This commit is contained in:
2025-06-26 03:35:15 +00:00
parent 56fa52fd80
commit 59f287112f
2193 changed files with 289518 additions and 3540 deletions

View File

@@ -0,0 +1,48 @@
{
"name": "helmet",
"description": "help secure Express/Connect apps with various HTTP headers",
"version": "8.1.0",
"author": "Adam Baldwin <adam@npmjs.com> (https://evilpacket.net)",
"contributors": [
"Evan Hahn <me@evanhahn.com> (https://evanhahn.com)"
],
"homepage": "https://helmetjs.github.io/",
"bugs": {
"url": "https://github.com/helmetjs/helmet/issues",
"email": "me@evanhahn.com"
},
"repository": {
"type": "git",
"url": "git://github.com/helmetjs/helmet.git"
},
"license": "MIT",
"keywords": [
"express",
"security",
"headers",
"backend",
"content-security-policy",
"cross-origin-embedder-policy",
"cross-origin-opener-policy",
"cross-origin-resource-policy",
"origin-agent-cluster",
"referrer-policy",
"strict-transport-security",
"x-content-type-options",
"x-dns-prefetch-control",
"x-download-options",
"x-frame-options",
"x-permitted-cross-domain-policies",
"x-powered-by",
"x-xss-protection"
],
"engines": {
"node": ">=18.0.0"
},
"exports": {
"import": "./index.mjs",
"require": "./index.cjs"
},
"main": "./index.cjs",
"types": "./index.d.cts"
}

View File

@@ -0,0 +1,247 @@
/*!
* router
* Copyright(c) 2013 Roman Shtylman
* Copyright(c) 2014-2022 Douglas Christopher Wilson
* MIT Licensed
*/
'use strict'
/**
* Module dependencies.
* @private
*/
const isPromise = require('is-promise')
const pathRegexp = require('path-to-regexp')
const debug = require('debug')('router:layer')
const deprecate = require('depd')('router')
/**
* Module variables.
* @private
*/
const TRAILING_SLASH_REGEXP = /\/+$/
const MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g
/**
* Expose `Layer`.
*/
module.exports = Layer
function Layer (path, options, fn) {
if (!(this instanceof Layer)) {
return new Layer(path, options, fn)
}
debug('new %o', path)
const opts = options || {}
this.handle = fn
this.keys = []
this.name = fn.name || '<anonymous>'
this.params = undefined
this.path = undefined
this.slash = path === '/' && opts.end === false
function matcher (_path) {
if (_path instanceof RegExp) {
const keys = []
let name = 0
let m
// eslint-disable-next-line no-cond-assign
while (m = MATCHING_GROUP_REGEXP.exec(_path.source)) {
keys.push({
name: m[1] || name++,
offset: m.index
})
}
return function regexpMatcher (p) {
const match = _path.exec(p)
if (!match) {
return false
}
const params = {}
for (let i = 1; i < match.length; i++) {
const key = keys[i - 1]
const prop = key.name
const val = decodeParam(match[i])
if (val !== undefined) {
params[prop] = val
}
}
return {
params,
path: match[0]
}
}
}
return pathRegexp.match((opts.strict ? _path : loosen(_path)), {
sensitive: opts.sensitive,
end: opts.end,
trailing: !opts.strict,
decode: decodeParam
})
}
this.matchers = Array.isArray(path) ? path.map(matcher) : [matcher(path)]
}
/**
* Handle the error for the layer.
*
* @param {Error} error
* @param {Request} req
* @param {Response} res
* @param {function} next
* @api private
*/
Layer.prototype.handleError = function handleError (error, req, res, next) {
const fn = this.handle
if (fn.length !== 4) {
// not a standard error handler
return next(error)
}
try {
// invoke function
const ret = fn(error, req, res, next)
// wait for returned promise
if (isPromise(ret)) {
if (!(ret instanceof Promise)) {
deprecate('handlers that are Promise-like are deprecated, use a native Promise instead')
}
ret.then(null, function (error) {
next(error || new Error('Rejected promise'))
})
}
} catch (err) {
next(err)
}
}
/**
* Handle the request for the layer.
*
* @param {Request} req
* @param {Response} res
* @param {function} next
* @api private
*/
Layer.prototype.handleRequest = function handleRequest (req, res, next) {
const fn = this.handle
if (fn.length > 3) {
// not a standard request handler
return next()
}
try {
// invoke function
const ret = fn(req, res, next)
// wait for returned promise
if (isPromise(ret)) {
if (!(ret instanceof Promise)) {
deprecate('handlers that are Promise-like are deprecated, use a native Promise instead')
}
ret.then(null, function (error) {
next(error || new Error('Rejected promise'))
})
}
} catch (err) {
next(err)
}
}
/**
* Check if this route matches `path`, if so
* populate `.params`.
*
* @param {String} path
* @return {Boolean}
* @api private
*/
Layer.prototype.match = function match (path) {
let match
if (path != null) {
// fast path non-ending match for / (any path matches)
if (this.slash) {
this.params = {}
this.path = ''
return true
}
let i = 0
while (!match && i < this.matchers.length) {
// match the path
match = this.matchers[i](path)
i++
}
}
if (!match) {
this.params = undefined
this.path = undefined
return false
}
// store values
this.params = match.params
this.path = match.path
this.keys = Object.keys(match.params)
return true
}
/**
* Decode param value.
*
* @param {string} val
* @return {string}
* @private
*/
function decodeParam (val) {
if (typeof val !== 'string' || val.length === 0) {
return val
}
try {
return decodeURIComponent(val)
} catch (err) {
if (err instanceof URIError) {
err.message = 'Failed to decode param \'' + val + '\''
err.status = 400
}
throw err
}
}
/**
* Loosens the given path for path-to-regexp matching.
*/
function loosen (path) {
if (path instanceof RegExp || path === '/') {
return path
}
return Array.isArray(path)
? path.map(function (p) { return loosen(p) })
: String(path).replace(TRAILING_SLASH_REGEXP, '')
}

