i did something

2023-05-08 05:50:34 -04:00
parent bdff32e188
commit 4d75310690
49 changed files with 1415 additions and 278 deletions
@@ -0,0 +1,65 @@
+1.4.0 / 2015-09-18
+==================
+
+  * Accept array of secrets in addition to a single secret
+  * Fix `JSONCookie` to return `undefined` for non-string arguments
+  * Fix `signedCookie` to return `undefined` for non-string arguments
+  * deps: cookie@0.2.2
+
+1.3.5 / 2015-05-19
+==================
+
+  * deps: cookie@0.1.3
+    - Slight optimizations
+
+1.3.4 / 2015-02-15
+==================
+
+  * deps: cookie-signature@1.0.6
+
+1.3.3 / 2014-09-05
+==================
+
+  * deps: cookie-signature@1.0.5
+
+1.3.2 / 2014-06-26
+==================
+
+  * deps: cookie-signature@1.0.4
+    - fix for timing attacks
+
+1.3.1 / 2014-06-17
+==================
+
+  * actually export `signedCookie`
+
+1.3.0 / 2014-06-17
+==================
+
+  * add `signedCookie` export for single cookie unsigning
+
+1.2.0 / 2014-06-17
+==================
+
+  * export parsing functions
+  * `req.cookies` and `req.signedCookies` are now plain objects
+  * slightly faster parsing of many cookies
+
+1.1.0 / 2014-05-12
+==================
+
+  * Support for NodeJS version 0.8
+  * deps: cookie@0.1.2
+    - Fix for maxAge == 0
+    - made compat with expires field
+    - tweak maxAge NaN error message
+
+1.0.1 / 2014-02-20
+==================
+
+  * add missing dependencies
+
+1.0.0 / 2014-02-15
+==================
+
+  * Genesis from `connect`
@@ -0,0 +1,23 @@
+(The MIT License)
+
+Copyright (c) 2014 TJ Holowaychuk <[email protected]>
+Copyright (c) 2015 Douglas Christopher Wilson <[email protected]>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,85 @@
+# cookie-parser
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+Parse `Cookie` header and populate `req.cookies` with an object keyed by the cookie
+names. Optionally you may enable signed cookie support by passing a `secret` string,
+which assigns `req.secret` so it may be used by other middleware.
+
+## Installation
+
+```sh
+$ npm install cookie-parser
+```
+
+## API
+
+```js
+var express      = require('express')
+var cookieParser = require('cookie-parser')
+
+var app = express()
+app.use(cookieParser())
+```
+
+### cookieParser(secret, options)
+
+- `secret` a string or array used for signing cookies. This is optional and if not specified, will not parse signed cookies. If a string is provided, this is used as the secret. If an array is provided, an attempt will be made to unsign the cookie with each secret in order.
+- `options` an object that is passed to `cookie.parse` as the second option. See [cookie](https://www.npmjs.org/package/cookie) for more information.
+  - `decode` a function to decode the value of the cookie
+
+### cookieParser.JSONCookie(str)
+
+Parse a cookie value as a JSON cookie. This will return the parsed JSON value if it was a JSON cookie, otherwise it will return the passed value.
+
+### cookieParser.JSONCookies(cookies)
+
+Given an object, this will iterate over the keys and call `JSONCookie` on each value. This will return the same object passed in.
+
+### cookieParser.signedCookie(str, secret)
+
+Parse a cookie value as a signed cookie. This will return the parsed unsigned value if it was a signed cookie and the signature was valid, otherwise it will return the passed value.
+
+The `secret` argument can be an array or string. If a string is provided, this is used as the secret. If an array is provided, an attempt will be made to unsign the cookie with each secret in order.
+
+### cookieParser.signedCookies(cookies, secret)
+
+Given an object, this will iterate over the keys and check if any value is a signed cookie. If it is a signed cookie and the signature is valid, the key will be deleted from the object and added to the new object that is returned.
