formidable - npm Package Compare versions

Comparing version 1.0.17 to 1.1.1

lib/file.js

 if (global.GENTLY) require = GENTLY.hijack(require);
 
 var util = require('util'),
-    WriteStream = require('fs').WriteStream,
+    fs = require('fs'),
     EventEmitter = require('events').EventEmitter,
@@ -34,7 +34,7 @@ crypto = require('crypto');
 File.prototype.open = function() {
-  this._writeStream = new WriteStream(this.path);
+  this._writeStream = new fs.WriteStream(this.path);
 };
 
 File.prototype.toJSON = function() {
-  return {
+  var json = {
     size: this.size,
@@ -49,2 +49,6 @@ path: this.path,
   };
+  if (this.hash && this.hash != "") {
+    json.hash = this.hash;
+  }
+  return json;
 };
@@ -51,0 +55,0 @@

lib/incoming_form.js

@@ -29,3 +29,3 @@ if (global.GENTLY) require = GENTLY.hijack(require);
   this.keepExtensions = opts.keepExtensions || false;
-  this.uploadDir = opts.uploadDir || os.tmpDir();
+  this.uploadDir = opts.uploadDir || (os.tmpdir && os.tmpdir()) || os.tmpDir();
   this.encoding = opts.encoding || 'utf-8';
@@ -356,6 +356,7 @@ this.headers = null;
 
-    var m = headerValue.match(/\bname="([^"]+)"/i);
+    // matches either a quoted-string or a token (RFC 2616 section 19.5.1)
+    var m = headerValue.match(/\bname=("([^"]*)"|([^\(\)<>@,;:\\"\/\[\]\?=\{\}\s\t/]+))/i);
     if (headerField == 'content-disposition') {
       if (m) {
-        part.name = m[1];
+        part.name = m[2] || m[3] || '';
       }
@@ -426,6 +427,8 @@
 IncomingForm.prototype._fileName = function(headerValue) {
-  var m = headerValue.match(/\bfilename="(.*?)"($|; )/i);
+  // matches either a quoted-string or a token (RFC 2616 section 19.5.1)
+  var m = headerValue.match(/\bfilename=("(.*?)"|([^\(\)<>@,;:\\"\/\[\]\?=\{\}\s\t/]+))($|;\s)/i);
   if (!m) return;
 
-  var filename = m[1].substr(m[1].lastIndexOf('\\') + 1);
+  var match = m[2] || m[3] || '';
+  var filename = match.substr(match.lastIndexOf('\\') + 1);
   filename = filename.replace(/%22/g, '"');
@@ -515,3 +518,3 @@ filename = filename.replace(/&#([\d]{4});/g, function(m, code) {
 
-  var parser = new JSONParser()
+  var parser = new JSONParser(this)
     , self = this;
@@ -536,7 +539,4 @@
 IncomingForm.prototype._uploadPath = function(filename) {
-  var name = 'upload_';
   var buf = crypto.randomBytes(16);
-  for (var i = 0; i < buf.length; ++i) {
-    name += ('0' + buf[i].toString(16)).slice(-2);
-  }
+  var name = 'upload_' + buf.toString('hex');
 
@@ -543,0 +543,0 @@ if (this.keepExtensions) {

lib/json_parser.js

@@ -5,3 +5,4 @@ if (global.GENTLY) require = GENTLY.hijack(require);
 
-function JSONParser() {
+function JSONParser(parent) {
+  this.parent = parent;
   this.data = new Buffer('');
@@ -32,3 +33,5 @@ this.bytesWritten = 0;
     }
-  } catch (e) {}
+  } catch (e) {
+    this.parent.emit('error', e);
+  }
   this.data = null;
@@ -35,0 +38,0 @@

package.json

@@ -5,10 +5,11 @@ {
   "homepage": "https://github.com/felixge/node-formidable",
-  "version": "1.0.17",
+  "license": "MIT",
+  "version": "1.1.1",
   "devDependencies": {
-    "gently": "0.8.0",
-    "findit": "0.1.1",
-    "hashish": "0.0.4",
-    "urun": "~0.0.6",
-    "utest": "0.0.3",
-    "request": "~2.11.4"
+    "gently": "^0.8.0",
+    "findit": "^0.1.2",
+    "hashish": "^0.0.4",
+    "urun": "^0.0.6",
+    "utest": "^0.0.8",
+    "request": "^2.11.4"
   },
@@ -33,3 +34,4 @@ "directories": {
   },
-  "optionalDependencies": {}
+  "optionalDependencies": {},
+  "license": "MIT"
 }

Readme.md

 # Formidable
 
-[![Build Status](https://secure.travis-ci.org/felixge/node-formidable.png?branch=master)](http://travis-ci.org/felixge/node-formidable)
+[![Build Status](https://travis-ci.org/felixge/node-formidable.svg?branch=master)](https://travis-ci.org/felixge/node-formidable)
 
 ## Purpose
 
-A node.js module for parsing form data, especially file uploads.
+A Node.js module for parsing form data, especially file uploads.
 
