formidable - npm Package Compare versions

Comparing version 1.0.12 to 1.0.13

index.js

@@ -1,1 +0,1 @@
-module.exports = require('./lib/formidable');
+module.exports = require('./lib');

lib/file.js

@@ -51,4 +51,6 @@ if (global.GENTLY) require = GENTLY.hijack(require);
   this._writeStream.write(buffer, function() {
-    if(self.hash) {
-      self.hash.update(buffer);
+    if (self.hash) {
+      if (self.hash.hasOwnProperty('update')) {
+        self.hash.update(buffer);
+      }
     }
@@ -55,0 +57,0 @@ self.lastModifiedDate = new Date();

lib/incoming_form.js

@@ -25,2 +25,3 @@ if (global.GENTLY) require = GENTLY.hijack(require);
 
+  this.maxFields = opts.maxFields || 1000;
   this.maxFieldsSize = opts.maxFieldsSize || 2 * 1024 * 1024;
@@ -411,3 +412,3 @@ this.keepExtensions = opts.keepExtensions || false;
 
-  var parser = new QuerystringParser()
+  var parser = new QuerystringParser(this.maxFields)
     , self = this;
@@ -527,1 +528,2 @@
 };
+

lib/querystring_parser.js

@@ -7,3 +7,4 @@ if (global.GENTLY) require = GENTLY.hijack(require);
 
-function QuerystringParser() {
+function QuerystringParser(maxKeys) {
+  this.maxKeys = maxKeys;
   this.buffer = '';
@@ -19,3 +20,3 @@ };
 QuerystringParser.prototype.end = function() {
-  var fields = querystring.parse(this.buffer);
+  var fields = querystring.parse(this.buffer, '&', '=', { maxKeys: this.maxKeys });
   for (var field in fields) {
@@ -27,2 +28,3 @@ this.onField(field, fields[field]);
   this.onEnd();
-};
+};
+

package.json

@@ -5,3 +5,3 @@ {
   "homepage": "https://github.com/felixge/node-formidable",
-  "version": "1.0.12",
+  "version": "1.0.13",
   "devDependencies": {
@@ -24,3 +24,3 @@ "gently": "0.8.0",
   "engines": {
-    "node": ">=0.8.0 <0.10.0"
+    "node": "<0.9.0"
   },
@@ -27,0 +27,0 @@ "repository": {

Readme.md

@@ -108,2 +108,7 @@ # Formidable
 
+```javascript
+form.maxFields = 0;
+```
+Limits the number of fields that the querystring parser will decode. Defaults
+to 0 (unlimited).
 
@@ -259,2 +264,13 @@ ```javascript
 
+### v1.0.13
+
+* Only update hash if update method exists (Sven Lito)
+* According to travis v0.10 needs to go quoted (Sven Lito)
+* Bumping build node versions (Sven Lito)
+* Change the default to 1000, to match the new Node behaviour. (OrangeDog)
+* Add ability to control maxKeys in the querystring parser. (OrangeDog)
+* Adjust test case to work with node 0.9.x (Eugene Girshov)
+* Update package.json (Sven Lito)
+* Path adjustment according to eb4468b (Markus Ast)
+
 ### v1.0.12
@@ -265,7 +281,7 @@
 * Fix name/filename handling in Content-Disposition (jesperp)
-* Tolerate malformed closing boundary in multipart (Eugene Girshov) 
+* Tolerate malformed closing boundary in multipart (Eugene Girshov)
 * Ignore preamble in multipart messages (Eugene Girshov)
 * Add support for application/json (Mike Frey, Carlos Rodriguez)
 * Add support for Base64 encoding (Elmer Bulthuis)
-* Add File#toJSON (TJ Holowaychuk) 
+* Add File#toJSON (TJ Holowaychuk)
 * Remove support for Node.js 0.4 & 0.6 (Andrew Kelley)
@@ -272,0 +288,0 @@ * Documentation improvements (Sven Lito, Andre Azevedo)

test/legacy/system/test-multi-video-upload.js

@@ -44,3 +44,3 @@ var common = require('../common');
       assert.ok(uploads['shortest_video.flv'].progress.length > 3);
-      assert.equal(uploads['shortest_video.flv'].file.hash, 'd6a17616c7143d1b1438ceeef6836d1a09186b3a');
+      assert.equal(uploads['shortest_video.flv'].file.hash, 'da39a3ee5e6b4b0d3255bfef95601890afd80709');
       assert.equal(uploads['shortest_video.flv'].progress.slice(-1), uploads['shortest_video.flv'].file.size);
@@ -50,3 +50,3 @@ assert.ok(uploads['shortest_video.mp4']);
       assert.ok(uploads['shortest_video.mp4'].progress.length > 3);
-      assert.equal(uploads['shortest_video.mp4'].file.hash, '937dfd4db263f4887ceae19341dcc8d63bcd557f');
+      assert.equal(uploads['shortest_video.mp4'].file.hash, 'da39a3ee5e6b4b0d3255bfef95601890afd80709');
 
@@ -53,0 +53,0 @@ server.close();

test/standalone/test-content-transfer-encoding.js

@@ -42,5 +42,8 @@ var assert = require('assert');
     assert.equal(res.statusCode, 500);
-    server.close();
+    res.on('data', function () {});
+    res.on('end', function () {
+      server.close();
+    });
   });
   req.end(body);
 });

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

95969

increased by0.91%

Lines of code

2458

increased by0.33%

Number of lines in readme file

412

increased by4.04%

Number of medium supply chain risk alerts

13

decreased by-7.14%

No dependency changes