path-to-regexp 6.2.2 → 7.1.0

package/Readme.md

@@ -16,59 +16,55 @@ npm install path-to-regexp --save
 
 ## Usage
 
-```javascript
+```js
 const { pathToRegexp, match, parse, compile } = require("path-to-regexp");
 
-// pathToRegexp(path, keys?, options?)
-// match(path)
-// parse(path)
-// compile(path)
+// pathToRegexp(path, options?)
+// match(path, options?)
+// parse(path, options?)
+// compile(path, options?)
 ```
 
 ### Path to regexp
 
-The `pathToRegexp` function will return a regular expression object based on the provided `path` argument. It accepts the following arguments:
+The `pathToRegexp` function returns a regular expression with `keys` as a property. It accepts the following arguments:
 
-- **path** A string, array of strings, or a regular expression.
-- **keys** _(optional)_ An array to populate with keys found in the path.
+- **path** A string.
 - **options** _(optional)_
-  - **sensitive** When `true` the regexp will be case sensitive. (default: `false`)
-  - **strict** When `true` the regexp won't allow an optional trailing delimiter to match. (default: `false`)
-  - **end** When `true` the regexp will match to the end of the string. (default: `true`)
-  - **start** When `true` the regexp will match from the beginning of the string. (default: `true`)
-  - **delimiter** The default delimiter for segments, e.g. `[^/#?]` for `:named` patterns. (default: `'/#?'`)
-  - **endsWith** Optional character, or list of characters, to treat as "end" characters.
-  - **encode** A function to encode strings before inserting into `RegExp`. (default: `x => x`)
-  - **prefixes** List of characters to automatically consider prefixes when parsing. (default: `./`)
-
-```javascript
-const keys = [];
-const regexp = pathToRegexp("/foo/:bar", keys);
-// regexp = /^\/foo(?:\/([^\/#\?]+?))[\/#\?]?$/i
-// keys = [{ name: 'bar', prefix: '/', suffix: '', pattern: '[^\\/#\\?]+?', modifier: '' }]
+  - **sensitive** Regexp will be case sensitive. (default: `false`)
+  - **trailing** Allows optional trailing delimiter to match. (default: `true`)
+  - **strict** Verify patterns are valid and safe to use. (default: `false`, recommended: `true`)
+  - **end** Match to the end of the string. (default: `true`)
+  - **start** Match from the beginning of the string. (default: `true`)
+  - **loose** Allow the delimiter to be arbitrarily repeated, e.g. `/` or `///`. (default: `true`)
+  - **delimiter** The default delimiter for segments, e.g. `[^/]` for `:named` parameters. (default: `'/'`)
+  - **encodePath** A function for encoding input strings. (default: `x => x`, recommended: [`encodeurl`](https://github.com/pillarjs/encodeurl) for unicode encoding)
+
+```js
+const regexp = pathToRegexp("/foo/:bar");
+// regexp = /^\/+foo(?:\/+([^\/]+?))(?:\/+)?$/i
+// keys = [{ name: 'bar', prefix: '', suffix: '', pattern: '', modifier: '' }]
 ```
 
-**Please note:** The `RegExp` returned by `path-to-regexp` is intended for ordered data (e.g. pathnames, hostnames). It can not handle arbitrarily ordered data (e.g. query strings, URL fragments, JSON, etc). When using paths that contain query strings, you need to escape the question mark (`?`) to ensure it does not flag the parameter as [optional](#optional).
+**Please note:** The `RegExp` returned by `path-to-regexp` is intended for ordered data (e.g. pathnames, hostnames). It can not handle arbitrarily ordered data (e.g. query strings, URL fragments, JSON, etc).
 
 ### Parameters
 
 The path argument is used to define parameters and populate keys.
 