 ## Current status
 
+**Maintainers Wanted:** Please see https://github.com/felixge/node-formidable/issues/412
+
 This module was developed for [Transloadit](http://transloadit.com/), a service focused on uploading
@@ -25,15 +27,8 @@ and encoding images and videos. It has been battle-tested against hundreds of GB of file uploads from
 
+```sh
+npm i -S formidable
+```
+
 This is a low level package, and if you're using a high level framework such as Express, chances are it's already included in it. You can [read this discussion](http://stackoverflow.com/questions/11295554/how-to-disable-express-bodyparser-for-file-uploads-node-js) about how Formidable is integrated with Express.
 
-Via [npm](http://github.com/isaacs/npm):
-```
-npm install formidable@latest
-```
-Manually:
-```
-git clone git://github.com/felixge/node-formidable.git formidable
-vim my.js
-# var formidable = require('./formidable');
-```
-
 Note: Formidable requires [gently](http://github.com/felixge/node-gently) to run the unit tests, but you won't need it for just using the library.
@@ -91,3 +86,3 @@
 Sets the directory for placing file uploads in. You can move them later on using
-`fs.rename()`. The default is `os.tmpDir()`.
+`fs.rename()`. The default is `os.tmpdir()`.
 
@@ -209,2 +204,5 @@ ```javascript
 #### 'progress'
+
+Emitted after each incoming chunk of data that has been parsed. Can be used to roll your own progress bar.
+
 ```javascript
@@ -214,3 +212,2 @@ form.on('progress', function(bytesReceived, bytesExpected) {
 ```
-Emitted after each incoming chunk of data that has been parsed. Can be used to roll your own progress bar.
 
@@ -220,2 +217,5 @@
 #### 'field'
+
+Emitted whenever a field / value pair has been received.
+
 ```javascript
@@ -228,3 +228,6 @@ form.on('field', function(name, value) {
 
-Emitted whenever a field / value pair has been received.
+Emitted whenever a new file is detected in the upload stream. Use this event if
+you want to stream the file to somewhere else while buffering the upload on
+the file system.
+
 ```javascript
@@ -237,7 +240,4 @@ form.on('fileBegin', function(name, file) {
 
-Emitted whenever a new file is detected in the upload stream. Use this even if
-you want to stream the file to somewhere else while buffering the upload on
-the file system.
+Emitted whenever a field / file pair has been received. `file` is an instance of `File`.
 
-Emitted whenever a field / file pair has been received. `file` is an instance of `File`.
 ```javascript
@@ -251,2 +251,3 @@ form.on('file', function(name, file) {
 Emitted when there is an error processing the incoming form. A request that experiences an error is automatically paused, you will have to manually call `request.resume()` if you want the request to continue firing `'data'` events.
+
 ```javascript
@@ -277,4 +278,15 @@ form.on('error', function(err) {
 
-### v1.0.14
+### v1.1.1 (2017-01-15)
 
+ * Fix DeprecationWarning about os.tmpDir() (Christian)
+ * Update `buffer.write` order of arguments for Node 7 (Kornel Lesiński)
+ * JSON Parser emits error events to the IncomingForm (alessio.montagnani)
+ * Improved Content-Disposition parsing (Sebastien)
+ * Access WriteStream of fs during runtime instead of include time (Jonas Amundsen)
+ * Use built-in toString to convert buffer to hex (Charmander)
+ * Add hash to json if present (Nick Stamas)
+ * Add license to package.json (Simen Bekkhus)
+
+### v1.0.14 (2013-05-03)
+
 * Add failing hash tests. (Ben Trask)
@@ -310,3 +322,3 @@ * Enable hash calculation again (Eugene Girshov)
 * Add support for application/octet-stream (Ion Lupascu, Chris Scribner)
-* Use os.tmpDir() to get tmp directory (Andrew Kelley)
+* Use os.tmpdir() to get tmp directory (Andrew Kelley)
 * Improve package.json (Andrew Kelley, Sven Lito)
@@ -317,110 +329,2 @@ * Fix benchmark script (Andrew Kelley)
 
