fulmine.js 5.19.6 → 5.19.8

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.19.6",
+    "version": "5.19.8",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {

package/src/declarative.js

@@ -18,7 +18,7 @@ limitations under the License.
 */
 
 const acorn = require("acorn");
-const { stringify, contentTypeSet, withUtf8Charset, contentTypeFor } = require("./utils.js");
+const { stringify, contentTypeSet, withUtf8Charset, contentTypeFor, headerIsWritable } = require("./utils.js");
 // H3App, DeclarativeResponse and _cfg exist at runtime but are missing from the .d.ts the
 // package ships, so the module is read through a loose alias
 const uWS = require("uWebSockets.js");
@@ -261,6 +261,11 @@ function readStatusAndHeaders(callExprs, headers) {
                     }
                     value = resolved;
                 }
+                // a name or a value setHeader refuses is an error page in express, not a header:
+                // left to the ordinary path, which throws it
+                if (!headerIsWritable(String(header), value)) {
+                    return null;
+                }
                 const index = headers.findIndex((entry) => String(entry[0]).toLowerCase() === name);
                 if (index === -1) {
                     headers.push([header, value]);
@@ -280,6 +285,9 @@ function readStatusAndHeaders(callExprs, headers) {
             if (call.arguments[0].type !== "Literal" || call.arguments[1].type !== "Literal") {
                 return null;
             }
+            if (!headerIsWritable(String(call.arguments[0].value), String(call.arguments[1].value))) {
+                return null;
+            }
             headers.push([call.arguments[0].value, String(call.arguments[1].value)]);
         } else if (call.obj.propertyName === "sendStatus") {
             if (call.arguments[0].type !== "Literal") {

package/src/node-shim.js

@@ -417,7 +417,10 @@ function serveNodeRequest(router, nodeReq, nodeRes, next) {
     router._armAbort(shimRes, response);
 
     return router._routeRequest(request, response).then((matched) => {
-        if (matched || response.headersSent || response.aborted) {
+        // a 404 after the head is out is left as it is, an error after it is not: it goes on to
+        // the final handler, which closes the connection as express's does. Same rule as the
+        // native path, see nativeDone in router-utils.js
+        if (matched || response.aborted || (response.headersSent && !request._error)) {
             return;
         }
         if (next) {

package/src/route.js

@@ -120,20 +120,19 @@ class Route {
                 if (handle.length !== 4) {
                     return next(err);
                 }
-                try {
-                    handle(err, req, res, next);
-                } catch (thrown) {
-                    next(thrown);
-                }
-            } else {
-                if (handle.length === 4) {
-                    return next();
-                }
-                try {
-                    handle(req, res, next);
-                } catch (thrown) {
-                    next(thrown);
+            } else if (handle.length === 4) {
+                return next();
+            }
+            try {
+                const out = err ? handle(err, req, res, next) : handle(req, res, next);
+                // a rejected promise goes to next() as the error it carries, as express's Layer
+                // does it. A bare rejection carries none and gets the one express invents. Thenable
+                // too, which express deprecates but still waits for
+                if (out && typeof out.then === "function") {
+                    out.then(null, (thrown) => next(thrown || new Error("Rejected promise")));
                 }
+            } catch (thrown) {
+                next(thrown);
             }
             sync = 0;
         };

package/src/utils.js

@@ -416,6 +416,10 @@ function patternToRegex(pattern, isPrefix = false, caseSensitive = true, strict
                 }
                 groupContent += pattern[i++];
             }
+            // a group nobody closed, which express refuses rather than reading to the end
+            if (braceDepth > 0) {
+                throw new Error(`Unexpected end at index ${len}, expected }: ${pattern}`);
+            }
             i++;
 
             // When a :parameter precedes this group, that parameter is the one that gives ground
@@ -512,12 +516,12 @@ function patternToRegex(pattern, isPrefix = false, caseSensitive = true, strict
 
         // these have no meaning in a path, and the route is refused rather than matching them
         // literally: a path that quietly stops matching is worse than one that fails at startup.
-        // Escape them to use them as literals.
-        if ("?+()[]!".includes(ch)) {
+        // Escape them to use them as literals. A } here closes a group nobody opened.
+        if ("?+()[]!}".includes(ch)) {
             throw new Error(`Unexpected ${ch} at index ${i}: ${pattern}`);
         }
 
-        if (".^$|}".includes(ch)) {
+        if (".^$|".includes(ch)) {
             regexPattern += "\\" + ch;
         } else {
             regexPattern += ch;
@@ -556,9 +560,20 @@ function escapePathLiteral(literal) {
     return literal.replace(/[:*{}?+()[\]!.^$|\\]/g, "\\$&");
 }
 
+// Everything path-to-regexp gives a meaning to: a parameter, a wildcard, a group, a character it
+// reserves, and the backslash that makes one of them literal. A dot or a dash is not in here, so
+// the ordinary path stays a string compare.
+const PATH_SYNTAX = /[:*{}?+()[\]!\\]/;
+
 /**
  * Whether a path has anything in it that a string comparison cannot answer, which is a parameter,
- * a wildcard or an optional group. A regular expression is already compiled, so it needs nothing.
+ * a wildcard, an optional group, or a reserved character. A regular expression is already
+ * compiled, so it needs nothing.
+ *
+ * The escapes are what the short list of three used to miss: "/\\(a\\)" is the way to ask for a
+ * literal parenthesis, and comparing it as text looked for the backslashes on the wire and
+ * answered 404. A reserved character written bare, "/(a)", has to reach the compiler too, which
+ * is what refuses it the way express does.
  *
  * @param {string|RegExp} pattern
  * @returns {boolean}
@@ -568,7 +583,7 @@ function needsConversionToRegex(pattern) {
         return false;
     }
 
-    return pattern.includes("*") || pattern.includes(":") || pattern.includes("{");
+    return PATH_SYNTAX.test(pattern);
 }
 
 /**