-#### Named Parameters
+#### Named parameters
 
-Named parameters are defined by prefixing a colon to the parameter name (`:foo`).
+Named parameters are defined by prefixing a colon to the parameter name (`:foo`). Parameter names can use any valid unicode identifier characters (similar to JavaScript).
 
 ```js
 const regexp = pathToRegexp("/:foo/:bar");
-// keys = [{ name: 'foo', prefix: '/', ... }, { name: 'bar', prefix: '/', ... }]
+// keys = [{ name: 'foo', ... }, { name: 'bar', ... }]
 
 regexp.exec("/test/route");
-//=> [ '/test/route', 'test', 'route', index: 0, input: '/test/route', groups: undefined ]
+//=> [ '/test/route', 'test', 'route', index: 0 ]
 ```
 
-**Please note:** Parameter names must use "word characters" (`[A-Za-z0-9_]`).
-
-##### Custom Matching Parameters
+##### Custom matching parameters
 
 Parameters can have a custom regexp, which overrides the default match (`[^/]+`). For example, you can match digits or names in a path:
 
@@ -94,64 +90,49 @@ regexpWord.exec("/users");
 
 **Tip:** Backslashes need to be escaped with another backslash in JavaScript strings.
 
-##### Custom Prefix and Suffix
+#### Unnamed parameters
 
-Parameters can be wrapped in `{}` to create custom prefixes or suffixes for your segment:
+It is possible to define a parameter without a name. The name will be numerically indexed:
 
 ```js
-const regexp = pathToRegexp("/:attr1?{-:attr2}?{-:attr3}?");
-
-regexp.exec("/test");
-// => ['/test', 'test', undefined, undefined]
+const regexp = pathToRegexp("/:foo/(.*)");
+// keys = [{ name: 'foo', ... }, { name: '0', ... }]
 
-regexp.exec("/test-test");
-// => ['/test', 'test', 'test', undefined]
+regexp.exec("/test/route");
+//=> [ '/test/route', 'test', 'route', index: 0 ]
 ```
 
-#### Unnamed Parameters
+##### Custom prefix and suffix
 
-It is possible to write an unnamed parameter that only consists of a regexp. It works the same the named parameter, except it will be numerically indexed:
+Parameters can be wrapped in `{}` to create custom prefixes or suffixes for your segment:
 
 ```js
-const regexp = pathToRegexp("/:foo/(.*)");
-// keys = [{ name: 'foo', ... }, { name: 0, ... }]
+const regexp = pathToRegexp("{/:attr1}?{-:attr2}?{-:attr3}?");
 
-regexp.exec("/test/route");
-//=> [ '/test/route', 'test', 'route', index: 0, input: '/test/route', groups: undefined ]
+regexp.exec("/test");
+// => ['/test', 'test', undefined, undefined]
+
+regexp.exec("/test-test");
+// => ['/test', 'test', 'test', undefined]
 ```
 
 #### Modifiers
 
-Modifiers must be placed after the parameter (e.g. `/:foo?`, `/(test)?`, `/:foo(test)?`, or `{-:foo(test)}?`).
+Modifiers are used after parameters with custom prefixes and suffixes (`{}`).
 
 ##### Optional
 
 Parameters can be suffixed with a question mark (`?`) to make the parameter optional.
 
 ```js
-const regexp = pathToRegexp("/:foo/:bar?");
+const regexp = pathToRegexp("/:foo{/:bar}?");
 // keys = [{ name: 'foo', ... }, { name: 'bar', prefix: '/', modifier: '?' }]
 
 regexp.exec("/test");
-//=> [ '/test', 'test', undefined, index: 0, input: '/test', groups: undefined ]
+//=> [ '/test', 'test', undefined, index: 0 ]
 
 regexp.exec("/test/route");
-//=> [ '/test/route', 'test', 'route', index: 0, input: '/test/route', groups: undefined ]
-```
-
-**Tip:** The prefix is also optional, escape the prefix `\/` to make it required.
-
-When dealing with query strings, escape the question mark (`?`) so it doesn't mark the parameter as optional. Handling unordered data is outside the scope of this library.
-
-```js
-const regexp = pathToRegexp("/search/:tableName\\?useIndex=true&term=amazing");
-
-regexp.exec("/search/people?useIndex=true&term=amazing");
-//=> [ '/search/people?useIndex=true&term=amazing', 'people', index: 0, input: '/search/people?useIndex=true&term=amazing', groups: undefined ]
-
-// This library does not handle query strings in different orders
-regexp.exec("/search/people?term=amazing&useIndex=true");
-//=> null
+//=> [ '/test/route', 'test', 'route', index: 0 ]
 ```
 
