fulmine.js 5.13.1 → 5.13.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.13.1",
+    "version": "5.13.2",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {

package/src/middlewares.js

@@ -363,6 +363,41 @@ function pickPrecompressed(filePath, accept, ttl, statTtl) {
     return undefined;
 }
 
+/**
+ * The index file to serve from a directory, tried in the order the option lists them, which is
+ * send's sendIndex. Throws the last failure when every name failed, and reports nothing when the
+ * list ran out without one, since those are the two different answers send gives.
+ *
+ * @param {string} dir the directory to look in
+ * @param {string[]} indexList the index names, in order
+ * @returns {{stat: any, name: string, candidate: string}|null} the file to serve, or null
+ */
+function findIndexFile(dir, indexList) {
+    let lastError;
+    for (const name of indexList) {
+        const candidate = path.join(dir, name);
+        let stat;
+        try {
+            stat = fs.statSync(candidate);
+        } catch (err) {
+            lastError = err;
+            continue;
+        }
+        // a directory by that name is not an index and is not an error either: send's own loop
+        // carries on with nothing to report, so a later name still answers and an exhausted list
+        // is the plain 404 rather than whatever the name before it failed with
+        if (stat.isDirectory()) {
+            lastError = undefined;
+            continue;
+        }
+        return { stat, name, candidate };
+    }
+    if (lastError) {
+        throw lastError;
+    }
+    return null;
+}
+
 /**
  * express.static, which is a thin front for res.sendFile: it resolves the path, refuses anything
  * that climbs out of the root, applies the dotfiles and index rules, and hands the rest over.
@@ -384,6 +419,9 @@ function serveStatic(root, options) {
     // mounts sharing one options object would otherwise also share one root
     options = Object.assign(new NullObject(), options);
     if (typeof options.index === "undefined") options.index = "index.html";
+    // send takes a list and tries the names in order, so one name is a list of one and `false` is
+    // an empty one. Passing the option along as it came handed an array to path.join, which throws
+    const indexList = options.index === false || options.index === "" ? [] : [options.index].flat();
     if (typeof options.redirect === "undefined") options.redirect = true;
     if (typeof options.fallthrough === "undefined") options.fallthrough = true;
     if (typeof options.dotfiles === "undefined") options.dotfiles = "ignore";
@@ -556,9 +594,9 @@ function serveStatic(root, options) {
             // a path written with a trailing slash asks for a directory, and send answers that by
             // looking for the index inside it. With nothing there, the file it names is that
             // index and not the directory that does not exist either
-            if (rawPath.endsWith("/") && options.index) {
+            if (rawPath.endsWith("/") && indexList.length > 0) {
                 try {
-                    fs.statSync(path.join(fullpath, options.index));
+                    findIndexFile(fullpath, indexList);
                 } catch (indexError) {
                     statError = indexError;
                 }
@@ -595,8 +633,11 @@ function serveStatic(root, options) {
         }
 
         // a file asked for with a trailing slash is not that file: send stats the path slash and
-        // all and gets ENOTDIR, so a root mounted as a file answers 404 there, not the file
-        if (req.endsWithSlash && !stat.isDirectory()) {
+        // all and gets ENOTDIR, so a root mounted as a file answers 404 there, not the file.
+        // With an index configured it never gets that far: a trailing slash sends send looking for
+        // the index inside whatever the path turned out to be, so what it reports is that the
+        // index under the file is missing, and the directory branch below does it for both
+        if (req.endsWithSlash && !stat.isDirectory() && indexList.length === 0) {
             if (!options.fallthrough) {
                 res.status(404);
                 return next(httpError(404));
@@ -604,7 +645,7 @@ function serveStatic(root, options) {
             return next();
         }
 
