Backend half

SerpentRace_Backend/node_modules/express/lib/response.js

@@ -12,16 +12,18 @@
  * @private
  */
 
+var Buffer = require('safe-buffer').Buffer
 var contentDisposition = require('content-disposition');
 var createError = require('http-errors')
+var deprecate = require('depd')('express');
 var encodeUrl = require('encodeurl');
 var escapeHtml = require('escape-html');
-var http = require('node:http');
+var http = require('http');
+var isAbsolute = require('./utils').isAbsolute;
 var onFinished = require('on-finished');
-var mime = require('mime-types')
-var path = require('node:path');
-var pathIsAbsolute = require('node:path').isAbsolute;
+var path = require('path');
 var statuses = require('statuses')
+var merge = require('utils-merge');
 var sign = require('cookie-signature').sign;
 var normalizeType = require('./utils').normalizeType;
 var normalizeTypes = require('./utils').normalizeTypes;
@@ -29,6 +31,7 @@ var setCharset = require('./utils').setCharset;
 var cookie = require('cookie');
 var send = require('send');
 var extname = path.extname;
+var mime = send.mime;
 var resolve = path.resolve;
 var vary = require('vary');
 
@@ -47,28 +50,24 @@ var res = Object.create(http.ServerResponse.prototype)
 module.exports = res
 
 /**
- * Set the HTTP status code for the response.
+ * Module variables.
+ * @private
+ */
+
+var charsetRegExp = /;\s*charset\s*=/;
+
+/**
+ * Set status `code`.
  *
- * Expects an integer value between 100 and 999 inclusive.
- * Throws an error if the provided status code is not an integer or if it's outside the allowable range.
- *
- * @param {number} code - The HTTP status code to set.
- * @return {ServerResponse} - Returns itself for chaining methods.
- * @throws {TypeError} If `code` is not an integer.
- * @throws {RangeError} If `code` is outside the range 100 to 999.
+ * @param {Number} code
+ * @return {ServerResponse}
  * @public
  */
 
 res.status = function status(code) {
-  // Check if the status code is not an integer
-  if (!Number.isInteger(code)) {
-    throw new TypeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be an integer.`);
+  if ((typeof code === 'string' || Math.floor(code) !== code) && code > 99 && code < 1000) {
+    deprecate('res.status(' + JSON.stringify(code) + '): use res.status(' + Math.floor(code) + ') instead')
   }
-  // Check if the status code is outside of Node's valid range
-  if (code < 100 || code > 999) {
-    throw new RangeError(`Invalid status code: ${JSON.stringify(code)}. Status code must be greater than 99 and less than 1000.`);
-  }
-
   this.statusCode = code;
   return this;
 };
@@ -80,11 +79,7 @@ res.status = function status(code) {
  *
  *    res.links({
  *      next: 'http://api.example.com/users?page=2',
- *      last: 'http://api.example.com/users?page=5',
- *      pages: [
- *        'http://api.example.com/users?page=1',
- *        'http://api.example.com/users?page=2'
- *      ]
+ *      last: 'http://api.example.com/users?page=5'
  *    });
  *
  * @param {Object} links
@@ -92,18 +87,11 @@ res.status = function status(code) {
  * @public
  */
 
-res.links = function(links) {
+res.links = function(links){
   var link = this.get('Link') || '';
   if (link) link += ', ';
-  return this.set('Link', link + Object.keys(links).map(function(rel) {
-    // Allow multiple links if links[rel] is an array
-    if (Array.isArray(links[rel])) {
-      return links[rel].map(function (singleLink) {
-        return `<${singleLink}>; rel="${rel}"`;
-      }).join(', ');
-    } else {
-      return `<${links[rel]}>; rel="${rel}"`;
-    }
+  return this.set('Link', link + Object.keys(links).map(function(rel){
+    return '<' + links[rel] + '>; rel="' + rel + '"';
   }).join(', '));
 };
 
