superagent 3.6.0 → 3.7.0

package/.travis.yml

@@ -1,9 +1,9 @@
 sudo: false
 language: node_js
 node_js:
-  - "7.1"
-  - "6.9"
-  - "4.6"
+  - "8"
+  - "6"
+  - "4"
 
 env:
   global:
@@ -12,5 +12,5 @@ env:
 
 matrix:
   include:
-    - node_js: "4.6"
+    - node_js: "8"
       env: BROWSER=1

package/History.md

@@ -1,3 +1,15 @@
+# 3.7.0 (2017-10-17)
+
+ * Limit maximum response size. Prevents zip bombs (Kornel)
+ * Catch and pass along errors in `.ok()` callback (Jeremy Ruppel)
+ * Fixed parsing of XHR headers without a newline (nsf)
+
+# 3.6.2 (2017-10-02)
+
+ * Upgrade MIME type dependency to a newer, secure version
+ * Recognize PDF MIME as binary
+ * Fix for error in subsequent require() calls (Steven de Salas)
+
 # 3.6.0 (2017-08-20)
 
  * Support disabling TCP_NODELAY option (#1240) (xiamengyu)

package/Makefile

@@ -20,7 +20,7 @@ test-cov: lib-cov
 	SUPERAGENT_COV=1 $(MAKE) test REPORTER=html-cov > coverage.html
 
 test-browser:
-	SAUCE_APPIUM_VERSION=1.6 ./node_modules/.bin/zuul -- $(BROWSERTESTS)
+	SAUCE_APPIUM_VERSION=1.7 ./node_modules/.bin/zuul -- $(BROWSERTESTS)
 
 test-browser-local:
 	./node_modules/.bin/zuul --no-coverage --local 4000 -- $(BROWSERTESTS)

package/Readme.md

@@ -14,15 +14,15 @@ node:
 $ npm install superagent
 ```
 
-Works with [browserify](https://github.com/substack/node-browserify) and should work with [webpack](https://github.com/visionmedia/superagent/wiki/SuperAgent-for-Webpack)
+Works with [browserify](https://github.com/substack/node-browserify) and [webpack](https://github.com/visionmedia/superagent/wiki/SuperAgent-for-Webpack).
 
 ```js
 request
   .post('/api/pet')
   .send({ name: 'Manny', species: 'cat' }) // sends a JSON post body
   .set('X-API-Key', 'foobar')
-  .set('Accept', 'application/json')
-  .end(function(err, res){
+  .set('accept', 'json')
+  .end((err, res) => {
     // Calling the end function will send the request
   });
 ```
@@ -33,27 +33,25 @@ Tested browsers:
 
 - Latest Firefox, Chrome, Safari
 - Latest Android, iPhone
-- IE10 through latest. IE9 with polyfills.
-
-Even though IE9 is supported, a polyfill for `window.FormData` is required for `.field()`.
+- IE10 through latest. IE9 with polyfills. Even though IE9 is supported, a polyfill for `window.FormData` is required for `.field()`.
 
 Node 4 or later is required.
 
-# Plugins
+## Plugins
 
 SuperAgent is easily extended via plugins.
 
 ```js
-var nocache = require('superagent-no-cache');
-var request = require('superagent');
-var prefix = require('superagent-prefix')('/static');
+const nocache = require('superagent-no-cache');
+const request = require('superagent');
+const prefix = require('superagent-prefix')('/static');
 
