strong-error-handler 2.0.0 → 2.3.1

package/.github/ISSUE_TEMPLATE.md

@@ -1,36 +1,37 @@
 <!--
-- Please ask questions at https://groups.google.com/forum/#!forum/loopbackjs or
+Questions:
+  https://groups.google.com/forum/#!forum/loopbackjs
   https://gitter.im/strongloop/loopback
-
-- Immediate support is available through our subscription plans, see
+Immediate support:
   https://strongloop.com/api-connect-faqs/
+  https://strongloop.com/node-js/subscription-plans/
 -->
 
-### Bug or feature request
+# Description/Steps to reproduce
 
 <!--
-Mark your choice with an "x" (eg. [x], NOT [*]).
+If feature: A description of the feature
+If bug: Steps to reproduce
 -->
 
-- [ ] Bug
-- [ ] Feature request
-
-### Description of feature (or steps to reproduce if bug)
-
-
-
-### Link to sample repo to reproduce issue (if bug)
-
-
-
-### Expected result
+# Link to reproduction sandbox
 
+<!--
+Link to an app sandbox for reproduction
 
+Note: Failure to provide a sandbox application for reproduction purposes will result in the issue being closed.
+-->
 
-### Actual result (if bug)
-
-
+# Expected result
 
-### Additional information (Node.js version, LoopBack version, etc)
+<!--
+Also include actual results if bug
+-->
 
+# Additional information
 
+<!--
+Copy+paste the output of these two commands:
+  node -e 'console.log(process.platform, process.arch, process.versions.node)'
+  npm ls --prod --depth 0 | grep loopback
+-->

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -6,17 +6,18 @@
 <!--
 Please use the following link syntaxes:
 
-- #49 (to reference issues in the current repository)
-- strongloop/loopback#49 (to reference issues in another repository)
+- connect to #49 (to reference issues in the current repository)
+- connect to strongloop/loopback#49 (to reference issues in another repository)
 -->
 
-- None
+- connect to <link_to_referenced_issue>
 
 ### Checklist
 
 <!--
-Please mark your choice with an "x" (i.e. [x], see
+- Please mark your choice with an "x" (i.e. [x], see
 https://github.com/blog/1375-task-lists-in-gfm-issues-pulls-comments)
+- PR's without test coverage will be closed.
 -->
 
 - [ ] New tests added or existing tests modified to cover all changes

package/CHANGES.md

@@ -1,3 +1,37 @@
+2018-01-25, Version 2.3.1
+=========================
+
+ * Escape strings in HTML output (XSS fix) (Zachery Metcalf)
+
+ * Update LICENSE.md (Diana Lau)
+
+
+2017-10-13, Version 2.3.0
+=========================
+
+ * update strong-globalize to 3.1.0 (shimks)
+
+ * CODEOWNERS: add zbarbuto (Miroslav Bajtoš)
+
+ * Update Issue and PR Templates (#59) (Sakib Hasan)
+
+ * fixed json typo of server/middleware.json (karanssj4)
+
+ * Add CODEOWNER file (Diana Lau)
+
+
+2017-07-20, Version 2.2.0
+=========================
+
+ * Add new option: negotiateContentType (Raj)
+
+
+2017-04-18, Version 2.1.0
+=========================
+
+ * Bump js2xmlparser dependency to version 3.0.0 (Matthew O'Donoghue)
+
+
 2017-03-22, Version 2.0.0
 =========================
 

package/CODEOWNERS

@@ -0,0 +1,5 @@
+# Lines starting with '#' are comments.
+# Each line is a file pattern followed by one or more owners,
+# the last matching pattern has the most precendence.
+
+* @bajtos @zbarbuto

package/LICENSE.md

@@ -1,4 +1,4 @@
-Copyright (c) IBM Corp. 2016. All Rights Reserved.
+Copyright (c) IBM Corp. 2016,2017. All Rights Reserved.
 Node module: strong-error-handler
 This project is licensed under the MIT License, full text below.
 

