step-node-agent 3.29.0 → 3.29.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/node_modules/body-parser/HISTORY.md +8 -0
- package/node_modules/body-parser/lib/types/urlencoded.js +2 -9
- package/node_modules/body-parser/package.json +9 -10
- package/node_modules/cookie/index.js +2 -1
- package/node_modules/cookie/package.json +1 -1
- package/node_modules/cookie-signature/History.md +5 -1
- package/node_modules/cookie-signature/index.js +6 -6
- package/node_modules/cookie-signature/package.json +2 -2
- package/node_modules/express/History.md +11 -0
- package/node_modules/express/package.json +17 -17
- package/node_modules/finalhandler/HISTORY.md +6 -0
- package/node_modules/finalhandler/package.json +3 -3
- package/node_modules/http-errors/HISTORY.md +6 -0
- package/node_modules/http-errors/index.js +4 -3
- package/node_modules/http-errors/package.json +12 -8
- package/node_modules/qs/.github/SECURITY.md +11 -0
- package/node_modules/qs/.github/THREAT_MODEL.md +78 -0
- package/node_modules/qs/CHANGELOG.md +31 -0
- package/node_modules/qs/README.md +25 -1
- package/node_modules/qs/dist/qs.js +95 -44
- package/node_modules/qs/eslint.config.mjs +56 -0
- package/node_modules/qs/lib/parse.js +107 -43
- package/node_modules/qs/lib/stringify.js +11 -6
- package/node_modules/qs/lib/utils.js +61 -6
- package/node_modules/qs/package.json +15 -12
- package/node_modules/qs/test/parse.js +257 -31
- package/node_modules/qs/test/stringify.js +23 -11
- package/node_modules/qs/test/utils.js +245 -0
- package/node_modules/raw-body/package.json +5 -7
- package/node_modules/send/HISTORY.md +19 -7
- package/node_modules/send/package.json +6 -6
- package/node_modules/serve-static/HISTORY.md +6 -0
- package/node_modules/serve-static/package.json +2 -2
- package/node_modules/statuses/HISTORY.md +5 -0
- package/node_modules/statuses/README.md +3 -0
- package/node_modules/statuses/package.json +7 -7
- package/node_modules/yaml/browser/dist/compose/compose-collection.js +1 -1
- package/node_modules/yaml/browser/dist/compose/resolve-block-seq.js +1 -1
- package/node_modules/yaml/browser/dist/compose/resolve-flow-collection.js +2 -2
- package/node_modules/yaml/browser/dist/errors.js +1 -1
- package/node_modules/yaml/browser/dist/nodes/Alias.js +1 -1
- package/node_modules/yaml/browser/dist/parse/parser.js +2 -2
- package/node_modules/yaml/browser/dist/stringify/stringifyNumber.js +1 -1
- package/node_modules/yaml/browser/dist/stringify/stringifyPair.js +1 -1
- package/node_modules/yaml/dist/compose/compose-collection.js +1 -1
- package/node_modules/yaml/dist/compose/resolve-block-seq.js +1 -1
- package/node_modules/yaml/dist/compose/resolve-flow-collection.js +2 -2
- package/node_modules/yaml/dist/errors.js +1 -1
- package/node_modules/yaml/dist/nodes/Alias.js +1 -1
- package/node_modules/yaml/dist/parse/parser.js +2 -2
- package/node_modules/yaml/dist/stringify/stringifyNumber.js +1 -1
- package/node_modules/yaml/dist/stringify/stringifyPair.js +1 -1
- package/node_modules/yaml/package.json +4 -4
- package/package.json +1 -1
- package/node_modules/body-parser/SECURITY.md +0 -25
- package/node_modules/cookie-signature/.npmignore +0 -4
- package/node_modules/qs/.eslintrc +0 -38
- package/node_modules/raw-body/HISTORY.md +0 -308
- package/node_modules/raw-body/SECURITY.md +0 -24
- package/node_modules/send/node_modules/encodeurl/HISTORY.md +0 -14
- package/node_modules/send/node_modules/encodeurl/LICENSE +0 -22
- package/node_modules/send/node_modules/encodeurl/README.md +0 -128
- package/node_modules/send/node_modules/encodeurl/index.js +0 -60
- package/node_modules/send/node_modules/encodeurl/package.json +0 -40
|
@@ -6,7 +6,7 @@ function stringifyNumber({ format, minFractionDigits, tag, value }) {
|
|
|
6
6
|
const num = typeof value === 'number' ? value : Number(value);
|
|
7
7
|
if (!isFinite(num))
|
|
8
8
|
return isNaN(num) ? '.nan' : num < 0 ? '-.inf' : '.inf';
|
|
9
|
-
let n = JSON.stringify(value);
|
|
9
|
+
let n = Object.is(value, -0) ? '-0' : JSON.stringify(value);
|
|
10
10
|
if (!format &&
|
|
11
11
|
minFractionDigits &&
|
|
12
12
|
(!tag || tag === 'tag:yaml.org,2002:float') &&
|
|
@@ -103,7 +103,7 @@ function stringifyPair({ key, value }, ctx, onComment, onChompKeep) {
|
|
|
103
103
|
ws += `\n${stringifyComment.indentComment(cs, ctx.indent)}`;
|
|
104
104
|
}
|
|
105
105
|
if (valueStr === '' && !ctx.inFlow) {
|
|
106
|
-
if (ws === '\n')
|
|
106
|
+
if (ws === '\n' && valueComment)
|
|
107
107
|
ws = '\n\n';
|
|
108
108
|
}
|
|
109
109
|
else {
|
|
@@ -1,8 +1,9 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "yaml",
|
|
3
|
-
"version": "2.8.
