Socket
Socket
Sign inDemoInstall

undici

Package Overview
Dependencies
1
Maintainers
3
Versions
205
Alerts
File Explorer

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

Comparing version 5.26.5 to 5.27.0

8

lib/core/request.js

@@ -225,2 +225,10 @@ 'use strict'

}
if (this[kHandler].onRequestSent) {
try {
this[kHandler].onRequestSent()
} catch (err) {
this.onError(err)
}
}
}

@@ -227,0 +235,0 @@

21

lib/fetch/body.js

@@ -29,2 +29,4 @@ 'use strict'

const File = NativeFile ?? UndiciFile
const textEncoder = new TextEncoder()
const textDecoder = new TextDecoder()

@@ -53,3 +55,3 @@ // https://fetch.spec.whatwg.org/#concept-bodyinit-extract

controller.enqueue(
typeof source === 'string' ? new TextEncoder().encode(source) : source
typeof source === 'string' ? textEncoder.encode(source) : source
)

@@ -124,3 +126,2 @@ queueMicrotask(() => readableStreamClose(controller))

const enc = new TextEncoder()
const blobParts = []

@@ -133,3 +134,3 @@ const rn = new Uint8Array([13, 10]) // '\r\n'

if (typeof value === 'string') {
const chunk = enc.encode(prefix +
const chunk = textEncoder.encode(prefix +
`; name="${escape(normalizeLinefeeds(name))}"` +

@@ -140,3 +141,3 @@ `\r\n\r\n${normalizeLinefeeds(value)}\r\n`)

} else {
const chunk = enc.encode(`${prefix}; name="${escape(normalizeLinefeeds(name))}"` +
const chunk = textEncoder.encode(`${prefix}; name="${escape(normalizeLinefeeds(name))}"` +
(value.name ? `; filename="${escape(value.name)}"` : '') + '\r\n' +

@@ -155,3 +156,3 @@ `Content-Type: ${

const chunk = enc.encode(`--${boundary}--`)
const chunk = textEncoder.encode(`--${boundary}--`)
blobParts.push(chunk)

@@ -452,3 +453,5 @@ length += chunk.byteLength

// https://url.spec.whatwg.org/#concept-urlencoded-parser
const textDecoder = new TextDecoder('utf-8', { ignoreBOM: true })
// Note that streaming decoder is stateful and cannot be reused
const streamingDecoder = new TextDecoder('utf-8', { ignoreBOM: true })
for await (const chunk of consumeBody(this[kState].body)) {

@@ -458,5 +461,5 @@ if (!isUint8Array(chunk)) {

}
text += textDecoder.decode(chunk, { stream: true })
text += streamingDecoder.decode(chunk, { stream: true })
}
text += textDecoder.decode()
text += streamingDecoder.decode()
entries = new URLSearchParams(text)

@@ -576,3 +579,3 @@ } catch (err) {

// decoder, ioQueue, output, and "replacement".
const output = new TextDecoder().decode(buffer)
const output = textDecoder.decode(buffer)

@@ -579,0 +582,0 @@ // 4. Return output.

@@ -6,2 +6,3 @@ 'use strict'

const corsSafeListedMethods = ['GET', 'HEAD', 'POST']
const corsSafeListedMethodsSet = new Set(corsSafeListedMethods)

@@ -11,2 +12,3 @@ const nullBodyStatus = [101, 204, 205, 304]

const redirectStatus = [301, 302, 303, 307, 308]
const redirectStatusSet = new Set(redirectStatus)

@@ -23,2 +25,4 @@ // https://fetch.spec.whatwg.org/#block-bad-port

const badPortsSet = new Set(badPorts)
// https://w3c.github.io/webappsec-referrer-policy/#referrer-policies

@@ -36,2 +40,3 @@ const referrerPolicy = [

]
const referrerPolicySet = new Set(referrerPolicy)

@@ -41,2 +46,3 @@ const requestRedirect = ['follow', 'manual', 'error']

const safeMethods = ['GET', 'HEAD', 'OPTIONS', 'TRACE']
const safeMethodsSet = new Set(safeMethods)

@@ -76,2 +82,3 @@ const requestMode = ['navigate', 'same-origin', 'no-cors', 'cors']

const forbiddenMethods = ['CONNECT', 'TRACE', 'TRACK']
const forbiddenMethodsSet = new Set(forbiddenMethods)

@@ -92,2 +99,3 @@ const subresource = [

]
const subresourceSet = new Set(subresource)