@@ -129,6 +117,31 @@ res.send = function send(body) {
   // settings
   var app = this.app;
 
+  // allow status / body
+  if (arguments.length === 2) {
+    // res.send(body, status) backwards compat
+    if (typeof arguments[0] !== 'number' && typeof arguments[1] === 'number') {
+      deprecate('res.send(body, status): Use res.status(status).send(body) instead');
+      this.statusCode = arguments[1];
+    } else {
+      deprecate('res.send(status, body): Use res.status(status).send(body) instead');
+      this.statusCode = arguments[0];
+      chunk = arguments[1];
+    }
+  }
+
+  // disambiguate res.send(status) and res.send(status, num)
+  if (typeof chunk === 'number' && arguments.length === 1) {
+    // res.send(status) will set status message as text string
+    if (!this.get('Content-Type')) {
+      this.type('txt');
+    }
+
+    deprecate('res.send(status): Use res.sendStatus(status) instead');
+    this.statusCode = chunk;
+    chunk = statuses.message[chunk]
+  }
+
   switch (typeof chunk) {
     // string defaulting to html
     case 'string':
@@ -141,7 +154,7 @@ res.send = function send(body) {
     case 'object':
       if (chunk === null) {
         chunk = '';
-      } else if (ArrayBuffer.isView(chunk)) {
+      } else if (Buffer.isBuffer(chunk)) {
         if (!this.get('Content-Type')) {
           this.type('bin');
         }
@@ -194,7 +207,7 @@ res.send = function send(body) {
   }
 
   // freshness
-  if (req.fresh) this.status(304);
+  if (req.fresh) this.statusCode = 304;
 
   // strip irrelevant headers
   if (204 === this.statusCode || 304 === this.statusCode) {
@@ -235,12 +248,27 @@ res.send = function send(body) {
  */
 
 res.json = function json(obj) {
+  var val = obj;
+
+  // allow status / body
+  if (arguments.length === 2) {
+    // res.json(body, status) backwards compat
+    if (typeof arguments[1] === 'number') {
+      deprecate('res.json(obj, status): Use res.status(status).json(obj) instead');
+      this.statusCode = arguments[1];
+    } else {
+      deprecate('res.json(status, obj): Use res.status(status).json(obj) instead');
+      this.statusCode = arguments[0];
+      val = arguments[1];
+    }
+  }
+
   // settings
   var app = this.app;
   var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(obj, replacer, spaces, escape)
+  var body = stringify(val, replacer, spaces, escape)
 
   // content-type
   if (!this.get('Content-Type')) {
@@ -263,12 +291,27 @@ res.json = function json(obj) {
  */
 
 res.jsonp = function jsonp(obj) {
+  var val = obj;
+
+  // allow status / body
+  if (arguments.length === 2) {
+    // res.jsonp(body, status) backwards compat
+    if (typeof arguments[1] === 'number') {
+      deprecate('res.jsonp(obj, status): Use res.status(status).jsonp(obj) instead');
+      this.statusCode = arguments[1];
+    } else {
+      deprecate('res.jsonp(status, obj): Use res.status(status).jsonp(obj) instead');
+      this.statusCode = arguments[0];
+      val = arguments[1];
+    }
+  }
+
   // settings
   var app = this.app;
   var escape = app.get('json escape')
   var replacer = app.get('json replacer');
   var spaces = app.get('json spaces');
-  var body = stringify(obj, replacer, spaces, escape)
+  var body = stringify(val, replacer, spaces, escape)
   var callback = this.req.query[app.get('jsonp callback name')];
 
   // content-type
@@ -326,7 +369,7 @@ res.jsonp = function jsonp(obj) {
 res.sendStatus = function sendStatus(statusCode) {
   var body = statuses.message[statusCode] || String(statusCode)
 