|
|
3
|
+
"version": "2.8.2",
|
|
4
4
|
"license": "ISC",
|
|
5
5
|
"author": "Eemeli Aro <eemeli@gmail.com>",
|
|
6
|
+
"funding": "https://github.com/sponsors/eemeli",
|
|
6
7
|
"repository": "github:eemeli/yaml",
|
|
7
8
|
"description": "JavaScript parser and stringifier for YAML",
|
|
8
9
|
"keywords": [
|
|
@@ -73,14 +74,13 @@
|
|
|
73
74
|
"@babel/preset-env": "^7.12.11",
|
|
74
75
|
"@eslint/js": "^9.9.1",
|
|
75
76
|
"@rollup/plugin-babel": "^6.0.3",
|
|
76
|
-
"@rollup/plugin-replace": "^
|
|
77
|
+
"@rollup/plugin-replace": "^6.0.3",
|
|
77
78
|
"@rollup/plugin-typescript": "^12.1.1",
|
|
78
79
|
"@types/jest": "^29.2.4",
|
|
79
80
|
"@types/node": "^20.11.20",
|
|
80
81
|
"babel-jest": "^29.0.1",
|
|
81
|
-
"cross-env": "^7.0.3",
|
|
82
82
|
"eslint": "^9.9.1",
|
|
83
|
-
"eslint-config-prettier": "^
|
|
83
|
+
"eslint-config-prettier": "^10.1.8",
|
|
84
84
|
"fast-check": "^2.12.0",
|
|
85
85
|
"jest": "^29.0.1",
|
|
86
86
|
"jest-resolve": "^29.7.0",
|
package/package.json
CHANGED
|
@@ -1,25 +0,0 @@
|
|
|
1
|
-
# Security Policies and Procedures
|
|
2
|
-
|
|
3
|
-
## Reporting a Bug
|
|
4
|
-
|
|
5
|
-
The Express team and community take all security bugs seriously. Thank you
|
|
6
|
-
for improving the security of Express. We appreciate your efforts and
|
|
7
|
-
responsible disclosure and will make every effort to acknowledge your
|
|
8
|
-
contributions.
|
|
9
|
-
|
|
10
|
-
Report security bugs by emailing the current owner(s) of `body-parser`. This
|
|
11
|
-
information can be found in the npm registry using the command
|
|
12
|
-
`npm owner ls body-parser`.
|
|
13
|
-
If unsure or unable to get the information from the above, open an issue
|
|
14
|
-
in the [project issue tracker](https://github.com/expressjs/body-parser/issues)
|
|
15
|
-
asking for the current contact information.
|
|
16
|
-
|
|
17
|
-
To ensure the timely response to your report, please ensure that the entirety
|
|
18
|
-
of the report is contained within the email body and not solely behind a web
|
|
19
|
-
link or an attachment.
|
|
20
|
-
|
|
21
|
-
At least one owner will acknowledge your email within 48 hours, and will send a
|
|
22
|
-
more detailed response within 48 hours indicating the next steps in handling
|
|
23
|
-
your report. After the initial reply to your report, the owners will
|
|
24
|
-
endeavor to keep you informed of the progress towards a fix and full
|
|
25
|
-
announcement, and may ask for additional information or guidance.
