fulmine.js 5.19.7 → 5.19.8

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.19.7",
+    "version": "5.19.8",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {

package/src/declarative.js

@@ -18,7 +18,7 @@ limitations under the License.
 */
 
 const acorn = require("acorn");
-const { stringify, contentTypeSet, withUtf8Charset, contentTypeFor } = require("./utils.js");
+const { stringify, contentTypeSet, withUtf8Charset, contentTypeFor, headerIsWritable } = require("./utils.js");
 // H3App, DeclarativeResponse and _cfg exist at runtime but are missing from the .d.ts the
 // package ships, so the module is read through a loose alias
 const uWS = require("uWebSockets.js");
@@ -261,6 +261,11 @@ function readStatusAndHeaders(callExprs, headers) {
                     }
                     value = resolved;
                 }
+                // a name or a value setHeader refuses is an error page in express, not a header:
+                // left to the ordinary path, which throws it
+                if (!headerIsWritable(String(header), value)) {
+                    return null;
+                }
                 const index = headers.findIndex((entry) => String(entry[0]).toLowerCase() === name);
                 if (index === -1) {
                     headers.push([header, value]);
@@ -280,6 +285,9 @@ function readStatusAndHeaders(callExprs, headers) {
             if (call.arguments[0].type !== "Literal" || call.arguments[1].type !== "Literal") {
                 return null;
             }
+            if (!headerIsWritable(String(call.arguments[0].value), String(call.arguments[1].value))) {
+                return null;
+            }
             headers.push([call.arguments[0].value, String(call.arguments[1].value)]);
         } else if (call.obj.propertyName === "sendStatus") {
             if (call.arguments[0].type !== "Literal") {

package/src/node-shim.js

@@ -417,7 +417,10 @@ function serveNodeRequest(router, nodeReq, nodeRes, next) {
     router._armAbort(shimRes, response);
 
     return router._routeRequest(request, response).then((matched) => {
-        if (matched || response.headersSent || response.aborted) {
+        // a 404 after the head is out is left as it is, an error after it is not: it goes on to
+        // the final handler, which closes the connection as express's does. Same rule as the
+        // native path, see nativeDone in router-utils.js
+        if (matched || response.aborted || (response.headersSent && !request._error)) {
             return;
         }
         if (next) {

package/src/route.js

@@ -120,20 +120,19 @@ class Route {
                 if (handle.length !== 4) {
                     return next(err);
                 }
-                try {
-                    handle(err, req, res, next);
-                } catch (thrown) {
-                    next(thrown);
-                }
-            } else {
-                if (handle.length === 4) {
-                    return next();
-                }
-                try {
-                    handle(req, res, next);
-                } catch (thrown) {
-                    next(thrown);
+            } else if (handle.length === 4) {
+                return next();
+            }
+            try {
+                const out = err ? handle(err, req, res, next) : handle(req, res, next);
+                // a rejected promise goes to next() as the error it carries, as express's Layer
+                // does it. A bare rejection carries none and gets the one express invents. Thenable
+                // too, which express deprecates but still waits for
+                if (out && typeof out.then === "function") {
+                    out.then(null, (thrown) => next(thrown || new Error("Rejected promise")));
                 }
+            } catch (thrown) {
+                next(thrown);
             }
             sync = 0;
         };