@@ -142,3 +150,10 @@ /** @type {globalThis['DOMException']} */

badPorts,
requestDuplex
requestDuplex,
subresourceSet,
badPortsSet,
redirectStatusSet,
corsSafeListedMethodsSet,
safeMethodsSet,
forbiddenMethodsSet,
referrerPolicySet
}

@@ -10,2 +10,3 @@ 'use strict'

const { kEnumerableProperty } = require('../core/util')
const encoder = new TextEncoder()

@@ -284,3 +285,3 @@ class File extends Blob {

// 3. Append the result of UTF-8 encoding s to bytes.
bytes.push(new TextEncoder().encode(s))
bytes.push(encoder.encode(s))
} else if (

@@ -287,0 +288,0 @@ types.isAnyArrayBuffer(element) ||

@@ -16,4 +16,4 @@ /* globals AbortController */

const {
forbiddenMethods,
corsSafeListedMethods,
forbiddenMethodsSet,
corsSafeListedMethodsSet,
referrerPolicy,

@@ -323,3 +323,3 @@ requestRedirect,

if (forbiddenMethods.indexOf(method.toUpperCase()) !== -1) {
if (forbiddenMethodsSet.has(method.toUpperCase())) {
throw TypeError(`'${init.method}' HTTP method is unsupported.`)

@@ -409,3 +409,3 @@ }

// then throw a TypeError.
if (!corsSafeListedMethods.includes(request.method)) {
if (!corsSafeListedMethodsSet.has(request.method)) {
throw new TypeError(

@@ -412,0 +412,0 @@ `'${request.method} is unsupported in no-cors mode.`

@@ -17,3 +17,3 @@ 'use strict'

const {
redirectStatus,
redirectStatusSet,
nullBodyStatus,

@@ -32,2 +32,3 @@ DOMException

const ReadableStream = globalThis.ReadableStream || require('stream/web').ReadableStream
const textEncoder = new TextEncoder('utf-8')

@@ -62,3 +63,3 @@ // https://fetch.spec.whatwg.org/#response-class

// 1. Let bytes the result of running serialize a JavaScript value to JSON bytes on data.
const bytes = new TextEncoder('utf-8').encode(
const bytes = textEncoder.encode(
serializeJavascriptValueToJSONString(data)

@@ -108,3 +109,3 @@ )

// 3. If status is not a redirect status, then throw a RangeError.
if (!redirectStatus.includes(status)) {
if (!redirectStatusSet.has(status)) {
throw new RangeError('Invalid status code ' + status)

@@ -111,0 +112,0 @@ }

'use strict'
const { redirectStatus, badPorts, referrerPolicy: referrerPolicyTokens } = require('./constants')
const { redirectStatusSet, referrerPolicySet: referrerPolicyTokens, badPortsSet } = require('./constants')
const { getGlobalOrigin } = require('./global')

@@ -32,3 +32,3 @@ const { performance } = require('perf_hooks')

// 1. If response’s status is not a redirect status, then return null.
if (!redirectStatus.includes(response.status)) {
if (!redirectStatusSet.has(response.status)) {
return null

@@ -68,3 +68,3 @@ }

// then return blocked.
if (urlIsHttpHttpsScheme(url) && badPorts.includes(url.port)) {
if (urlIsHttpHttpsScheme(url) && badPortsSet.has(url.port)) {
return 'blocked'

@@ -211,3 +211,3 @@ }

const token = policyHeader[i - 1].trim()
if (referrerPolicyTokens.includes(token)) {
if (referrerPolicyTokens.has(token)) {
policy = token

@@ -214,0 +214,0 @@ break

{
"name": "undici",
"version": "5.26.5",
"version": "5.27.0",
"description": "An HTTP/1.1 client, written from scratch for Node.js",

@@ -87,3 +87,3 @@ "homepage": "https://undici.nodejs.org",

"test:websocket": "node scripts/verifyVersion.js 18 || tap test/websocket/*.js",
"test:wpt": "node scripts/verifyVersion 18 || (node test/wpt/start-fetch.mjs && node test/wpt/start-FileAPI.mjs && node test/wpt/start-mimesniff.mjs && node test/wpt/start-xhr.mjs && node --no-warnings --expose-internals test/wpt/start-websockets.mjs)",
"test:wpt": "node scripts/verifyVersion 18 || (node test/wpt/start-fetch.mjs && node test/wpt/start-FileAPI.mjs && node test/wpt/start-mimesniff.mjs && node test/wpt/start-xhr.mjs && node test/wpt/start-websockets.mjs)",
"coverage": "nyc --reporter=text --reporter=html npm run test",

@@ -90,0 +90,0 @@ "coverage:ci": "nyc --reporter=lcov npm run test",

Sorry, the diff of this file is too big to display

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Packages

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc