formstream 1.5.2 → 1.5.3

package/README.md

@@ -92,6 +92,12 @@ fs.stat(filepath, function (err, stat) {
 
 ## API Doc
 
+Field names and filenames use percent encoding for carriage returns (`%0D`),
+line feeds (`%0A`), and double quotes (`%22`) in multipart headers.
+Other characters and field contents remain unchanged.
+The `field()`, `buffer()`, and `stream()` methods throw a `TypeError` synchronously
+if a supplied MIME type contains a carriage return or line feed.
+
 ### formstream([options])
 
 Create a form instance.
@@ -104,7 +110,7 @@ Create a form instance.
 
 Form - form instance
 
-### FormStream#field(name, value)
+### FormStream#field(name, value[, mimeType])
 
 Add a normal field to the form.
 
@@ -112,6 +118,7 @@ Add a normal field to the form.
 
 - **name** String - Name of field
 - **value** String - Value of field
+- ***mimeType*** String - Optional. Content-Type of the field
 
 #### Returns
 
@@ -200,6 +207,39 @@ Emitted when the stream has received no more 'data' events will happen.
 
 See [Node.js Documentation](http://nodejs.org/api/stream.html#stream_event_end) for more.
 
+## Releasing
+
+Maintainers prepare releases through a pull request that updates the version in
+`package.json` and describes the changes in `CHANGELOG.md`. To update the version
+without creating a commit or tag, run `npm version patch --no-git-tag-version`
+(or use `minor`, `major`, or an explicit version).
+
+After the PR merges into `master`, `release.yml` compares the package versions
+before and after the push. It publishes only when the version changes. The
+workflow skips versions already on npm, runs the project checks, and publishes
+with npm trusted publishing and provenance. Stable versions use the `latest`
+dist-tag; prerelease versions use `next`.
+
+After npm publishing succeeds, the workflow creates a GitHub release with a
+`v<version>` tag at the commit that triggered the workflow and automatically
+generated release notes. Prerelease versions are marked as GitHub prereleases.
+To retry a failed release, rerun the failed workflow in GitHub Actions. If the
+version is already on npm, the workflow still creates the missing GitHub release.
+Existing GitHub releases remain unchanged.
+
+Configure the `formstream` package's trusted publisher on npm with these values:
+
+- Provider: GitHub Actions
+- Organization: `node-modules`
+- Repository: `formstream`
+- Workflow filename: `release.yml`
+- Environment: leave empty
+- Allow direct publishing with `npm publish`
+
+The workflow uses OIDC and does not require an `NPM_TOKEN` or `GIT_TOKEN` secret.
+See the [npm trusted publishing documentation](https://docs.npmjs.com/trusted-publishers/)
+for package configuration instructions.
+
 ## License
 
 [MIT](LICENSE)

package/lib/formstream.js

@@ -161,14 +161,14 @@ FormStream.prototype.stream = function (name, stream, filename, mimeType, size)
     mimeType = mime.getType(filename);
   }
 
+  var leading = this._leading({ name: name, filename: filename }, mimeType);
+
   stream.once('error', this.emit.bind(this, 'error'));
   // if form stream destroy, also destroy the source stream
   this.once('destroy', function () {
     destroy(stream);
   });
 
-  var leading = this._leading({ name: name, filename: filename }, mimeType);
-
   var ps = parseStream().pause();
   stream.pipe(ps);
 
@@ -226,12 +226,18 @@ FormStream.prototype._leading = function (disposition, type) {
 
   if (disposition) {
     for (var k in disposition) {
-      dispositions.push(k + '="' + disposition[k] + '"');
+      // Escape multipart names and filenames as in HTML form submissions.
+      var value = String(disposition[k]).replace(/\r/g, '%0D').replace(/\n/g, '%0A').replace(/"/g, '%22');
+      dispositions.push(k + '="' + value + '"');
     }
   }
 
   leading.push('Content-Disposition: form-data; ' + dispositions.join('; '));
   if (type) {
+    type = String(type);
+    if (/[\r\n]/.test(type)) {
+      throw new TypeError('MIME type must not contain CR or LF');
+    }
     leading.push('Content-Type: ' + type);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "formstream",
-  "version": "1.5.2",
+  "version": "1.5.3",
   "description": "A multipart/form-data encoded stream, helper for file upload.",
   "main": "lib/formstream.js",
   "types": "types/formstream.d.ts",