-  this.status(statusCode);
+  this.statusCode = statusCode;
   this.type('txt');
 
   return this.send(body);
@@ -394,15 +437,12 @@ res.sendFile = function sendFile(path, options, callback) {
     opts = {};
   }
 
-  if (!opts.root && !pathIsAbsolute(path)) {
+  if (!opts.root && !isAbsolute(path)) {
     throw new TypeError('path must be absolute or specify root to res.sendFile');
   }
 
   // create file stream
   var pathname = encodeURI(path);
-
-  // wire application etag option to send
-  opts.etag = this.app.enabled('etag');
   var file = send(req, pathname, opts);
 
   // transfer
@@ -417,6 +457,78 @@ res.sendFile = function sendFile(path, options, callback) {
   });
 };
 
+/**
+ * Transfer the file at the given `path`.
+ *
+ * Automatically sets the _Content-Type_ response header field.
+ * The callback `callback(err)` is invoked when the transfer is complete
+ * or when an error occurs. Be sure to check `res.headersSent`
+ * if you wish to attempt responding, as the header and some data
+ * may have already been transferred.
+ *
+ * Options:
+ *
+ *   - `maxAge`   defaulting to 0 (can be string converted by `ms`)
+ *   - `root`     root directory for relative filenames
+ *   - `headers`  object of headers to serve with file
+ *   - `dotfiles` serve dotfiles, defaulting to false; can be `"allow"` to send them
+ *
+ * Other options are passed along to `send`.
+ *
+ * Examples:
+ *
+ *  The following example illustrates how `res.sendfile()` may
+ *  be used as an alternative for the `static()` middleware for
+ *  dynamic situations. The code backing `res.sendfile()` is actually
+ *  the same code, so HTTP cache support etc is identical.
+ *
+ *     app.get('/user/:uid/photos/:file', function(req, res){
+ *       var uid = req.params.uid
+ *         , file = req.params.file;
+ *
+ *       req.user.mayViewFilesFrom(uid, function(yes){
+ *         if (yes) {
+ *           res.sendfile('/uploads/' + uid + '/' + file);
+ *         } else {
+ *           res.send(403, 'Sorry! you cant see that.');
+ *         }
+ *       });
+ *     });
+ *
+ * @public
+ */
+
+res.sendfile = function (path, options, callback) {
+  var done = callback;
+  var req = this.req;
+  var res = this;
+  var next = req.next;
+  var opts = options || {};
+
+  // support function as second arg
+  if (typeof options === 'function') {
+    done = options;
+    opts = {};
+  }
+
+  // create file stream
+  var file = send(req, path, opts);
+
+  // transfer
+  sendfile(res, file, opts, function (err) {
+    if (done) return done(err);
+    if (err && err.code === 'EISDIR') return next();
+
+    // next() all but write errors
+    if (err && err.code !== 'ECONNABORTED' && err.syscall !== 'write') {
+      next(err);
+    }
+  });
+};
+
+res.sendfile = deprecate.function(res.sendfile,
+  'res.sendfile: Use res.sendFile instead');
+
 /**
  * Transfer the file at the given `path` as an attachment.
  *
@@ -487,10 +599,8 @@ res.download = function download (path, filename, options, callback) {
 };
 
 /**
- * Set _Content-Type_ response header with `type` through `mime.contentType()`
+ * Set _Content-Type_ response header with `type` through `mime.lookup()`
  * when it does not contain "/", or set the Content-Type to `type` otherwise.
- * When no mapping is found though `mime.contentType()`, the type is set to
- * "application/octet-stream".
  *
  * Examples:
  *
@@ -508,7 +618,7 @@ res.download = function download (path, filename, options, callback) {
 res.contentType =
 res.type = function contentType(type) {
   var ct = type.indexOf('/') === -1
-    ? (mime.contentType(type) || 'application/octet-stream')
+    ? mime.lookup(type)
     : type;
 
