wapplr 1.0.79 → 1.0.80

package/dist/server/middlewares.js

@@ -251,7 +251,7 @@ function createMiddlewares(p) {
             return t;
           }).join('; '));
         }
-        if (!res.getHeader("Content-Length") && !dontSetContentLength) {
+        if (!res.getHeader("Content-Length") && !dontSetContentLength && _html) {
           res.setHeader("Content-Length", Buffer.byteLength(_html));
         }
         if (!res.getHeader("Last-Modified") && mtime) {

package/dist/server/static.js

@@ -9,99 +9,98 @@ exports["default"] = serveStatic;
 exports.endStream = endStream;
 var _regenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/regenerator"));
 var _asyncToGenerator2 = _interopRequireDefault(require("@babel/runtime/helpers/asyncToGenerator"));
-var fs = require("node:fs/promises");
-var fsSync = require("node:fs");
-var path = require("path");
-function destroy(stream) {
-  if (!(stream !== null && stream !== void 0 && stream.__destroyed)) {
-    stream.destroy();
-    stream.__destroyed = true;
+var _nodeFs = require("node:fs");
+var _nodePath = _interopRequireDefault(require("node:path"));
+function endStream(req, res, stream) {
+  if (!stream) {
+    return;
+  }
+  if (stream.__destroyed) {
+    return;
+  }
+  stream.__destroyed = true;
+  var cleanup = stream.__cleanup;
+  if (cleanup) {
+    try {
+      var _req$off, _req$off2, _res$off, _stream$off, _stream$off2;
+      req === null || req === void 0 ? void 0 : (_req$off = req.off) === null || _req$off === void 0 ? void 0 : _req$off.call(req, "aborted", cleanup);
+      req === null || req === void 0 ? void 0 : (_req$off2 = req.off) === null || _req$off2 === void 0 ? void 0 : _req$off2.call(req, "close", cleanup);
+      res === null || res === void 0 ? void 0 : (_res$off = res.off) === null || _res$off === void 0 ? void 0 : _res$off.call(res, "close", cleanup);
+      stream === null || stream === void 0 ? void 0 : (_stream$off = stream.off) === null || _stream$off === void 0 ? void 0 : _stream$off.call(stream, "error", cleanup);
+      stream === null || stream === void 0 ? void 0 : (_stream$off2 = stream.off) === null || _stream$off2 === void 0 ? void 0 : _stream$off2.call(stream, "close", cleanup);
+    } catch (_unused) {}
+    stream.__cleanup = null;
+  }
+  try {
+    var _stream$destroy;
+    (_stream$destroy = stream.destroy) === null || _stream$destroy === void 0 ? void 0 : _stream$destroy.call(stream);
+  } catch (_unused2) {}
+  try {
     if (typeof stream.close === "function") {
-      stream.on("open", function onOpenClose() {
+      var _stream$once;
+      (_stream$once = stream.once) === null || _stream$once === void 0 ? void 0 : _stream$once.call(stream, "open", function onOpenClose() {
         if (typeof this.fd === "number") {
           this.close();
         }
       });
     }
-  }
-  return stream;
+  } catch (_unused3) {}
 }
-function onFinished(req, res, callback) {
-  function isFinishedResponse() {
-    var socket = res.socket;
-    if (typeof res.finished === "boolean") {
-      return Boolean(res.finished || res.writableEnded || socket && !socket.writable);
-    }
-  }
-  function isFinishedRequest() {
-    var socket = req.socket;
-    if (typeof req.complete === "boolean") {
-      return Boolean(req.upgrade || !socket || !socket.readable || req.complete && !req.readable);
-    }
-  }
-  function removeListener() {
-    if (req.__onFinishedInterval) {
-      clearInterval(req.__onFinishedInterval);
-      req.__onFinishedInterval = 0;
-    }
-    if (res.__onFinishedInterval) {
-      clearInterval(res.__onFinishedInterval);
-      res.__onFinishedInterval = 0;
-    }
+function addCloseEventsForReadableStream(req, res, stream) {
+  var _req$on, _req$on2, _res$on, _stream$on, _stream$on2;
+  if (!req || !res || !stream) {
+    return;
   }
-  function listener() {
-    var result = isFinishedRequest() || isFinishedResponse();
-    if (result) {
-      removeListener();
-      callback();
+  var finished = false;
+  var cleanup = function cleanup(err) {
+    if (finished) {
+      return;
     }
-  }
-  req.__onFinishedInterval = res.__onFinishedInterval = setInterval(listener, 100);
-  req.__onFinishedRemoveListener = res.__onFinishedRemoveListener = removeListener;
+    finished = true;
+    try {
+      var _stream$destroy2;
+      (_stream$destroy2 = stream.destroy) === null || _stream$destroy2 === void 0 ? void 0 : _stream$destroy2.call(stream, err);
+    } catch (_unused4) {}
