hono 4.11.7 → 4.12.7

package/dist/utils/accept.js

@@ -1,30 +1,197 @@
 // src/utils/accept.ts
-var parseAccept = (acceptHeader) => {
-  if (!acceptHeader) {
-    return [];
+var isWhitespace = (char) => char === 32 || char === 9 || char === 10 || char === 13;
+var consumeWhitespace = (acceptHeader, startIndex) => {
+  while (startIndex < acceptHeader.length) {
+    if (!isWhitespace(acceptHeader.charCodeAt(startIndex))) {
+      break;
+    }
+    startIndex++;
+  }
+  return startIndex;
+};
+var ignoreTrailingWhitespace = (acceptHeader, startIndex) => {
+  while (startIndex > 0) {
+    if (!isWhitespace(acceptHeader.charCodeAt(startIndex - 1))) {
+      break;
+    }
+    startIndex--;
+  }
+  return startIndex;
+};
+var skipInvalidParam = (acceptHeader, startIndex) => {
+  while (startIndex < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(startIndex);
+    if (char === 59) {
+      return [startIndex + 1, true];
+    }
+    if (char === 44) {
+      return [startIndex + 1, false];
+    }
+    startIndex++;
+  }
+  return [startIndex, false];
+};
+var skipInvalidAcceptValue = (acceptHeader, startIndex) => {
+  let i = startIndex;
+  let inQuotes = false;
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i);
+    if (inQuotes && char === 92) {
+      i++;
+    } else if (char === 34) {
+      inQuotes = !inQuotes;
+    } else if (!inQuotes && char === 44) {
+      return i + 1;
+    }
+    i++;
+  }
+  return i;
+};
+var getNextParam = (acceptHeader, startIndex) => {
+  startIndex = consumeWhitespace(acceptHeader, startIndex);
+  let i = startIndex;
+  let key;
+  let value;
+  let hasNext = false;
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i);
+    if (char === 61) {
+      key = acceptHeader.slice(startIndex, ignoreTrailingWhitespace(acceptHeader, i));
+      i++;
+      break;
+    }
+    if (char === 59) {
+      return [i + 1, void 0, void 0, true];
+    }
+    if (char === 44) {
+      return [i + 1, void 0, void 0, false];
+    }
+    i++;
+  }
+  if (key === void 0) {
+    return [i, void 0, void 0, false];
+  }
+  i = consumeWhitespace(acceptHeader, i);
+  if (acceptHeader.charCodeAt(i) === 61) {
+    const skipResult = skipInvalidParam(acceptHeader, i + 1);
+    return [skipResult[0], key, void 0, skipResult[1]];
+  }
+  let inQuotes = false;
+  const paramStartIndex = i;
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i);
+    if (inQuotes && char === 92) {
+      i++;
+    } else if (char === 34) {
+      if (inQuotes) {
+        let nextIndex = consumeWhitespace(acceptHeader, i + 1);
+        const nextChar = acceptHeader.charCodeAt(nextIndex);
+        if (nextIndex < acceptHeader.length && !(nextChar === 59 || nextChar === 44)) {
+          const skipResult = skipInvalidParam(acceptHeader, nextIndex);
+          return [skipResult[0], key, void 0, skipResult[1]];
+        }
+        value = acceptHeader.slice(paramStartIndex + 1, i);
+        if (value.includes("\\")) {
+          value = value.replace(/\\(.)/g, "$1");
+        }
+        if (nextChar === 44) {
+          return [nextIndex + 1, key, value, false];
+        }
+        if (nextChar === 59) {
+          hasNext = true;
+          nextIndex++;
+        }
+        i = nextIndex;
+        break;
+      }
+      inQuotes = true;
+    } else if (!inQuotes && (char === 59 || char === 44)) {
+      value = acceptHeader.slice(paramStartIndex, ignoreTrailingWhitespace(acceptHeader, i));
+      if (char === 59) {
+        hasNext = true;
+      }
+      i++;
+      break;
+    }
+    i++;
   }
-  const acceptValues = acceptHeader.split(",").map((value, index) => ({ value, index }));
-  return acceptValues.map(parseAcceptValue).filter((item) => Boolean(item)).sort(sortByQualityAndIndex).map(({ type, params, q }) => ({ type, params, q }));
+  return [
+    i,
+    key,
+    value ?? acceptHeader.slice(paramStartIndex, ignoreTrailingWhitespace(acceptHeader, i)),
+    hasNext
+  ];
 };
-var parseAcceptValueRegex = /;(?=(?:(?:[^"]*"){2})*[^"]*$)/;
-var parseAcceptValue = ({ value, index }) => {
-  const parts = value.trim().split(parseAcceptValueRegex).map((s) => s.trim());
-  const type = parts[0];
-  if (!type) {
-    return null;
+var getNextAcceptValue = (acceptHeader, startIndex) => {
+  const accept = {
+    type: "",
+    params: {},
+    q: 1
+  };
+  startIndex = consumeWhitespace(acceptHeader, startIndex);
+  let i = startIndex;
+  while (i < acceptHeader.length) {
+    const char = acceptHeader.charCodeAt(i);
+    if (char === 59 || char === 44) {
+      accept.type = acceptHeader.slice(startIndex, ignoreTrailingWhitespace(acceptHeader, i));
+      i++;
+      if (char === 44) {
+        return [i, accept.type ? accept : void 0];
+      }
+      if (!accept.type) {
+        return [skipInvalidAcceptValue(acceptHeader, i), void 0];
+      }
+      break;
+    }
+    i++;
+  }
+  if (!accept.type) {
+    accept.type = acceptHeader.slice(
+      startIndex,
+      ignoreTrailingWhitespace(acceptHeader, acceptHeader.length)
+    );
+    return [acceptHeader.length, accept.type ? accept : void 0];
+  }
+  let param;
+  let value;
+  let hasNext;
+  while (i < acceptHeader.length) {
+    ;
+    [i, param, value, hasNext] = getNextParam(acceptHeader, i);
+    if (param && value) {
+      accept.params[param] = value;
+    }
+    if (!hasNext) {
+      break;
+    }
   }
-  const params = parseParams(parts.slice(1));
-  const q = parseQuality(params.q);
-  return { type, params, q, index };
+  return [i, accept];
 };
-var parseParams = (paramParts) => {
-  return paramParts.reduce((acc, param) => {
-    const [key, val] = param.split("=").map((s) => s.trim());
-    if (key && val) {
-      acc[key] = val;
+var parseAccept = (acceptHeader) => {
+  if (!acceptHeader) {
+    return [];
+  }
+  const values = [];
+  let i = 0;
+  let accept;
+  let requiresSort = false;
+  let lastAccept;
+  while (i < acceptHeader.length) {
+    ;
+    [i, accept] = getNextAcceptValue(acceptHeader, i);
+    if (accept) {
+      accept.q = parseQuality(accept.params.q);
+      values.push(accept);
+      if (lastAccept && lastAccept.q < accept.q) {
+        requiresSort = true;
+      }
+      lastAccept = accept;
     }
-    return acc;
-  }, {});
+  }
+  if (requiresSort) {
+    values.sort((a, b) => b.q - a.q);
+  }
+  return values;
 };
 var parseQuality = (qVal) => {
   if (qVal === void 0) {
@@ -51,13 +218,6 @@ var parseQuality = (qVal) => {
   }
   return num;
 };
-var sortByQualityAndIndex = (a, b) => {
-  const qDiff = b.q - a.q;
-  if (qDiff !== 0) {
-    return qDiff;
-  }
-  return a.index - b.index;
-};
 export {
   parseAccept
 };

