Started adding slash commands, doesn't work though

2026-06-06 07:52:57 +00:00 · 2022-09-26 15:41:20 +00:00
parent b6495eb886
commit ec4c1200d5
2214 changed files with 159174 additions and 42761 deletions
@@ -1,3 +1,57 @@
+4.18.1 / 2022-04-29
+===================
+
+  * Fix hanging on large stack of sync routes
+
+4.18.0 / 2022-04-25
+===================
+
+  * Add "root" option to `res.download`
+  * Allow `options` without `filename` in `res.download`
+  * Deprecate string and non-integer arguments to `res.status`
+  * Fix behavior of `null`/`undefined` as `maxAge` in `res.cookie`
+  * Fix handling very large stacks of sync middleware
+  * Ignore `Object.prototype` values in settings through `app.set`/`app.get`
+  * Invoke `default` with same arguments as types in `res.format`
+  * Support proper 205 responses using `res.send`
+  * Use `http-errors` for `res.format` error
+  * deps: body-parser@1.20.0
+    - Fix error message for json parse whitespace in `strict`
+    - Fix internal error when inflated body exceeds limit
+    - Prevent loss of async hooks context
+    - Prevent hanging when request already read
+    - deps: depd@2.0.0
+    - deps: http-errors@2.0.0
+    - deps: on-finished@2.4.1
+    - deps: qs@6.10.3
+    - deps: raw-body@2.5.1
+  * deps: cookie@0.5.0
+    - Add `priority` option
+    - Fix `expires` option to reject invalid dates
+  * deps: depd@2.0.0
+    - Replace internal `eval` usage with `Function` constructor
+    - Use instance methods on `process` to check for listeners
+  * deps: finalhandler@1.2.0
+    - Remove set content headers that break response
+    - deps: on-finished@2.4.1
+    - deps: statuses@2.0.1
+  * deps: on-finished@2.4.1
+    - Prevent loss of async hooks context
+  * deps: qs@6.10.3
+  * deps: send@0.18.0
+    - Fix emitted 416 error missing headers property
+    - Limit the headers removed for 304 response
+    - deps: depd@2.0.0
+    - deps: destroy@1.2.0
+    - deps: http-errors@2.0.0
+    - deps: on-finished@2.4.1
+    - deps: statuses@2.0.1
+  * deps: serve-static@1.15.0
+    - deps: send@0.18.0
+  * deps: statuses@2.0.1
+    - Remove code 306
+    - Rename `425 Unordered Collection` to standard `425 Too Early`
+
 4.17.3 / 2022-02-16
 ===================

@@ -2,11 +2,9 @@

  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).

-  [![NPM Version][npm-image]][npm-url]
-  [![NPM Downloads][downloads-image]][downloads-url]
-  [![Linux Build][ci-image]][ci-url]
-  [![Windows Build][appveyor-image]][appveyor-url]
-  [![Test Coverage][coveralls-image]][coveralls-url]
+  [![NPM Version][npm-version-image]][npm-url]
+  [![NPM Install Size][npm-install-size-image]][npm-install-size-url]
+  [![NPM Downloads][npm-downloads-image]][npm-downloads-url]

 ```js
 const express = require('express')
@@ -33,7 +31,7 @@ the [`npm init` command](https://docs.npmjs.com/creating-a-package-json-file).
 Installation is done using the
 [`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):

-```bash
+```console
 $ npm install express
 ```

@@ -61,35 +59,31 @@ for more information.

 **PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/expressjs/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/expressjs/express/wiki/New-features-in-4.x).