|
|
@@ -1,38 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"root": true,
|
|
3
|
-
|
|
4
|
-
"extends": "@ljharb",
|
|
5
|
-
|
|
6
|
-
"ignorePatterns": [
|
|
7
|
-
"dist/",
|
|
8
|
-
],
|
|
9
|
-
|
|
10
|
-
"rules": {
|
|
11
|
-
"complexity": 0,
|
|
12
|
-
"consistent-return": 1,
|
|
13
|
-
"func-name-matching": 0,
|
|
14
|
-
"id-length": [2, { "min": 1, "max": 25, "properties": "never" }],
|
|
15
|
-
"indent": [2, 4],
|
|
16
|
-
"max-lines-per-function": [2, { "max": 150 }],
|
|
17
|
-
"max-params": [2, 18],
|
|
18
|
-
"max-statements": [2, 100],
|
|
19
|
-
"multiline-comment-style": 0,
|
|
20
|
-
"no-continue": 1,
|
|
21
|
-
"no-magic-numbers": 0,
|
|
22
|
-
"no-restricted-syntax": [2, "BreakStatement", "DebuggerStatement", "ForInStatement", "LabeledStatement", "WithStatement"],
|
|
23
|
-
},
|
|
24
|
-
|
|
25
|
-
"overrides": [
|
|
26
|
-
{
|
|
27
|
-
"files": "test/**",
|
|
28
|
-
"rules": {
|
|
29
|
-
"function-paren-newline": 0,
|
|
30
|
-
"max-lines-per-function": 0,
|
|
31
|
-
"max-statements": 0,
|
|
32
|
-
"no-buffer-constructor": 0,
|
|
33
|
-
"no-extend-native": 0,
|
|
34
|
-
"no-throw-literal": 0,
|
|
35
|
-
},
|
|
36
|
-
},
|
|
37
|
-
],
|
|
38
|
-
}
|
|
@@ -1,308 +0,0 @@
|
|
|
1
|
-
2.5.2 / 2023-02-21
|
|
2
|
-
==================
|
|
3
|
-
|
|
4
|
-
* Fix error message for non-stream argument
|
|
5
|
-
|
|
6
|
-
2.5.1 / 2022-02-28
|
|
7
|
-
==================
|
|
8
|
-
|
|
9
|
-
* Fix error on early async hooks implementations
|
|
10
|
-
|
|
11
|
-
2.5.0 / 2022-02-21
|
|
12
|
-
==================
|
|
13
|
-
|
|
14
|
-
* Prevent loss of async hooks context
|
|
15
|
-
* Prevent hanging when stream is not readable
|
|
16
|
-
* deps: http-errors@2.0.0
|
|
17
|
-
- deps: depd@2.0.0
|
|
18
|
-
- deps: statuses@2.0.1
|
|
19
|
-
|
|
20
|
-
2.4.3 / 2022-02-14
|
|
21
|
-
==================
|
|
22
|
-
|
|
23
|
-
* deps: bytes@3.1.2
|
|
24
|
-
|
|
25
|
-
2.4.2 / 2021-11-16
|
|
26
|
-
==================
|
|
27
|
-
|
|
28
|
-
* deps: bytes@3.1.1
|
|
29
|
-
* deps: http-errors@1.8.1
|
|
30
|
-
- deps: setprototypeof@1.2.0
|
|
31
|
-
- deps: toidentifier@1.0.1
|
|
32
|
-
|
|
33
|
-
2.4.1 / 2019-06-25
|
|
34
|
-
==================
|
|
35
|
-
|
|
36
|
-
* deps: http-errors@1.7.3
|
|
37
|
-
- deps: inherits@2.0.4
|
|
38
|
-
|
|
39
|
-
2.4.0 / 2019-04-17
|
|
40
|
-
==================
|
|
41
|
-
|
|
42
|
-
* deps: bytes@3.1.0
|
|
43
|
-
- Add petabyte (`pb`) support
|
|
44
|
-
* deps: http-errors@1.7.2
|
|
45
|
-
- Set constructor name when possible
|
|
46
|
-
- deps: setprototypeof@1.1.1
|
|
47
|
-
- deps: statuses@'>= 1.5.0 < 2'
|
|
48
|
-
* deps: iconv-lite@0.4.24
|
|
49
|
-
- Added encoding MIK
|
|
50
|
-
|
|
51
|
-
2.3.3 / 2018-05-08
|
|
52
|
-
==================
|
|
53
|
-
|
|
54
|
-
* deps: http-errors@1.6.3
|
|
55
|
-
- deps: depd@~1.1.2
|
|
56
|
-
- deps: setprototypeof@1.1.0
|
|
57
|
-
- deps: statuses@'>= 1.3.1 < 2'
|
|
58
|
-
* deps: iconv-lite@0.4.23
|
|
59
|
-
- Fix loading encoding with year appended
|
|
60
|
-
- Fix deprecation warnings on Node.js 10+
|
|
61
|
-
|
|
62
|
-
2.3.2 / 2017-09-09
|
|
63
|
-
==================
|
|
64
|
-
|
|
65
|
-
* deps: iconv-lite@0.4.19
|
|
66
|
-
- Fix ISO-8859-1 regression
|
|
67
|
-
- Update Windows-1255
|
|
68
|
-
|
|
69
|
-
2.3.1 / 2017-09-07
|
|
70
|
-
==================
|
|
71
|
-
|
|
72
|
-
* deps: bytes@3.0.0
|
|
73
|
-
* deps: http-errors@1.6.2
|
|
74
|
-
- deps: depd@1.1.1
|
|
75
|
-
* perf: skip buffer decoding on overage chunk
|
|
76
|
-
|
|
77
|
-
2.3.0 / 2017-08-04
|
|
78
|
-
==================
|
|
79
|
-
|
|
80
|
-
* Add TypeScript definitions
|
|
81
|
-