package/README.md

@@ -82,6 +82,8 @@ The content type of the response depends on the request's `Accepts` header.
 | debug | Boolean    | `false` | If `true`, HTTP responses include all error properties, including sensitive data such as file paths, URLs and stack traces. See [Example output](#example) below. |
 | log | Boolean | `true` |  If `true`, all errors are printed via `console.error`, including an array of fields (custom error properties) that are safe to include in response messages (both 4xx and 5xx). <br/> If `false`, sends only the error back in the response. |
 | safeFields | [String] | `[]` |  Specifies property names on errors that are allowed to be passed through in 4xx and 5xx responses. See [Safe error fields](#safe-error-fields) below. |
+| defaultType | String | `"json"` | Specify the default response content type to use when the client does not provide any Accepts header.
+| negotiateContentType | Boolean | true | Negotiate the response content type via Accepts request header. When disabled, strong-error-handler will always use the default content type when producing responses. Disabling content type negotiation is useful if you want to see JSON-formatted error responses in browsers, because browsers usually prefer HTML and XML over other content types.
 
 ### Customizing log format
 
@@ -119,7 +121,7 @@ Then in `server/middleware.json`, specify your custom error logging function as
     "./middleware/error-logger": {},
     "strong-error-handler": {
       "params": {
-        log: false
+        "log": false
       }
     }
 }

package/lib/content-negotiation.js

@@ -56,6 +56,18 @@ function negotiateContentProducer(req, logWarning, options) {
   debug('Resolved content-type', resolvedContentType);
   var contentType = resolvedContentType || defaultType;
 
+  if (options.negotiateContentType === false) {
+    if (SUPPORTED_TYPES.indexOf(options.defaultType) > -1) {
+      debug('Forcing options.defaultType `%s`',
+        options.defaultType);
+      contentType = options.defaultType;
+    } else {
+      debug('contentType: `%s` is not supported, ' +
+        'falling back to contentType: `%s`',
+         options.defaultType, contentType);
+    }
+  }
+
   // to receive _format from user's url param to overide the content type
   // req.query (eg /api/Users/1?_format=json will overide content negotiation
   // https://github.com/strongloop/strong-remoting/blob/ac3093dcfbb787977ca0229b0f672703859e52e1/lib/http-context.js#L643-L645

package/package.json

@@ -2,7 +2,7 @@
   "name": "strong-error-handler",
   "description": "Error handler for use in development and production environments.",
   "license": "MIT",
-  "version": "2.0.0",
+  "version": "2.3.1",
   "engines": {
     "node": ">=4"
   },
@@ -19,10 +19,10 @@
   "dependencies": {
     "accepts": "^1.3.3",
     "debug": "^2.2.0",
-    "ejs": "^2.4.2",
+    "ejs": "^2.5.7",
     "http-status": "^1.0.0",
-    "js2xmlparser": "^2.0.2",
-    "strong-globalize": "^2.6.7"
+    "js2xmlparser": "^3.0.0",
+    "strong-globalize": "^3.1.0"
   },
   "devDependencies": {
     "chai": "^3.5.0",

package/views/default-error.ejs

@@ -1,19 +1,19 @@
 <html>
   <head>
     <meta charset='utf-8'>
-    <title><%- data.name || data.message %></title>
+    <title><%= data.name || data.message %></title>
     <style><%- include style.css %></style>
   </head>
   <body>
     <div id="wrapper">
-      <h1><%- data.name %></h1>
-      <h2><em><%- data.statusCode %></em> <%- data.message %></h2>
+      <h1><%= data.name %></h1>
+      <h2><em><%= data.statusCode %></em> <%= data.message %></h2>
       <%
         // display all the non-standard properties
         var standardProps = ['name', 'statusCode', 'message', 'stack'];
         for (var prop in data) {
           if (standardProps.indexOf(prop) == -1 && data[prop]) { %>
-            <div><b><%- prop %></b>: <%- data[prop] %></div>
+            <div><b><%= prop %></b>: <%= data[prop] %></div>
           <% }
         }
         if (data.stack) { %>

package/.npmignore

@@ -1,35 +0,0 @@
-# Logs
-logs
-*.log
-npm-debug.log*
-
-# Runtime data
-pids
-*.pid
-*.seed
-
-# Directory for instrumented libs generated by jscoverage/JSCover
-lib-cov
-
-# Coverage directory used by tools like istanbul
-coverage
-
-# Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
-.grunt
-
-# node-waf configuration
-.lock-wscript
-
-# Compiled binary addons (http://nodejs.org/api/addons.html)
-build/Release
-
-# Dependency directory
-node_modules
-
-# Optional npm cache directory
-.npm
-
-# Optional REPL history
-.node_repl_history
-test
-.travis.yml