package/dist/utils/body.js

@@ -54,6 +54,9 @@ var handleParsingAllValues = (form, key, value) => {
   }
 };
 var handleParsingNestedValues = (form, key, value) => {
+  if (/(?:^|\.)__proto__\./.test(key)) {
+    return;
+  }
   let nestedForm = form;
   const keys = key.split(".");
   keys.forEach((key2, index) => {

package/dist/utils/buffer.js

@@ -17,15 +17,42 @@ var equal = (a, b) => {
   }
   return true;
 };
+var constantTimeEqualString = (a, b) => {
+  const aLen = a.length;
+  const bLen = b.length;
+  const maxLen = Math.max(aLen, bLen);
+  let out = aLen ^ bLen;
+  for (let i = 0; i < maxLen; i++) {
+    const aChar = i < aLen ? a.charCodeAt(i) : 0;
+    const bChar = i < bLen ? b.charCodeAt(i) : 0;
+    out |= aChar ^ bChar;
+  }
+  return out === 0;
+};
+var timingSafeEqualString = async (a, b, hashFunction) => {
+  if (!hashFunction) {
+    hashFunction = sha256;
+  }
+  const [sa, sb] = await Promise.all([hashFunction(a), hashFunction(b)]);
+  if (sa == null || sb == null || typeof sa !== "string" || typeof sb !== "string") {
+    return false;
+  }
+  const hashEqual = constantTimeEqualString(sa, sb);
+  const originalEqual = constantTimeEqualString(a, b);
+  return hashEqual && originalEqual;
+};
 var timingSafeEqual = async (a, b, hashFunction) => {
+  if (typeof a === "string" && typeof b === "string") {
+    return timingSafeEqualString(a, b, hashFunction);
+  }
   if (!hashFunction) {
     hashFunction = sha256;
   }
   const [sa, sb] = await Promise.all([hashFunction(a), hashFunction(b)]);
-  if (!sa || !sb) {
+  if (!sa || !sb || typeof sa !== "string" || typeof sb !== "string") {
     return false;
   }
-  return sa === sb && a === b;
+  return timingSafeEqualString(sa, sb);
 };
 var bufferToString = (buffer) => {
   if (buffer instanceof ArrayBuffer) {

package/dist/utils/cookie.js

@@ -87,6 +87,11 @@ var _serialize = (name, value, opt = {}) => {
       throw new Error("__Host- Cookie must not have Domain attributes");
     }
   }
+  for (const key of ["domain", "path"]) {
+    if (opt[key] && /[;\r\n]/.test(opt[key])) {
+      throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+    }
+  }
   if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
     if (opt.maxAge > 3456e4) {
       throw new Error(

