3 * Copyright(c) 2012 TJ Holowaychuk
4 * Copyright(c) 2014-2016 Douglas Christopher Wilson
11 * Module dependencies.
15 var createError = require('http-errors')
16 var debug = require('debug')('send')
17 var deprecate = require('depd')('send')
18 var destroy = require('destroy')
19 var encodeUrl = require('encodeurl')
20 var escapeHtml = require('escape-html')
21 var etag = require('etag')
22 var fresh = require('fresh')
23 var fs = require('fs')
24 var mime = require('mime')
25 var ms = require('ms')
26 var onFinished = require('on-finished')
27 var parseRange = require('range-parser')
28 var path = require('path')
29 var statuses = require('statuses')
30 var Stream = require('stream')
31 var util = require('util')
34 * Path function references.
38 var extname = path.extname
40 var normalize = path.normalize
41 var resolve = path.resolve
45 * Regular expression for identifying a bytes Range header.
49 var BYTES_RANGE_REGEXP = /^ *bytes=/
52 * Maximum value allowed for the max age.
56 var MAX_MAXAGE = 60 * 60 * 24 * 365 * 1000 // 1 year
59 * Regular expression to match a path with a directory up component.
63 var UP_PATH_REGEXP = /(?:^|[\\/])\.\.(?:[\\/]|$)/
71 module.exports.mime = mime
74 * Return a `SendStream` for `req` and `path`.
77 * @param {string} path
78 * @param {object} [options]
79 * @return {SendStream}
83 function send (req, path, options) {
84 return new SendStream(req, path, options)
88 * Initialize a `SendStream` with the given `path`.
90 * @param {Request} req
91 * @param {String} path
92 * @param {object} [options]
96 function SendStream (req, path, options) {
99 var opts = options || {}
105 this._acceptRanges = opts.acceptRanges !== undefined
106 ? Boolean(opts.acceptRanges)
109 this._cacheControl = opts.cacheControl !== undefined
110 ? Boolean(opts.cacheControl)
113 this._etag = opts.etag !== undefined
117 this._dotfiles = opts.dotfiles !== undefined
121 if (this._dotfiles !== 'ignore' && this._dotfiles !== 'allow' && this._dotfiles !== 'deny') {
122 throw new TypeError('dotfiles option must be "allow", "deny", or "ignore"')
125 this._hidden = Boolean(opts.hidden)
127 if (opts.hidden !== undefined) {
128 deprecate('hidden: use dotfiles: \'' + (this._hidden ? 'allow' : 'ignore') + '\' instead')
132 if (opts.dotfiles === undefined) {
133 this._dotfiles = undefined
136 this._extensions = opts.extensions !== undefined
137 ? normalizeList(opts.extensions, 'extensions option')
140 this._immutable = opts.immutable !== undefined
141 ? Boolean(opts.immutable)
144 this._index = opts.index !== undefined
145 ? normalizeList(opts.index, 'index option')
148 this._lastModified = opts.lastModified !== undefined
149 ? Boolean(opts.lastModified)
152 this._maxage = opts.maxAge || opts.maxage
153 this._maxage = typeof this._maxage === 'string'
155 : Number(this._maxage)
156 this._maxage = !isNaN(this._maxage)
157 ? Math.min(Math.max(0, this._maxage), MAX_MAXAGE)
160 this._root = opts.root
164 if (!this._root && opts.from) {
170 * Inherits from `Stream`.
173 util.inherits(SendStream, Stream)
176 * Enable or disable etag generation.
178 * @param {Boolean} val
179 * @return {SendStream}
183 SendStream.prototype.etag = deprecate.function(function etag (val) {
184 this._etag = Boolean(val)
185 debug('etag %s', this._etag)
187 }, 'send.etag: pass etag as option')
190 * Enable or disable "hidden" (dot) files.
192 * @param {Boolean} path
193 * @return {SendStream}
197 SendStream.prototype.hidden = deprecate.function(function hidden (val) {
198 this._hidden = Boolean(val)
199 this._dotfiles = undefined
200 debug('hidden %s', this._hidden)
202 }, 'send.hidden: use dotfiles option')
205 * Set index `paths`, set to a falsy
206 * value to disable index support.
