hono 4.12.3 → 4.12.4

package/dist/cjs/helper/streaming/sse.js

@@ -34,6 +34,11 @@ class SSEStreamingApi extends import_stream.StreamingApi {
     const dataLines = data.split(/\r\n|\r|\n/).map((line) => {
       return `data: ${line}`;
     }).join("\n");
+    for (const key of ["event", "id", "retry"]) {
+      if (message[key] && /[\r\n]/.test(message[key])) {
+        throw new Error(`${key} must not contain "\\r" or "\\n"`);
+      }
+    }
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,

package/dist/cjs/middleware/serve-static/index.js

@@ -23,6 +23,7 @@ __export(serve_static_exports, {
 module.exports = __toCommonJS(serve_static_exports);
 var import_compress = require("../../utils/compress");
 var import_mime = require("../../utils/mime");
+var import_url = require("../../utils/url");
 var import_path = require("./path");
 const ENCODINGS = {
   br: ".br",
@@ -44,7 +45,7 @@ const serveStatic = (options) => {
       filename = options.path;
     } else {
       try {
-        filename = decodeURIComponent(c.req.path);
+        filename = (0, import_url.tryDecodeURI)(c.req.path);
         if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
           throw new Error();
         }

package/dist/cjs/utils/cookie.js

@@ -112,6 +112,11 @@ const _serialize = (name, value, opt = {}) => {
       throw new Error("__Host- Cookie must not have Domain attributes");
     }
   }
+  for (const key of ["domain", "path"]) {
+    if (opt[key] && /[;\r\n]/.test(opt[key])) {
+      throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+    }
+  }
   if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
     if (opt.maxAge > 3456e4) {
       throw new Error(

package/dist/cjs/utils/url.js

@@ -29,7 +29,8 @@ __export(url_exports, {
   mergePath: () => mergePath,
   splitPath: () => splitPath,
   splitRoutingPath: () => splitRoutingPath,
-  tryDecode: () => tryDecode
+  tryDecode: () => tryDecode,
+  tryDecodeURI: () => tryDecodeURI
 });
 module.exports = __toCommonJS(url_exports);
 const splitPath = (path) => {
@@ -251,5 +252,6 @@ const decodeURIComponent_ = decodeURIComponent;
   mergePath,
   splitPath,
   splitRoutingPath,
-  tryDecode
+  tryDecode,
+  tryDecodeURI
 });

package/dist/helper/streaming/sse.js

@@ -11,6 +11,11 @@ var SSEStreamingApi = class extends StreamingApi {
     const dataLines = data.split(/\r\n|\r|\n/).map((line) => {
       return `data: ${line}`;
     }).join("\n");
+    for (const key of ["event", "id", "retry"]) {
+      if (message[key] && /[\r\n]/.test(message[key])) {
+        throw new Error(`${key} must not contain "\\r" or "\\n"`);
+      }
+    }
     const sseData = [
       message.event && `event: ${message.event}`,
       dataLines,

package/dist/middleware/serve-static/index.js

@@ -1,6 +1,7 @@
 // src/middleware/serve-static/index.ts
 import { COMPRESSIBLE_CONTENT_TYPE_REGEX } from "../../utils/compress.js";
 import { getMimeType } from "../../utils/mime.js";
+import { tryDecodeURI } from "../../utils/url.js";
 import { defaultJoin } from "./path.js";
 var ENCODINGS = {
   br: ".br",
@@ -22,7 +23,7 @@ var serveStatic = (options) => {
       filename = options.path;
     } else {
       try {
-        filename = decodeURIComponent(c.req.path);
+        filename = tryDecodeURI(c.req.path);
         if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
           throw new Error();
         }

package/dist/types/client/types.d.ts

@@ -1,7 +1,7 @@
 import type { Hono } from '../hono';
 import type { HonoBase } from '../hono-base';
 import type { METHODS, METHOD_NAME_ALL_LOWERCASE } from '../router';
-import type { Endpoint, KnownResponseFormat, ResponseFormat, Schema } from '../types';
+import type { Endpoint, ExtractSchema, KnownResponseFormat, ResponseFormat, Schema } from '../types';
 import type { StatusCode, SuccessStatusCode } from '../utils/http-status';
 import type { HasRequiredKeys } from '../utils/types';
 /**
@@ -205,5 +205,5 @@ type ModSchema<D, Def extends GlobalResponseDefinition> = {
         [M in keyof D[K]]: ModRoute<D[K][M], Def>;
     };
 };
-export type ApplyGlobalResponse<App, Def extends GlobalResponseDefinition> = App extends HonoBase<infer E, infer D extends Schema, infer B> ? Hono<E, ModSchema<D, Def> extends Schema ? ModSchema<D, Def> : never, B> : never;
+export type ApplyGlobalResponse<App, Def extends GlobalResponseDefinition> = App extends HonoBase<infer E, infer _ extends Schema, infer B> ? ModSchema<ExtractSchema<App>, Def> extends infer S extends Schema ? Hono<E, S, B> : never : never;
 export {};

package/dist/types/utils/url.d.ts

@@ -8,6 +8,16 @@ export declare const splitRoutingPath: (routePath: string) => string[];
 export declare const getPattern: (label: string, next?: string) => Pattern | null;
 type Decoder = (str: string) => string;
 export declare const tryDecode: (str: string, decoder: Decoder) => string;
+/**
+ * Try to apply decodeURI() to given string.
+ * If it fails, skip invalid percent encoding or invalid UTF-8 sequences, and apply decodeURI() to the rest as much as possible.
+ * @param str The string to decode.
+ * @returns The decoded string that sometimes contains undecodable percent encoding.
+ * @example
+ * tryDecodeURI('Hello%20World') // 'Hello World'
+ * tryDecodeURI('Hello%20World/%A4%A2') // 'Hello World/%A4%A2'
+ */
+export declare const tryDecodeURI: (str: string) => string;
 export declare const getPath: (request: Request) => string;
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;

package/dist/utils/cookie.js

@@ -87,6 +87,11 @@ var _serialize = (name, value, opt = {}) => {
       throw new Error("__Host- Cookie must not have Domain attributes");
     }
   }
+  for (const key of ["domain", "path"]) {
+    if (opt[key] && /[;\r\n]/.test(opt[key])) {
+      throw new Error(`${key} must not contain ";", "\\r", or "\\n"`);
+    }
+  }
   if (opt && typeof opt.maxAge === "number" && opt.maxAge >= 0) {
     if (opt.maxAge > 3456e4) {
       throw new Error(

package/dist/utils/url.js

@@ -217,5 +217,6 @@ export {
   mergePath,
   splitPath,
   splitRoutingPath,
-  tryDecode
+  tryDecode,
+  tryDecodeURI
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.12.3",
+  "version": "4.12.4",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",