update
This commit is contained in:
@@ -0,0 +1,48 @@
|
||||
{
|
||||
"name": "helmet",
|
||||
"description": "help secure Express/Connect apps with various HTTP headers",
|
||||
"version": "8.1.0",
|
||||
"author": "Adam Baldwin <adam@npmjs.com> (https://evilpacket.net)",
|
||||
"contributors": [
|
||||
"Evan Hahn <me@evanhahn.com> (https://evanhahn.com)"
|
||||
],
|
||||
"homepage": "https://helmetjs.github.io/",
|
||||
"bugs": {
|
||||
"url": "https://github.com/helmetjs/helmet/issues",
|
||||
"email": "me@evanhahn.com"
|
||||
},
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git://github.com/helmetjs/helmet.git"
|
||||
},
|
||||
"license": "MIT",
|
||||
"keywords": [
|
||||
"express",
|
||||
"security",
|
||||
"headers",
|
||||
"backend",
|
||||
"content-security-policy",
|
||||
"cross-origin-embedder-policy",
|
||||
"cross-origin-opener-policy",
|
||||
"cross-origin-resource-policy",
|
||||
"origin-agent-cluster",
|
||||
"referrer-policy",
|
||||
"strict-transport-security",
|
||||
"x-content-type-options",
|
||||
"x-dns-prefetch-control",
|
||||
"x-download-options",
|
||||
"x-frame-options",
|
||||
"x-permitted-cross-domain-policies",
|
||||
"x-powered-by",
|
||||
"x-xss-protection"
|
||||
],
|
||||
"engines": {
|
||||
"node": ">=18.0.0"
|
||||
},
|
||||
"exports": {
|
||||
"import": "./index.mjs",
|
||||
"require": "./index.cjs"
|
||||
},
|
||||
"main": "./index.cjs",
|
||||
"types": "./index.d.cts"
|
||||
}
|
||||
@@ -0,0 +1,247 @@
|
||||
/*!
|
||||
* router
|
||||
* Copyright(c) 2013 Roman Shtylman
|
||||
* Copyright(c) 2014-2022 Douglas Christopher Wilson
|
||||
* MIT Licensed
|
||||
*/
|
||||
|
||||
'use strict'
|
||||
|
||||
/**
|
||||
* Module dependencies.
|
||||
* @private
|
||||
*/
|
||||
|
||||
const isPromise = require('is-promise')
|
||||
const pathRegexp = require('path-to-regexp')
|
||||
const debug = require('debug')('router:layer')
|
||||
const deprecate = require('depd')('router')
|
||||
|
||||
/**
|
||||
* Module variables.
|
||||
* @private
|
||||
*/
|
||||
|
||||
const TRAILING_SLASH_REGEXP = /\/+$/
|
||||
const MATCHING_GROUP_REGEXP = /\((?:\?<(.*?)>)?(?!\?)/g
|
||||
|
||||
/**
|
||||
* Expose `Layer`.
|
||||
*/
|
||||
|
||||
module.exports = Layer
|
||||
|
||||
function Layer (path, options, fn) {
|
||||
if (!(this instanceof Layer)) {
|
||||
return new Layer(path, options, fn)
|
||||
}
|
||||
|
||||
debug('new %o', path)
|
||||
const opts = options || {}
|
||||
|
||||
this.handle = fn
|
||||
this.keys = []
|
||||
this.name = fn.name || '<anonymous>'
|
||||
this.params = undefined
|
||||
this.path = undefined
|
||||
this.slash = path === '/' && opts.end === false
|
||||
|
||||
function matcher (_path) {
|
||||
if (_path instanceof RegExp) {
|
||||
const keys = []
|
||||
let name = 0
|
||||
let m
|
||||
// eslint-disable-next-line no-cond-assign
|
||||
while (m = MATCHING_GROUP_REGEXP.exec(_path.source)) {
|
||||
keys.push({
|
||||
name: m[1] || name++,
|
||||
offset: m.index
|
||||
})
|
||||
}
|
||||
|
||||
return function regexpMatcher (p) {
|
||||
const match = _path.exec(p)
|
||||
if (!match) {
|
||||
return false
|
||||
}
|
||||
|
||||
const params = {}
|
||||
for (let i = 1; i < match.length; i++) {
|
||||
const key = keys[i - 1]
|
||||
const prop = key.name
|
||||
const val = decodeParam(match[i])
|
||||
|
||||
if (val !== undefined) {
|
||||
params[prop] = val
|
||||
}
|
||||
}
|
||||
|
||||
return {
|
||||
params,
|
||||
path: match[0]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return pathRegexp.match((opts.strict ? _path : loosen(_path)), {
|
||||
sensitive: opts.sensitive,
|
||||
end: opts.end,
|
||||
trailing: !opts.strict,
|
||||
decode: decodeParam
|
||||
})
|
||||
}
|
||||
this.matchers = Array.isArray(path) ? path.map(matcher) : [matcher(path)]
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle the error for the layer.
