express-static-gzip - npm Package Compare versions

Comparing version 2.0.6 to 2.0.7

.github/workflows/nodejs.yml

@@ -7,2 +7,5 @@ name: Node CI
     - master
+  pull_request:
+    branches:
+      - master
 
@@ -9,0 +12,0 @@ jobs:

package.json

 {
   "name": "express-static-gzip",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "simple wrapper on top of express.static, that allows serving pre-gziped files",
@@ -5,0 +5,0 @@ "main": "index.js",

README.md

@@ -5,2 +5,3 @@
 [![npm][npm-version-image]][npm-url]
+![Node CI](https://github.com/tkoenig89/express-static-gzip/workflows/Node%20CI/badge.svg?branch=master&event=push)
 [![npm][npm-downloads-image]][npm-url]
@@ -7,0 +8,0 @@ [![Donate][donate-paypal-image]][donate-url]

test/encoding-selection.spec.js

@@ -68,2 +68,12 @@ const expect = require('chai').expect;
     });
+
+    it('should treat identity as null', function () {
+        const result = findEncoding('identity;q=1, gzip;q=0.5', [GZIP]);
+        expect(result).to.be.null;
+    });
+
+    it('should not use encodings with q=0', function () {
+        const result = findEncoding('br;q=1, *;q=0', [GZIP]);
+        expect(result).to.be.null;
+    });
 });

util/encoding-selection.js

 // see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Accept-Encoding
 
+// Indicates the identity function (i.e. no compression, nor modification)
+const IDENTITY = 'identity';
+
 /**
@@ -21,2 +24,5 @@ *
     for (const encoding of sortedEncodingList) {
+        if (encoding === IDENTITY) {
+            return null;
+        }
         for (let i = 0; i < availableCompressions.length; i++) {
@@ -62,2 +68,3 @@ if (encoding === '*' || encoding === availableCompressions[i].encodingName) {
         .sort((encodingA, encodingB) => encodingB.q - encodingA.q)
+        .filter(encoding => encoding.q > 0)
         .map(encoding => encoding.name);
@@ -90,2 +97,2 @@ }
     findEncoding: findEncoding
-};
+};

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Lines of code

701

2.19%

Number of lines in readme file

149

0.68%

Worsened metrics

Total package byte prevSize

40151

-0.84%

No dependency changes