 request
   .get('/some-url')
   .query({ action: 'edit', city: 'London' }) // query string
   .use(prefix) // Prefixes *only* this request
   .use(nocache) // Prevents caching of *only* this request
-  .end(function(err, res){
+  .end((err, res) => {
     // Do something
   });
 ```
@@ -77,6 +75,20 @@ Please prefix your plugin with `superagent-*` so that it can easily be found by
 
 For SuperAgent extensions such as couchdb and oauth visit the [wiki](https://github.com/visionmedia/superagent/wiki).
 
+## Upgrading from previous versions:
+
+Our breaking changes are mostly in rarely used functionality and from stricter error handling.
+
+* [2.x to 3.x](https://github.com/visionmedia/superagent/releases/tag/v3.0.0):
+  - Ensure you're running Node 4 or later. We dropped support for Node 0.x.
+  - Test code that calls `.send()` multiple times. Invalid calls to `.send()` will now throw instead of sending garbage.
+* [1.x to 2.x](https://github.com/visionmedia/superagent/releases/tag/v2.0.0):
+  - If you use `.parse()` in the *browser* version, rename it to `.serialize()`.
+  - If you rely on `undefined` in query-string values being sent literally as the text "undefined", switch to checking for missing value instead. `?key=undefined` is now `?key` (without a value).
+  - If you use `.then()` in Internet Explorer, ensure that you have a polyfill that adds a global `Promise` object.
+* 0.x to 1.x:
+  - Use `.end(function(err, res){})`. 1-argument version is no longer supported.
+
 ## Running node tests
 
 Install dependencies:

package/docs/index.md

@@ -178,7 +178,7 @@ SuperAgent formats are extensible, however by default "json" and "form" are supp
         .send({ name: 'tj' })
         .send({ pet: 'tobi' })
         .end(callback)
-        
+
 Sending a [`FormData`](https://developer.mozilla.org/en-US/docs/Web/API/FormData/FormData) object is also supported. The following example will __POST__ the content of the HTML form identified by id="myForm":
 
       request.post('/user')
@@ -467,6 +467,8 @@ The Node client allows you to pipe data to and from the request. For example pip
     const req = request.post('/somewhere');
     req.type('json');
     stream.pipe(req);
+    
+Note that when you pipe to a request, superagent sends the piped data with [chunked transfer encoding](https://en.wikipedia.org/wiki/Chunked_transfer_encoding), which isn't supported by all servers (for instance, Python WSGI servers).
 
 Or piping the response to a file:
 
@@ -478,20 +480,28 @@ Or piping the response to a file:
 
 SuperAgent is also great for _building_ multipart requests for which it provides methods `.attach()` and `.field()`.
 
+When you use `.field()` or `.attach()` you can't use `.send()` and you *must not* set `Content-Type` (the correct type will be set for you).
+
 ### Attaching files
 
-As mentioned a higher-level API is also provided, in the form of `.attach(name, [path], [filename])` and `.field(name, value)`/`.field(object)`. Attaching several files is simple, you can also provide a custom filename for the attachment, otherwise the basename of the attached file is used.
+To send a file use `.attach(name, [file], [options])`. You can attach multiple files by calling `.attach` multiple times. The arguments are:
+
+ * `name` — filed name in the form.
+ * `file` — either string with file path or `Blob`/`Buffer` object.
+ * `options` — (optional) either string with custom file name or `{filename: string}` object. In Node also `{contentType: 'mime/type'}` is supported. In browser create a `Blob` with an appropriate type instead.
+
+<br>
 
     request
       .post('/upload')
-      .attach('avatar', 'path/to/tobi.png', 'user.png')
-      .attach('image', 'path/to/loki.png')
-      .attach('file', 'path/to/jane.png')
+      .attach('image1', 'path/to/felix.jpeg')
+      .attach('image2', imageBuffer, 'luna.jpeg')
+      .field('caption', 'My cats')