package/dist/utils/jwt/jwt.js

@@ -69,7 +69,7 @@ var verify = async (token, publicKey, algOrOptions) => {
   if (header.alg !== alg) {
     throw new JwtAlgorithmMismatch(alg, header.alg);
   }
-  const now = Date.now() / 1e3 | 0;
+  const now = Math.floor(Date.now() / 1e3);
   if (nbf && payload.nbf && payload.nbf > now) {
     throw new JwtTokenNotBefore(token);
   }
@@ -134,6 +134,7 @@ var verifyWithJwks = async (token, options, init) => {
   if (!options.allowedAlgorithms.includes(header.alg)) {
     throw new JwtAlgorithmNotAllowed(header.alg, options.allowedAlgorithms);
   }
+  let verifyKeys = options.keys ? [...options.keys] : void 0;
   if (options.jwks_uri) {
     const response = await fetch(options.jwks_uri, init);
     if (!response.ok) {
@@ -146,15 +147,12 @@ var verifyWithJwks = async (token, options, init) => {
     if (!Array.isArray(data.keys)) {
       throw new Error('invalid JWKS response. "keys" field is not an array');
     }
-    if (options.keys) {
-      options.keys.push(...data.keys);
-    } else {
-      options.keys = data.keys;
-    }
-  } else if (!options.keys) {
+    verifyKeys ??= [];
+    verifyKeys.push(...data.keys);
+  } else if (!verifyKeys) {
     throw new Error('verifyWithJwks requires options for either "keys" or "jwks_uri" or both');
   }
-  const matchingKey = options.keys.find((key) => key.kid === header.kid);
+  const matchingKey = verifyKeys.find((key) => key.kid === header.kid);
   if (!matchingKey) {
     throw new JwtTokenInvalid(token);
   }
@@ -167,10 +165,13 @@ var verifyWithJwks = async (token, options, init) => {
   });
 };
 var decode = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new JwtTokenInvalid(token);
+  }
   try {
-    const [h, p] = token.split(".");
-    const header = decodeJwtPart(h);
-    const payload = decodeJwtPart(p);
+    const header = decodeJwtPart(parts[0]);
+    const payload = decodeJwtPart(parts[1]);
     return {
       header,
       payload
@@ -180,9 +181,12 @@ var decode = (token) => {
   }
 };
 var decodeHeader = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new JwtTokenInvalid(token);
+  }
   try {
-    const [h] = token.split(".");
-    return decodeJwtPart(h);
+    return decodeJwtPart(parts[0]);
   } catch {
     throw new JwtTokenInvalid(token);
   }

package/dist/utils/url.js

@@ -73,9 +73,11 @@ var getPath = (request) => {
     const charCode = url.charCodeAt(i);
     if (charCode === 37) {
       const queryIndex = url.indexOf("?", i);
-      const path = url.slice(start, queryIndex === -1 ? void 0 : queryIndex);
+      const hashIndex = url.indexOf("#", i);
+      const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
+      const path = url.slice(start, end);
       return tryDecodeURI(path.includes("%25") ? path.replace(/%25/g, "%2525") : path);
-    } else if (charCode === 63) {
+    } else if (charCode === 63 || charCode === 35) {
       break;
     }
   }
@@ -215,5 +217,6 @@ export {
   mergePath,
   splitPath,
   splitRoutingPath,
-  tryDecode
+  tryDecode,
+  tryDecodeURI
 };

package/dist/validator/validator.js

@@ -39,7 +39,7 @@ var validator = (target, validationFunc) => {
             throw new HTTPException(400, { message });
           }
         }
-        const form = {};
+        const form = /* @__PURE__ */ Object.create(null);
         formData.forEach((value2, key) => {
           if (key.endsWith("[]")) {
             ;
@@ -47,7 +47,7 @@ var validator = (target, validationFunc) => {
           } else if (Array.isArray(form[key])) {
             ;
             form[key].push(value2);
-          } else if (key in form) {
+          } else if (Object.hasOwn(form, key)) {
             form[key] = [form[key], value2];
           } else {
             form[key] = value2;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.11.7",
+  "version": "4.12.7",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -656,18 +656,19 @@
     "nodejs"
   ],
   "devDependencies": {
-    "@hono/eslint-config": "^2.0.5",
+    "@hono/eslint-config": "^2.1.0",
     "@hono/node-server": "^1.13.5",
     "@types/glob": "^9.0.0",
     "@types/jsdom": "^21.1.7",
     "@types/node": "^24.3.0",
-    "@typescript/native-preview": "7.0.0-dev.20251220.1",
+    "@types/ws": "^8.18.1",
+    "@typescript/native-preview": "7.0.0-dev.20260210.1",
     "@vitest/coverage-v8": "^3.2.4",
     "arg": "^5.0.2",
     "bun-types": "^1.2.20",
     "editorconfig-checker": "6.1.1",
     "esbuild": "^0.27.1",
-    "eslint": "9.39.1",
+    "eslint": "^9.39.3",
     "glob": "^11.0.0",
     "jsdom": "22.1.0",
     "msw": "^2.6.0",