koa 2.8.1 → 2.11.0

package/History.md

@@ -1,4 +1,45 @@
 
+2.11.0 / 2019-10-28
+==================
+
+**features**
+  * [[`422e539`](http://github.com/koajs/koa/commit/422e539e8989e65ba43ecc39ddbaa3c4f755d465)] - feat: support app.proxyIPHeader and app.maxIpsCount to make ctx.ips more security (Yiyu He <<dead_horse@qq.com>>)
+  * [[`d48d88e`](http://github.com/koajs/koa/commit/d48d88ee17b780c02123e6d657274cab456e943e)] - feat: implement response.has (#1397) (Konstantin Vyatkin <<tino@vtkn.io>>)
+
+**others**
+  * [[`4dc56f6`](http://github.com/koajs/koa/commit/4dc56f6d04e8f5fe12ba53a8a776653b3d7b60ed)] - chore: update ESLint and plugins/configs (#1407) (Konstantin Vyatkin <<tino@vtkn.io>>)
+  * [[`be7d334`](http://github.com/koajs/koa/commit/be7d334778481639294cdf87f5c359a230aeb65b)] - chore: removes code duplication at handling HEAD method (#1400) (Konstantin Vyatkin <<tino@vtkn.io>>)
+  * [[`f155785`](http://github.com/koajs/koa/commit/f155785e2bb42b5ddf0a8156401c6dafdf57ba8b)] - chore: support `writableEnded` (#1402) (Konstantin Vyatkin <<tino@vtkn.io>>)
+  * [[`b968688`](http://github.com/koajs/koa/commit/b968688afe2c727ae141f50aa983d481dbc1dbbf)] - chore: add FUNDING.yml (#1403) (Konstantin Vyatkin <<tino@vtkn.io>>)
+  * [[`4f96829`](http://github.com/koajs/koa/commit/4f968298f97394e488297ec32c8e927a3a322076)] - chore: remove isJSON in res.length (#1399) (Konstantin Vyatkin <<tino@vtkn.io>>)
+  * [[`8be5626`](http://github.com/koajs/koa/commit/8be5626bbb54e6c899a1b71d22411709126d9fea)] - build: enable codecov partial coverage and use bash uploader (#1396) (Konstantin Vyatkin <<tino@vtkn.io>>)
+  * [[`ef5c43b`](http://github.com/koajs/koa/commit/ef5c43bcbcf31819e032c3b7ae7654b7f8e9358b)] - chore: use rest params (#1393) (Konstantin Vyatkin <<tino@vtkn.io>>)
+
+2.10.0 / 2019-10-12
+==================
+
+**features**
+  * [[`d7f7f77`](http://github.com/koajs/koa/commit/d7f7f77689e2eaef050686be2bdf3e72881a79ac)] - feat: support sameSite=none cookies (bump cookies dependency) (#1390) (Filip Skokan <<panva.ip@gmail.com>>)
+
+2.9.0 / 2019-10-12
+==================
+
+**features**
+  * [[`2d1c598`](http://github.com/koajs/koa/commit/2d1c5981869e0fe6f5bc71b5c5582accfd125cc6)] - feat: export HttpError from http-errors library (Micheal Hill <<micheal.hill@trunkplatform.com>>)
+
+**others**
+  * [[`cf70dbc`](http://github.com/koajs/koa/commit/cf70dbc6d2ba62bf1eb12b563dd5ecd27af6e2be)] - Chore: Use https in readme (#1389) (谭九鼎 <<109224573@qq.com>>)
+
+2.8.2 / 2019-09-28
+==================
+
+**fixes**
+  * [[`54e8fab`](http://github.com/koajs/koa/commit/54e8fab3e3d907bbb264caf3e28a24773d0d6fdb)] - fix: encode redirect url if not already encoded (#1384) (fengmk2 <<fengmk2@gmail.com>>)
+
+**others**
+  * [[`817b498`](http://github.com/koajs/koa/commit/817b49830571b45a8aec6b1fc1525434f5798c58)] - test: fix body test (#1375) (Robert Nagy <<ronagy@icloud.com>>)
+  * [[`f75d445`](http://github.com/koajs/koa/commit/f75d4455359ecdf30eeb676e2c7f31d4cf7b42ed)] - test: fix end after end (#1374) (Robert Nagy <<ronagy@icloud.com>>)
+
 2.8.1 / 2019-08-19
 ==================
 

package/Readme.md

@@ -41,7 +41,7 @@ app.listen(3000);
 
  - [Kick-Off-Koa](https://github.com/koajs/kick-off-koa) - An intro to Koa via a set of self-guided workshops.
  - [Workshop](https://github.com/koajs/workshop) - A workshop to learn the basics of Koa, Express' spiritual successor.
- - [Introduction Screencast](http://knowthen.com/episode-3-koajs-quickstart-guide/) - An introduction to installing and getting started with Koa
+ - [Introduction Screencast](https://knowthen.com/episode-3-koajs-quickstart-guide/) - An introduction to installing and getting started with Koa
 