|
||||
*
|
||||
* @param {Error} error
|
||||
* @param {Request} req
|
||||
* @param {Response} res
|
||||
* @param {function} next
|
||||
* @api private
|
||||
*/
|
||||
|
||||
Layer.prototype.handleError = function handleError (error, req, res, next) {
|
||||
const fn = this.handle
|
||||
|
||||
if (fn.length !== 4) {
|
||||
// not a standard error handler
|
||||
return next(error)
|
||||
}
|
||||
|
||||
try {
|
||||
// invoke function
|
||||
const ret = fn(error, req, res, next)
|
||||
|
||||
// wait for returned promise
|
||||
if (isPromise(ret)) {
|
||||
if (!(ret instanceof Promise)) {
|
||||
deprecate('handlers that are Promise-like are deprecated, use a native Promise instead')
|
||||
}
|
||||
|
||||
ret.then(null, function (error) {
|
||||
next(error || new Error('Rejected promise'))
|
||||
})
|
||||
}
|
||||
} catch (err) {
|
||||
next(err)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle the request for the layer.
|
||||
*
|
||||
* @param {Request} req
|
||||
* @param {Response} res
|
||||
* @param {function} next
|
||||
* @api private
|
||||
*/
|
||||
|
||||
Layer.prototype.handleRequest = function handleRequest (req, res, next) {
|
||||
const fn = this.handle
|
||||
|
||||
if (fn.length > 3) {
|
||||
// not a standard request handler
|
||||
return next()
|
||||
}
|
||||
|
||||
try {
|
||||
// invoke function
|
||||
const ret = fn(req, res, next)
|
||||
|
||||
// wait for returned promise
|
||||
if (isPromise(ret)) {
|
||||
if (!(ret instanceof Promise)) {
|
||||
deprecate('handlers that are Promise-like are deprecated, use a native Promise instead')
|
||||
}
|
||||
|
||||
ret.then(null, function (error) {
|
||||
next(error || new Error('Rejected promise'))
|
||||
})
|
||||
}
|
||||
} catch (err) {
|
||||
next(err)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if this route matches `path`, if so
|
||||
* populate `.params`.
|
||||
*
|
||||
* @param {String} path
|
||||
* @return {Boolean}
|
||||
* @api private
|
||||
*/
|
||||
|
||||
Layer.prototype.match = function match (path) {
|
||||
let match
|
||||
|
||||
if (path != null) {
|
||||
// fast path non-ending match for / (any path matches)
|
||||
if (this.slash) {
|
||||
this.params = {}
|
||||
this.path = ''
|
||||
return true
|
||||
}
|
||||
|
||||
let i = 0
|
||||
while (!match && i < this.matchers.length) {
|
||||
// match the path
|
||||
match = this.matchers[i](path)
|
||||
i++
|
||||
}
|
||||
}
|
||||
|
||||
if (!match) {
|
||||
this.params = undefined
|
||||
this.path = undefined
|
||||
return false
|
||||
}
|
||||
|
||||
// store values
|
||||
this.params = match.params
|
||||
this.path = match.path
|
||||
this.keys = Object.keys(match.params)
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
/**
|
||||
* Decode param value.
|
||||
*
|
||||
* @param {string} val
|
||||
* @return {string}
|
||||
* @private
|
||||
*/
|
||||
|
||||
function decodeParam (val) {
|
||||
if (typeof val !== 'string' || val.length === 0) {
|
||||
return val
|
||||
}
|
||||
|
||||
try {
|
||||
return decodeURIComponent(val)
|
||||
} catch (err) {
|
||||
if (err instanceof URIError) {
|
||||
err.message = 'Failed to decode param \'' + val + '\''
|
||||
err.status = 400
|
||||
}
|
||||
|
||||
throw err
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Loosens the given path for path-to-regexp matching.
