Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
A http file send
$ npm install file-send
var http = require('http'),
FileSend = require('file-send'),
Send = FileSend('/', {
etag: false,
maxAge: '30d'
});
http.createServer(function (request, response){
Send.use(request) // Create a new send stream
.pipe(response); // Send stream to client
});
Create a new Send
for the given root
path and options to initialize.
Set how "dotFiles" are treated when encountered. A dotFile is a file or directory that begins with a dot ("."). Note this check is done on the path itself without checking if the path actually exists on the disk. If root
is specified, only the dotfiles above the root are checked (i.e. the root itself can be within a dotfile).
The default value is 'ignore'
.
'allow'
No special treatment for dotfiles.'deny'
Send a 403 for any request for a dotfile.'ignore'
Pretend like the dotfile does not exist and 404.Enable or disable etag generation, defaults to true.
If a given file doesn't exist, try appending one of the given extensions, in the given order. By default, this is disabled (set to false
). An example value that will serve extension-less HTML files: ['html', 'htm']
.
This is skipped if the requested file already has an extension.
By default send supports "index.html" files, to disable this set false
or to supply a new index pass a string or an array in preferred order.
Enable or disable Last-Modified
header, defaults to true. Uses the file system's last modified value.
Provide a max-age in milliseconds for http caching, defaults to 0. This can also be a string accepted by the ms module.
var stream = Send.use(request); // The Send.use return a new send stream
Create a new SendStream
for the given request
and response
.
The SendStream
is an event emitter and will emit the following events:
error
an error occurred (err)
directory
a directory was requestedfile
a file was requested (path, stat)
headers
the headers are about to be set on a file (response, path, stat)
stream
file streaming has started (stream, next(stream))
end
streaming has completedThe pipe
method is used to pipe the response into the Node.js HTTP response object, typically Send.use(req).pipe(res)
.
Return the normalize request url.
Return the http request.
Return the http response.
Redirect url, if header already send, do nothing.
Emit http error, if header already send will end the response with error message and status.
The basic interface, send a file stream to response no filter. If it is not necessary to do not use.
By default when no error
listeners are present an automatic response will be made, otherwise you have full control over the response, aka you may show a 5xx page etc.
It does not perform internal caching, you should use a reverse proxy cache such as Varnish for this, or those fancy things called CDNs. If your application is small enough that it would benefit from single-node memory caching, it's small enough that it does not need caching at all ;).
To enable debug()
instrumentation:
$ node app -v
or:
$ node app -verbose
$ npm install
$ npm test
Serving from a root directory with custom error-handling:
var http = require('http'),
FileSend = require('file-send'),
Send = FileSend('/www/example.com/public'); // Set root
// Your custom error-handling logic:
function error(err) {
var res = this.response;
res.statusCode = err.status || 500;
res.end(err.message);
}
// Your custom headers
function headers(res, path, stat) {
// serve all files for download
res.setHeader('Content-Disposition', 'attachment');
}
// Your custom directory handling logic:
function directory(path, stat) {
// TODO You can do something here
// Like displays the current directory file list
this.response.end('This is a directory !');
}
var app = http.createServer(function(request, response){
// Transfer arbitrary files from within /www/example.com/public/*
Send.use(request)
.on('error', error)
.on('directory', directory)
.on('headers', headers)
.pipe(response);
}).listen(3000);
FAQs
A http file send.
We found that file-send demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.