connect-gzip - npm Package Compare versions

Comparing version 0.0.1 to 0.1.0

lib/staticGzip.js

@@ -58,2 +58,7 @@ /*!
     
+    // Potentially malicious path
+    if (~filename.indexOf('..')) {
+      return passToStatic(filename);
+    }
+    
     // Check for requested file
@@ -66,5 +71,5 @@ fs.stat(filename, function(err, stat) {
       // Check for compressed file
-      var gzipname = path.join(path.dirname(filename),
-            Number(stat.mtime) + '.gz.' + path.basename(filename)
-          );
+      var base = path.basename(filename),
+          dir = path.dirname(filename),
+          gzipname = path.join(dir, base + '.' + Number(stat.mtime) + '.gz');
       fs.stat(gzipname, function(err) {
@@ -84,2 +89,5 @@ if (err && err.code === 'ENOENT') {
       function sendGzip() {
+        var charset = mime.charsets.lookup(type),
+            contentType = type + (charset ? '; charset=' + charset : '');
+        res.setHeader('Content-Type', contentType);
         res.setHeader('Content-Encoding', 'gzip');
@@ -86,0 +94,0 @@ res.setHeader('Vary', 'Accept-Encoding');

package.json

 {
   "name": "connect-gzip",
   "description": "Gzip middleware for Connect. Based on implementation in Connect 0.5.9. Original source: https://github.com/senchalabs/connect/tree/c9a0c1e0e98451bb5fffb70c622b827a11bf4fc7",
-  "version": "0.0.1",
+  "version": "0.1.0",
   "author": "Nate Smith",
   "main": "./index.js",
   "dependencies": {
-    "connect": ">= 1.0.0",
+    "connect": ">= 1.4.0",
     "mime": ">= 0.0.1"
-  }
+  },
+  "engines": {
+    "node": "*"
+  },
+  "directories": {
+    "lib": "./lib"
+  },
+  "files": [
+    ""
+  ]
 }

New alerts

Native code

Supply chain risk

Contains native code (e.g., compiled binaries or shared libraries). Including native code can obscure malicious behavior.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

19866

increased by2.18%

Lines of code

441

increased by1.38%

Worsened metrics

Number of medium supply chain risk alerts

5

increased by25%

Dependency changes

• Updatedconnect@>= 1.4.0