node-xmlhttprequest - npm Package Compare versions

Comparing version 1.0.3 to 1.0.4

index.js

@@ -1,6 +0,4 @@
-import { XMLHttpRequest } from './src/xmlhttprequest.js'
+const { XMLHttpRequest } = require('./src/xmlhttprequest.js')
 
-// https://github.com/fastify/fastify/blob/224dc104260ad26f9baa0e46962f917963d41fe5/fastify.js#L711
-
-export { XMLHttpRequest }
-export default XMLHttpRequest
+module.exports.XMLHttpRequest = XMLHttpRequest
+module.exports.default = XMLHttpRequest

package.json

 {
   "name": "node-xmlhttprequest",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "A spec-compliant version of XMLHttpRequest",
   "main": "index.js",
-  "type": "module",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "node tests/wpt/run.mjs",
+    "lint": "standard | snazzy",
+    "lint:fix": "standard --fix | snazzy"
   },
@@ -17,3 +18,13 @@ "keywords": [
     "undici": "github:nodejs/undici"
+  },
+  "devDependencies": {
+    "snazzy": "^9.0.0",
+    "standard": "^17.0.0"
+  },
+  "standard": {
+    "ignore": [
+      "tests/wpt/resources/",
+      "tests/wpt/xhr/"
+    ]
   }
 }

src/encoding.js

@@ -0,1 +1,3 @@
+'use strict'
+
 /**
@@ -5,3 +7,3 @@ * @see https://encoding.spec.whatwg.org/#concept-encoding-get
  */
-export function getEncoding (label) {
+function getEncoding (label) {
   // 1. Remove any leading and trailing ASCII whitespace from label.
@@ -282,1 +284,5 @@ // 2. If label is an ASCII case-insensitive match for any of the
 }
+
+module.exports = {
+  getEncoding
+}

src/symbols.js

@@ -1,22 +0,47 @@
-export const kUploadObject = Symbol('upload object')
-export const kTimeout = Symbol('timeout')
-export const kResponseType = Symbol('response type')
-export const kFetchController = Symbol('fetch controller')
-export const kSendFlag = Symbol('send flag')
-export const kUploadListenerFlag = Symbol('upload listener flag')
-export const kRequestMethod = Symbol('request method')
-export const kRequestURL = Symbol('request url')
-export const kSychronousFlag = Symbol('sync flag')
-export const kRequestHeaders = Symbol('headers list')
-export const kResponse = Symbol('response')
-export const kReceivedBytes = Symbol('received bytes')
-export const kResponseObject = Symbol('response object')
-export const kState = Symbol('state')
-export const kCrossOriginCredentials = Symbol('cross origin credentials')
-export const kRequestBody = Symbol('request body')
-export const kUploadCompleteFlag = Symbol('upload complete flag')
-export const kTimedOutFlag = Symbol('timed out flag')
-export const kOverrideMimeType = Symbol('override mime type')
-export const kLengthComputable = Symbol('length computable')
-export const kLoaded = Symbol('loaded')
-export const kTotal = Symbol('total')
+'use strict'
+
+module.exports = {
+  // https://xhr.spec.whatwg.org/#upload-object
+  kUploadObject: Symbol('upload object'),
+  // https://xhr.spec.whatwg.org/#timeout
+  kTimeout: Symbol('timeout'),
+  // https://xhr.spec.whatwg.org/#response-type
+  kResponseType: Symbol('response type'),
+  // https://xhr.spec.whatwg.org/#xmlhttprequest-fetch-controller
+  kFetchController: Symbol('fetch controller'),
+  // https://xhr.spec.whatwg.org/#send-flag
+  kSendFlag: Symbol('send flag'),
+  // https://xhr.spec.whatwg.org/#upload-listener-flag
+  kUploadListenerFlag: Symbol('upload listener flag'),
+  // https://xhr.spec.whatwg.org/#request-method
+  kRequestMethod: Symbol('request method'),
+  // https://xhr.spec.whatwg.org/#request-url
+  kRequestURL: Symbol('request url'),
+  // https://xhr.spec.whatwg.org/#synchronous-flag
+  kSychronousFlag: Symbol('sync flag'),
+  // https://xhr.spec.whatwg.org/#author-request-headers
+  kRequestHeaders: Symbol('headers list'),
+  // https://xhr.spec.whatwg.org/#response
+  kResponse: Symbol('response'),
+  // https://xhr.spec.whatwg.org/#received-bytes
+  kReceivedBytes: Symbol('received bytes'),
+  // https://xhr.spec.whatwg.org/#response-object
+  kResponseObject: Symbol('response object'),
+  // https://xhr.spec.whatwg.org/#concept-xmlhttprequest-state
+  kState: Symbol('state'),
+  // https://xhr.spec.whatwg.org/#cross-origin-credentials
+  kCrossOriginCredentials: Symbol('cross origin credentials'),
+  // https://xhr.spec.whatwg.org/#request-body
+  kRequestBody: Symbol('request body'),
+  // https://xhr.spec.whatwg.org/#upload-complete-flag
+  kUploadCompleteFlag: Symbol('upload complete flag'),
+  // https://xhr.spec.whatwg.org/#timed-out-flag
+  kTimedOutFlag: Symbol('timed out flag'),
+  // https://xhr.spec.whatwg.org/#override-mime-type
+  kOverrideMimeType: Symbol('override mime type'),
+
+  // ProgressEvent symbols
+  kLengthComputable: Symbol('length computable'),
+  kLoaded: Symbol('loaded'),
+  kTotal: Symbol('total')
+}