+  };
+  stream.__cleanup = cleanup;
+  (_req$on = req.on) === null || _req$on === void 0 ? void 0 : _req$on.call(req, "aborted", cleanup);
+  (_req$on2 = req.on) === null || _req$on2 === void 0 ? void 0 : _req$on2.call(req, "close", cleanup);
+  (_res$on = res.on) === null || _res$on === void 0 ? void 0 : _res$on.call(res, "close", cleanup);
+  (_stream$on = stream.on) === null || _stream$on === void 0 ? void 0 : _stream$on.call(stream, "error", cleanup);
+  (_stream$on2 = stream.on) === null || _stream$on2 === void 0 ? void 0 : _stream$on2.call(stream, "close", cleanup);
 }
-function endStream(req, res, stream) {
-  if (req.__onFinishedRemoveListener) {
-    req.__onFinishedRemoveListener();
-    req.__onFinishedRemoveListener = null;
+function safeJoin(root, reqPathname) {
+  var decoded;
+  try {
+    decoded = decodeURIComponent(reqPathname || "/");
+  } catch (_unused5) {
+    return null;
   }
-  if (res.__onFinishedRemoveListener) {
-    res.__onFinishedRemoveListener();
-    res.__onFinishedRemoveListener = null;
+  if (decoded.includes("\0")) {
+    return null;
   }
-  destroy(stream);
-}
-function addCloseEventsForReadableStream(req, res, stream) {
-  req.on("close", function () {
-    endStream(req, res, stream);
-  });
-  req.connection.on("close", function () {
-    endStream(req, res, stream);
-  });
-  onFinished(req, res, function () {
-    endStream(req, res, stream);
-  });
-  stream.on("close", function onclose() {
-    endStream(req, res, stream);
-  });
+  var absRoot = _nodePath["default"].resolve(root);
+  var absPath = _nodePath["default"].resolve(absRoot, "." + decoded);
+  var rel = _nodePath["default"].relative(absRoot, absPath);
+  if (rel.startsWith("..") || _nodePath["default"].isAbsolute(rel)) {
+    return null;
+  }
+  return absPath;
 }
 function serveStatic(publicPath) {
+  var opts = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  var root = _nodePath["default"].resolve(publicPath);
+  var _opts$allowDotfiles = opts.allowDotfiles,
+    allowDotfiles = _opts$allowDotfiles === void 0 ? false : _opts$allowDotfiles;
   return /*#__PURE__*/function () {
     var _staticMiddleware = (0, _asyncToGenerator2["default"])(/*#__PURE__*/(0, _regenerator2["default"])().m(function _callee(req, res, next) {
-      var parsedUrl, sanitizePath, pathname, parsedSanitizePath, ext, stream, data, stats, _t, _t2;
+      var _req$headers, _res$setHeader3, _res$setHeader4;
+      var method, urlObj, joined, parsed, stats, size, start, end, statusCode, range, m, hasStart, hasEnd, suffixLength, _res$setHeader, contentLength, _res$setHeader2, runSend, stream, _t, _t2, _t3;
       return (0, _regenerator2["default"])().w(function (_context) {
         while (1) switch (_context.p = _context.n) {
           case 0:
-            parsedUrl = {
-              pathname: req.wappRequest.path
-            };
-            try {
-              parsedUrl = new URL(req.wappRequest.url);
-            } catch (e) {}
-            sanitizePath = path.normalize(parsedUrl.pathname).replace(/^(\.\.[\/\\])+/, "");
-            pathname = path.join(publicPath, sanitizePath);
-            parsedSanitizePath = path.parse(pathname);
-            ext = parsedSanitizePath.ext;
-            if (ext) {
+            method = (req.wappRequest.method || req.method || "GET").toUpperCase();
+            if (!(method !== "GET" && method !== "HEAD")) {
               _context.n = 2;
               break;
             }
@@ -111,61 +110,225 @@ function serveStatic(publicPath) {
             return _context.a(2, _context.v);
           case 2:
             _context.p = 2;
-            _context.n = 3;
-            return fs.access(pathname);
-          case 3:
-            _context.n = 6;
+            urlObj = new URL(req.wappRequest.url || req.url, "http://localhost");
+            _context.n = 5;
             break;
-          case 4:
-            _context.p = 4;
+          case 3:
+            _context.p = 3;
             _t = _context.v;
-            _context.n = 5;
+            _context.n = 4;
             return next();
-          case 5:
+          case 4:
             return _context.a(2, _context.v);
+          case 5:
+            joined = safeJoin(root, urlObj.pathname);
+            if (joined) {
+              _context.n = 7;
+              break;
+            }
+            _context.n = 6;
+            return next();
           case 6:
-            _context.p = 6;