* Use `http-errors` for standard emitted errors
|
|
82
|
-
* deps: bytes@2.5.0
|
|
83
|
-
* deps: iconv-lite@0.4.18
|
|
84
|
-
- Add support for React Native
|
|
85
|
-
- Add a warning if not loaded as utf-8
|
|
86
|
-
- Fix CESU-8 decoding in Node.js 8
|
|
87
|
-
- Improve speed of ISO-8859-1 encoding
|
|
88
|
-
|
|
89
|
-
2.2.0 / 2017-01-02
|
|
90
|
-
==================
|
|
91
|
-
|
|
92
|
-
* deps: iconv-lite@0.4.15
|
|
93
|
-
- Added encoding MS-31J
|
|
94
|
-
- Added encoding MS-932
|
|
95
|
-
- Added encoding MS-936
|
|
96
|
-
- Added encoding MS-949
|
|
97
|
-
- Added encoding MS-950
|
|
98
|
-
- Fix GBK/GB18030 handling of Euro character
|
|
99
|
-
|
|
100
|
-
2.1.7 / 2016-06-19
|
|
101
|
-
==================
|
|
102
|
-
|
|
103
|
-
* deps: bytes@2.4.0
|
|
104
|
-
* perf: remove double-cleanup on happy path
|
|
105
|
-
|
|
106
|
-
2.1.6 / 2016-03-07
|
|
107
|
-
==================
|
|
108
|
-
|
|
109
|
-
* deps: bytes@2.3.0
|
|
110
|
-
- Drop partial bytes on all parsed units
|
|
111
|
-
- Fix parsing byte string that looks like hex
|
|
112
|
-
|
|
113
|
-
2.1.5 / 2015-11-30
|
|
114
|
-
==================
|
|
115
|
-
|
|
116
|
-
* deps: bytes@2.2.0
|
|
117
|
-
* deps: iconv-lite@0.4.13
|
|
118
|
-
|
|
119
|
-
2.1.4 / 2015-09-27
|
|
120
|
-
==================
|
|
121
|
-
|
|
122
|
-
* Fix masking critical errors from `iconv-lite`
|
|
123
|
-
* deps: iconv-lite@0.4.12
|
|
124
|
-
- Fix CESU-8 decoding in Node.js 4.x
|
|
125
|
-
|
|
126
|
-
2.1.3 / 2015-09-12
|
|
127
|
-
==================
|
|
128
|
-
|
|
129
|
-
* Fix sync callback when attaching data listener causes sync read
|
|
130
|
-
- Node.js 0.10 compatibility issue
|
|
131
|
-
|
|
132
|
-
2.1.2 / 2015-07-05
|
|
133
|
-
==================
|
|
134
|
-
|
|
135
|
-
* Fix error stack traces to skip `makeError`
|
|
136
|
-
* deps: iconv-lite@0.4.11
|
|
137
|
-
- Add encoding CESU-8
|
|
138
|
-
|
|
139
|
-
2.1.1 / 2015-06-14
|
|
140
|
-
==================
|
|
141
|
-
|
|
142
|
-
* Use `unpipe` module for unpiping requests
|
|
143
|
-
|
|
144
|
-
2.1.0 / 2015-05-28
|
|
145
|
-
==================
|
|
146
|
-
|
|
147
|
-
* deps: iconv-lite@0.4.10
|
|
148
|
-
- Improved UTF-16 endianness detection
|
|
149
|
-
- Leading BOM is now removed when decoding
|
|
150
|
-
- The encoding UTF-16 without BOM now defaults to UTF-16LE when detection fails
|
|
151
|
-
|
|
152
|
-
2.0.2 / 2015-05-21
|
|
153
|
-
==================
|
|
154
|
-
|
|
155
|
-
* deps: bytes@2.1.0
|
|
156
|
-
- Slight optimizations
|
|
157
|
-
|
|
158
|
-
2.0.1 / 2015-05-10
|
|
159
|
-
==================
|
|
160
|
-
|
|
161
|
-
* Fix a false-positive when unpiping in Node.js 0.8
|
|
162
|
-
|
|
163
|
-
2.0.0 / 2015-05-08
|
|
164
|
-
==================
|
|
165
|
-
|
|
166
|
-
* Return a promise without callback instead of thunk
|
|
167
|
-
* deps: bytes@2.0.1
|
|
168
|
-
- units no longer case sensitive when parsing
|
|
169
|
-
|
|
170
|
-
1.3.4 / 2015-04-15
|
|
171
|
-
==================
|
|
172
|
-
|
|
173
|
-
* Fix hanging callback if request aborts during read
|
|
174
|
-
* deps: iconv-lite@0.4.8
|
|
175
|
-
- Add encoding alias UNICODE-1-1-UTF-7
|
|
176
|
-
|
|
177
|
-
1.3.3 / 2015-02-08
|
|
178
|
-
==================
|
|
179
|
-
|
|
180
|
-
* deps: iconv-lite@0.4.7
|
|
181
|
-
- Gracefully support enumerables on `Object.prototype`
|
|
182
|
-
|
|
183
|
-
1.3.2 / 2015-01-20
|
|
184
|
-
==================
|
|
185
|
-
|
|
186
|
-
* deps: iconv-lite@0.4.6
|
|
187
|
-
- Fix rare aliases of single-byte encodings
|
|
188
|
-
|
|
189
|
-
1.3.1 / 2014-11-21
|
|
190
|
-
==================
|
|
191
|
-
|
|
192
|
-
* deps: iconv-lite@0.4.5
|
|
193
|
-
