hono 4.12.16 → 4.12.18

package/dist/cjs/helper/ssg/ssg.js

@@ -69,6 +69,8 @@ const defaultExtensionMap = {
   "text/html": "html",
   "text/xml": "xml",
   "application/xml": "xml",
+  "application/atom+xml": "xml",
+  "application/rss+xml": "xml",
   "application/yaml": "yaml"
 };
 const determineExtension = (mimeType, userExtensionMap) => {

package/dist/cjs/jsx/base.js

@@ -161,7 +161,7 @@ class JSXNode {
     const props = this.props;
     let { children } = this;
     buffer[0] += `<${tag}`;
-    const normalizeKey = nameSpaceContext && (0, import_context.useContext)(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName((0, import_utils.normalizeIntrinsicElementKey)(key)) : (key) => (0, import_utils.normalizeIntrinsicElementKey)(key);
+    const normalizeKey = tag === "svg" || nameSpaceContext && (0, import_context.useContext)(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName((0, import_utils.normalizeIntrinsicElementKey)(key)) : (key) => (0, import_utils.normalizeIntrinsicElementKey)(key);
     for (let [key, v] of Object.entries(props)) {
       key = normalizeKey(key);
       if (!(0, import_utils.isValidAttributeName)(key)) {

package/dist/cjs/jsx/utils.js

@@ -90,15 +90,105 @@ const isValidAttributeName = (name) => {
   cacheValidName(validAttributeNameCache, validAttributeNameCacheMax, name);
   return true;
 };
+const invalidStylePropertyNameCharRe = /[\s"'():;\\/\[\]{}\x00-\x1f\x7f-\x9f]/;
+const validStylePropertyNameCache = /* @__PURE__ */ new Set();
+const validStylePropertyNameCacheMax = 1024;
+const isValidStylePropertyName = (name) => {
+  if (validStylePropertyNameCache.has(name)) {
+    return true;
+  }
+  const len = name.length;
+  if (len === 0) {
+    return false;
+  }
+  for (let i = 0; i < len; i++) {
+    const c = name.charCodeAt(i);
+    if (!(c >= 97 && c <= 122 || // a-z
+    c >= 65 && c <= 90 || // A-Z
+    c >= 48 && c <= 57 || // 0-9
+    c === 45 || // -
+    c === 95)) {
+      if (!invalidStylePropertyNameCharRe.test(name)) {
+        cacheValidName(validStylePropertyNameCache, validStylePropertyNameCacheMax, name);
+        return true;
+      } else {
+        return false;
+      }
+    }
+  }
+  cacheValidName(validStylePropertyNameCache, validStylePropertyNameCacheMax, name);
+  return true;
+};
+const unsafeStyleValueCharRe = /[;"'\\/\[\](){}]/;
+const hasUnsafeStyleValue = (value) => {
+  if (!unsafeStyleValueCharRe.test(value)) {
+    return false;
+  }
+  let quote = 0;
+  const blockStack = [];
+  for (let i = 0, len = value.length; i < len; i++) {
+    const c = value.charCodeAt(i);
+    if (c === 92) {
+      if (i === len - 1) {
+        return true;
+      }
+      i++;
+    } else if (quote !== 0) {
+      if (c === 10 || c === 12 || c === 13) {
+        return true;
+      }
+      if (c === quote) {
+        quote = 0;
+      }
+    } else if (c === 47 && value.charCodeAt(i + 1) === 42) {
+      const end = value.indexOf("*/", i + 2);
+      if (end === -1) {
+        return true;
+      }
+      i = end + 1;
+    } else if (c === 34 || c === 39) {
+      quote = c;
+    } else if (c === 40) {
+      blockStack.push(41);
+    } else if (c === 91) {
+      blockStack.push(93);
+    } else if (c === 123 || c === 125) {
+      return true;
+    } else if (c === 41 || c === 93) {
+      if (blockStack[blockStack.length - 1] !== c) {
+        return true;
+      }
+      blockStack.pop();
+    } else if (c === 59 && blockStack.length === 0) {
+      return true;
+    }
+  }
+  return quote !== 0 || blockStack.length !== 0;
+};
 const styleObjectForEach = (style, fn) => {
   for (const [k, v] of Object.entries(style)) {
     const key = k[0] === "-" || !/[A-Z]/.test(k) ? k : k.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);
-    fn(
-      key,
-      v == null ? null : typeof v === "number" ? !key.match(
+    if (!isValidStylePropertyName(key)) {
+      continue;
+    }
+    if (v == null) {
+      fn(key, null);
+      continue;
+    }
+    let value;
+    if (typeof v === "number") {
+      value = !key.match(
         /^(?:a|border-im|column(?:-c|s)|flex(?:$|-[^b])|grid-(?:ar|[^a])|font-w|li|or|sca|st|ta|wido|z)|ty$/
-      ) ? `${v}px` : `${v}` : v
-    );
+      ) ? `${v}px` : `${v}`;
+    } else if (typeof v === "string") {
+      if (hasUnsafeStyleValue(v)) {
+        continue;
+      }
+      value = v;
+    } else {
+      continue;
+    }
+    fn(key, value);
   }
 };
 // Annotate the CommonJS export names for ESM import in node:

package/dist/cjs/middleware/cache/index.js

@@ -22,8 +22,7 @@ __export(cache_exports, {
 module.exports = __toCommonJS(cache_exports);
 const defaultCacheableStatusCodes = [200];
 const shouldSkipCache = (res) => {
-  const vary = res.headers.get("Vary");
-  if (vary && vary.includes("*")) {
+  if (res.headers.has("Vary")) {
     return true;
   }
   const cacheControl = res.headers.get("Cache-Control");
@@ -84,6 +83,10 @@ const cache = (options) => {
     }
   };
   return async function cache2(c, next) {
+    if (c.req.method !== "GET" || c.req.raw.headers.has("Authorization")) {
+      await next();
+      return;
+    }
     let key = c.req.url;
     if (options.keyGenerator) {
       key = await options.keyGenerator(c);

package/dist/cjs/middleware/cors/index.js

@@ -21,14 +21,11 @@ __export(cors_exports, {
 });
 module.exports = __toCommonJS(cors_exports);
 const cors = (options) => {
-  const defaults = {
+  const opts = {
     origin: "*",
     allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"],
     allowHeaders: [],
-    exposeHeaders: []
-  };
-  const opts = {
-    ...defaults,
+    exposeHeaders: [],
     ...options
   };
   const findAllowOrigin = ((optsOrigin) => {

package/dist/cjs/utils/jwt/jwt.js

@@ -81,14 +81,20 @@ const verify = async (token, publicKey, algOrOptions) => {
     throw new import_types.JwtAlgorithmMismatch(alg, header.alg);
   }
   const now = Math.floor(Date.now() / 1e3);
-  if (nbf && payload.nbf && payload.nbf > now) {
-    throw new import_types.JwtTokenNotBefore(token);
+  if (nbf && payload.nbf !== void 0) {
+    if (typeof payload.nbf !== "number" || !Number.isFinite(payload.nbf) || payload.nbf > now) {
+      throw new import_types.JwtTokenNotBefore(token);
+    }
   }
-  if (exp && payload.exp && payload.exp <= now) {
-    throw new import_types.JwtTokenExpired(token);
+  if (exp && payload.exp !== void 0) {
+    if (typeof payload.exp !== "number" || !Number.isFinite(payload.exp) || payload.exp <= now) {
+      throw new import_types.JwtTokenExpired(token);
+    }
   }
-  if (iat && payload.iat && now < payload.iat) {
-    throw new import_types.JwtTokenIssuedAt(now, payload.iat);
+  if (iat && payload.iat !== void 0) {
+    if (typeof payload.iat !== "number" || !Number.isFinite(payload.iat) || now < payload.iat) {
+      throw new import_types.JwtTokenIssuedAt(now, payload.iat);
+    }
   }
   if (iss) {
     if (!payload.iss) {

package/dist/helper/ssg/ssg.js

@@ -47,6 +47,8 @@ var defaultExtensionMap = {
   "text/html": "html",
   "text/xml": "xml",
   "application/xml": "xml",
+  "application/atom+xml": "xml",
+  "application/rss+xml": "xml",
   "application/yaml": "yaml"
 };
 var determineExtension = (mimeType, userExtensionMap) => {

package/dist/jsx/base.js

@@ -124,7 +124,7 @@ var JSXNode = class {
     const props = this.props;
     let { children } = this;
     buffer[0] += `<${tag}`;
-    const normalizeKey = nameSpaceContext && useContext(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName(normalizeIntrinsicElementKey(key)) : (key) => normalizeIntrinsicElementKey(key);
+    const normalizeKey = tag === "svg" || nameSpaceContext && useContext(nameSpaceContext) === "svg" ? (key) => toSVGAttributeName(normalizeIntrinsicElementKey(key)) : (key) => normalizeIntrinsicElementKey(key);
     for (let [key, v] of Object.entries(props)) {
       key = normalizeKey(key);
       if (!isValidAttributeName(key)) {