src/util.js

@@ -1,5 +0,7 @@
-import { kResponse, kOverrideMimeType, kResponseType, kReceivedBytes } from './symbols.js'
-import { parseMIMEType } from 'undici/lib/fetch/dataURL.js'
-import { getEncoding } from './encoding.js'
+'use strict'
 
+const { kResponse, kOverrideMimeType, kResponseType, kReceivedBytes } = require('./symbols.js')
+const { parseMIMEType } = require('undici/lib/fetch/dataURL.js')
+const { getEncoding } = require('./encoding.js')
+
 /**
@@ -14,3 +16,3 @@ * @typedef {import('./index').XMLHttpRequest} XMLHttpRequest
  */
-export function isValidHeaderValue (value) {
+function isValidHeaderValue (value) {
   // see: https://chromium.googlesource.com/chromium/src/+/7d15b7fc471b33e2d52a45876cb8323a4fb0e780/third_party/WebKit/Source/platform/network/HTTPParsers.cpp#224
@@ -42,3 +44,3 @@ return (
  */
-export function serializeMimeType (mimeType) {
+function serializeMimeType (mimeType) {
   // 1. Let serialization be the concatenation of mimeType’s type,
@@ -82,3 +84,3 @@ //    U+002F (/), and mimeType’s subtype.
  */
-export function extractLengthFromHeadersList (headers) {
+function extractLengthFromHeadersList (headers) {
   const header = headers.get('content-length')
@@ -124,3 +126,3 @@
  */
-export function getTextResponse (xhr) {
+function getTextResponse (xhr) {
   // 1. If xhr’s response’s body is null, then return the empty string.
@@ -302,3 +304,3 @@ if (xhr[kResponse].body == null) {
  */
-export function finalMimeType (xhr) {
+function finalMimeType (xhr) {
   // 1. If xhr’s override MIME type is null, return the result of
@@ -312,2 +314,24 @@ //    get a response MIME type for xhr.
   return xhr[kOverrideMimeType]
-}
+}
+
+// https://encoding.spec.whatwg.org/#utf-8-decode
+function utf8Decode (buffer) {
+  if (buffer[0] === 0xEF && buffer[1] === 0xBB && buffer[2] === 0xBF) {
+    buffer = buffer.subarray(3)
+  }
+
+  const text = new TextDecoder('utf-8', {
+    fatal: true
+  }).decode(buffer)
+
+  return JSON.parse(text)
+}
+
+module.exports = {
+  finalMimeType,
+  getTextResponse,
+  extractLengthFromHeadersList,
+  serializeMimeType,
+  isValidHeaderValue,
+  utf8Decode
+}

