hono 4.13.4 → 4.13.5

package/dist/cjs/helper/ssg/ssg.js

@@ -206,7 +206,7 @@ const saveContentToFile = async (data, fsModule, outDir, extensionMap) => {
   const { routePath, content, mimeType } = awaitedData;
   const filePath = generateFilePath(routePath, outDir, mimeType, extensionMap);
   const dirPath = (0, import_utils2.dirname)(filePath);
-  if (!createdDirs.has(dirPath)) {
+  if (dirPath !== "" && !createdDirs.has(dirPath)) {
     await fsModule.mkdir(dirPath, { recursive: true });
     createdDirs.add(dirPath);
   }

package/dist/cjs/helper/ssg/utils.js

@@ -33,8 +33,14 @@ const dirname = (path) => {
 const normalizePath = (path) => {
   return path.replace(/(\\)/g, "/").replace(/\/$/g, "");
 };
-const handleParent = (resultPaths, beforeParentFlag) => {
-  if (resultPaths.length === 0 || beforeParentFlag) {
+const getUncRoot = (path) => {
+  const uncRoot = path.replace(/\\/g, "/").match(/^\/\/([^/]+)\/([^/]+)/);
+  if (uncRoot) {
+    return `${uncRoot[1].toLowerCase()}/${uncRoot[2].toLowerCase()}`;
+  }
+};
+const handleParent = (resultPaths) => {
+  if (resultPaths.length === 0 || resultPaths[resultPaths.length - 1] === "..") {
     resultPaths.push("..");
   } else {
     resultPaths.pop();
@@ -47,22 +53,20 @@ const handleNonDot = (path, resultPaths) => {
   }
 };
 const handleSegments = (paths, resultPaths) => {
-  let beforeParentFlag = false;
   for (const path of paths) {
     if (path === "..") {
-      handleParent(resultPaths, beforeParentFlag);
-      beforeParentFlag = true;
+      handleParent(resultPaths);
     } else {
       handleNonDot(path, resultPaths);
-      beforeParentFlag = false;
     }
   }
 };
 const joinPaths = (...paths) => {
+  const hasUncPrefix = getUncRoot(paths[0]) !== void 0;
   paths = paths.map(normalizePath);
   const resultPaths = [];
   handleSegments(paths.join("/").split("/"), resultPaths);
-  return (paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
+  return (hasUncPrefix ? "//" : paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
 };
 const filterStaticGenerateRoutes = (hono) => {
   return hono.routes.reduce((acc, { method, handler, path }) => {
@@ -76,10 +80,26 @@ const filterStaticGenerateRoutes = (hono) => {
 const isDynamicRoute = (path) => {
   return path.split("/").some((segment) => segment.startsWith(":") || segment.includes("*"));
 };
+const toSegments = (path) => path === "" ? [] : path.split("/");
+const getPathRoot = (path) => {
+  const normalizedPath = path.replace(/\\/g, "/");
+  const uncRoot = getUncRoot(normalizedPath);
+  if (uncRoot) {
+    return `unc:${uncRoot}`;
+  }
+  const driveRoot = normalizedPath.match(/^([A-Za-z]):/);
+  if (driveRoot) {
+    const kind = normalizedPath[2] === "/" ? "drive-absolute" : "drive-relative";
+    return `${kind}:${driveRoot[1].toLowerCase()}`;
+  }
+  return normalizedPath.startsWith("/") ? "absolute" : "relative";
+};
 const ensureWithinOutDir = (outDir, filePath) => {
-  const normalizedOutDir = joinPaths("/", outDir);
-  const normalizedFilePath = joinPaths("/", filePath);
-  if (normalizedFilePath !== normalizedOutDir && !normalizedFilePath.startsWith(`${normalizedOutDir}/`)) {
+  const outDirSegments = toSegments(joinPaths(outDir));
+  const filePathSegments = toSegments(joinPaths(filePath));
+  const hasMismatchedPathRoot = getPathRoot(outDir) !== getPathRoot(filePath);
+  const climbsAboveOutDir = filePathSegments[outDirSegments.length] === "..";
+  if (hasMismatchedPathRoot || filePathSegments.length <= outDirSegments.length || !outDirSegments.every((segment, i) => segment === filePathSegments[i]) || climbsAboveOutDir) {
     throw new Error(`Path traversal detected: "${filePath}" is outside the output directory`);
   }
 };

package/dist/cjs/middleware/cache/index.js

@@ -44,7 +44,7 @@ const parseVaryDirectives = (vary) => {
 };
 const createCacheKey = (key, requestUrl, request, varyHeaders) => {
   const url = new URL(cacheKeyPath, requestUrl);
-  url.searchParams.append(cacheKeyParameter, key.split("#", 1)[0]);
+  url.searchParams.append(cacheKeyParameter, key);
   url.searchParams.append(cacheMethodKeyParameter, request.method);
   if (request.method === "QUERY") {
     url.searchParams.append(queryDigestKeyParameter, request.digest);