+
+The `secret` argument can be an array or string. If a string is provided, this is used as the secret. If an array is provided, an attempt will be made to unsign the cookie with each secret in order.
+
+## Example
+
+```js
+var express      = require('express')
+var cookieParser = require('cookie-parser')
+
+var app = express()
+app.use(cookieParser())
+
+app.get('/', function(req, res) {
+  console.log("Cookies: ", req.cookies)
+})
+
+app.listen(8080)
+
+// curl command that sends an HTTP request with two cookies
+// curl http://127.0.0.1:8080 --cookie "Cho=Kim;Greet=Hello"
+```
+
+### [MIT Licensed](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/cookie-parser.svg
+[npm-url]: https://npmjs.org/package/cookie-parser
+[node-version-image]: https://img.shields.io/node/v/cookie-parser.svg
+[node-version-url]: http://nodejs.org/download/
+[travis-image]: https://img.shields.io/travis/expressjs/cookie-parser/master.svg
+[travis-url]: https://travis-ci.org/expressjs/cookie-parser
+[coveralls-image]: https://img.shields.io/coveralls/expressjs/cookie-parser/master.svg
+[coveralls-url]: https://coveralls.io/r/expressjs/cookie-parser?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/cookie-parser.svg
+[downloads-url]: https://npmjs.org/package/cookie-parser
@@ -0,0 +1,179 @@
+/*!
+ * cookie-parser
+ * Copyright(c) 2014 TJ Holowaychuk
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var cookie = require('cookie');
+var signature = require('cookie-signature');
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = cookieParser;
+module.exports.JSONCookie = JSONCookie;
+module.exports.JSONCookies = JSONCookies;
+module.exports.signedCookie = signedCookie;
+module.exports.signedCookies = signedCookies;
+
+/**
+ * Parse Cookie header and populate `req.cookies`
+ * with an object keyed by the cookie names.
+ *
+ * @param {string|array} [secret] A string (or array of strings) representing cookie signing secret(s).
+ * @param {Object} [options]
+ * @return {Function}
+ * @public
+ */
+
+function cookieParser(secret, options) {
+  return function cookieParser(req, res, next) {
+    if (req.cookies) {
+      return next();
+    }
+
+    var cookies = req.headers.cookie;
+    var secrets = !secret || Array.isArray(secret)
+      ? (secret || [])
+      : [secret];
+
+    req.secret = secrets[0];
+    req.cookies = Object.create(null);
+    req.signedCookies = Object.create(null);
+
+    // no cookies
+    if (!cookies) {
+      return next();
+    }
+
+    req.cookies = cookie.parse(cookies, options);
+
+    // parse signed cookies
+    if (secrets.length !== 0) {
+      req.signedCookies = signedCookies(req.cookies, secrets);
+      req.signedCookies = JSONCookies(req.signedCookies);
+    }
+
+    // parse JSON cookies
+    req.cookies = JSONCookies(req.cookies);
+
+    next();
+  };
+}
+
+/**
+ * Parse JSON cookie string.
+ *
+ * @param {String} str
+ * @return {Object} Parsed object or undefined if not json cookie
+ * @public
+ */
+
+function JSONCookie(str) {
+  if (typeof str !== 'string' || str.substr(0, 2) !== 'j:') {
+    return undefined;
+  }
+
+  try {
+    return JSON.parse(str.slice(2));
+  } catch (err) {
+    return undefined;
+  }
+}
+
+/**
+ * Parse JSON cookies.
+ *
+ * @param {Object} obj
+ * @return {Object}
+ * @public
+ */
+
+function JSONCookies(obj) {
+  var cookies = Object.keys(obj);
+  var key;
+  var val;
+
+  for (var i = 0; i < cookies.length; i++) {
+    key = cookies[i];
+    val = JSONCookie(obj[key]);
+
+    if (val) {
+      obj[key] = val;
+    }
+  }
+
+  return obj;
+}
+
+/**
+ * Parse a signed cookie string, return the decoded value.