-            _context.n = 7;
-            return fs.readFile(pathname);
+            return _context.a(2, _context.v);
           case 7:
-            data = _context.v;
+            parsed = _nodePath["default"].parse(joined);
+            if (parsed.ext) {
+              _context.n = 9;
+              break;
+            }
             _context.n = 8;
-            return fs.stat(pathname);
+            return next();
           case 8:
+            return _context.a(2, _context.v);
+          case 9:
+            if (!(!allowDotfiles && parsed.base.startsWith("."))) {
+              _context.n = 11;
+              break;
+            }
+            _context.n = 10;
+            return next();
+          case 10:
+            return _context.a(2, _context.v);
+          case 11:
+            _context.p = 11;
+            _context.n = 12;
+            return _nodeFs.promises.stat(joined);
+          case 12:
             stats = _context.v;
-            res.wappResponse.status(200);
+            if (stats.isFile()) {
+              _context.n = 14;
+              break;
+            }
+            _context.n = 13;
+            return next();
+          case 13:
+            return _context.a(2, _context.v);
+          case 14:
+            _context.n = 19;
+            break;
+          case 15:
+            _context.p = 15;
+            _t2 = _context.v;
+            if (!((_t2 === null || _t2 === void 0 ? void 0 : _t2.code) === "ENOENT")) {
+              _context.n = 17;
+              break;
+            }
+            _context.n = 16;
+            return next();
+          case 16:
+            return _context.a(2, _context.v);
+          case 17:
+            res.wappResponse.status(500, _t2);
+            res.wapp.log(_t2, req, res);
+            _context.n = 18;
+            return next(_t2);
+          case 18:
+            return _context.a(2, _context.v);
+          case 19:
+            size = stats.size;
+            start = 0;
+            end = size > 0 ? size - 1 : 0;
+            statusCode = 200;
+            range = (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.range;
+            if (!(range && /^bytes=/.test(range))) {
+              _context.n = 21;
+              break;
+            }
+            m = /bytes=(\d*)-(\d*)/.exec(range);
+            if (!m) {
+              _context.n = 21;
+              break;
+            }
+            hasStart = m[1] !== "";
+            hasEnd = m[2] !== "";
+            if (hasStart) {
+              start = parseInt(m[1], 10);
+            }
+            if (hasEnd) {
+              end = parseInt(m[2], 10);
+            }
+            if (!hasStart && hasEnd) {
+              suffixLength = end;
+              if (Number.isFinite(suffixLength)) {
+                if (suffixLength > size) {
+                  start = 0;
+                } else {
+                  start = size - suffixLength;
+                }
+                end = size > 0 ? size - 1 : 0;
+              }
+            }
+            if (hasStart && !hasEnd) {
+              end = size > 0 ? size - 1 : 0;
+            }
+            if (!(Number.isNaN(start) || Number.isNaN(end) || start > end || start < 0 || end >= size)) {
+              _context.n = 20;
+              break;
+            }
+            (_res$setHeader = res.setHeader) === null || _res$setHeader === void 0 ? void 0 : _res$setHeader.call(res, "Content-Range", "bytes */".concat(size));
+            res.wappResponse.status(416);
             res.wappResponse.sendData = {
-              data: data,
               stats: stats,
-              parsedPath: parsedSanitizePath
+              parsedPath: parsed,
+              dontSetContentLength: true
+            };
+            return _context.a(2, res.wapp.middleware.runSendMiddlewares(req, res, function () {
+              res.end();
+            }));
+          case 20:
+            statusCode = 206;
+          case 21:
+            contentLength = statusCode === 206 ? end - start + 1 : size;
+            res.wappResponse.status(statusCode);
+            res.wappResponse.sendData = {
+              stats: stats,
+              parsedPath: parsed,
+              dontSetContentLength: true
+            };
+            if (statusCode === 206) {
+              (_res$setHeader2 = res.setHeader) === null || _res$setHeader2 === void 0 ? void 0 : _res$setHeader2.call(res, "Content-Range", "bytes ".concat(start, "-").concat(end, "/").concat(size));