package/dist/jsx/utils.js

@@ -66,15 +66,105 @@ var isValidAttributeName = (name) => {
   cacheValidName(validAttributeNameCache, validAttributeNameCacheMax, name);
   return true;
 };
+var invalidStylePropertyNameCharRe = /[\s"'():;\\/\[\]{}\x00-\x1f\x7f-\x9f]/;
+var validStylePropertyNameCache = /* @__PURE__ */ new Set();
+var validStylePropertyNameCacheMax = 1024;
+var isValidStylePropertyName = (name) => {
+  if (validStylePropertyNameCache.has(name)) {
+    return true;
+  }
+  const len = name.length;
+  if (len === 0) {
+    return false;
+  }
+  for (let i = 0; i < len; i++) {
+    const c = name.charCodeAt(i);
+    if (!(c >= 97 && c <= 122 || // a-z
+    c >= 65 && c <= 90 || // A-Z
+    c >= 48 && c <= 57 || // 0-9
+    c === 45 || // -
+    c === 95)) {
+      if (!invalidStylePropertyNameCharRe.test(name)) {
+        cacheValidName(validStylePropertyNameCache, validStylePropertyNameCacheMax, name);
+        return true;
+      } else {
+        return false;
+      }
+    }
+  }
+  cacheValidName(validStylePropertyNameCache, validStylePropertyNameCacheMax, name);
+  return true;
+};
+var unsafeStyleValueCharRe = /[;"'\\/\[\](){}]/;
+var hasUnsafeStyleValue = (value) => {
+  if (!unsafeStyleValueCharRe.test(value)) {
+    return false;
+  }
+  let quote = 0;
+  const blockStack = [];
+  for (let i = 0, len = value.length; i < len; i++) {
+    const c = value.charCodeAt(i);
+    if (c === 92) {
+      if (i === len - 1) {
+        return true;
+      }
+      i++;
+    } else if (quote !== 0) {
+      if (c === 10 || c === 12 || c === 13) {
+        return true;
+      }
+      if (c === quote) {
+        quote = 0;
+      }
+    } else if (c === 47 && value.charCodeAt(i + 1) === 42) {
+      const end = value.indexOf("*/", i + 2);
+      if (end === -1) {
+        return true;
+      }
+      i = end + 1;
+    } else if (c === 34 || c === 39) {
+      quote = c;
+    } else if (c === 40) {
+      blockStack.push(41);
+    } else if (c === 91) {
+      blockStack.push(93);
+    } else if (c === 123 || c === 125) {
+      return true;
+    } else if (c === 41 || c === 93) {
+      if (blockStack[blockStack.length - 1] !== c) {
+        return true;
+      }
+      blockStack.pop();
+    } else if (c === 59 && blockStack.length === 0) {
+      return true;
+    }
+  }
+  return quote !== 0 || blockStack.length !== 0;
+};
 var styleObjectForEach = (style, fn) => {
   for (const [k, v] of Object.entries(style)) {
     const key = k[0] === "-" || !/[A-Z]/.test(k) ? k : k.replace(/[A-Z]/g, (m) => `-${m.toLowerCase()}`);
-    fn(
-      key,
-      v == null ? null : typeof v === "number" ? !key.match(
+    if (!isValidStylePropertyName(key)) {
+      continue;
+    }
+    if (v == null) {
+      fn(key, null);
+      continue;
+    }
+    let value;
+    if (typeof v === "number") {
+      value = !key.match(
         /^(?:a|border-im|column(?:-c|s)|flex(?:$|-[^b])|grid-(?:ar|[^a])|font-w|li|or|sca|st|ta|wido|z)|ty$/
-      ) ? `${v}px` : `${v}` : v
-    );
+      ) ? `${v}px` : `${v}`;
+    } else if (typeof v === "string") {
+      if (hasUnsafeStyleValue(v)) {
+        continue;
+      }
+      value = v;
+    } else {
+      continue;
+    }
+    fn(key, value);
   }
 };
 export {

package/dist/middleware/cache/index.js

@@ -1,8 +1,7 @@
 // src/middleware/cache/index.ts
 var defaultCacheableStatusCodes = [200];
 var shouldSkipCache = (res) => {
-  const vary = res.headers.get("Vary");
-  if (vary && vary.includes("*")) {
+  if (res.headers.has("Vary")) {
     return true;
   }
   const cacheControl = res.headers.get("Cache-Control");
@@ -63,6 +62,10 @@ var cache = (options) => {
     }
   };
   return async function cache2(c, next) {
+    if (c.req.method !== "GET" || c.req.raw.headers.has("Authorization")) {
+      await next();
+      return;
+    }
     let key = c.req.url;
     if (options.keyGenerator) {
       key = await options.keyGenerator(c);

package/dist/middleware/cors/index.js

@@ -1,13 +1,10 @@
 // src/middleware/cors/index.ts
 var cors = (options) => {
-  const defaults = {
+  const opts = {
     origin: "*",
     allowMethods: ["GET", "HEAD", "PUT", "POST", "DELETE", "PATCH"],
     allowHeaders: [],
-    exposeHeaders: []
-  };
-  const opts = {
-    ...defaults,
+    exposeHeaders: [],
     ...options
   };
   const findAllowOrigin = ((optsOrigin) => {