-### Security Issues
-
-If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
-
 ## Quick Start

  The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:

  Install the executable. The executable's major version will match Express's:

-```bash
+```console
 $ npm install -g express-generator@4
 ```

  Create the app:

-```bash
+```console
 $ express /tmp/foo && cd /tmp/foo
 ```

  Install dependencies:

-```bash
+```console
 $ npm install
 ```

  Start the server:

-```bash
+```console
 $ npm start
 ```

@@ -109,7 +103,7 @@ $ npm start

  To view the examples, clone the Express repo and install the dependencies:

-```bash
+```console
 $ git clone git://github.com/expressjs/express.git --depth 1
 $ cd express
 $ npm install
@@ -117,22 +111,34 @@ $ npm install

  Then run whichever example you want:

-```bash
+```console
 $ node examples/content-negotiation
 ```

-## Tests
-
-  To run the test suite, first install the dependencies, then run `npm test`:
-
-```bash
-$ npm install
-$ npm test
-```
-
 ## Contributing

-[Contributing Guide](Contributing.md)
+  [![Linux Build][github-actions-ci-image]][github-actions-ci-url]
+  [![Windows Build][appveyor-image]][appveyor-url]
+  [![Test Coverage][coveralls-image]][coveralls-url]
+
+The Express.js project welcomes all constructive contributions. Contributions take many forms,
+from code for bug fixes and enhancements, to additions and fixes to documentation, additional
+tests, triaging incoming pull requests and issues, and more!
+
+See the [Contributing Guide](Contributing.md) for more technical details on contributing.
+
+### Security Issues
+
+If you discover a security vulnerability in Express, please see [Security Policies and Procedures](Security.md).
+
+### Running Tests
+
+To run the test suite, first install the dependencies, then run `npm test`:
+
+```console
+$ npm install
+$ npm test
+```

 ## People

@@ -146,13 +152,15 @@ The current lead maintainer is [Douglas Christopher Wilson](https://github.com/d

  [MIT](LICENSE)

-[ci-image]: https://img.shields.io/github/workflow/status/expressjs/express/ci/master.svg?label=linux
-[ci-url]: https://github.com/expressjs/express/actions?query=workflow%3Aci
-[npm-image]: https://img.shields.io/npm/v/express.svg
-[npm-url]: https://npmjs.org/package/express
-[downloads-image]: https://img.shields.io/npm/dm/express.svg
-[downloads-url]: https://npmcharts.com/compare/express?minimal=true
-[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
+[appveyor-image]: https://badgen.net/appveyor/ci/dougwilson/express/master?label=windows
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
-[coveralls-image]: https://img.shields.io/coveralls/expressjs/express/master.svg
+[coveralls-image]: https://badgen.net/coveralls/c/github/expressjs/express/master
 [coveralls-url]: https://coveralls.io/r/expressjs/express?branch=master
+[github-actions-ci-image]: https://badgen.net/github/checks/expressjs/express/master?label=linux
+[github-actions-ci-url]: https://github.com/expressjs/express/actions/workflows/ci.yml
+[npm-downloads-image]: https://badgen.net/npm/dm/express
+[npm-downloads-url]: https://npmcharts.com/compare/express?minimal=true
+[npm-install-size-image]: https://badgen.net/packagephobia/install/express
+[npm-install-size-url]: https://packagephobia.com/result?p=express
+[npm-url]: https://npmjs.org/package/express
+[npm-version-image]: https://badgen.net/npm/v/express
@@ -29,6 +29,13 @@ var flatten = require('array-flatten');
 var merge = require('utils-merge');
 var resolve = require('path').resolve;
 var setPrototypeOf = require('setprototypeof')
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var hasOwnProperty = Object.prototype.hasOwnProperty
 var slice = Array.prototype.slice;

 /**
@@ -352,7 +359,17 @@ app.param = function param(name, fn) {