src/xmlhttprequest.js

@@ -1,2 +0,4 @@
-import {
+'use strict'
+
+const {
   kUploadObject,
@@ -24,4 +26,4 @@ kTimeout,
   kTotal
-} from './symbols.js'
-import {
+} = require('./symbols.js')
+const {
   isValidHeaderValue,
@@ -31,20 +33,20 @@ serializeMimeType,
   getTextResponse,
-  finalMimeType
-} from './util.js'
-import { isValidHTTPToken, normalizeMethod } from 'undici/lib/fetch/util.js'
-import { forbiddenMethods, DOMException } from 'undici/lib/fetch/constants.js'
-import { safelyExtractBody } from 'undici/lib/fetch/body.js'
-import { Fetch, finalizeAndReportTiming, fetching } from 'undici/lib/fetch/index.js'
-import { HeadersList } from 'undici/lib/fetch/headers.js'
-import { makeNetworkError, makeResponse } from 'undici/lib/fetch/response.js'
-import { parseMIMEType } from 'undici/lib/fetch/dataURL.js'
-import { makeRequest } from 'undici/lib/fetch/request.js'
-import { webidl } from 'undici/lib/fetch/webidl.js'
-import { getGlobalDispatcher, getGlobalOrigin } from 'undici'
-import assert from 'assert'
-import { Blob } from 'buffer'
-import { toUSVString } from 'util'
-import { Worker, MessageChannel, receiveMessageOnPort } from 'worker_threads';
-import { fileURLToPath } from 'url'
-import { join } from 'path'
+  finalMimeType,
+  utf8Decode
+} = require('./util.js')
+const { isValidHTTPToken, normalizeMethod } = require('undici/lib/fetch/util.js')
+const { forbiddenMethods, DOMException } = require('undici/lib/fetch/constants.js')
+const { safelyExtractBody } = require('undici/lib/fetch/body.js')
+const { Fetch, finalizeAndReportTiming, fetching } = require('undici/lib/fetch/index.js')
+const { HeadersList } = require('undici/lib/fetch/headers.js')
+const { makeNetworkError, makeResponse } = require('undici/lib/fetch/response.js')
+const { parseMIMEType } = require('undici/lib/fetch/dataURL.js')
+const { makeRequest } = require('undici/lib/fetch/request.js')
+const { webidl } = require('undici/lib/fetch/webidl.js')
+const { getGlobalDispatcher, getGlobalOrigin } = require('undici')
+const assert = require('assert')
+const { Blob } = require('buffer')
+const { toUSVString } = require('util')
+const { Worker, MessageChannel, receiveMessageOnPort } = require('worker_threads')
+const { join } = require('path')
 
@@ -85,3 +87,3 @@ const XMLHttpRequestReadyState = {
 
-export class XMLHttpRequest extends XMLHttpRequestUpload {
+class XMLHttpRequest extends XMLHttpRequestUpload {
   // https://xhr.spec.whatwg.org/#constructors
@@ -607,3 +609,3 @@ constructor () {
         // 9. If length is not an integer, then set it to 0.
-        if (!Number.isSafeInteger(length)) {
+        if (length === 'failure' || !Number.isSafeInteger(length)) {
           length = 0
@@ -654,5 +656,16 @@ }
           try {
-            for await (const bytes of this[kResponse].body.stream) {
-              processBodyChunk(bytes)
+            /** @type {import('stream/web').ReadableStream<Uint8Array>} */
+            const stream = this[kResponse].body.stream
+            const reader = stream.getReader()
+
+            while (true) {
+              const { done, value } = await reader.read()
+
+              if (done) {
+                break
+              }
+
+              processBodyChunk(value)
             }
+
             processEndOfBody()
@@ -730,3 +743,3 @@ } catch (err) {
 
-      const path = fileURLToPath(join(import.meta.url, '../worker.mjs'))
+      const path = join(__dirname, 'worker.mjs')
 
@@ -757,3 +770,3 @@ const w = new Worker(path, {
         const { body, status, statusText, headers, type, url } = message
-      
+
         this[kResponse] = makeResponse({
@@ -1033,9 +1046,5 @@ status,
       //    then return null.
-      let jsonObject = ''
+      let jsonObject
       try {
-        for (const byte of this[kReceivedBytes]) {
-          jsonObject += String.fromCodePoint(byte)
-        }
-
-        jsonObject = JSON.parse(jsonObject)
+        jsonObject = utf8Decode(new Uint8Array(this[kReceivedBytes]))
       } catch {
@@ -1155,3 +1164,3 @@ return null
  * @see https://xhr.spec.whatwg.org/#concept-event-fire-progress
- * @param {string} e
+ * @param {string|Event} e
  * @param {EventTarget} target
@@ -1173,4 +1182,11 @@ * @param {number} transmitted
   target.dispatchEvent(event)
-  // eslint-disable-next-line no-useless-call
-  target[`on${eventName}`]?.call(target, event)
+
+  try {
+    // eslint-disable-next-line no-useless-call
+    target[`on${eventName}`]?.call(target, event)
+  } catch (e) {
+    queueMicrotask(() => {
+      throw e
+    })
+  }
 }
@@ -1183,2 +1199,3 @@
   try {
+    // eslint-disable-next-line no-useless-call
     target.onreadystatechange?.call(target, event)
@@ -1329,1 +1346,5 @@ } catch (e) {
 )
+
+module.exports = {
+  XMLHttpRequest
+}

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

No tests

Quality

Package does not have any tests. This is a strong signal of a poorly maintained or low quality package.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1406140

488.34%

Number of package files

27

42.11%

Lines of code

6672

3.04%

Number of low quality alerts

1

-50%

Worsened metrics

Dev dependency count

2

Infinity%

Number of medium supply chain risk alerts

2

100%

Is type module

No

NaN

No dependency changes