- Fix Windows-31J and X-SJIS encoding support
|
|
194
|
-
|
|
195
|
-
1.3.0 / 2014-07-20
|
|
196
|
-
==================
|
|
197
|
-
|
|
198
|
-
* Fully unpipe the stream on error
|
|
199
|
-
- Fixes `Cannot switch to old mode now` error on Node.js 0.10+
|
|
200
|
-
|
|
201
|
-
1.2.3 / 2014-07-20
|
|
202
|
-
==================
|
|
203
|
-
|
|
204
|
-
* deps: iconv-lite@0.4.4
|
|
205
|
-
- Added encoding UTF-7
|
|
206
|
-
|
|
207
|
-
1.2.2 / 2014-06-19
|
|
208
|
-
==================
|
|
209
|
-
|
|
210
|
-
* Send invalid encoding error to callback
|
|
211
|
-
|
|
212
|
-
1.2.1 / 2014-06-15
|
|
213
|
-
==================
|
|
214
|
-
|
|
215
|
-
* deps: iconv-lite@0.4.3
|
|
216
|
-
- Added encodings UTF-16BE and UTF-16 with BOM
|
|
217
|
-
|
|
218
|
-
1.2.0 / 2014-06-13
|
|
219
|
-
==================
|
|
220
|
-
|
|
221
|
-
* Passing string as `options` interpreted as encoding
|
|
222
|
-
* Support all encodings from `iconv-lite`
|
|
223
|
-
|
|
224
|
-
1.1.7 / 2014-06-12
|
|
225
|
-
==================
|
|
226
|
-
|
|
227
|
-
* use `string_decoder` module from npm
|
|
228
|
-
|
|
229
|
-
1.1.6 / 2014-05-27
|
|
230
|
-
==================
|
|
231
|
-
|
|
232
|
-
* check encoding for old streams1
|
|
233
|
-
* support node.js < 0.10.6
|
|
234
|
-
|
|
235
|
-
1.1.5 / 2014-05-14
|
|
236
|
-
==================
|
|
237
|
-
|
|
238
|
-
* bump bytes
|
|
239
|
-
|
|
240
|
-
1.1.4 / 2014-04-19
|
|
241
|
-
==================
|
|
242
|
-
|
|
243
|
-
* allow true as an option
|
|
244
|
-
* bump bytes
|
|
245
|
-
|
|
246
|
-
1.1.3 / 2014-03-02
|
|
247
|
-
==================
|
|
248
|
-
|
|
249
|
-
* fix case when length=null
|
|
250
|
-
|
|
251
|
-
1.1.2 / 2013-12-01
|
|
252
|
-
==================
|
|
253
|
-
|
|
254
|
-
* be less strict on state.encoding check
|
|
255
|
-
|
|
256
|
-
1.1.1 / 2013-11-27
|
|
257
|
-
==================
|
|
258
|
-
|
|
259
|
-
* add engines
|
|
260
|
-
|
|
261
|
-
1.1.0 / 2013-11-27
|
|
262
|
-
==================
|
|
263
|
-
|
|
264
|
-
* add err.statusCode and err.type
|
|
265
|
-
* allow for encoding option to be true
|
|
266
|
-
* pause the stream instead of dumping on error
|
|
267
|
-
* throw if the stream's encoding is set
|
|
268
|
-
|
|
269
|
-
1.0.1 / 2013-11-19
|
|
270
|
-
==================
|
|
271
|
-
|
|
272
|
-
* dont support streams1, throw if dev set encoding
|
|
273
|
-
|
|
274
|
-
1.0.0 / 2013-11-17
|
|
275
|
-
==================
|
|
276
|
-
|
|
277
|
-
* rename `expected` option to `length`
|
|
278
|
-
|
|
279
|
-
0.2.0 / 2013-11-15
|
|
280
|
-
==================
|
|
281
|
-
|
|
282
|
-
* republish
|
|
283
|
-
|
|
284
|
-
0.1.1 / 2013-11-15
|
|
285
|
-
==================
|
|
286
|
-
|
|
287
|
-
* use bytes
|
|
288
|
-
|
|
289
|
-
0.1.0 / 2013-11-11
|
|
290
|
-
==================
|
|
291
|
-
|
|
292
|
-
* generator support
|
|
293
|
-
|
|
294
|
-
0.0.3 / 2013-10-10
|
|
295
|
-
==================
|
|
296
|
-
|
|
297
|
-
* update repo
|
|
298
|
-
|
|
299
|
-
0.0.2 / 2013-09-14
|
|
300
|
-
==================
|
|
301
|
-
|
|
302
|
-
* dump stream on bad headers
|
|
303
|
-
* listen to events after defining received and buffers
|
|
304
|
-
|
|
305
|
-
0.0.1 / 2013-09-14
|
|
306
|
-
==================
|
|
307
|
-
|
|
308
|
-
* Initial release
|
|
@@ -1,24 +0,0 @@
|
|
|
1
|
-
# Security Policies and Procedures
|
|
2
|
-
|
|
3
|
-
## Reporting a Bug
|
|
4
|
-
|
|
5
|
-
The `raw-body` team and community take all security bugs seriously. Thank you
|
|
6
|
-
for improving the security of Express. We appreciate your efforts and
|
|
7
|
-
responsible disclosure and will make every effort to acknowledge your
|
|
8
|
-
contributions.