package/dist/cjs/utils/body.js

@@ -21,6 +21,8 @@ __export(body_exports, {
 });
 module.exports = __toCommonJS(body_exports);
 var import_buffer = require("./buffer");
+const MAX_NESTING_DEPTH = 32;
+const MAX_NESTED_OBJECTS = 1e4;
 const isRawRequest = (request) => "headers" in request;
 const parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -53,6 +55,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -65,7 +68,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -88,23 +91,32 @@ const handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-const handleParsingNestedValues = (form, key, value) => {
+const handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+const throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   parseBody

package/dist/cjs/utils/url.js

@@ -119,7 +119,11 @@ const getPath = (request) => {
 };
 const getQueryStrings = (url) => {
   const queryIndex = url.indexOf("?", 8);
-  return queryIndex === -1 ? "" : "?" + url.slice(queryIndex + 1);
+  if (queryIndex === -1) {
+    return "";
+  }
+  const hashIndex = url.indexOf("#", 8);
+  return hashIndex === -1 ? url.slice(queryIndex) : queryIndex < hashIndex ? url.slice(queryIndex, hashIndex) : "";
 };
 const getPathNoStrict = (request) => {
   const result = getPath(request);
@@ -166,6 +170,10 @@ const _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 const _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);

package/dist/helper/ssg/ssg.js

@@ -184,7 +184,7 @@ var saveContentToFile = async (data, fsModule, outDir, extensionMap) => {
   const { routePath, content, mimeType } = awaitedData;
   const filePath = generateFilePath(routePath, outDir, mimeType, extensionMap);
   const dirPath = dirname(filePath);
-  if (!createdDirs.has(dirPath)) {
+  if (dirPath !== "" && !createdDirs.has(dirPath)) {
     await fsModule.mkdir(dirPath, { recursive: true });
     createdDirs.add(dirPath);
   }

package/dist/helper/ssg/utils.js

@@ -8,8 +8,14 @@ var dirname = (path) => {
 var normalizePath = (path) => {
   return path.replace(/(\\)/g, "/").replace(/\/$/g, "");
 };
-var handleParent = (resultPaths, beforeParentFlag) => {
-  if (resultPaths.length === 0 || beforeParentFlag) {
+var getUncRoot = (path) => {
+  const uncRoot = path.replace(/\\/g, "/").match(/^\/\/([^/]+)\/([^/]+)/);
+  if (uncRoot) {
+    return `${uncRoot[1].toLowerCase()}/${uncRoot[2].toLowerCase()}`;
+  }
+};
+var handleParent = (resultPaths) => {
+  if (resultPaths.length === 0 || resultPaths[resultPaths.length - 1] === "..") {
     resultPaths.push("..");
   } else {
     resultPaths.pop();
@@ -22,22 +28,20 @@ var handleNonDot = (path, resultPaths) => {
   }
 };
 var handleSegments = (paths, resultPaths) => {
-  let beforeParentFlag = false;
   for (const path of paths) {
     if (path === "..") {
-      handleParent(resultPaths, beforeParentFlag);
-      beforeParentFlag = true;
+      handleParent(resultPaths);
     } else {
       handleNonDot(path, resultPaths);
-      beforeParentFlag = false;
     }
   }
 };
 var joinPaths = (...paths) => {
+  const hasUncPrefix = getUncRoot(paths[0]) !== void 0;
   paths = paths.map(normalizePath);
   const resultPaths = [];
   handleSegments(paths.join("/").split("/"), resultPaths);
-  return (paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
+  return (hasUncPrefix ? "//" : paths[0][0] === "/" ? "/" : "") + resultPaths.join("/");
 };
 var filterStaticGenerateRoutes = (hono) => {
   return hono.routes.reduce((acc, { method, handler, path }) => {
@@ -51,10 +55,26 @@ var filterStaticGenerateRoutes = (hono) => {
 var isDynamicRoute = (path) => {
   return path.split("/").some((segment) => segment.startsWith(":") || segment.includes("*"));
 };
+var toSegments = (path) => path === "" ? [] : path.split("/");
+var getPathRoot = (path) => {
+  const normalizedPath = path.replace(/\\/g, "/");
+  const uncRoot = getUncRoot(normalizedPath);
+  if (uncRoot) {
+    return `unc:${uncRoot}`;
+  }
+  const driveRoot = normalizedPath.match(/^([A-Za-z]):/);
+  if (driveRoot) {
+    const kind = normalizedPath[2] === "/" ? "drive-absolute" : "drive-relative";
+    return `${kind}:${driveRoot[1].toLowerCase()}`;
+  }
+  return normalizedPath.startsWith("/") ? "absolute" : "relative";
+};
 var ensureWithinOutDir = (outDir, filePath) => {
-  const normalizedOutDir = joinPaths("/", outDir);
-  const normalizedFilePath = joinPaths("/", filePath);
-  if (normalizedFilePath !== normalizedOutDir && !normalizedFilePath.startsWith(`${normalizedOutDir}/`)) {
+  const outDirSegments = toSegments(joinPaths(outDir));
+  const filePathSegments = toSegments(joinPaths(filePath));
+  const hasMismatchedPathRoot = getPathRoot(outDir) !== getPathRoot(filePath);
+  const climbsAboveOutDir = filePathSegments[outDirSegments.length] === "..";
+  if (hasMismatchedPathRoot || filePathSegments.length <= outDirSegments.length || !outDirSegments.every((segment, i) => segment === filePathSegments[i]) || climbsAboveOutDir) {
     throw new Error(`Path traversal detected: "${filePath}" is outside the output directory`);
   }
 };