       .end(callback);
 
 ### Field values
 
-Much like form fields in HTML, you can set field values with the `.field(name, value)` method. Suppose you want to upload a few images with your name and email, your request might look something like this:
+Much like form fields in HTML, you can set field values with `.field(name, value)` and `.field({name: value})`. Suppose you want to upload a few images with your name and email, your request might look something like this:
 
      request
        .post('/upload')

package/lib/client.js

@@ -220,11 +220,12 @@ function parseHeader(str) {
   var field;
   var val;
 
-  lines.pop(); // trailing CRLF
-
   for (var i = 0, len = lines.length; i < len; ++i) {
     line = lines[i];
     index = line.indexOf(':');
+    if (index === -1) { // could be empty line, just skip it
+      continue;
+    }
     field = line.slice(0, index).toLowerCase();
     val = trim(line.slice(index + 1));
     fields[field] = val;
@@ -420,16 +421,16 @@ function Request(method, url) {
     try {
       if (!self._isResponseOK(res)) {
         new_err = new Error(res.statusText || 'Unsuccessful HTTP response');
-        new_err.original = err;
-        new_err.response = res;
-        new_err.status = res.status;
       }
-    } catch(e) {
-      new_err = e; // #985 touching res may cause INVALID_STATE_ERR on old Android
+    } catch(custom_err) {
+      new_err = custom_err; // ok() callback can throw
     }
 
     // #1000 don't catch errors from the callback to avoid double calling it
     if (new_err) {
+      new_err.original = err;
+      new_err.response = res;
+      new_err.status = res.status;
       self.callback(new_err, res);
     } else {
       self.callback(null, res);

package/lib/is-object.js

@@ -1,3 +1,5 @@
+'use strict';
+
 /**
  * Check if `obj` is an object.
  *

package/lib/node/agent.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Module dependencies.

package/lib/node/index.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Module dependencies.
@@ -70,7 +71,7 @@ exports.Response = Response;
 
 mime.define({
   'application/x-www-form-urlencoded': ['form', 'urlencoded', 'form-data']
-});
+}, true);
 
 /**
  * Protocol map.
@@ -675,16 +676,20 @@ Request.prototype.callback = function(err, res){
   this.called = true;
 
   if (!err) {
-    if (this._isResponseOK(res)) {
-      return fn(err, res);
-    }
+    try {
+      if (this._isResponseOK(res)) {
+        return fn(err, res);
+      }
 
-    var msg = 'Unsuccessful HTTP response';
-    if (res) {
-      msg = http.STATUS_CODES[res.status] || msg;
+      var msg = 'Unsuccessful HTTP response';
+      if (res) {
+        msg = http.STATUS_CODES[res.status] || msg;
+      }
+      err = new Error(msg);
+      err.status = res ? res.status : undefined;
+    } catch (new_err) {
+      err = new_err;
     }
-    err = new Error(msg);
-    err.status = res ? res.status : undefined;
   }
 
   err.response = res;
@@ -845,6 +850,24 @@ Request.prototype._end = function() {
     }
 
     var parserHandlesEnd = false;
+    if (buffer) {
+      // Protectiona against zip bombs and other nuisance
+      let responseBytesLeft = self._maxResponseSize || 200000000;
+      res.on('data', function(buf) {
+        responseBytesLeft -= buf.byteLength || buf.length;
+        if (responseBytesLeft < 0) {
+          // This will propagate through error event
+          const err = Error("Maximum response size reached");
+          err.code = "ETOOLARGE";
+          // Parsers aren't required to observe error event,
+          // so would incorrectly report success
+          parserHandlesEnd = false;
+          // Will emit error event
+          res.destroy(err);
+        }
+      });
+    }
+
     if (parser) {
       try {
         // Unbuffered parsers are supposed to emit response early,
@@ -890,6 +913,7 @@ Request.prototype._end = function() {
 