|
|
9
|
-
|
|
10
|
-
Report security bugs by emailing the current owners of `raw-body`. This information
|
|
11
|
-
can be found in the npm registry using the command `npm owner ls raw-body`.
|
|
12
|
-
If unsure or unable to get the information from the above, open an issue
|
|
13
|
-
in the [project issue tracker](https://github.com/stream-utils/raw-body/issues)
|
|
14
|
-
asking for the current contact information.
|
|
15
|
-
|
|
16
|
-
To ensure the timely response to your report, please ensure that the entirety
|
|
17
|
-
of the report is contained within the email body and not solely behind a web
|
|
18
|
-
link or an attachment.
|
|
19
|
-
|
|
20
|
-
At least one owner will acknowledge your email within 48 hours, and will send a
|
|
21
|
-
more detailed response within 48 hours indicating the next steps in handling
|
|
22
|
-
your report. After the initial reply to your report, the owners will
|
|
23
|
-
endeavor to keep you informed of the progress towards a fix and full
|
|
24
|
-
announcement, and may ask for additional information or guidance.
|
|
@@ -1,14 +0,0 @@
|
|
|
1
|
-
1.0.2 / 2018-01-21
|
|
2
|
-
==================
|
|
3
|
-
|
|
4
|
-
* Fix encoding `%` as last character
|
|
5
|
-
|
|
6
|
-
1.0.1 / 2016-06-09
|
|
7
|
-
==================
|
|
8
|
-
|
|
9
|
-
* Fix encoding unpaired surrogates at start/end of string
|
|
10
|
-
|
|
11
|
-
1.0.0 / 2016-06-08
|
|
12
|
-
==================
|
|
13
|
-
|
|
14
|
-
* Initial release
|
|
@@ -1,22 +0,0 @@
|
|
|
1
|
-
(The MIT License)
|
|
2
|
-
|
|
3
|
-
Copyright (c) 2016 Douglas Christopher Wilson
|
|
4
|
-
|
|
5
|
-
Permission is hereby granted, free of charge, to any person obtaining
|
|
6
|
-
a copy of this software and associated documentation files (the
|
|
7
|
-
'Software'), to deal in the Software without restriction, including
|
|
8
|
-
without limitation the rights to use, copy, modify, merge, publish,
|
|
9
|
-
distribute, sublicense, and/or sell copies of the Software, and to
|
|
10
|
-
permit persons to whom the Software is furnished to do so, subject to
|
|
11
|
-
the following conditions:
|
|
12
|
-
|
|
13
|
-
The above copyright notice and this permission notice shall be
|
|
14
|
-
included in all copies or substantial portions of the Software.
|
|
15
|
-
|
|
16
|
-
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
|
|
17
|
-
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
18
|
-
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
19
|
-
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
|
20
|
-
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
|
21
|
-
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
|
22
|
-
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
@@ -1,128 +0,0 @@
|
|
|
1
|
-
# encodeurl
|
|
2
|
-
|
|
3
|
-
[![NPM Version][npm-image]][npm-url]
|
|
4
|
-
[![NPM Downloads][downloads-image]][downloads-url]
|
|
5
|
-
[![Node.js Version][node-version-image]][node-version-url]
|
|
6
|
-
[![Build Status][travis-image]][travis-url]
|
|
7
|
-
[![Test Coverage][coveralls-image]][coveralls-url]
|
|
8
|
-
|
|
9
|
-
Encode a URL to a percent-encoded form, excluding already-encoded sequences
|
|
10
|
-
|
|
11
|
-
## Installation
|
|
12
|
-
|
|
13
|
-
This is a [Node.js](https://nodejs.org/en/) module available through the
|
|
14
|
-
[npm registry](https://www.npmjs.com/). Installation is done using the
|
|
15
|
-
[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
|
|
16
|
-
|
|
17
|
-
```sh
|
|
18
|
-
$ npm install encodeurl
|
|
19
|
-
```
|
|
20
|
-
|
|
21
|
-
## API
|
|
22
|
-
|
|
23
|
-
```js
|
|
24
|
-
var encodeUrl = require('encodeurl')
|
|
25
|
-
```
|
|
26
|
-
|
|
27
|
-
### encodeUrl(url)
|
|
28
|
-
|
|
29
|
-
Encode a URL to a percent-encoded form, excluding already-encoded sequences.