 ##### Zero or more
@@ -159,14 +140,14 @@ regexp.exec("/search/people?term=amazing&useIndex=true");
 Parameters can be suffixed with an asterisk (`*`) to denote a zero or more parameter matches.
 
 ```js
-const regexp = pathToRegexp("/:foo*");
+const regexp = pathToRegexp("{/:foo}*");
 // keys = [{ name: 'foo', prefix: '/', modifier: '*' }]
 
-regexp.exec("/");
-//=> [ '/', undefined, index: 0, input: '/', groups: undefined ]
+regexp.exec("/foo");
+//=> [ '/foo', "foo", index: 0 ]
 
 regexp.exec("/bar/baz");
-//=> [ '/bar/baz', 'bar/baz', index: 0, input: '/bar/baz', groups: undefined ]
+//=> [ '/bar/baz', 'bar/baz', index: 0 ]
 ```
 
 ##### One or more
@@ -174,165 +155,159 @@ regexp.exec("/bar/baz");
 Parameters can be suffixed with a plus sign (`+`) to denote a one or more parameter matches.
 
 ```js
-const regexp = pathToRegexp("/:foo+");
+const regexp = pathToRegexp("{/:foo}+");
 // keys = [{ name: 'foo', prefix: '/', modifier: '+' }]
 
 regexp.exec("/");
 //=> null
 
 regexp.exec("/bar/baz");
-//=> [ '/bar/baz','bar/baz', index: 0, input: '/bar/baz', groups: undefined ]
+//=> [ '/bar/baz', 'bar/baz', index: 0 ]
 ```
 
-### Match
+##### Custom separator
 
-The `match` function will return a function for transforming paths into parameters:
+By default, parameters set the separator as the `prefix + suffix` of the token. Using `;` you can modify this:
 
 ```js
-// Make sure you consistently `decode` segments.
-const fn = match("/user/:id", { decode: decodeURIComponent });
+const regexp = pathToRegexp("/name{/:parts;-}+");
 
-fn("/user/123"); //=> { path: '/user/123', index: 0, params: { id: '123' } }
-fn("/invalid"); //=> false
-fn("/user/caf%C3%A9"); //=> { path: '/user/caf%C3%A9', index: 0, params: { id: 'café' } }
+regexp.exec("/name");
+//=> null
+
+regexp.exec("/bar/1-2-3");
+//=> [ '/name/1-2-3', '1-2-3', index: 0 ]
 ```
 
-The `match` function can be used to custom match named parameters. For example, this can be used to whitelist a small number of valid paths:
+#### Wildcard
 
-```js
-const urlMatch = match("/users/:id/:tab(home|photos|bio)", {
-  decode: decodeURIComponent,
-});
+A wildcard can also be used. It is roughly equivalent to `(.*)`.
 
-urlMatch("/users/1234/photos");
-//=> { path: '/users/1234/photos', index: 0, params: { id: '1234', tab: 'photos' } }
+```js
+const regexp = pathToRegexp("/*");
+// keys = [{ name: '0', pattern: '[^\\/]*', separator: '/', modifier: '*' }]
 
-urlMatch("/users/1234/bio");
-//=> { path: '/users/1234/bio', index: 0, params: { id: '1234', tab: 'bio' } }
+regexp.exec("/");
+//=> [ '/', '', index: 0 ]
 
-urlMatch("/users/1234/otherstuff");
-//=> false
+regexp.exec("/bar/baz");
+//=> [ '/bar/baz', 'bar/baz', index: 0 ]
 ```
 
-#### Process Pathname
+### Match
+
+The `match` function returns a function for transforming paths into parameters:
 
-You should make sure variations of the same path match the expected `path`. Here's one possible solution using `encode`:
+- **path** A string.
+- **options** _(optional)_ The same options as `pathToRegexp`, plus:
+  - **decode** Function for decoding strings for params, or `false` to disable entirely. (default: `decodeURIComponent`)
 
 ```js
-const fn = match("/café", { encode: encodeURI });
+const fn = match("/user/:id");
 
