
 
-<!-- GITCONTRIBUTOR_START -->
-
 ## Contributors
 
-|[<img src="https://avatars.githubusercontent.com/u/156269?v=4" width="100px;"/><br/><sub><b>fengmk2</b></sub>](https://github.com/fengmk2)<br/>|[<img src="https://avatars.githubusercontent.com/u/288288?v=4" width="100px;"/><br/><sub><b>xingrz</b></sub>](https://github.com/xingrz)<br/>|[<img src="https://avatars.githubusercontent.com/u/32174276?v=4" width="100px;"/><br/><sub><b>semantic-release-bot</b></sub>](https://github.com/semantic-release-bot)<br/>|[<img src="https://avatars.githubusercontent.com/u/13151189?v=4" width="100px;"/><br/><sub><b>fjc0k</b></sub>](https://github.com/fjc0k)<br/>|[<img src="https://avatars.githubusercontent.com/u/18096247?v=4" width="100px;"/><br/><sub><b>mrspeiser</b></sub>](https://github.com/mrspeiser)<br/>|[<img src="https://avatars.githubusercontent.com/u/985607?v=4" width="100px;"/><br/><sub><b>dead-horse</b></sub>](https://github.com/dead-horse)<br/>|
-| :---: | :---: | :---: | :---: | :---: | :---: |
-[<img src="https://avatars.githubusercontent.com/u/7326406?v=4" width="100px;"/><br/><sub><b>shaozj</b></sub>](https://github.com/shaozj)<br/>
-
-This project follows the git-contributor [spec](https://github.com/xudafeng/git-contributor), auto updated at `Wed May 15 2024 00:34:12 GMT+0800`.
+[![Contributors](https://contrib.rocks/image?repo=node-modules/formstream)](https://github.com/node-modules/formstream/graphs/contributors)
 
-<!-- GITCONTRIBUTOR_END -->
+Made with [contributors-img](https://contrib.rocks).

package/lib/formstream.js

@@ -35,6 +35,7 @@ Content-Type: image/png\r\n
 
 var debug = require('util').debuglog('formstream');
 var Stream = require('stream');
+var crypto = require('crypto');
 var parseStream = require('pause-stream');
 var util = require('util');
 var mime = require('mime');
@@ -71,15 +72,8 @@ util.inherits(FormStream, Stream);
 module.exports = FormStream;
 
 FormStream.prototype._generateBoundary = function() {
-  // https://github.com/felixge/node-form-data/blob/master/lib/form_data.js#L162
-  // This generates a 50 character boundary similar to those used by Firefox.
-  // They are optimized for boyer-moore parsing.
-  var boundary = '--------------------------';
-  for (var i = 0; i < 24; i++) {
-    boundary += Math.floor(Math.random() * 10).toString(16);
-  }
-
-  return boundary;
+  // https://github.com/form-data/form-data/blob/16e00765342106876f98a1c9703314006c9e937a/lib/form_data.js#L345
+  return '--------------------------' + crypto.randomBytes(12).toString('hex');
 };
 
 FormStream.prototype.setTotalStreamSize = function (size) {
@@ -167,14 +161,14 @@ FormStream.prototype.stream = function (name, stream, filename, mimeType, size)
     mimeType = mime.getType(filename);
   }
 
+  var leading = this._leading({ name: name, filename: filename }, mimeType);
+
   stream.once('error', this.emit.bind(this, 'error'));
   // if form stream destroy, also destroy the source stream
   this.once('destroy', function () {
     destroy(stream);
   });
 
-  var leading = this._leading({ name: name, filename: filename }, mimeType);
-
   var ps = parseStream().pause();
   stream.pipe(ps);
 
@@ -232,12 +226,18 @@ FormStream.prototype._leading = function (disposition, type) {
 
   if (disposition) {
     for (var k in disposition) {
-      dispositions.push(k + '="' + disposition[k] + '"');
+      // Escape multipart names and filenames as in HTML form submissions.
+      var value = String(disposition[k]).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+      dispositions.push(k + '="' + value + '"');
     }
   }
 
   leading.push('Content-Disposition: form-data; ' + dispositions.join('; '));
   if (type) {
+    type = String(type);
+    if (/[\r\n]/.test(type)) {
+      throw new TypeError('MIME type must not contain CR or LF');
+    }
     leading.push('Content-Type: ' + type);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "formstream",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "A multipart/form-data encoded stream, helper for file upload.",
   "main": "lib/formstream.js",
   "types": "types/formstream.d.ts",
@@ -13,8 +13,7 @@
     "cov": "egg-bin cov",
     "ci": "npm run lint && npm run tsd && npm run cov && NODE_DEBUG=formstream npm run cov",
     "lint": "jshint .",
-    "tsd": "tsd",
-    "contributor": "git-contributor"
+    "tsd": "tsd"
   },
   "repository": {
     "type": "git",
@@ -40,7 +39,6 @@
     "connect-multiparty": "1",
     "egg-bin": "^5.6.1",
     "express": "^4.16.4",
-    "git-contributor": "^2.1.5",
     "jshint": "^2.13.6",
     "pedding": "1",
     "should": "4",