-        if (stat.isDirectory()) {
+        if (stat.isDirectory() || req.endsWithSlash) {
             if (!req.endsWithSlash) {
                 if (options.redirect) {
                     // The query goes along, and the leading slashes are collapsed. Both were
@@ -624,11 +665,10 @@ function serveStatic(root, options) {
                     } else return next();
                 }
             }
-            if (options.index) {
+            if (indexList.length > 0) {
+                let found;
                 try {
-                    stat = fs.statSync(path.join(fullpath, options.index));
-                    _path = path.join(url, options.index);
-                    filePath = path.join(fullpath, options.index);
+                    found = findIndexFile(fullpath, indexList);
                 } catch (err) {
                     if (!options.fallthrough) {
                         res.status(404);
@@ -637,6 +677,18 @@ function serveStatic(root, options) {
                         return next(asStatError(err));
                     } else return next();
                 }
+                if (found === null) {
+                    // every name was a directory, which send reports as its plain 404 rather than
+                    // as a file that could not be read
+                    if (!options.fallthrough) {
+                        res.status(404);
+                        return next(httpError(404));
+                    }
+                    return next();
+                }
+                stat = found.stat;
+                _path = path.join(url, found.name);
+                filePath = found.candidate;
             } else {
                 // a directory with no index to serve is a Not Found, and saying so is the whole
                 // point of fallthrough: false. This moved on to the next handler instead, so the

package/src/request.js

@@ -730,6 +730,10 @@ module.exports = class Request extends LazyReadable {
             this._isOptions = this.method === "OPTIONS";
             this._isHead = this.method === "HEAD";
         }
+        // what the router last saw as the method. A middleware assigning another one is a rewrite,
+        // which express honours because it reads req.method at every layer, and dispatch compares
+        // against this to notice it
+        this._lastMethod = this.method;
         // the folded _opPath and the percent scan of _originalPath, built on the hop that first
         // wants them and dropped by every rewrite, see _pathMatches and Walk#dispatch
         this._opPathLower = null;
@@ -753,6 +757,8 @@ module.exports = class Request extends LazyReadable {
         // how many characters of _originalPath the mounts entered so far have taken, which is
         // where baseUrl ends and the path below them begins
         this._consumed = 0;
+        // whether one of them took a trailing slash, which only a RegExp mount can: see baseUrl
+        this._mountSlash = false;
         this._paramStack = null;
         // route and application in pairs, one pair per mounted application entered from another
         // application, so handing back puts the one that was current back, see rememberApp
@@ -934,8 +940,26 @@ module.exports = class Request extends LazyReadable {
         if (this._baseUrlOverride !== undefined) {
             return this._baseUrlOverride;
         }
+        if (this._consumed === 0) {
+            return "";
+        }
         // what the mounts took, which is where the path they left off begins
-        return this._consumed === 0 ? "" : this._originalPath.slice(0, this._consumed);
+        if (this._mountSlash !== true) {
+            return this._originalPath.slice(0, this._consumed);
+        }
+        // Express drops one trailing slash off each mount before joining them, so this is a join
+        // of the pieces rather than one slice of the path: a RegExp mount ending in "/" matched
+        // against "/a//b" takes "/a/" and reads back as "/a", and what the mount below it took is
+        // appended to that rather than to the original. Only a RegExp mount can take a trailing
+        // slash, a registered path having had it removed, so almost every request answers above.
+        let out = "";
+        let at = 0;
+        for (const taken of this._stack) {
+            const piece = this._originalPath.slice(at, at + taken);
+            at += taken;
+            out += piece.charCodeAt(taken - 1) === 0x2f ? piece.slice(0, -1) : piece;
+        }
+        return out;
     }
 
     /**
@@ -1114,6 +1138,21 @@ module.exports = class Request extends LazyReadable {
         this._lastUrl = newUrl;
     }
 
+    /**
+     * Takes over what a middleware assigned to req.method. Both flags are read as bare fields by
+     * the routing scan rather than compared against req.method, so they are what has to follow it,
+     * and an OPTIONS the request has just become still needs the set the verbs are collected in.
+     */
+    _absorbMethodRewrite() {
+        const method = this.method;
+        this._isOptions = method === "OPTIONS";
+        this._isHead = method === "HEAD";
+        if (this._isOptions && this._matchedMethods === null) {
+            this._matchedMethods = new Set();
+        }
+        this._lastMethod = method;
+    }
+
     /**
      * The query string parsed by whichever parser the "query parser" setting names. A null-prototype
      * object, so a key like "__proto__" cannot reach Object.prototype. No setter, so assigning to