 
 ## Middleware

package/lib/application.js

@@ -10,7 +10,6 @@ const debug = require('debug')('koa:application');
 const onFinished = require('on-finished');
 const response = require('./response');
 const compose = require('koa-compose');
-const isJSON = require('koa-is-json');
 const context = require('./context');
 const request = require('./request');
 const statuses = require('statuses');
@@ -21,6 +20,7 @@ const http = require('http');
 const only = require('only');
 const convert = require('koa-convert');
 const deprecate = require('depd')('koa');
+const { HttpError } = require('http-errors');
 
 /**
  * Expose `Application` class.
@@ -41,6 +41,8 @@ module.exports = class Application extends Emitter {
     * @param {string[]} [options.keys] Signed cookie keys
     * @param {boolean} [options.proxy] Trust proxy headers
     * @param {number} [options.subdomainOffset] Subdomain offset
+    * @param {boolean} [options.proxyIpHeader] proxy ip header, default to X-Forwarded-For
+    * @param {boolean} [options.maxIpsCount] max ips read from proxy ip header, default to 0 (means infinity)
     *
     */
 
@@ -49,6 +51,8 @@ module.exports = class Application extends Emitter {
     options = options || {};
     this.proxy = options.proxy || false;
     this.subdomainOffset = options.subdomainOffset || 2;
+    this.proxyIpHeader = options.proxyIpHeader || 'X-Forwarded-For';
+    this.maxIpsCount = options.maxIpsCount || 0;
     this.env = options.env || process.env.NODE_ENV || 'development';
     if (options.keys) this.keys = options.keys;
     this.middleware = [];
@@ -224,9 +228,10 @@ function respond(ctx) {
     return res.end();
   }
 
-  if ('HEAD' == ctx.method) {
-    if (!res.headersSent && isJSON(body)) {
-      ctx.length = Buffer.byteLength(JSON.stringify(body));
+  if ('HEAD' === ctx.method) {
+    if (!res.headersSent && !ctx.response.has('Content-Length')) {
+      const { length } = ctx.response;
+      if (Number.isInteger(length)) ctx.length = length;
     }
     return res.end();
   }
@@ -257,3 +262,9 @@ function respond(ctx) {
   }
   res.end(body);
 }
+
+/**
+ * Make HttpError available to consumers of the library so that consumers don't
+ * have a direct dependency upon `http-errors`
+ */
+module.exports.HttpError = HttpError;

package/lib/context.js

@@ -193,6 +193,7 @@ delegate(proto, 'response')
   .method('redirect')
   .method('remove')
   .method('vary')
+  .method('has')
   .method('set')
   .method('append')
   .method('flushHeaders')

package/lib/request.js

@@ -432,10 +432,14 @@ module.exports = {
 
   get ips() {
     const proxy = this.app.proxy;
-    const val = this.get('X-Forwarded-For');
-    return proxy && val
+    const val = this.get(this.app.proxyIpHeader);
+    let ips = proxy && val
       ? val.split(/\s*,\s*/)
       : [];
+    if (this.app.maxIpsCount > 0) {
+      ips = ips.slice(-this.app.maxIpsCount);
+    }
+    return ips;
   },
 
   /**
@@ -622,15 +626,14 @@ module.exports = {
    *
    *     this.is('html'); // => false
    *
-   * @param {String|Array} types...
+   * @param {String|String[]} [type]
+   * @param {String[]} [types]
    * @return {String|false|null}
    * @api public
    */
 
-  is(types) {
-    if (!types) return typeis(this.req);
-    if (!Array.isArray(types)) types = [].slice.call(arguments);
-    return typeis(this.req, types);
+  is(type, ...types) {
+    return typeis(this.req, type, ...types);
   },
 
   /**

package/lib/response.js

@@ -9,7 +9,6 @@ const contentDisposition = require('content-disposition');
 const ensureErrorHandler = require('error-inject');
 const getType = require('cache-content-type');
 const onFinish = require('on-finished');
-const isJSON = require('koa-is-json');
 const escape = require('escape-html');
 const typeis = require('type-is').is;
 const statuses = require('statuses');
@@ -19,6 +18,8 @@ const extname = require('path').extname;
 const vary = require('vary');
 const only = require('only');
 const util = require('util');
+const encodeUrl = require('encodeurl');
+const Stream = require('stream');
 
 /**
  * Prototype.
@@ -148,7 +149,7 @@ module.exports = {
     if (!this._explicitStatus) this.status = 200;
 
     // set the content-type only if not yet set
-    const setType = !this.header['content-type'];
+    const setType = !this.has('Content-Type');
 