   return this.set('Content-Type', ct);
@@ -657,9 +767,6 @@ res.append = function append(field, val) {
  *
  * Aliased as `res.header()`.
  *
- * When the set header is "Content-Type", the type is expanded to include
- * the charset if not present using `mime.contentType()`.
- *
  * @param {String|Object} field
  * @param {String|Array} val
  * @return {ServerResponse} for chaining
@@ -678,7 +785,10 @@ res.header = function header(field, val) {
       if (Array.isArray(value)) {
         throw new TypeError('Content-Type cannot be set to an Array');
       }
-      value = mime.contentType(value)
+      if (!charsetRegExp.test(value)) {
+        var charset = mime.charsets.lookup(value.split(';')[0]);
+        if (charset) value += '; charset=' + charset.toLowerCase();
+      }
     }
 
     this.setHeader(field, value);
@@ -712,10 +822,15 @@ res.get = function(field){
  */
 
 res.clearCookie = function clearCookie(name, options) {
-  // Force cookie expiration by setting expires to the past
-  const opts = { path: '/', ...options, expires: new Date(1)};
-  // ensure maxAge is not passed
-  delete opts.maxAge
+  if (options) {
+    if (options.maxAge) {
+      deprecate('res.clearCookie: Passing "options.maxAge" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.');
+    }
+    if (options.expires) {
+      deprecate('res.clearCookie: Passing "options.expires" is deprecated. In v5.0.0 of Express, this option will be ignored, as res.clearCookie will automatically set cookies to expire immediately. Please update your code to omit this option.');
+    }
+  }
+  var opts = merge({ expires: new Date(1), path: '/' }, options);
 
   return this.cookie(name, '', opts);
 };
@@ -745,7 +860,7 @@ res.clearCookie = function clearCookie(name, options) {
  */
 
 res.cookie = function (name, value, options) {
-  var opts = { ...options };
+  var opts = merge({}, options);
   var secret = this.req.secret;
   var signed = opts.signed;
 
@@ -797,13 +912,27 @@ res.cookie = function (name, value, options) {
  */
 
 res.location = function location(url) {
-  return this.set('Location', encodeUrl(url));
+  var loc;
+
+  // "back" is an alias for the referrer
+  if (url === 'back') {
+    deprecate('res.location("back"): use res.location(req.get("Referrer") || "/") and refer to https://dub.sh/security-redirect for best practices');
+    loc = this.req.get('Referrer') || '/';
+  } else {
+    loc = String(url);
+  }
+
+  return this.set('Location', encodeUrl(loc));
 };
 
 /**
  * Redirect to the given `url` with optional response `status`
  * defaulting to 302.
  *
+ * The resulting `url` is determined by `res.location()`, so
+ * it will play nicely with mounted apps, relative paths,
+ * `"back"` etc.
+ *
  * Examples:
  *
  *    res.redirect('/foo/bar');
@@ -821,8 +950,13 @@ res.redirect = function redirect(url) {
 
   // allow status / url
   if (arguments.length === 2) {
-    status = arguments[0]
-    address = arguments[1]
+    if (typeof arguments[0] === 'number') {
+      status = arguments[0];
+      address = arguments[1];
+    } else {
+      deprecate('res.redirect(url, status): Use res.redirect(status, url) instead');
+      status = arguments[1];
+    }
   }
 
   // Set location header
@@ -845,7 +979,7 @@ res.redirect = function redirect(url) {
   });
 
   // Respond
-  this.status(status);
+  this.statusCode = status;
   this.set('Content-Length', Buffer.byteLength(body));
 
   if (this.req.method === 'HEAD') {
@@ -865,6 +999,12 @@ res.redirect = function redirect(url) {
  */
 
 res.vary = function(field){
+  // checks for back-compat
+  if (!field || (Array.isArray(field) && !field.length)) {
+    deprecate('res.vary(): Provide a field name');
+    return this;
+  }
+
   vary(this, field);
 
   return this;