+            }
+            (_res$setHeader3 = res.setHeader) === null || _res$setHeader3 === void 0 ? void 0 : _res$setHeader3.call(res, "Accept-Ranges", "bytes");
+            (_res$setHeader4 = res.setHeader) === null || _res$setHeader4 === void 0 ? void 0 : _res$setHeader4.call(res, "Content-Length", String(contentLength));
+            runSend = function runSend() {
+              return new Promise(function (resolve) {
+                var _res$wapp, _res$wapp$middleware;
+                if ((_res$wapp = res.wapp) !== null && _res$wapp !== void 0 && (_res$wapp$middleware = _res$wapp.middleware) !== null && _res$wapp$middleware !== void 0 && _res$wapp$middleware.runSendMiddlewares) {
+                  res.wapp.middleware.runSendMiddlewares(req, res, function () {
+                    return resolve();
+                  });
+                } else {
+                  resolve();
+                }
+              });
             };
-            stream = fsSync.createReadStream(pathname);
+            _context.p = 22;
+            _context.n = 23;
+            return runSend();
+          case 23:
+            if (!res.writableEnded) {
+              _context.n = 24;
+              break;
+            }
+            return _context.a(2);
+          case 24:
+            if (!(method === "HEAD")) {
+              _context.n = 25;
+              break;
+            }
+            res.end();
+            return _context.a(2);
+          case 25:
+            stream = statusCode === 206 ? (0, _nodeFs.createReadStream)(joined, {
+              start: start,
+              end: end
+            }) : (0, _nodeFs.createReadStream)(joined);
             addCloseEventsForReadableStream(req, res, stream);
-            stream.on("error", function onerror(err) {
+            stream.on("error", function (err) {
+              var _res$wapp2, _res$wapp2$log;
               endStream(req, res, stream);
-              res.wappResponse.status(err.statusCode || 500, err);
-              res.wapp.log(err, req, res);
-              next(err);
-            });
-            stream.on("open", function onopen() {
-              res.wapp.middleware.runSendMiddlewares(req, res, function next() {
-                res.wapp.log(req, res);
-                stream.pipe(res);
-              });
+              (_res$wapp2 = res.wapp) === null || _res$wapp2 === void 0 ? void 0 : (_res$wapp2$log = _res$wapp2.log) === null || _res$wapp2$log === void 0 ? void 0 : _res$wapp2$log.call(_res$wapp2, err, req, res);
+              if (!res.headersSent) {
+                res.wappResponse.status(err.statusCode || 500, err);
+              }
+              if (!res.writableEnded) {
+                try {
+                  res.end();
+                } catch (_unused7) {}
+              }
+              if (typeof next === "function") {
+                next(err);
+              }
             });
-            _context.n = 10;
-            break;
-          case 9:
-            _context.p = 9;
-            _t2 = _context.v;
+            if (!res.writableEnded) {
+              _context.n = 26;
+              break;
+            }
             endStream(req, res, stream);
-            res.wappResponse.status(_t2.statusCode || 500, _t2);
-            res.wapp.log(_t2, req, res);
-            next(_t2);
-          case 10:
+            return _context.a(2);
+          case 26:
+            res.wapp.log(req, res);
+            stream.pipe(res);
+            _context.n = 28;
+            break;
+          case 27:
+            _context.p = 27;
+            _t3 = _context.v;
+            res.wapp.log(_t3, req, res);
+            if (!res.writableEnded) {
+              res.wappResponse.status(_t3.statusCode || 500, _t3);
+              res.end();
+            }
+            if (!(typeof next === "function")) {
+              _context.n = 28;
+              break;
+            }
+            _context.n = 28;
+            return next(_t3);
+          case 28:
             return _context.a(2);
         }
-      }, _callee, null, [[6, 9], [2, 4]]);
+      }, _callee, null, [[22, 27], [11, 15], [2, 3]]);
     }));
     function staticMiddleware(_x, _x2, _x3) {
       return _staticMiddleware.apply(this, arguments);

package/package.json

@@ -22,7 +22,7 @@
     "files": [
         "dist/*"
     ],
-    "version": "1.0.79",
+    "version": "1.0.80",
     "main": "dist/server",
     "browser": "dist/client",
     "repository": {