-### v1.0.11
-
-* Calculate checksums for incoming files (sreuter)
-* Add definition parameters to "IncomingForm" as an argument (Math-)
-
-### v1.0.10
-
-* Make parts to be proper Streams (Matt Robenolt)
-
-### v1.0.9
-
-* Emit progress when content length header parsed (Tim Koschützki)
-* Fix Readme syntax due to GitHub changes (goob)
-* Replace references to old 'sys' module in Readme with 'util' (Peter Sugihara)
-
-### v1.0.8
-
-* Strip potentially unsafe characters when using `keepExtensions: true`.
-* Switch to utest / urun for testing
-* Add travis build
-
-### v1.0.7
-
-* Remove file from package that was causing problems when installing on windows. (#102)
-* Fix typos in Readme (Jason Davies).
-
-### v1.0.6
-
-* Do not default to the default to the field name for file uploads where
-  filename="".
-
-### v1.0.5
-
-* Support filename="" in multipart parts
-* Explain unexpected end() errors in parser better
-
-**Note:** Starting with this version, formidable emits 'file' events for empty
-file input fields. Previously those were incorrectly emitted as regular file
-input fields with value = "".
-
-### v1.0.4
-
-* Detect a good default tmp directory regardless of platform. (#88)
-
-### v1.0.3
-
-* Fix problems with utf8 characters (#84) / semicolons in filenames (#58)
-* Small performance improvements
-* New test suite and fixture system
-
-### v1.0.2
-
-* Exclude node\_modules folder from git
-* Implement new `'aborted'` event
-* Fix files in example folder to work with recent node versions
-* Make gently a devDependency
-
-[See Commits](https://github.com/felixge/node-formidable/compare/v1.0.1...v1.0.2)
-
-### v1.0.1
-
-* Fix package.json to refer to proper main directory. (#68, Dean Landolt)
-
-[See Commits](https://github.com/felixge/node-formidable/compare/v1.0.0...v1.0.1)
-
-### v1.0.0
-
-* Add support for multipart boundaries that are quoted strings. (Jeff Craig)
-
-This marks the beginning of development on version 2.0 which will include
-several architectural improvements.
-
-[See Commits](https://github.com/felixge/node-formidable/compare/v0.9.11...v1.0.0)
-
-### v0.9.11
-
-* Emit `'progress'` event when receiving data, regardless of parsing it. (Tim Koschützki)
-* Use [W3C FileAPI Draft](http://dev.w3.org/2006/webapi/FileAPI/) properties for File class
-
-**Important:** The old property names of the File class will be removed in a
-future release.
-
-[See Commits](https://github.com/felixge/node-formidable/compare/v0.9.10...v0.9.11)
-
-### Older releases
-
-These releases were done before starting to maintain the above Changelog:
-
-* [v0.9.10](https://github.com/felixge/node-formidable/compare/v0.9.9...v0.9.10)
-* [v0.9.9](https://github.com/felixge/node-formidable/compare/v0.9.8...v0.9.9)
-* [v0.9.8](https://github.com/felixge/node-formidable/compare/v0.9.7...v0.9.8)
-* [v0.9.7](https://github.com/felixge/node-formidable/compare/v0.9.6...v0.9.7)
-* [v0.9.6](https://github.com/felixge/node-formidable/compare/v0.9.5...v0.9.6)
-* [v0.9.5](https://github.com/felixge/node-formidable/compare/v0.9.4...v0.9.5)
-* [v0.9.4](https://github.com/felixge/node-formidable/compare/v0.9.3...v0.9.4)
-* [v0.9.3](https://github.com/felixge/node-formidable/compare/v0.9.2...v0.9.3)
-* [v0.9.2](https://github.com/felixge/node-formidable/compare/v0.9.1...v0.9.2)
-* [v0.9.1](https://github.com/felixge/node-formidable/compare/v0.9.0...v0.9.1)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.9.0](https://github.com/felixge/node-formidable/compare/v0.8.0...v0.9.0)
-* [v0.1.0](https://github.com/felixge/node-formidable/commits/v0.1.0)
-
 ## License
@@ -427,0 +331,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Lines of code

891

increased by0.79%

Worsened metrics

Total package byte prevSize

37664

decreased by-7.73%

Number of lines in readme file

330

decreased by-22.54%

Number of medium supply chain risk alerts

1

increased byInfinity%

No dependency changes