-fn("/caf%C3%A9"); //=> { path: '/caf%C3%A9', index: 0, params: {} }
+fn("/user/123"); //=> { path: '/user/123', index: 0, params: { id: '123' } }
+fn("/invalid"); //=> false
+fn("/user/caf%C3%A9"); //=> { path: '/user/caf%C3%A9', index: 0, params: { id: 'café' } }
 ```
 
-**Note:** [`URL`](https://developer.mozilla.org/en-US/docs/Web/API/URL) encodes paths, so `/café` would be normalized to `/caf%C3%A9` and match in the above example.
+**Note:** Setting `decode: false` disables the "splitting" behavior of repeated parameters, which is useful if you need the exactly matched parameter back.
+
+### Compile ("Reverse" Path-To-RegExp)
 
-##### Alternative Using Normalize
+The `compile` function will return a function for transforming parameters into a valid path:
 
-Sometimes you won't have already normalized paths to use, so you could normalize it yourself before matching:
+- **path** A string.
+- **options** _(optional)_ Similar to `pathToRegexp` (`delimiter`, `encodePath`, `sensitive`, and `loose`), plus:
+  - **validate** When `false` the function can produce an invalid (unmatched) path. (default: `true`)
+  - **encode** Function for encoding input strings for output into the path, or `false` to disable entirely. (default: `encodeURIComponent`)
 
 ```js
-/**
- * Normalize a pathname for matching, replaces multiple slashes with a single
- * slash and normalizes unicode characters to "NFC". When using this method,
- * `decode` should be an identity function so you don't decode strings twice.
- */
-function normalizePathname(pathname: string) {
-  return (
-    decodeURI(pathname)
-      // Replaces repeated slashes in the URL.
-      .replace(/\/+/g, "/")
-      // Reference: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
-      // Note: Missing native IE support, may want to skip this step.
-      .normalize()
-  );
-}
-
-// Two possible ways of writing `/café`:
-const re = pathToRegexp("/caf\u00E9");
-const input = encodeURI("/cafe\u0301");
-
-re.test(input); //=> false
-re.test(normalizePathname(input)); //=> true
-```
+const toPath = compile("/user/:id");
 
-### Parse
+toPath({ id: "name" }); //=> "/user/name"
+toPath({ id: "café" }); //=> "/user/caf%C3%A9"
 
-The `parse` function will return a list of strings and keys from a path string:
+// When disabling `encode`, you need to make sure inputs are encoded correctly. No arrays are accepted.
+const toPathRaw = compile("/user/:id", { encode: false });
 
-```js
-const tokens = parse("/route/:foo/(.*)");
+toPathRaw({ id: "%3A%2F" }); //=> "/user/%3A%2F"
+toPathRaw({ id: ":/" }); //=> Throws, "/user/:/" when `validate` is `false`.
 
-console.log(tokens[0]);
-//=> "/route"
+const toPathRepeated = compile("{/:segment}+");
 
-console.log(tokens[1]);
-//=> { name: 'foo', prefix: '/', suffix: '', pattern: '[^\\/#\\?]+?', modifier: '' }
+toPathRepeated({ segment: ["foo"] }); //=> "/foo"
+toPathRepeated({ segment: ["a", "b", "c"] }); //=> "/a/b/c"
 
-console.log(tokens[2]);
-//=> { name: 0, prefix: '/', suffix: '', pattern: '.*', modifier: '' }
+const toPathRegexp = compile("/user/:id(\\d+)");
+
+toPathRegexp({ id: "123" }); //=> "/user/123"
 ```
 
-**Note:** This method only works with strings.
+## Developers
 
-### Compile ("Reverse" Path-To-RegExp)
+- If you are rewriting paths with match and compiler, consider using `encode: false` and `decode: false` to keep raw paths passed around.
+- To ensure matches work on paths containing characters usually encoded, consider using [encodeurl](https://github.com/pillarjs/encodeurl) for `encodePath`.
+- If matches are intended to be exact, you need to set `loose: false`, `trailing: false`, and `sensitive: true`.
+- Enable `strict: true` to detect ReDOS issues.
 
-The `compile` function will return a function for transforming parameters into a valid path:
+### Parse
 
-```js
-// Make sure you encode your path segments consistently.
-const toPath = compile("/user/:id", { encode: encodeURIComponent });
+A `parse` function is available and returns `TokenData`, the set of tokens and other metadata parsed from the input string. `TokenData` is can passed directly into `pathToRegexp`, `match`, and `compile`. It accepts only two options, `delimiter` and `encodePath`, which makes those options redundant in the above methods.
 
-toPath({ id: 123 }); //=> "/user/123"
-toPath({ id: "café" }); //=> "/user/caf%C3%A9"
-toPath({ id: ":/" }); //=> "/user/%3A%2F"
+### Tokens
 
-// Without `encode`, you need to make sure inputs are encoded correctly.
-// (Note: You can use `validate: false` to create an invalid paths.)
-const toPathRaw = compile("/user/:id", { validate: false });
+The `tokens` returned by `TokenData` is an array of strings or keys, represented as objects, with the following properties:
 
-toPathRaw({ id: "%3A%2F" }); //=> "/user/%3A%2F"
-toPathRaw({ id: ":/" }); //=> "/user/:/"
+- `name` The name of the token
+- `prefix` _(optional)_ The prefix string for the segment (e.g. `"/"`)
+- `suffix` _(optional)_ The suffix string for the segment (e.g. `""`)
+- `pattern` _(optional)_ The pattern defined to match this token
+- `modifier` _(optional)_ The modifier character used for the segment (e.g. `?`)
+- `separator` _(optional)_ The string used to separate repeated parameters
 
-const toPathRepeated = compile("/:segment+");
+### Custom path
 
-toPathRepeated({ segment: "foo" }); //=> "/foo"
-toPathRepeated({ segment: ["a", "b", "c"] }); //=> "/a/b/c"
+In some applications, you may not be able to use the `path-to-regexp` syntax (e.g. file-based routing), but you can still use this library for `match`, `compile`, and `pathToRegexp` by building your own `TokenData` instance. For example:
 
-const toPathRegexp = compile("/user/:id(\\d+)");
+```js
+import { TokenData, match } from "path-to-regexp";
 
-toPathRegexp({ id: 123 }); //=> "/user/123"
-toPathRegexp({ id: "123" }); //=> "/user/123"
+const tokens = ["/", { name: "foo" }];
+const path = new TokenData(tokens, "/");
+const fn = match(path);
+
+fn("/test"); //=> { path: '/test', index: 0, params: { foo: 'test' } }
 ```
 
