@hono/node-server - npm Package Compare versions

Comparing version 1.16.0 to 1.17.0

dist/globals.d.mts

 
-export { }
+export {  }

dist/globals.d.ts

 
-export { }
+export {  }

dist/request.d.mts

@@ -25,2 +25,2 @@ import { IncomingMessage } from 'node:http';
 
-export { GlobalRequest, IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };
+export { GlobalRequest, type IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };

dist/request.d.ts

@@ -25,2 +25,2 @@ import { IncomingMessage } from 'node:http';
 
-export { GlobalRequest, IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };
+export { GlobalRequest, type IncomingMessageWithWrapBodyStream, Request, RequestError, abortControllerKey, getAbortController, newRequest, toRequestError, wrapBodyStream };

dist/response.d.mts

@@ -26,2 +26,2 @@ import { OutgoingHttpHeaders } from 'node:http';
 
-export { GlobalResponse, InternalCache, Response, cacheKey };
+export { GlobalResponse, type InternalCache, Response, cacheKey };

dist/response.d.ts

@@ -26,2 +26,2 @@ import { OutgoingHttpHeaders } from 'node:http';
 
-export { GlobalResponse, InternalCache, Response, cacheKey };
+export { GlobalResponse, type InternalCache, Response, cacheKey };

dist/serve-static.d.mts

@@ -17,2 +17,2 @@ import { Env, Context, MiddlewareHandler } from 'hono';
 
-export { ServeStaticOptions, serveStatic };
+export { type ServeStaticOptions, serveStatic };

dist/serve-static.d.ts

@@ -17,2 +17,2 @@ import { Env, Context, MiddlewareHandler } from 'hono';
 
-export { ServeStaticOptions, serveStatic };
+export { type ServeStaticOptions, serveStatic };

dist/serve-static.js

@@ -26,5 +26,5 @@ "use strict";
 module.exports = __toCommonJS(serve_static_exports);
-var import_filepath = require("hono/utils/filepath");
 var import_mime = require("hono/utils/mime");
 var import_node_fs = require("fs");
+var import_node_path = require("path");
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
@@ -53,5 +53,2 @@ var ENCODINGS = {
 };
-var addCurrentDirPrefix = (path) => {
-  return `./${path}`;
-};
 var getStats = (path) => {
@@ -66,2 +63,4 @@ let stats;
 var serveStatic = (options = { root: "" }) => {
+  const root = (0, import_node_path.resolve)(options.root || ".");
+  const optionPath = options.path;
   return async (c, next) => {
@@ -73,3 +72,11 @@ if (c.finalized) {
     try {
-      filename = options.path ?? decodeURIComponent(c.req.path);
+      const rawPath = optionPath ?? c.req.path;
+      if (!optionPath) {
+        const decodedPath = decodeURIComponent(rawPath);
+        if (decodedPath.includes("..")) {
+          await options.onNotFound?.(rawPath, c);
+          return next();
+        }
+      }
+      filename = optionPath ?? decodeURIComponent(c.req.path);
     } catch {
@@ -79,21 +86,10 @@ await options.onNotFound?.(c.req.path, c);
     }
-    let path = (0, import_filepath.getFilePathWithoutDefaultDocument)({
-      filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-      root: options.root
-    });
-    if (path) {
-      path = addCurrentDirPrefix(path);
-    } else {
-      return next();
-    }
+    const requestPath = options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename;
+    let path = optionPath ? options.root ? (0, import_node_path.resolve)((0, import_node_path.join)(root, optionPath)) : optionPath : (0, import_node_path.resolve)((0, import_node_path.join)(root, requestPath));
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
-      path = (0, import_filepath.getFilePath)({
-        filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-        root: options.root,
-        defaultDocument: options.index ?? "index.html"
-      });
-      if (path) {
-        path = addCurrentDirPrefix(path);
-      } else {
+      const indexFile = options.index ?? "index.html";
+      path = (0, import_node_path.resolve)((0, import_node_path.join)(path, indexFile));
+      if (!optionPath && !path.startsWith(root)) {
+        await options.onNotFound?.(path, c);
         return next();
@@ -100,0 +96,0 @@ }