 app.set = function set(setting, val) {
  if (arguments.length === 1) {
    // app.get(setting)
-    return this.settings[setting];
+    var settings = this.settings
+
+    while (settings && settings !== Object.prototype) {
+      if (hasOwnProperty.call(settings, setting)) {
+        return settings[setting]
+      }
+
+      settings = Object.getPrototypeOf(settings)
+    }
+
+    return undefined
  }

  debug('set "%s" to %o', setting, val);
@@ -14,6 +14,7 @@

 var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
+var createError = require('http-errors')
 var deprecate = require('depd')('express');
 var encodeUrl = require('encodeurl');
 var escapeHtml = require('escape-html');
@@ -64,6 +65,9 @@ var charsetRegExp = /;\s*charset\s*=/;
 */

 res.status = function status(code) {
+  if ((typeof code === 'string' || Math.floor(code) !== code) && code > 99 && code < 1000) {
+    deprecate('res.status(' + JSON.stringify(code) + '): use res.status(' + Math.floor(code) + ') instead')
+  }
  this.statusCode = code;
  return this;
 };
@@ -135,7 +139,7 @@ res.send = function send(body) {

    deprecate('res.send(status): Use res.sendStatus(status) instead');
    this.statusCode = chunk;
-    chunk = statuses[chunk]
+    chunk = statuses.message[chunk]
  }

  switch (typeof chunk) {
@@ -213,6 +217,13 @@ res.send = function send(body) {
    chunk = '';
  }

+  // alter headers for 205
+  if (this.statusCode === 205) {
+    this.set('Content-Length', '0')
+    this.removeHeader('Transfer-Encoding')
+    chunk = ''
+  }
+
  if (req.method === 'HEAD') {
    // skip body for HEAD
    this.end();
@@ -356,7 +367,7 @@ res.jsonp = function jsonp(obj) {
 */

 res.sendStatus = function sendStatus(statusCode) {
-  var body = statuses[statusCode] || String(statusCode)
+  var body = statuses.message[statusCode] || String(statusCode)

  this.statusCode = statusCode;
  this.type('txt');
@@ -551,6 +562,13 @@ res.download = function download (path, filename, options, callback) {
    opts = null
  }

+  // support optional filename, where options may be in it's place
+  if (typeof filename === 'object' &&
+    (typeof options === 'function' || options === undefined)) {
+    name = null
+    opts = filename
+  }
+
  // set Content-Disposition when file is sent
  var headers = {
    'Content-Disposition': contentDisposition(name || path)
@@ -572,7 +590,9 @@ res.download = function download (path, filename, options, callback) {
  opts.headers = headers

  // Resolve the full path for sendFile
-  var fullPath = resolve(path);
+  var fullPath = !opts.root
+    ? resolve(path)
+    : path

  // send file
  return this.sendFile(fullPath, opts, done)
@@ -665,9 +685,8 @@ res.format = function(obj){
  var req = this.req;
  var next = req.next;

-  var fn = obj.default;
-  if (fn) delete obj.default;
-  var keys = Object.keys(obj);
+  var keys = Object.keys(obj)
+    .filter(function (v) { return v !== 'default' })

  var key = keys.length > 0
    ? req.accepts(keys)
@@ -678,13 +697,12 @@ res.format = function(obj){
  if (key) {
    this.set('Content-Type', normalizeType(key).value);
    obj[key](req, this, next);
-  } else if (fn) {
-    fn();
+  } else if (obj.default) {
+    obj.default(req, this, next)
  } else {
-    var err = new Error('Not Acceptable');
-    err.status = err.statusCode = 406;
-    err.types = normalizeTypes(keys).map(function(o){ return o.value });
-    next(err);
+    next(createError(406, {
+      types: normalizeTypes(keys).map(function (o) { return o.value })
+    }))
  }

  return this;
@@ -850,9 +868,13 @@ res.cookie = function (name, value, options) {
    val = 's:' + sign(val, secret);
  }

-  if ('maxAge' in opts) {
-    opts.expires = new Date(Date.now() + opts.maxAge);
-    opts.maxAge /= 1000;
+  if (opts.maxAge != null) {