     // terminating events
     res.once('error', function(err){
+      parserHandlesEnd = false;
       self.callback(err, null);
     });
     if (!parserHandlesEnd) res.once('end', function(){

package/lib/node/parsers/image.js

@@ -1,3 +1,5 @@
+'use strict';
+
 module.exports = function(res, fn){
   var data = []; // Binary data needs binary storage
 
@@ -7,4 +9,4 @@ module.exports = function(res, fn){
   res.on('end', function () {
       fn(null, Buffer.concat(data));
   });
-};
+};

package/lib/node/parsers/index.js

@@ -1,3 +1,4 @@
+'use strict';
 
 exports['application/x-www-form-urlencoded'] = require('./urlencoded');
 exports['application/json'] = require('./json');
@@ -5,4 +6,5 @@ exports.text = require('./text');
 
 var binary = require('./image');
 exports['application/octet-stream'] = binary;
+exports['application/pdf'] = binary;
 exports.image = binary;

package/lib/node/parsers/json.js

@@ -1,3 +1,4 @@
+'use strict';
 
 module.exports = function parseJSON(res, fn){
   res.text = '';

package/lib/node/parsers/text.js

@@ -1,7 +1,8 @@
+'use strict';
 
 module.exports = function(res, fn){
   res.text = '';
   res.setEncoding('utf8');
   res.on('data', function(chunk){ res.text += chunk; });
   res.on('end', fn);
-};
+};

package/lib/node/parsers/urlencoded.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Module dependencies.
@@ -16,4 +17,4 @@ module.exports = function(res, fn){
       fn(err);
     }
   });
-};
+};

package/lib/node/response.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Module dependencies.

package/lib/node/unzip.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Module dependencies.
@@ -66,4 +67,4 @@ exports.unzip = function(req, res){
     }
     return this;
   };
-};
+};

package/lib/request-base.js

@@ -1,3 +1,5 @@
+'use strict';
+
 /**
  * Module of mixed-in functions shared between node and client code
  */
@@ -413,6 +415,21 @@ RequestBase.prototype.redirects = function(n){
   return this;
 };
 
+/**
+ * Maximum size of buffered response body, in bytes. Counts uncompressed size.
+ * Default 200MB.
+ *
+ * @param {Number} n
+ * @return {Request} for chaining
+ */
+RequestBase.prototype.maxResponseSize = function(n){
+  if ('number' !== typeof n) {
+    throw TypeError("Invalid argument");
+  }
+  this._maxResponseSize = n;
+  return this;
+};
+
 /**
  * Convert to a plain javascript object (not JSON string) of scalar properties.
  * Note as this method is designed to return a useful non-this value,

package/lib/response-base.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Module dependencies.

package/lib/should-retry.js

@@ -1,3 +1,5 @@
+'use strict';
+
 var ERROR_CODES = [
   'ECONNRESET',
   'ETIMEDOUT',

package/lib/utils.js

@@ -1,3 +1,4 @@
+'use strict';
 
 /**
  * Return the mime type for the given `str`.
@@ -65,4 +66,4 @@ exports.cleanHeader = function(header, shouldStripCookie){
     delete header['cookie'];
   }
   return header;
-};
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "superagent",
-  "version": "3.6.0",
+  "version": "3.7.0",
   "description": "elegant & feature rich browser / node HTTP with a fluent API",
   "scripts": {
     "prepublish": "make all",
@@ -26,25 +26,25 @@
   "dependencies": {
     "component-emitter": "^1.2.0",
     "cookiejar": "^2.1.0",
-    "debug": "^2.6.0",
+    "debug": "^3.1.0",
     "extend": "^3.0.0",
-    "form-data": "^2.1.1",
+    "form-data": "^2.3.1",
     "formidable": "^1.1.1",
     "methods": "^1.1.1",
-    "mime": "^1.3.6",
-    "qs": "^6.4.0",
+    "mime": "^1.4.1",
+    "qs": "^6.5.1",
     "readable-stream": "^2.0.5"
   },
   "devDependencies": {
     "Base64": "^1.0.1",
     "basic-auth-connect": "^1.0.0",
-    "body-parser": "^1.17.0",
+    "body-parser": "^1.18.2",
     "browserify": "^14.1.0",
     "cookie-parser": "^1.4.3",
-    "express": "^4.15.2",
-    "express-session": "^1.15.0",