View File

@@ -0,0 +1,23 @@
(The MIT License)
Copyright (c) 2013 Roman Shtylman
Copyright (c) 2014-2022 Douglas Christopher Wilson
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
'Software'), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

View File

@@ -0,0 +1,292 @@
2.0.1 / 2025-03-27
==========
2.0.0 / 2024-08-31
==========
* Drop node <18
* Use `content-type@^1.0.5` and `media-typer@^1.0.0` for type validation
- No behavior changes, upgrades `media-typer`
* deps: mime-types@^3.0.0
- Add `application/toml` with extension `.toml`
- Add `application/ubjson` with extension `.ubj`
- Add `application/x-keepass2` with extension `.kdbx`
- Add deprecated iWorks mime types and extensions
- Add extension `.amr` to `audio/amr`
- Add extension `.cjs` to `application/node`
- Add extension `.dbf` to `application/vnd.dbf`
- Add extension `.m4s` to `video/iso.segment`
- Add extension `.mvt` to `application/vnd.mapbox-vector-tile`
- Add extension `.mxmf` to `audio/mobile-xmf`
- Add extension `.opus` to `audio/ogg`
- Add extension `.rar` to `application/vnd.rar`
- Add extension `.td` to `application/urc-targetdesc+xml`
- Add extension `.trig` to `application/trig`
- Add extensions from IANA for `application/*+xml` types
- Add `image/avif` with extension `.avif`
- Add `image/ktx2` with extension `.ktx2`
- Add `image/vnd.ms-dds` with extension `.dds`
- Add new upstream MIME types
- Fix extension of `application/vnd.apple.keynote` to be `.key`
- Remove ambigious extensions from IANA for `application/*+xml` types
- Update primary extension to `.es` for `application/ecmascript`
1.6.18 / 2019-04-26
===================
* Fix regression passing request object to `typeis.is`
1.6.17 / 2019-04-25
===================
* deps: mime-types@~2.1.24
- Add Apple file extensions from IANA
- Add extension `.csl` to `application/vnd.citationstyles.style+xml`
- Add extension `.es` to `application/ecmascript`
- Add extension `.nq` to `application/n-quads`
- Add extension `.nt` to `application/n-triples`
- Add extension `.owl` to `application/rdf+xml`
- Add extensions `.siv` and `.sieve` to `application/sieve`
- Add extensions from IANA for `image/*` types
- Add extensions from IANA for `model/*` types
- Add extensions to HEIC image types
- Add new mime types
- Add `text/mdx` with extension `.mdx`
* perf: prevent internal `throw` on invalid type
1.6.16 / 2018-02-16
===================
* deps: mime-types@~2.1.18
- Add `application/raml+yaml` with extension `.raml`
- Add `application/wasm` with extension `.wasm`
- Add `text/shex` with extension `.shex`
- Add extensions for JPEG-2000 images
- Add extensions from IANA for `message/*` types
- Add extension `.mjs` to `application/javascript`
- Add extension `.wadl` to `application/vnd.sun.wadl+xml`
- Add extension `.gz` to `application/gzip`
- Add glTF types and extensions
- Add new mime types
- Update extensions `.md` and `.markdown` to be `text/markdown`
- Update font MIME types
- Update `text/hjson` to registered `application/hjson`
1.6.15 / 2017-03-31
===================
* deps: mime-types@~2.1.15
- Add new mime types
1.6.14 / 2016-11-18
===================
* deps: mime-types@~2.1.13
- Add new mime types
1.6.13 / 2016-05-18
===================
* deps: mime-types@~2.1.11
- Add new mime types
1.6.12 / 2016-02-28
===================