|
|
30
|
-
|
|
31
|
-
This function will take an already-encoded URL and encode all the non-URL
|
|
32
|
-
code points (as UTF-8 byte sequences). This function will not encode the
|
|
33
|
-
"%" character unless it is not part of a valid sequence (`%20` will be
|
|
34
|
-
left as-is, but `%foo` will be encoded as `%25foo`).
|
|
35
|
-
|
|
36
|
-
This encode is meant to be "safe" and does not throw errors. It will try as
|
|
37
|
-
hard as it can to properly encode the given URL, including replacing any raw,
|
|
38
|
-
unpaired surrogate pairs with the Unicode replacement character prior to
|
|
39
|
-
encoding.
|
|
40
|
-
|
|
41
|
-
This function is _similar_ to the intrinsic function `encodeURI`, except it
|
|
42
|
-
will not encode the `%` character if that is part of a valid sequence, will
|
|
43
|
-
not encode `[` and `]` (for IPv6 hostnames) and will replace raw, unpaired
|
|
44
|
-
surrogate pairs with the Unicode replacement character (instead of throwing).
|
|
45
|
-
|
|
46
|
-
## Examples
|
|
47
|
-
|
|
48
|
-
### Encode a URL containing user-controled data
|
|
49
|
-
|
|
50
|
-
```js
|
|
51
|
-
var encodeUrl = require('encodeurl')
|
|
52
|
-
var escapeHtml = require('escape-html')
|
|
53
|
-
|
|
54
|
-
http.createServer(function onRequest (req, res) {
|
|
55
|
-
// get encoded form of inbound url
|
|
56
|
-
var url = encodeUrl(req.url)
|
|
57
|
-
|
|
58
|
-
// create html message
|
|
59
|
-
var body = '<p>Location ' + escapeHtml(url) + ' not found</p>'
|
|
60
|
-
|
|
61
|
-
// send a 404
|
|
62
|
-
res.statusCode = 404
|
|
63
|
-
res.setHeader('Content-Type', 'text/html; charset=UTF-8')
|
|
64
|
-
res.setHeader('Content-Length', String(Buffer.byteLength(body, 'utf-8')))
|
|
65
|
-
res.end(body, 'utf-8')
|
|
66
|
-
})
|
|
67
|
-
```
|
|
68
|
-
|
|
69
|
-
### Encode a URL for use in a header field
|
|
70
|
-
|
|
71
|
-
```js
|
|
72
|
-
var encodeUrl = require('encodeurl')
|
|
73
|
-
var escapeHtml = require('escape-html')
|
|
74
|
-
var url = require('url')
|
|
75
|
-
|
|
76
|
-
http.createServer(function onRequest (req, res) {
|
|
77
|
-
// parse inbound url
|
|
78
|
-
var href = url.parse(req)
|
|
79
|
-
|
|
80
|
-
// set new host for redirect
|
|
81
|
-
href.host = 'localhost'
|
|
82
|
-
href.protocol = 'https:'
|
|
83
|
-
href.slashes = true
|
|
84
|
-
|
|
85
|
-
// create location header
|
|
86
|
-
var location = encodeUrl(url.format(href))
|
|
87
|
-
|
|
88
|
-
// create html message
|
|
89
|
-
var body = '<p>Redirecting to new site: ' + escapeHtml(location) + '</p>'
|
|
90
|
-
|
|
91
|
-
// send a 301
|
|
92
|
-
res.statusCode = 301
|
|
93
|
-
res.setHeader('Content-Type', 'text/html; charset=UTF-8')
|
|
94
|
-
res.setHeader('Content-Length', String(Buffer.byteLength(body, 'utf-8')))
|
|
95
|
-
res.setHeader('Location', location)
|
|
96
|
-
res.end(body, 'utf-8')
|
|
97
|
-
})
|
|
98
|
-
```
|
|
99
|
-
|
|
100
|
-
## Testing
|
|
101
|
-
|
|
102
|
-
```sh
|
|
103
|
-
$ npm test
|
|
104
|
-
$ npm run lint
|
|
105
|
-
```
|
|
106
|
-
|
|
107
|
-
## References
|
|
108
|
-
|
|
109
|
-
- [RFC 3986: Uniform Resource Identifier (URI): Generic Syntax][rfc-3986]
|
|
110
|
-
- [WHATWG URL Living Standard][whatwg-url]
|
|
111
|
-
|
|
112
|
-
[rfc-3986]: https://tools.ietf.org/html/rfc3986
|
|
113
|
-
[whatwg-url]: https://url.spec.whatwg.org/
|
|
114
|
-
|
|
115
|
-
## License
|
|
116
|
-
|
|
117
|
-
[MIT](LICENSE)
|
|
118
|
-
|
|
119
|
-
[npm-image]: https://img.shields.io/npm/v/encodeurl.svg
|
|
120
|
-
[npm-url]: https://npmjs.org/package/encodeurl
|
|
121
|
-
[node-version-image]: https://img.shields.io/node/v/encodeurl.svg
|
|
122
|
-
[node-version-url]: https://nodejs.org/en/download
|
|
123
|
-
[travis-image]: https://img.shields.io/travis/pillarjs/encodeurl.svg
|
|
124
|
-
[travis-url]: https://travis-ci.org/pillarjs/encodeurl
|
|
125
|
-
[coveralls-image]: https://img.shields.io/coveralls/pillarjs/encodeurl.svg
|
|
126
|
-
[coveralls-url]: https://coveralls.io/r/pillarjs/encodeurl?branch=master
|
|
127
|
-
[downloads-image]: https://img.shields.io/npm/dm/encodeurl.svg
|
|
128
|
-
[downloads-url]: https://npmjs.org/package/encodeurl
|
|
@@ -1,60 +0,0 @@
|
|
|
1
|
-
/*!