package/src/router.js

@@ -216,6 +216,11 @@ class Walk {
         if (req.url !== req._lastUrl && this.takeUrlRewrite(startIndex)) {
             return;
         }
+        // and the same for req.method, which method-override assigns: the compiled chain was
+        // picked by the verb the request arrived with, so it no longer stands for this one
+        if (req.method !== req._lastMethod && this.takeMethodRewrite(startIndex)) {
+            return;
+        }
         let routeIndex = startIndex;
         // a compiled chain runs what is in it without matching again, so this is where a layer that
         // provably has nothing to do for this request is stepped over rather than entered
@@ -345,6 +350,34 @@ class Walk {
         return true;
     }
 
+    /**
+     * Takes over a req.method a middleware assigned, which method-override is written to do. The
+     * ordinary scan reads req.method per route and is right from the next hop on; a compiled chain
+     * was chosen by the method µWS dispatched on, so ordinary routing takes over from the top the
+     * way a url rewrite does.
+     *
+     * @param {number} startIndex where dispatch was about to resume
+     * @returns {boolean} whether this rerouted the walk itself
+     */
+    takeMethodRewrite(startIndex) {
+        const req = this.req;
+        const router = this.router;
+        req._absorbMethodRewrite();
+        if (!this.skipCheck) {
+            return false;
+        }
+        this.skipUntil = startIndex > 0 ? this.routes[startIndex - 1] : undefined;
+        if (req._stack !== null && req._stack.length > 0) {
+            req._stack.length = 0;
+            req._consumed = 0;
+            setMountedPath(req);
+        }
+        this.routes = router._routes;
+        this.skipCheck = false;
+        this.dispatch(0);
+        return true;
+    }
+
     /**
      * Enters the route the walk is on: a mount adjusts req.url, req.path and the mount stack on the
      * way in, and then the route's callbacks run one after another through next().
@@ -375,6 +408,11 @@ class Walk {
             // one cannot bite. An application is mostly pathless middleware, and this is per hop
             if (taken !== 0 || req.endsWithSlash) {
                 req._consumed += taken;
+                // a mount that took a trailing slash: req.baseUrl then has to join the pieces
+                // rather than slice the path, which is the slower half of its getter
+                if (taken !== 0 && req._originalPath.charCodeAt(req._consumed - 1) === 0x2f) {
+                    req._mountSlash = true;
+                }
                 setMountedPath(req);
             }
         }
@@ -707,6 +745,12 @@ const PATH_PROPERTY = {
     enumerable: true
 };
 
+// and the two the walk calls when a middleware rewrote req.url or req.method, for the same reason:
+// an adopted request has no prototype of ours to find them on, and a rewrite through one of those
+// routers threw instead of being taken over
+const ABSORB_URL = Request.prototype._absorbUrlRewrite;
+const ABSORB_METHOD = Request.prototype._absorbMethodRewrite;
+
 const NO_PARAM_NAMES = [];
 
 /**
@@ -854,6 +898,8 @@ function adoptPlainRequest(req, router) {
     // an adopted request is a plain object, so it carries no prototype of ours and reads its path
     // off a property of its own. The class's getter itself, so there is one of it
     Object.defineProperty(req, "path", PATH_PROPERTY);
+    req._absorbUrlRewrite = ABSORB_URL;
+    req._absorbMethodRewrite = ABSORB_METHOD;
     req.originalUrl = req.originalUrl ?? arrived;
     req._originalPath = path;
     req.endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
@@ -861,6 +907,7 @@ function adoptPlainRequest(req, router) {
     req._opPathLower = null;
     req._mayFailDecode = null;
     req._lastUrl = req.url;
+    req._lastMethod = req.method;
     req._isOptions = req.method === "OPTIONS";
     req._isHead = req.method === "HEAD";
     req.params = req.params ?? Object.create(null);
@@ -868,6 +915,7 @@ function adoptPlainRequest(req, router) {
     // requests never see one, same as the Request constructor
     req._stack = null;
     req._consumed = 0;
+    req._mountSlash = false;
     req._paramStack = null;
     req._matchedMethods = req._isOptions ? new Set() : null;
     req.routeCount = 1;