+ *
+ * @param {String} str signed cookie string
+ * @param {string|array} secret
+ * @return {String} decoded value
+ * @public
+ */
+
+function signedCookie(str, secret) {
+  if (typeof str !== 'string') {
+    return undefined;
+  }
+
+  if (str.substr(0, 2) !== 's:') {
+    return str;
+  }
+
+  var secrets = !secret || Array.isArray(secret)
+    ? (secret || [])
+    : [secret];
+
+  for (var i = 0; i < secrets.length; i++) {
+    var val = signature.unsign(str.slice(2), secrets[i]);
+
+    if (val !== false) {
+      return val;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Parse signed cookies, returning an object containing the decoded key/value
+ * pairs, while removing the signed key from obj.
+ *
+ * @param {Object} obj
+ * @param {string|array} secret
+ * @return {Object}
+ * @public
+ */
+
+function signedCookies(obj, secret) {
+  var cookies = Object.keys(obj);
+  var dec;
+  var key;
+  var ret = Object.create(null);
+  var val;
+
+  for (var i = 0; i < cookies.length; i++) {
+    key = cookies[i];
+    val = obj[key];
+    dec = signedCookie(val, secret);
+
+    if (val !== dec) {
+      ret[key] = dec;
+      delete obj[key];
+    }
+  }
+
+  return ret;
+}
@@ -0,0 +1,92 @@
+0.2.2 / 2015-09-17
+==================
+
+  * Fix regression when setting empty cookie value
+    - Ease the new restriction, which is just basic header-level validation
+  * Fix typo in invalid value errors
+
+0.2.1 / 2015-09-17
+==================
+
+  * Throw on invalid values provided to `serialize`
+    - Ensures the resulting string is a valid HTTP header value
+
+0.2.0 / 2015-08-13
+==================
+
+  * Add `firstPartyOnly` option
+  * Throw better error for invalid argument to parse
+  * perf: hoist regular expression
+
+0.1.5 / 2015-09-17
+==================
+
+  * Fix regression when setting empty cookie value
+    - Ease the new restriction, which is just basic header-level validation
+  * Fix typo in invalid value errors
+
+0.1.4 / 2015-09-17
+==================
+
+  * Throw better error for invalid argument to parse
+  * Throw on invalid values provided to `serialize`
+    - Ensures the resulting string is a valid HTTP header value
+
+0.1.3 / 2015-05-19
+==================
+
+  * Reduce the scope of try-catch deopt
+  * Remove argument reassignments
+
+0.1.2 / 2014-04-16
+==================
+
+  * Remove unnecessary files from npm package
+
+0.1.1 / 2014-02-23
+==================
+
+  * Fix bad parse when cookie value contained a comma
+  * Fix support for `maxAge` of `0`
+
+0.1.0 / 2013-05-01
+==================
+
+  * Add `decode` option
+  * Add `encode` option
+
+0.0.6 / 2013-04-08
+==================
+
+  * Ignore cookie parts missing `=`
+
+0.0.5 / 2012-10-29
+==================
+
+  * Return raw cookie value if value unescape errors
+
+0.0.4 / 2012-06-21
+==================
+
+  * Use encode/decodeURIComponent for cookie encoding/decoding
+    - Improve server/client interoperability
+
+0.0.3 / 2012-06-06
+==================
+
+  * Only escape special characters per the cookie RFC
+
+0.0.2 / 2012-06-01
+==================
+
+  * Fix `maxAge` option to not throw error
+
+0.0.1 / 2012-05-28
+==================
+
+  * Add more tests
+
+0.0.0 / 2012-05-28
+==================
+
+  * Initial release
@@ -0,0 +1,24 @@
+(The MIT License)
+
+Copyright (c) 2012-2014 Roman Shtylman <[email protected]>
+Copyright (c) 2015 Douglas Christopher Wilson <[email protected]>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
@@ -0,0 +1,67 @@
+# cookie
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Node.js Version][node-version-image]][node-version-url]
+[![Build Status][travis-image]][travis-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+
+cookie is a basic cookie parser and serializer. It doesn't make assumptions about how you are going to deal with your cookies. It basically just provides a way to read and write the HTTP cookie headers.