+    var maxAge = opts.maxAge - 0
+
+    if (!isNaN(maxAge)) {
+      opts.expires = new Date(Date.now() + maxAge)
+      opts.maxAge = Math.floor(maxAge / 1000)
+    }
  }

  if (opts.path == null) {
@@ -933,12 +955,12 @@ res.redirect = function redirect(url) {
  // Support text/{plain,html} by default
  this.format({
    text: function(){
-      body = statuses[status] + '. Redirecting to ' + address
+      body = statuses.message[status] + '. Redirecting to ' + address
    },

    html: function(){
      var u = escapeHtml(address);
-      body = '<p>' + statuses[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
+      body = '<p>' + statuses.message[status] + '. Redirecting to <a href="' + u + '">' + u + '</a></p>'
    },

    default: function(){
@@ -1113,7 +1135,7 @@ function sendfile(res, file, options, callback) {
 * ability to escape characters that can trigger HTML sniffing.
 *
 * @param {*} value
- * @param {function} replaces
+ * @param {function} replacer
 * @param {number} spaces
 * @param {boolean} escape
 * @returns {string}
@@ -108,8 +108,8 @@ proto.param = function param(name, fn) {
  var ret;

  if (name[0] === ':') {
-    deprecate('router.param(' + JSON.stringify(name) + ', fn): Use router.param(' + JSON.stringify(name.substr(1)) + ', fn) instead');
-    name = name.substr(1);
+    deprecate('router.param(' + JSON.stringify(name) + ', fn): Use router.param(' + JSON.stringify(name.slice(1)) + ', fn) instead')
+    name = name.slice(1)
  }

  for (var i = 0; i < len; ++i) {
@@ -142,6 +142,7 @@ proto.handle = function handle(req, res, out) {
  var protohost = getProtohost(req.url) || ''
  var removed = '';
  var slashAdded = false;
+  var sync = 0
  var paramcalled = {};

  // store options for OPTIONS request
@@ -180,14 +181,14 @@ proto.handle = function handle(req, res, out) {

    // remove added slash
    if (slashAdded) {
-      req.url = req.url.substr(1);
+      req.url = req.url.slice(1)
      slashAdded = false;
    }

    // restore altered req.url
    if (removed.length !== 0) {
      req.baseUrl = parentUrl;
-      req.url = protohost + removed + req.url.substr(protohost.length);
+      req.url = protohost + removed + req.url.slice(protohost.length)
      removed = '';
    }

@@ -203,6 +204,11 @@ proto.handle = function handle(req, res, out) {
      return;
    }

+    // max sync stack
+    if (++sync > 100) {
+      return setImmediate(next, err)
+    }
+
    // get pathname of request
    var path = getPathname(req);

@@ -251,7 +257,6 @@ proto.handle = function handle(req, res, out) {
      // don't even bother matching route
      if (!has_method && method !== 'HEAD') {
        match = false;
-        continue;
      }
    }

@@ -274,21 +279,21 @@ proto.handle = function handle(req, res, out) {
    // this should be done for the layer
    self.process_params(layer, paramcalled, req, res, function (err) {
      if (err) {
-        return next(layerError || err);
+        next(layerError || err)
+      } else if (route) {
+        layer.handle_request(req, res, next)
+      } else {
+        trim_prefix(layer, layerError, layerPath, path)
      }

-      if (route) {
-        return layer.handle_request(req, res, next);
-      }
-
-      trim_prefix(layer, layerError, layerPath, path);
+      sync = 0
    });
  }

  function trim_prefix(layer, layerError, layerPath, path) {
    if (layerPath.length !== 0) {
      // Validate path is a prefix match
-      if (layerPath !== path.substr(0, layerPath.length)) {
+      if (layerPath !== path.slice(0, layerPath.length)) {
        next(layerError)
        return
      }
@@ -301,7 +306,7 @@ proto.handle = function handle(req, res, out) {
      // middleware (.use stuff) needs to have the path stripped
      debug('trim prefix (%s) from url %s', layerPath, req.url);