|
||||
*/
|
||||
function loosen (path) {
|
||||
if (path instanceof RegExp || path === '/') {
|
||||
return path
|
||||
}
|
||||
|
||||
return Array.isArray(path)
|
||||
? path.map(function (p) { return loosen(p) })
|
||||
: String(path).replace(TRAILING_SLASH_REGEXP, '')
|
||||
}
|
||||
@@ -0,0 +1,23 @@
|
||||
(The MIT License)
|
||||
|
||||
Copyright (c) 2013 Roman Shtylman
|
||||
Copyright (c) 2014-2022 Douglas Christopher Wilson
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of this software and associated documentation files (the
|
||||
'Software'), to deal in the Software without restriction, including
|
||||
without limitation the rights to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, and/or sell copies of the Software, and to
|
||||
permit persons to whom the Software is furnished to do so, subject to
|
||||
the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be
|
||||
included in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
@@ -0,0 +1,292 @@
|
||||
2.0.1 / 2025-03-27
|
||||
==========
|
||||
|
||||
2.0.0 / 2024-08-31
|
||||
==========
|
||||
|
||||
* Drop node <18
|
||||
* Use `content-type@^1.0.5` and `media-typer@^1.0.0` for type validation
|
||||
- No behavior changes, upgrades `media-typer`
|
||||
* deps: mime-types@^3.0.0
|
||||
- Add `application/toml` with extension `.toml`
|
||||
- Add `application/ubjson` with extension `.ubj`
|
||||
- Add `application/x-keepass2` with extension `.kdbx`
|
||||
- Add deprecated iWorks mime types and extensions
|
||||
- Add extension `.amr` to `audio/amr`
|
||||
- Add extension `.cjs` to `application/node`
|
||||
- Add extension `.dbf` to `application/vnd.dbf`
|
||||
- Add extension `.m4s` to `video/iso.segment`
|
||||
- Add extension `.mvt` to `application/vnd.mapbox-vector-tile`
|
||||
- Add extension `.mxmf` to `audio/mobile-xmf`
|
||||
- Add extension `.opus` to `audio/ogg`
|
||||
- Add extension `.rar` to `application/vnd.rar`
|
||||
- Add extension `.td` to `application/urc-targetdesc+xml`
|
||||
- Add extension `.trig` to `application/trig`
|
||||
- Add extensions from IANA for `application/*+xml` types
|
||||
- Add `image/avif` with extension `.avif`
|
||||
- Add `image/ktx2` with extension `.ktx2`
|
||||
- Add `image/vnd.ms-dds` with extension `.dds`
|
||||
- Add new upstream MIME types
|
||||
- Fix extension of `application/vnd.apple.keynote` to be `.key`
|
||||
- Remove ambigious extensions from IANA for `application/*+xml` types
|
||||
- Update primary extension to `.es` for `application/ecmascript`
|
||||
|
||||
1.6.18 / 2019-04-26
|
||||
===================
|
||||
|
||||
* Fix regression passing request object to `typeis.is`
|
||||
|
||||
1.6.17 / 2019-04-25
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.24
|
||||
- Add Apple file extensions from IANA
|
||||
- Add extension `.csl` to `application/vnd.citationstyles.style+xml`
|
||||
- Add extension `.es` to `application/ecmascript`
|
||||
- Add extension `.nq` to `application/n-quads`
|
||||
- Add extension `.nt` to `application/n-triples`
|
||||
- Add extension `.owl` to `application/rdf+xml`
|
||||
- Add extensions `.siv` and `.sieve` to `application/sieve`
|
||||
- Add extensions from IANA for `image/*` types
|
||||
- Add extensions from IANA for `model/*` types
|
||||
- Add extensions to HEIC image types
|
||||
- Add new mime types
|
||||
- Add `text/mdx` with extension `.mdx`
|
||||
* perf: prevent internal `throw` on invalid type
|
||||
|
||||
1.6.16 / 2018-02-16
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.18
|
||||
- Add `application/raml+yaml` with extension `.raml`
|
||||
- Add `application/wasm` with extension `.wasm`
|
||||
- Add `text/shex` with extension `.shex`
|
||||
- Add extensions for JPEG-2000 images
|
||||
- Add extensions from IANA for `message/*` types
|
||||
- Add extension `.mjs` to `application/javascript`
|
||||
- Add extension `.wadl` to `application/vnd.sun.wadl+xml`
|
||||
- Add extension `.gz` to `application/gzip`
|
||||
- Add glTF types and extensions
|
||||
- Add new mime types
|
||||
- Update extensions `.md` and `.markdown` to be `text/markdown`
|
||||
- Update font MIME types
|
||||
- Update `text/hjson` to registered `application/hjson`
|
||||
|
||||
1.6.15 / 2017-03-31
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.15
|
||||
- Add new mime types
|
||||
|
||||
1.6.14 / 2016-11-18
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.13
|
||||
- Add new mime types
|
||||
|
||||
1.6.13 / 2016-05-18
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.11
|
||||
- Add new mime types
|
||||
|
||||
1.6.12 / 2016-02-28