+
+See [RFC6265](http://tools.ietf.org/html/rfc6265) for details about the http header for cookies.
+
+## how?
+
+```
+npm install cookie
+```
+
+```javascript
+var cookie = require('cookie');
+
+var hdr = cookie.serialize('foo', 'bar');
+// hdr = 'foo=bar';
+
+var cookies = cookie.parse('foo=bar; cat=meow; dog=ruff');
+// cookies = { foo: 'bar', cat: 'meow', dog: 'ruff' };
+```
+
+## more
+
+The serialize function takes a third parameter, an object, to set cookie options. See the RFC for valid values.
+
+### path
+> cookie path
+
+### expires
+> absolute expiration date for the cookie (Date object)
+
+### maxAge
+> relative max age of the cookie from when the client receives it (seconds)
+
+### domain
+> domain for the cookie
+
+### secure
+> true or false
+
+### httpOnly
+> true or false
+
+### firstPartyOnly
+> true or false
+
+## License
+
+[MIT](LICENSE)
+
+[npm-image]: https://img.shields.io/npm/v/cookie.svg
+[npm-url]: https://npmjs.org/package/cookie
+[node-version-image]: https://img.shields.io/node/v/cookie.svg
+[node-version-url]: http://nodejs.org/download/
+[travis-image]: https://img.shields.io/travis/jshttp/cookie/master.svg
+[travis-url]: https://travis-ci.org/jshttp/cookie
+[coveralls-image]: https://img.shields.io/coveralls/jshttp/cookie/master.svg
+[coveralls-url]: https://coveralls.io/r/jshttp/cookie?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/cookie.svg
+[downloads-url]: https://npmjs.org/package/cookie
@@ -0,0 +1,158 @@
+/*!
+ * cookie
+ * Copyright(c) 2012-2014 Roman Shtylman
+ * Copyright(c) 2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+/**
+ * Module exports.
+ * @public
+ */
+
+exports.parse = parse;
+exports.serialize = serialize;
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var decode = decodeURIComponent;
+var encode = encodeURIComponent;
+var pairSplitRegExp = /; */;
+
+/**
+ * RegExp to match field-content in RFC 7230 sec 3.2
+ *
+ * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
+ * field-vchar   = VCHAR / obs-text
+ * obs-text      = %x80-FF
+ */
+
+var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
+
+/**
+ * Parse a cookie header.
+ *
+ * Parse the given cookie header string into an object
+ * The object has the various cookies as keys(names) => values
+ *
+ * @param {string} str
+ * @param {object} [options]
+ * @return {object}
+ * @public
+ */
+
+function parse(str, options) {
+  if (typeof str !== 'string') {
+    throw new TypeError('argument str must be a string');
+  }
+
+  var obj = {}
+  var opt = options || {};
+  var pairs = str.split(pairSplitRegExp);
+  var dec = opt.decode || decode;
+
+  pairs.forEach(function(pair) {
+    var eq_idx = pair.indexOf('=')
+
+    // skip things that don't look like key=value
+    if (eq_idx < 0) {
+      return;
+    }
+
+    var key = pair.substr(0, eq_idx).trim()
+    var val = pair.substr(++eq_idx, pair.length).trim();
+
+    // quoted values
+    if ('"' == val[0]) {
+      val = val.slice(1, -1);
+    }
+
+    // only assign once
+    if (undefined == obj[key]) {
+      obj[key] = tryDecode(val, dec);
+    }
+  });
+
+  return obj;
+}
+
+/**
+ * Serialize data into a cookie header.