      removed = layerPath;
-      req.url = protohost + req.url.substr(protohost.length + removed.length);
+      req.url = protohost + req.url.slice(protohost.length + removed.length)

      // Ensure leading slash
      if (!protohost && req.url[0] !== '/') {
@@ -547,10 +552,10 @@ function getProtohost(url) {
  var pathLength = searchIndex !== -1
    ? searchIndex
    : url.length
-  var fqdnIndex = url.substr(0, pathLength).indexOf('://')
+  var fqdnIndex = url.slice(0, pathLength).indexOf('://')

  return fqdnIndex !== -1
-    ? url.substr(0, url.indexOf('/', 3 + fqdnIndex))
+    ? url.substring(0, url.indexOf('/', 3 + fqdnIndex))
    : undefined
 }

@@ -98,6 +98,8 @@ Route.prototype._options = function _options() {
 Route.prototype.dispatch = function dispatch(req, res, done) {
  var idx = 0;
  var stack = this.stack;
+  var sync = 0
+
  if (stack.length === 0) {
    return done();
  }
@@ -127,6 +129,11 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
      return done(err);
    }

+    // max sync stack
+    if (++sync > 100) {
+      return setImmediate(next, err)
+    }
+
    if (layer.method && layer.method !== method) {
      return next(err);
    }
@@ -136,6 +143,8 @@ Route.prototype.dispatch = function dispatch(req, res, done) {
    } else {
      layer.handle_request(req, res, next);
    }
+
+    sync = 0
  }
 };

@@ -120,6 +120,7 @@ exports.contentDisposition = deprecate.function(contentDisposition,
 * also includes `.originalIndex` for stable sorting
 *
 * @param {String} str
+ * @param {Number} index
 * @return {Object}
 * @api private
 */
@@ -74,7 +74,7 @@ function View(name, options) {

  if (!opts.engines[this.ext]) {
    // load engine
-    var mod = this.ext.substr(1)
+    var mod = this.ext.slice(1)
    debug('require "%s"', mod)

    // default engine export
@@ -1,7 +1,7 @@
 {
  "name": "express",
  "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.17.3",
+  "version": "4.18.1",
  "author": "TJ Holowaychuk <tj@vision-media.ca>",
  "contributors": [
    "Aaron Heckmann <aaron.heckmann+github@gmail.com>",
@@ -30,31 +30,32 @@
  "dependencies": {
    "accepts": "~1.3.8",
    "array-flatten": "1.1.1",
-    "body-parser": "1.19.2",
+    "body-parser": "1.20.0",
    "content-disposition": "0.5.4",
    "content-type": "~1.0.4",
-    "cookie": "0.4.2",
+    "cookie": "0.5.0",
    "cookie-signature": "1.0.6",
    "debug": "2.6.9",
-    "depd": "~1.1.2",
+    "depd": "2.0.0",
    "encodeurl": "~1.0.2",
    "escape-html": "~1.0.3",
    "etag": "~1.8.1",
-    "finalhandler": "~1.1.2",
+    "finalhandler": "1.2.0",
    "fresh": "0.5.2",
+    "http-errors": "2.0.0",
    "merge-descriptors": "1.0.1",
    "methods": "~1.1.2",
-    "on-finished": "~2.3.0",
+    "on-finished": "2.4.1",
    "parseurl": "~1.3.3",
    "path-to-regexp": "0.1.7",
    "proxy-addr": "~2.0.7",
-    "qs": "6.9.7",
+    "qs": "6.10.3",
    "range-parser": "~1.2.1",
    "safe-buffer": "5.2.1",
-    "send": "0.17.2",
-    "serve-static": "1.14.2",
+    "send": "0.18.0",
+    "serve-static": "1.15.0",
    "setprototypeof": "1.2.0",
-    "statuses": "~1.5.0",
+    "statuses": "2.0.1",
    "type-is": "~1.6.18",
    "utils-merge": "1.0.1",
    "vary": "~1.1.2"
@@ -64,20 +65,18 @@
    "connect-redis": "3.4.2",
    "cookie-parser": "1.4.6",
    "cookie-session": "2.0.0",
-    "ejs": "3.1.6",
+    "ejs": "3.1.7",
    "eslint": "7.32.0",
    "express-session": "1.17.2",
    "hbs": "4.2.0",
    "marked": "0.7.0",
    "method-override": "3.0.0",
-    "mocha": "9.2.0",
+    "mocha": "9.2.2",
    "morgan": "1.10.0",
    "multiparty": "4.2.3",
    "nyc": "15.1.0",
    "pbkdf2-password": "1.2.1",
-    "resolve-path": "1.4.0",
-    "should": "13.2.3",
-    "supertest": "6.2.2",
+    "supertest": "6.2.3",
    "vhost": "~3.0.2"
  },
  "engines": {