express - npm Package Compare versions

Comparing version 4.18.3 to 4.19.0

lib/response.js

@@ -37,2 +37,3 @@ /*!
 var vary = require('vary');
+var urlParse = require('url').parse;
 
@@ -915,4 +916,21 @@ /**
 
+  var lowerLoc = loc.toLowerCase();
+  var encodedUrl = encodeUrl(loc);
+  if (lowerLoc.indexOf('https://') === 0 || lowerLoc.indexOf('http://') === 0) {
+    try {
+      var parsedUrl = urlParse(loc);
+      var parsedEncodedUrl = urlParse(encodedUrl);
+      // Because this can encode the host, check that we did not change the host
+      if (parsedUrl.host !== parsedEncodedUrl.host) {
+        // If the host changes after encodeUrl, return the original url
+        return this.set('Location', loc);
+      }
+    } catch (e) {
+      // If parse fails, return the original url
+      return this.set('Location', loc);
+    }
+  }
+
   // set location
-  return this.set('Location', encodeUrl(loc));
+  return this.set('Location', encodedUrl);
 };
@@ -919,0 +937,0 @@

package.json

 {
   "name": "express",
   "description": "Fast, unopinionated, minimalist web framework",
-  "version": "4.18.3",
+  "version": "4.19.0",
   "author": "TJ Holowaychuk <[e-mail]>",
@@ -36,3 +36,3 @@ "contributors": [
     "content-type": "~1.0.4",
-    "cookie": "0.5.0",
+    "cookie": "0.6.0",
     "cookie-signature": "1.0.6",
@@ -39,0 +39,0 @@ "debug": "2.6.9",

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

214897

increased by0.39%

Lines of code

3485

increased by0.49%

Dependency changes

• + Addedcookie@0.6.0(transitive)

• - Removedcookie@0.5.0(transitive)

• Updatedcookie@0.6.0