+ *
+ * Serialize the a name value pair into a cookie string suitable for
+ * http headers. An optional options object specified cookie parameters.
+ *
+ * serialize('foo', 'bar', { httpOnly: true })
+ *   => "foo=bar; httpOnly"
+ *
+ * @param {string} name
+ * @param {string} val
+ * @param {object} [options]
+ * @return {string}
+ * @public
+ */
+
+function serialize(name, val, options) {
+  var opt = options || {};
+  var enc = opt.encode || encode;
+
+  if (!fieldContentRegExp.test(name)) {
+    throw new TypeError('argument name is invalid');
+  }
+
+  var value = enc(val);
+
+  if (value && !fieldContentRegExp.test(value)) {
+    throw new TypeError('argument val is invalid');
+  }
+
+  var pairs = [name + '=' + value];
+
+  if (null != opt.maxAge) {
+    var maxAge = opt.maxAge - 0;
+    if (isNaN(maxAge)) throw new Error('maxAge should be a Number');
+    pairs.push('Max-Age=' + maxAge);
+  }
+
+  if (opt.domain) {
+    if (!fieldContentRegExp.test(opt.domain)) {
+      throw new TypeError('option domain is invalid');
+    }
+
+    pairs.push('Domain=' + opt.domain);
+  }
+
+  if (opt.path) {
+    if (!fieldContentRegExp.test(opt.path)) {
+      throw new TypeError('option path is invalid');
+    }
+
+    pairs.push('Path=' + opt.path);
+  }
+
+  if (opt.expires) pairs.push('Expires=' + opt.expires.toUTCString());
+  if (opt.httpOnly) pairs.push('HttpOnly');
+  if (opt.secure) pairs.push('Secure');
+  if (opt.firstPartyOnly) pairs.push('First-Party-Only');
+
+  return pairs.join('; ');
+}
+
+/**
+ * Try decoding a string using a decoding function.
+ *
+ * @param {string} str
+ * @param {function} decode
+ * @private
+ */
+
+function tryDecode(str, decode) {
+  try {
+    return decode(str);
+  } catch (e) {
+    return str;
+  }
+}
@@ -0,0 +1,33 @@
+{
+  "name": "cookie",
+  "description": "cookie parsing and serialization",
+  "version": "0.2.2",
+  "author": "Roman Shtylman <[email protected]>",
+  "contributors": [
+    "Douglas Christopher Wilson <[email protected]>"
+  ],
+  "license": "MIT",
+  "keywords": [
+    "cookie",
+    "cookies"
+  ],
+  "repository": "jshttp/cookie",
+  "devDependencies": {
+    "istanbul": "0.3.20",
+    "mocha": "1.21.5"
+  },
+  "files": [
+    "HISTORY.md",
+    "LICENSE",
+    "README.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.6"
+  },
+  "scripts": {
+    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/"
+  }
+}
@@ -0,0 +1,37 @@
+{
+  "name": "cookie-parser",
+  "description": "cookie parsing with signatures",
+  "version": "1.4.0",
+  "author": "TJ Holowaychuk <[email protected]> (http://tjholowaychuk.com)",
+  "contributors": [
+    "Douglas Christopher Wilson <[email protected]>"
+  ],
+  "license": "MIT",
+  "repository": "expressjs/cookie-parser",
+  "keywords": [
+    "cookie",
+    "middleware"
+  ],
+  "dependencies": {
+    "cookie": "0.2.2",
+    "cookie-signature": "1.0.6"
+  },
+  "devDependencies": {
+    "istanbul": "0.3.20",
+    "mocha": "2.2.5",
+    "supertest": "1.1.0"
+  },
+  "files": [
+    "LICENSE",
+    "HISTORY.md",
+    "index.js"
+  ],
+  "engines": {
+    "node": ">= 0.8.0"
+  },
+  "scripts": {
+    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
+    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/"
+  }
+}