dist/serve-static.mjs

 // src/serve-static.ts
-import { getFilePath, getFilePathWithoutDefaultDocument } from "hono/utils/filepath";
 import { getMimeType } from "hono/utils/mime";
 import { createReadStream, lstatSync } from "fs";
+import { join, resolve } from "path";
 var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
@@ -28,5 +28,2 @@ var ENCODINGS = {
 };
-var addCurrentDirPrefix = (path) => {
-  return `./${path}`;
-};
 var getStats = (path) => {
@@ -41,2 +38,4 @@ let stats;
 var serveStatic = (options = { root: "" }) => {
+  const root = resolve(options.root || ".");
+  const optionPath = options.path;
   return async (c, next) => {
@@ -48,3 +47,11 @@ if (c.finalized) {
     try {
-      filename = options.path ?? decodeURIComponent(c.req.path);
+      const rawPath = optionPath ?? c.req.path;
+      if (!optionPath) {
+        const decodedPath = decodeURIComponent(rawPath);
+        if (decodedPath.includes("..")) {
+          await options.onNotFound?.(rawPath, c);
+          return next();
+        }
+      }
+      filename = optionPath ?? decodeURIComponent(c.req.path);
     } catch {
@@ -54,21 +61,10 @@ await options.onNotFound?.(c.req.path, c);
     }
-    let path = getFilePathWithoutDefaultDocument({
-      filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-      root: options.root
-    });
-    if (path) {
-      path = addCurrentDirPrefix(path);
-    } else {
-      return next();
-    }
+    const requestPath = options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename;
+    let path = optionPath ? options.root ? resolve(join(root, optionPath)) : optionPath : resolve(join(root, requestPath));
     let stats = getStats(path);
     if (stats && stats.isDirectory()) {
-      path = getFilePath({
-        filename: options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename,
-        root: options.root,
-        defaultDocument: options.index ?? "index.html"
-      });
-      if (path) {
-        path = addCurrentDirPrefix(path);
-      } else {
+      const indexFile = options.index ?? "index.html";
+      path = resolve(join(path, indexFile));
+      if (!optionPath && !path.startsWith(root)) {
+        await options.onNotFound?.(path, c);
         return next();
@@ -75,0 +71,0 @@ }

dist/types.d.mts

@@ -1,3 +0,3 @@
-import { IncomingMessage, ServerResponse, Server, ServerOptions as ServerOptions$1, createServer } from 'node:http';
-import { Http2ServerRequest, Http2ServerResponse, Http2Server, Http2SecureServer, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer } from 'node:http2';
+import { IncomingMessage, ServerResponse, ServerOptions as ServerOptions$1, createServer, Server } from 'node:http';
+import { Http2ServerRequest, Http2ServerResponse, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer, Http2Server, Http2SecureServer } from 'node:http2';
 import { ServerOptions as ServerOptions$2, createServer as createServer$1 } from 'node:https';
@@ -44,2 +44,2 @@
 
-export { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };
+export type { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };

dist/types.d.ts

@@ -1,3 +0,3 @@
-import { IncomingMessage, ServerResponse, Server, ServerOptions as ServerOptions$1, createServer } from 'node:http';
-import { Http2ServerRequest, Http2ServerResponse, Http2Server, Http2SecureServer, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer } from 'node:http2';
+import { IncomingMessage, ServerResponse, ServerOptions as ServerOptions$1, createServer, Server } from 'node:http';
+import { Http2ServerRequest, Http2ServerResponse, ServerOptions as ServerOptions$3, createServer as createServer$2, SecureServerOptions, createSecureServer, Http2Server, Http2SecureServer } from 'node:http2';
 import { ServerOptions as ServerOptions$2, createServer as createServer$1 } from 'node:https';
@@ -44,2 +44,2 @@
 
-export { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };
+export type { CustomErrorHandler, FetchCallback, Http2Bindings, HttpBindings, NextHandlerOption, Options, ServerOptions, ServerType };

dist/utils.d.mts

 import { OutgoingHttpHeaders } from 'node:http';
 import { Writable } from 'node:stream';
 
-declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<void> | undefined;
+declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<undefined> | undefined;
 declare const buildOutgoingHttpHeaders: (headers: Headers | HeadersInit | null | undefined) => OutgoingHttpHeaders;
 
 export { buildOutgoingHttpHeaders, writeFromReadableStream };

dist/utils.d.ts

 import { OutgoingHttpHeaders } from 'node:http';
 import { Writable } from 'node:stream';
 
-declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<void> | undefined;
+declare function writeFromReadableStream(stream: ReadableStream<Uint8Array>, writable: Writable): Promise<undefined> | undefined;
 declare const buildOutgoingHttpHeaders: (headers: Headers | HeadersInit | null | undefined) => OutgoingHttpHeaders;
 
 export { buildOutgoingHttpHeaders, writeFromReadableStream };

package.json

 {
   "name": "@hono/node-server",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Node.js Adapter for Hono",
@@ -57,3 +57,3 @@ "main": "dist/index.js",
   "scripts": {
-    "test": "node --expose-gc ./node_modules/.bin/jest",
+    "test": "node --expose-gc node_modules/jest/bin/jest.js",
     "build": "tsup --external hono",
@@ -60,0 +60,0 @@ "watch": "tsup --watch",

README.md

@@ -131,2 +131,3 @@ # Node.js Adapter for Hono
 The default value is `true`. The Node.js Adapter automatically cleans up (explicitly call `destroy()` method) if application is not finished to consume the incoming request. If you don't want to do that, set `false`.
+
 If the application accepts connections from arbitrary clients, this cleanup must be done otherwise incomplete requests from clients may cause the application to stop responding. If your application only accepts connections from trusted clients, such as in a reverse proxy environment and there is no process that returns a response without reading the body of the POST request all the way through, you can improve performance by setting it to `false`.
@@ -171,3 +172,3 @@
 
-Note that `root` must be _relative_ to the current working directory from which the app was started. Absolute paths are not supported.
+If using a relative path, `root` will be relative to the current working directory from which the app was started.
 
@@ -174,0 +175,0 @@ This can cause confusion when running your application locally.

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 3 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 3 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

194157

0.18%

Number of lines in readme file

341

0.29%

Worsened metrics

Lines of code

5687

-0.14%

No dependency changes