* deps: mime-types@~2.1.10
- Add new mime types
- Fix extension of `application/dash+xml`
- Update primary extension for `audio/mp4`
1.6.11 / 2016-01-29
===================
* deps: mime-types@~2.1.9
- Add new mime types
1.6.10 / 2015-12-01
===================
* deps: mime-types@~2.1.8
- Add new mime types
1.6.9 / 2015-09-27
==================
* deps: mime-types@~2.1.7
- Add new mime types
1.6.8 / 2015-09-04
==================
* deps: mime-types@~2.1.6
- Add new mime types
1.6.7 / 2015-08-20
==================
* Fix type error when given invalid type to match against
* deps: mime-types@~2.1.5
- Add new mime types
1.6.6 / 2015-07-31
==================
* deps: mime-types@~2.1.4
- Add new mime types
1.6.5 / 2015-07-16
==================
* deps: mime-types@~2.1.3
- Add new mime types
1.6.4 / 2015-07-01
==================
* deps: mime-types@~2.1.2
- Add new mime types
* perf: enable strict mode
* perf: remove argument reassignment
1.6.3 / 2015-06-08
==================
* deps: mime-types@~2.1.1
- Add new mime types
* perf: reduce try block size
* perf: remove bitwise operations
1.6.2 / 2015-05-10
==================
* deps: mime-types@~2.0.11
- Add new mime types
1.6.1 / 2015-03-13
==================
* deps: mime-types@~2.0.10
- Add new mime types
1.6.0 / 2015-02-12
==================
* fix false-positives in `hasBody` `Transfer-Encoding` check
* support wildcard for both type and subtype (`*/*`)
1.5.7 / 2015-02-09
==================
* fix argument reassignment
* deps: mime-types@~2.0.9
- Add new mime types
1.5.6 / 2015-01-29
==================
* deps: mime-types@~2.0.8
- Add new mime types
1.5.5 / 2014-12-30
==================
* deps: mime-types@~2.0.7
- Add new mime types
- Fix missing extensions
- Fix various invalid MIME type entries
- Remove example template MIME types
- deps: mime-db@~1.5.0
1.5.4 / 2014-12-10
==================
* deps: mime-types@~2.0.4
- Add new mime types
- deps: mime-db@~1.3.0
1.5.3 / 2014-11-09
==================
* deps: mime-types@~2.0.3
- Add new mime types
- deps: mime-db@~1.2.0
1.5.2 / 2014-09-28
==================
* deps: mime-types@~2.0.2
- Add new mime types
- deps: mime-db@~1.1.0
1.5.1 / 2014-09-07
==================
* Support Node.js 0.6
* deps: media-typer@0.3.0
* deps: mime-types@~2.0.1
- Support Node.js 0.6
1.5.0 / 2014-09-05
==================
* fix `hasbody` to be true for `content-length: 0`
1.4.0 / 2014-09-02
==================
* update mime-types
1.3.2 / 2014-06-24
==================
* use `~` range on mime-types
1.3.1 / 2014-06-19
==================
* fix global variable leak
1.3.0 / 2014-06-19
==================
* improve type parsing
- invalid media type never matches
- media type not case-sensitive
- extra LWS does not affect results
1.2.2 / 2014-06-19
==================
* fix behavior on unknown type argument
1.2.1 / 2014-06-03
==================
* switch dependency from `mime` to `mime-types@1.0.0`
1.2.0 / 2014-05-11
==================
* support suffix matching:
- `+json` matches `application/vnd+json`
- `*/vnd+json` matches `application/vnd+json`
- `application/*+json` matches `application/vnd+json`
1.1.0 / 2014-04-12
==================
* add non-array values support
* expose internal utilities:
- `.is()`
- `.hasBody()`
- `.normalize()`
- `.match()`
1.0.1 / 2014-03-30
==================
* add `multipart` as a shorthand