-**Note:** The generated function will throw on invalid input.
+## Errors
+
+An effort has been made to ensure ambiguous paths from previous releases throw an error. This means you might be seeing an error when things worked before.
 
-### Working with Tokens
+### Unexpected `?`, `*`, or `+`
 
-Path-To-RegExp exposes the two functions used internally that accept an array of tokens:
+In previous major versions `/` and `.` were used as implicit prefixes of parameters. So `/:key?` was implicitly `{/:key}?`. For example:
 
-- `tokensToRegexp(tokens, keys?, options?)` Transform an array of tokens into a matching regular expression.
-- `tokensToFunction(tokens)` Transform an array of tokens into a path generator function.
+- `/:key?` → `{/:key}?` or `/:key*` → `{/:key}*` or `/:key+` → `{/:key}+`
+- `.:key?` → `{.:key}?` or `.:key*` → `{.:key}*` or `.:key+` → `{.:key}+`
+- `:key?` → `{:key}?` or `:key*` → `{:key}*` or `:key+` → `{:key}+`
 
-#### Token Information
+### Unexpected `;`
 
-- `name` The name of the token (`string` for named or `number` for unnamed index)
-- `prefix` The prefix string for the segment (e.g. `"/"`)
-- `suffix` The suffix string for the segment (e.g. `""`)
-- `pattern` The RegExp used to match this token (`string`)
-- `modifier` The modifier character used for the segment (e.g. `?`)
+Used as a [custom separator](#custom-separator) for repeated parameters.
 
-## Compatibility with Express <= 4.x
+### Unexpected `!`, `@`, or `,`
 
-Path-To-RegExp breaks compatibility with Express <= `4.x`:
+These characters have been reserved for future use.
 
-- RegExp special characters can only be used in a parameter
-  - Express.js 4.x supported `RegExp` special characters regardless of position - this is considered a bug
-- Parameters have suffixes that augment meaning - `*`, `+` and `?`. E.g. `/:user*`
-- No wildcard asterisk (`*`) - use parameters instead (`(.*)` or `:splat*`)
+### Express <= 4.x
 
-## Live Demo
+Path-To-RegExp breaks compatibility with Express <= `4.x` in the following ways:
 
-You can see a live demo of this library in use at [express-route-tester](http://forbeslindesay.github.io/express-route-tester/).
+- The only part of the string that is a regex is within `()`.
+  - In Express.js 4.x, everything was passed as-is after a simple replacement, so you could write `/[a-z]+` to match `/test`.
+- The `?` optional character must be used after `{}`.
+- Some characters have new meaning or have been reserved (`{}?*+@!;`).
+- The parameter name now supports all unicode identifier characters, previously it was only `[a-z0-9]`.
 
 ## License