     // string
     if ('string' == typeof val) {
@@ -200,18 +201,15 @@ module.exports = {
    */
 
   get length() {
-    const len = this.header['content-length'];
-    const body = this.body;
-
-    if (null == len) {
-      if (!body) return;
-      if ('string' == typeof body) return Buffer.byteLength(body);
-      if (Buffer.isBuffer(body)) return body.length;
-      if (isJSON(body)) return Buffer.byteLength(JSON.stringify(body));
-      return;
+    if (this.has('Content-Length')) {
+      return parseInt(this.get('Content-Length'), 10) || 0;
     }
 
-    return Math.trunc(len) || 0;
+    const { body } = this;
+    if (!body || body instanceof Stream) return undefined;
+    if ('string' === typeof body) return Buffer.byteLength(body);
+    if (Buffer.isBuffer(body)) return body.length;
+    return Buffer.byteLength(JSON.stringify(body));
   },
 
   /**
@@ -260,7 +258,7 @@ module.exports = {
   redirect(url, alt) {
     // location
     if ('back' == url) url = this.ctx.get('Referrer') || alt || '/';
-    this.set('Location', url);
+    this.set('Location', encodeUrl(url));
 
     // status
     if (!statuses.redirect[this.status]) this.status = 302;
@@ -388,16 +386,14 @@ module.exports = {
    * Check whether the response is one of the listed types.
    * Pretty much the same as `this.request.is()`.
    *
-   * @param {String|Array} types...
+   * @param {String|String[]} [type]
+   * @param {String[]} [types]
    * @return {String|false}
    * @api public
    */
 
-  is(types) {
-    const type = this.type;
-    if (!types) return type || false;
-    if (!Array.isArray(types)) types = [].slice.call(arguments);
-    return typeis(type, types);
+  is(type, ...types) {
+    return typeis(this.type, type, ...types);
   },
 
   /**
@@ -420,6 +416,29 @@ module.exports = {
     return this.header[field.toLowerCase()] || '';
   },
 
+  /**
+   * Returns true if the header identified by name is currently set in the outgoing headers.
+   * The header name matching is case-insensitive.
+   *
+   * Examples:
+   *
+   *     this.has('Content-Type');
+   *     // => true
+   *
+   *     this.get('content-type');
+   *     // => true
+   *
+   * @param {String} field
+   * @return {boolean}
+   * @api public
+   */
+  has(field) {
+    return typeof this.res.hasHeader === 'function'
+      ? this.res.hasHeader(field)
+      // Node < 7.7
+      : field.toLowerCase() in this.headers;
+  },
+
   /**
    * Set header `field` to `val`, or pass
    * an object of header fields.
@@ -501,7 +520,11 @@ module.exports = {
 
   get writable() {
     // can't write any more after response finished
-    if (this.res.finished) return false;
+    // response.writableEnded is available since Node > 12.9
+    // https://nodejs.org/api/http.html#http_response_writableended
+    // response.finished is undocumented feature of previous Node versions
+    // https://stackoverflow.com/questions/16254385/undocumented-response-finished-in-node-js
+    if (this.res.writableEnded || this.res.finished) return false;
 
     const socket = this.res.socket;
     // There are already pending outgoing res, but still writable

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "koa",
-  "version": "2.8.1",
+  "version": "2.11.0",
   "description": "Koa web app framework",
   "main": "lib/application.js",
   "scripts": {
@@ -26,11 +26,12 @@
     "cache-content-type": "^1.0.0",
     "content-disposition": "~0.5.2",
     "content-type": "^1.0.4",
-    "cookies": "~0.7.1",
+    "cookies": "~0.8.0",
     "debug": "~3.1.0",
     "delegates": "^1.0.0",
     "depd": "^1.1.2",
     "destroy": "^1.0.4",
+    "encodeurl": "^1.0.2",
     "error-inject": "^1.0.0",
     "escape-html": "^1.0.3",
     "fresh": "~0.5.2",
@@ -39,7 +40,6 @@
     "is-generator-function": "^1.0.7",
     "koa-compose": "^4.1.0",
     "koa-convert": "^1.2.0",
-    "koa-is-json": "^1.0.0",
     "on-finished": "^2.3.0",
     "only": "~0.0.2",
     "parseurl": "^1.3.2",
@@ -49,11 +49,13 @@
   },
   "devDependencies": {
     "egg-bin": "^4.13.0",
-    "eslint": "^6.0.1",
+    "eslint": "^6.5.1",
     "eslint-config-koa": "^2.0.0",
-    "eslint-config-standard": "^7.0.1",
-    "eslint-plugin-promise": "^3.5.0",
-    "eslint-plugin-standard": "^2.1.1",
+    "eslint-config-standard": "^14.1.0",
+    "eslint-plugin-import": "^2.18.2",
+    "eslint-plugin-node": "^10.0.0",
+    "eslint-plugin-promise": "^4.2.1",
+    "eslint-plugin-standard": "^4.0.1",
     "mm": "^2.5.0",
     "supertest": "^3.1.0"
   },