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.10
|
||||
- Add new mime types
|
||||
- Fix extension of `application/dash+xml`
|
||||
- Update primary extension for `audio/mp4`
|
||||
|
||||
1.6.11 / 2016-01-29
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.9
|
||||
- Add new mime types
|
||||
|
||||
1.6.10 / 2015-12-01
|
||||
===================
|
||||
|
||||
* deps: mime-types@~2.1.8
|
||||
- Add new mime types
|
||||
|
||||
1.6.9 / 2015-09-27
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.1.7
|
||||
- Add new mime types
|
||||
|
||||
1.6.8 / 2015-09-04
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.1.6
|
||||
- Add new mime types
|
||||
|
||||
1.6.7 / 2015-08-20
|
||||
==================
|
||||
|
||||
* Fix type error when given invalid type to match against
|
||||
* deps: mime-types@~2.1.5
|
||||
- Add new mime types
|
||||
|
||||
1.6.6 / 2015-07-31
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.1.4
|
||||
- Add new mime types
|
||||
|
||||
1.6.5 / 2015-07-16
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.1.3
|
||||
- Add new mime types
|
||||
|
||||
1.6.4 / 2015-07-01
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.1.2
|
||||
- Add new mime types
|
||||
* perf: enable strict mode
|
||||
* perf: remove argument reassignment
|
||||
|
||||
1.6.3 / 2015-06-08
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.1.1
|
||||
- Add new mime types
|
||||
* perf: reduce try block size
|
||||
* perf: remove bitwise operations
|
||||
|
||||
1.6.2 / 2015-05-10
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.11
|
||||
- Add new mime types
|
||||
|
||||
1.6.1 / 2015-03-13
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.10
|
||||
- Add new mime types
|
||||
|
||||
1.6.0 / 2015-02-12
|
||||
==================
|
||||
|
||||
* fix false-positives in `hasBody` `Transfer-Encoding` check
|
||||
* support wildcard for both type and subtype (`*/*`)
|
||||
|
||||
1.5.7 / 2015-02-09
|
||||
==================
|
||||
|
||||
* fix argument reassignment
|
||||
* deps: mime-types@~2.0.9
|
||||
- Add new mime types
|
||||
|
||||
1.5.6 / 2015-01-29
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.8
|
||||
- Add new mime types
|
||||
|
||||
1.5.5 / 2014-12-30
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.7
|
||||
- Add new mime types
|
||||
- Fix missing extensions
|
||||
- Fix various invalid MIME type entries
|
||||
- Remove example template MIME types
|
||||
- deps: mime-db@~1.5.0
|
||||
|
||||
1.5.4 / 2014-12-10
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.4
|
||||
- Add new mime types
|
||||
- deps: mime-db@~1.3.0
|
||||
|
||||
1.5.3 / 2014-11-09
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.3
|
||||
- Add new mime types
|
||||
- deps: mime-db@~1.2.0
|
||||
|
||||
1.5.2 / 2014-09-28
|
||||
==================
|
||||
|
||||
* deps: mime-types@~2.0.2
|
||||
- Add new mime types
|
||||
- deps: mime-db@~1.1.0
|
||||
|
||||
1.5.1 / 2014-09-07
|
||||
==================
|
||||
|
||||
* Support Node.js 0.6
|
||||
* deps: media-typer@0.3.0
|
||||
* deps: mime-types@~2.0.1
|
||||
- Support Node.js 0.6
|
||||
|
||||
1.5.0 / 2014-09-05
|
||||
==================
|
||||
|
||||
* fix `hasbody` to be true for `content-length: 0`
|
||||
|
||||
1.4.0 / 2014-09-02
|
||||
==================
|
||||
|
||||
* update mime-types
|
||||
|
||||
1.3.2 / 2014-06-24
|
||||
==================
|
||||
|
||||
* use `~` range on mime-types
|
||||
|
||||
1.3.1 / 2014-06-19
|
||||
==================
|
||||
|
||||
* fix global variable leak
|
||||
|
||||
1.3.0 / 2014-06-19
|
||||
==================
|
||||
|
||||
* improve type parsing
|
||||
|
||||
- invalid media type never matches
|
||||
- media type not case-sensitive
|
||||
- extra LWS does not affect results
|
||||
|
||||
1.2.2 / 2014-06-19
|
||||
==================
|
||||
|
||||
* fix behavior on unknown type argument
|
||||
|
||||
1.2.1 / 2014-06-03
|
||||
==================
|
||||
|
||||
* switch dependency from `mime` to `mime-types@1.0.0`
|
||||
|
||||
1.2.0 / 2014-05-11
|
||||
==================
|
||||
|
||||
* support suffix matching:
|
||||
|
||||
- `+json` matches `application/vnd+json`
|
||||
- `*/vnd+json` matches `application/vnd+json`
|
||||
- `application/*+json` matches `application/vnd+json`
|
||||
|
||||
1.1.0 / 2014-04-12
|
||||
==================
|
||||
|
||||
* add non-array values support
|
||||
* expose internal utilities:
|
||||
|
||||
- `.is()`
|
||||
- `.hasBody()`
|
||||
- `.normalize()`
|
||||
- `.match()`
|
||||
|
||||
1.0.1 / 2014-03-30
|
||||
==================
|
||||
|
||||
* add `multipart` as a shorthand
|
||||
Reference in New Issue
Block a user