+    "express": "^4.16.0",
+    "express-session": "^1.15.6",
     "marked": "^0.3.6",
-    "mocha": "^3.1.2",
+    "mocha": "^3.5.3",
     "multer": "^1.3.0",
     "should": "^11.2.0",
     "should-http": "^0.1.1",

package/superagent.js

@@ -1,4 +1,6 @@
 (function(f){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=f()}else if(typeof define==="function"&&define.amd){define([],f)}else{var g;if(typeof window!=="undefined"){g=window}else if(typeof global!=="undefined"){g=global}else if(typeof self!=="undefined"){g=self}else{g=this}g.superagent = f()}})(function(){var define,module,exports;return (function e(t,n,r){function s(o,u){if(!n[o]){if(!t[o]){var a=typeof require=="function"&&require;if(!u&&a)return a(o,!0);if(i)return i(o,!0);var f=new Error("Cannot find module '"+o+"'");throw f.code="MODULE_NOT_FOUND",f}var l=n[o]={exports:{}};t[o][0].call(l.exports,function(e){var n=t[o][1][e];return s(n?n:e)},l,l.exports,e,t,n,r)}return n[o].exports}var i=typeof require=="function"&&require;for(var o=0;o<r.length;o++)s(r[o]);return s})({1:[function(require,module,exports){
+'use strict';
+
 /**
  * Check if `obj` is an object.
  *
@@ -14,6 +16,8 @@ function isObject(obj) {
 module.exports = isObject;
 
 },{}],2:[function(require,module,exports){
+'use strict';
+
 /**
  * Module of mixed-in functions shared between node and client code
  */
@@ -429,6 +433,21 @@ RequestBase.prototype.redirects = function(n){
   return this;
 };
 
+/**
+ * Maximum size of buffered response body, in bytes. Counts uncompressed size.
+ * Default 200MB.
+ *
+ * @param {Number} n
+ * @return {Request} for chaining
+ */
+RequestBase.prototype.maxResponseSize = function(n){
+  if ('number' !== typeof n) {
+    throw TypeError("Invalid argument");
+  }
+  this._maxResponseSize = n;
+  return this;
+};
+
 /**
  * Convert to a plain javascript object (not JSON string) of scalar properties.
  * Note as this method is designed to return a useful non-this value,
@@ -636,6 +655,7 @@ RequestBase.prototype._setTimeouts = function() {
 }
 
 },{"./is-object":1}],3:[function(require,module,exports){
+'use strict';
 
 /**
  * Module dependencies.
@@ -771,6 +791,8 @@ ResponseBase.prototype._setStatusProperties = function(status){
 };
 
 },{"./utils":5}],4:[function(require,module,exports){
+'use strict';
+
 var ERROR_CODES = [
   'ECONNRESET',
   'ETIMEDOUT',
@@ -796,6 +818,7 @@ module.exports = function shouldRetry(err, res) {
 };
 
 },{}],5:[function(require,module,exports){
+'use strict';
 
 /**
  * Return the mime type for the given `str`.
@@ -864,6 +887,7 @@ exports.cleanHeader = function(header, shouldStripCookie){
   }
   return header;
 };
+
 },{}],6:[function(require,module,exports){
 
 /**
@@ -1252,11 +1276,12 @@ function parseHeader(str) {
   var field;
   var val;
 
-  lines.pop(); // trailing CRLF
-
   for (var i = 0, len = lines.length; i < len; ++i) {
     line = lines[i];
     index = line.indexOf(':');
+    if (index === -1) { // could be empty line, just skip it
+      continue;
+    }
     field = line.slice(0, index).toLowerCase();
     val = trim(line.slice(index + 1));
     fields[field] = val;
@@ -1452,16 +1477,16 @@ function Request(method, url) {
     try {
       if (!self._isResponseOK(res)) {
         new_err = new Error(res.statusText || 'Unsuccessful HTTP response');
-        new_err.original = err;
-        new_err.response = res;
-        new_err.status = res.status;
       }
-    } catch(e) {
-      new_err = e; // #985 touching res may cause INVALID_STATE_ERR on old Android
+    } catch(custom_err) {
+      new_err = custom_err; // ok() callback can throw
     }
 
     // #1000 don't catch errors from the callback to avoid double calling it
     if (new_err) {
+      new_err.original = err;
+      new_err.response = res;
+      new_err.status = res.status;
       self.callback(new_err, res);
     } else {
       self.callback(null, res);