package/dist/middleware/cache/index.js

@@ -23,7 +23,7 @@ var parseVaryDirectives = (vary) => {
 };
 var createCacheKey = (key, requestUrl, request, varyHeaders) => {
   const url = new URL(cacheKeyPath, requestUrl);
-  url.searchParams.append(cacheKeyParameter, key.split("#", 1)[0]);
+  url.searchParams.append(cacheKeyParameter, key);
   url.searchParams.append(cacheMethodKeyParameter, request.method);
   if (request.method === "QUERY") {
     url.searchParams.append(queryDigestKeyParameter, request.digest);

package/dist/types/utils/url.d.ts

@@ -19,6 +19,10 @@ export declare const tryDecode: (str: string, decoder: Decoder) => string;
  */
 export declare const tryDecodeURI: (str: string) => string;
 export declare const getPath: (request: Request) => string;
+/**
+ * @deprecated
+ * Use the `URL` API instead.
+ */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
 /**

package/dist/utils/body.js

@@ -1,5 +1,7 @@
 // src/utils/body.ts
 import { bufferToFormData } from "./buffer.js";
+var MAX_NESTING_DEPTH = 32;
+var MAX_NESTED_OBJECTS = 1e4;
 var isRawRequest = (request) => "headers" in request;
 var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
   const { all = false, dot = false } = options;
@@ -32,6 +34,7 @@ async function parseFormData(request, options) {
 }
 function convertFormDataToBodyData(formData, options) {
   const form = /* @__PURE__ */ Object.create(null);
+  const nestingState = { count: 0 };
   formData.forEach((value, key) => {
     const shouldParseAllValues = options.all || key.endsWith("[]");
     if (!shouldParseAllValues) {
@@ -44,7 +47,7 @@ function convertFormDataToBodyData(formData, options) {
     Object.entries(form).forEach(([key, value]) => {
       const shouldParseDotValues = key.includes(".");
       if (shouldParseDotValues) {
-        handleParsingNestedValues(form, key, value);
+        handleParsingNestedValues(form, key, value, nestingState);
         delete form[key];
       }
     });
@@ -67,23 +70,32 @@ var handleParsingAllValues = (form, key, value) => {
     }
   }
 };
-var handleParsingNestedValues = (form, key, value) => {
+var handleParsingNestedValues = (form, key, value, state) => {
   if (/(?:^|\.)__proto__\./.test(key)) {
     return;
   }
   let nestedForm = form;
-  const keys = key.split(".");
+  const keys = key.split(".", MAX_NESTING_DEPTH + 2);
+  if (keys.length > MAX_NESTING_DEPTH + 1) {
+    throwNestingLimitExceeded();
+  }
   keys.forEach((key2, index) => {
     if (index === keys.length - 1) {
       nestedForm[key2] = value;
     } else {
       if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        if (state.count++ >= MAX_NESTED_OBJECTS) {
+          throwNestingLimitExceeded();
+        }
         nestedForm[key2] = /* @__PURE__ */ Object.create(null);
       }
       nestedForm = nestedForm[key2];
     }
   });
 };
+var throwNestingLimitExceeded = () => {
+  throw new Error("Nesting limit exceeded");
+};
 export {
   parseBody
 };

package/dist/utils/url.js

@@ -85,7 +85,11 @@ var getPath = (request) => {
 };
 var getQueryStrings = (url) => {
   const queryIndex = url.indexOf("?", 8);
-  return queryIndex === -1 ? "" : "?" + url.slice(queryIndex + 1);
+  if (queryIndex === -1) {
+    return "";
+  }
+  const hashIndex = url.indexOf("#", 8);
+  return hashIndex === -1 ? url.slice(queryIndex) : queryIndex < hashIndex ? url.slice(queryIndex, hashIndex) : "";
 };
 var getPathNoStrict = (request) => {
   const result = getPath(request);
@@ -132,6 +136,10 @@ var _decodeURI = (value) => {
   return tryDecodeURIComponent(value);
 };
 var _getQueryParam = (url, key, multiple) => {
+  const hashIndex = url.indexOf("#", 8);
+  if (hashIndex !== -1) {
+    url = url.slice(0, hashIndex);
+  }
   let encoded;
   if (!multiple && key && key.indexOf("%") === -1 && key.indexOf("+") === -1) {
     let keyIndex2 = url.indexOf("?", 8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.4",
+  "version": "4.13.5",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",