|
|
2
|
-
* encodeurl
|
|
3
|
-
* Copyright(c) 2016 Douglas Christopher Wilson
|
|
4
|
-
* MIT Licensed
|
|
5
|
-
*/
|
|
6
|
-
|
|
7
|
-
'use strict'
|
|
8
|
-
|
|
9
|
-
/**
|
|
10
|
-
* Module exports.
|
|
11
|
-
* @public
|
|
12
|
-
*/
|
|
13
|
-
|
|
14
|
-
module.exports = encodeUrl
|
|
15
|
-
|
|
16
|
-
/**
|
|
17
|
-
* RegExp to match non-URL code points, *after* encoding (i.e. not including "%")
|
|
18
|
-
* and including invalid escape sequences.
|
|
19
|
-
* @private
|
|
20
|
-
*/
|
|
21
|
-
|
|
22
|
-
var ENCODE_CHARS_REGEXP = /(?:[^\x21\x25\x26-\x3B\x3D\x3F-\x5B\x5D\x5F\x61-\x7A\x7E]|%(?:[^0-9A-Fa-f]|[0-9A-Fa-f][^0-9A-Fa-f]|$))+/g
|
|
23
|
-
|
|
24
|
-
/**
|
|
25
|
-
* RegExp to match unmatched surrogate pair.
|
|
26
|
-
* @private
|
|
27
|
-
*/
|
|
28
|
-
|
|
29
|
-
var UNMATCHED_SURROGATE_PAIR_REGEXP = /(^|[^\uD800-\uDBFF])[\uDC00-\uDFFF]|[\uD800-\uDBFF]([^\uDC00-\uDFFF]|$)/g
|
|
30
|
-
|
|
31
|
-
/**
|
|
32
|
-
* String to replace unmatched surrogate pair with.
|
|
33
|
-
* @private
|
|
34
|
-
*/
|
|
35
|
-
|
|
36
|
-
var UNMATCHED_SURROGATE_PAIR_REPLACE = '$1\uFFFD$2'
|
|
37
|
-
|
|
38
|
-
/**
|
|
39
|
-
* Encode a URL to a percent-encoded form, excluding already-encoded sequences.
|
|
40
|
-
*
|
|
41
|
-
* This function will take an already-encoded URL and encode all the non-URL
|
|
42
|
-
* code points. This function will not encode the "%" character unless it is
|
|
43
|
-
* not part of a valid sequence (`%20` will be left as-is, but `%foo` will
|
|
44
|
-
* be encoded as `%25foo`).
|
|
45
|
-
*
|
|
46
|
-
* This encode is meant to be "safe" and does not throw errors. It will try as
|
|
47
|
-
* hard as it can to properly encode the given URL, including replacing any raw,
|
|
48
|
-
* unpaired surrogate pairs with the Unicode replacement character prior to
|
|
49
|
-
* encoding.
|
|
50
|
-
*
|
|
51
|
-
* @param {string} url
|
|
52
|
-
* @return {string}
|
|
53
|
-
* @public
|
|
54
|
-
*/
|
|
55
|
-
|
|
56
|
-
function encodeUrl (url) {
|
|
57
|
-
return String(url)
|
|
58
|
-
.replace(UNMATCHED_SURROGATE_PAIR_REGEXP, UNMATCHED_SURROGATE_PAIR_REPLACE)
|
|
59
|
-
.replace(ENCODE_CHARS_REGEXP, encodeURI)
|
|
60
|
-
}
|