hono 4.13.3 → 4.13.5

package/dist/router/trie-router/node.js

@@ -1,11 +1,12 @@
 // src/router/trie-router/node.ts
 import { METHOD_NAME_ALL } from "../../router.js";
 import { getPattern, splitPath, splitRoutingPath } from "../../utils/url.js";
-var emptyParams = /* @__PURE__ */ Object.create(null);
+import { createNullObject } from "../utils.js";
+var emptyParams = createNullObject();
 var order = 0;
 var Node = class _Node {
   #methods = [];
-  #children = /* @__PURE__ */ Object.create(null);
+  #children = createNullObject();
   #patterns = [];
   #pattern;
   #params = emptyParams;
@@ -42,7 +43,7 @@ var Node = class _Node {
       const m = node.#methods[i];
       const handlerSet = m[method] || m[METHOD_NAME_ALL];
       if (handlerSet) {
-        handlerSet.params = /* @__PURE__ */ Object.create(null);
+        handlerSet.params = createNullObject();
         handlerSets.push(handlerSet);
         for (let i2 = 0, len2 = handlerSet.possibleKeys.length; i2 < len2; i2++) {
           const key = handlerSet.possibleKeys[i2];

package/dist/router/utils.js

@@ -0,0 +1,5 @@
+// src/router/utils.ts
+var createNullObject = () => /* @__PURE__ */ Object.create(null);
+export {
+  createNullObject
+};

package/dist/types/router/reg-exp-router/node.d.ts

@@ -1,3 +1,6 @@
+export declare const LABEL_REG_EXP_STR = "[^/]+";
+export declare const ONLY_WILDCARD_REG_EXP_STR = ".*";
+export declare const TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
 export declare const PATH_ERROR: unique symbol;
 export type ParamAssocArray = [string, number][];
 export interface Context {

package/dist/types/router/utils.d.ts

@@ -0,0 +1 @@
+export declare const createNullObject: () => any;

package/dist/types/utils/url.d.ts

@@ -19,6 +19,10 @@ export declare const tryDecode: (str: string, decoder: Decoder) => string;
  */
 export declare const tryDecodeURI: (str: string) => string;
 export declare const getPath: (request: Request) => string;
+/**
+ * @deprecated
+ * Use the `URL` API instead.
+ */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
 /**

package/dist/utils/body.js

@@ -1,5 +1,7 @@
 // src/utils/body.ts
 import { bufferToFormData } from "./buffer.js";
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -32,6 +34,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -44,7 +47,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -67,23 +70,32 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 export {
   parseBody
 };

package/dist/utils/cookie.js

@@ -77,7 +77,7 @@ var parseSigned = async (cookie, secret, name) => {
   const secretKey = await getCryptoKey(secret);
   for (const [key, value] of Object.entries(parse(cookie, name))) {
     const signatureStartPos = value.lastIndexOf(".");
-    if (signatureStartPos < 1) {
+    if (signatureStartPos < 0) {
       continue;
     }
     const signedValue = value.substring(0, signatureStartPos);

package/dist/utils/stream.js

@@ -75,7 +75,13 @@ var StreamingApi = class {
   abort() {
     if (!this.aborted) {
       this.aborted = true;
-      this.abortSubscribers.forEach((subscriber) => subscriber());
+      this.abortSubscribers.forEach((subscriber) => {
+        try {
+          void Promise.resolve(subscriber()).catch(() => {
+          });
+        } catch {
+        }
+      });
     }
   }
 };

package/dist/utils/url.js

@@ -85,7 +85,11 @@ var getPath = (request) => {
 };
 var getQueryStrings = (url) => {
   const queryIndex = url.indexOf("?", 8);
-  return queryIndex === -1 ? "" : "?" + url.slice(queryIndex + 1);
+  if (queryIndex === -1) {
+    return "";
+  }
+  const hashIndex = url.indexOf("#", 8);
+  return hashIndex === -1 ? url.slice(queryIndex) : queryIndex < hashIndex ? url.slice(queryIndex, hashIndex) : "";
 };
 var getPathNoStrict = (request) => {
   const result = getPath(request);
@@ -132,6 +136,10 @@ var _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 var _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.3",
+  "version": "4.13.5",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",