208 * @param {String|Boolean|Array} paths
209 * @return {SendStream}
213 SendStream.prototype.index = deprecate.function(function index (paths) {
214 var index = !paths ? [] : normalizeList(paths, 'paths argument')
215 debug('index %o', paths)
218 }, 'send.index: pass index as option')
223 * @param {String} path
224 * @return {SendStream}
228 SendStream.prototype.root = function root (path) {
229 this._root = resolve(String(path))
230 debug('root %s', this._root)
234 SendStream.prototype.from = deprecate.function(SendStream.prototype.root,
235 'send.from: pass root as option')
237 SendStream.prototype.root = deprecate.function(SendStream.prototype.root,
238 'send.root: pass root as option')
241 * Set max-age to `maxAge`.
243 * @param {Number} maxAge
244 * @return {SendStream}
248 SendStream.prototype.maxage = deprecate.function(function maxage (maxAge) {
249 this._maxage = typeof maxAge === 'string'
252 this._maxage = !isNaN(this._maxage)
253 ? Math.min(Math.max(0, this._maxage), MAX_MAXAGE)
255 debug('max-age %d', this._maxage)
257 }, 'send.maxage: pass maxAge as option')
260 * Emit error with `status`.
262 * @param {number} status
263 * @param {Error} [err]
267 SendStream.prototype.error = function error (status, err) {
268 // emit if listeners instead of responding
269 if (hasListeners(this, 'error')) {
270 return this.emit('error', createError(status, err, {
276 var msg = statuses[status] || String(status)
277 var doc = createHtmlDocument('Error', escapeHtml(msg))
279 // clear existing headers
283 if (err && err.headers) {
284 setHeaders(res, err.headers)
287 // send basic response
288 res.statusCode = status
289 res.setHeader('Content-Type', 'text/html; charset=UTF-8')
290 res.setHeader('Content-Length', Buffer.byteLength(doc))
291 res.setHeader('Content-Security-Policy', "default-src 'none'")
292 res.setHeader('X-Content-Type-Options', 'nosniff')
297 * Check if the pathname ends with "/".
303 SendStream.prototype.hasTrailingSlash = function hasTrailingSlash () {
304 return this.path[this.path.length - 1] === '/'
308 * Check if this is a conditional GET request.
314 SendStream.prototype.isConditionalGET = function isConditionalGET () {
315 return this.req.headers['if-match'] ||
316 this.req.headers['if-unmodified-since'] ||
317 this.req.headers['if-none-match'] ||
318 this.req.headers['if-modified-since']
322 * Check if the request preconditions failed.
328 SendStream.prototype.isPreconditionFailure = function isPreconditionFailure () {
333 var match = req.headers['if-match']
335 var etag = res.getHeader('ETag')
336 return !etag || (match !== '*' && parseTokenList(match).every(function (match) {
337 return match !== etag && match !== 'W/' + etag && 'W/' + match !== etag
341 // if-unmodified-since
342 var unmodifiedSince = parseHttpDate(req.headers['if-unmodified-since'])
343 if (!isNaN(unmodifiedSince)) {
344 var lastModified = parseHttpDate(res.getHeader('Last-Modified'))
345 return isNaN(lastModified) || lastModified > unmodifiedSince
352 * Strip content-* header fields.
357 SendStream.prototype.removeContentHeaderFields = function removeContentHeaderFields () {
359 var headers = getHeaderNames(res)
361 for (var i = 0; i < headers.length; i++) {
362 var header = headers[i]
363 if (header.substr(0, 8) === 'content-' && header !== 'content-location') {
364 res.removeHeader(header)
370 * Respond with 304 not modified.
375 SendStream.prototype.notModified = function notModified () {
377 debug('not modified')
378 this.removeContentHeaderFields()
384 * Raise error that headers already sent.
389 SendStream.prototype.headersAlreadySent = function headersAlreadySent () {
390 var err = new Error('Can\'t set headers after they are sent.')
391 debug('headers already sent')
396 * Check if the request is cacheable, aka
397 * responded with 2xx or 304 (see RFC 2616 section 14.2{5,6}).
403 SendStream.prototype.isCachable = function isCachable () {
404 var statusCode = this.res.statusCode
405 return (statusCode >= 200 && statusCode < 300) ||
410 * Handle stat() error.
412 * @param {Error} error
416 SendStream.prototype.onStatError = function onStatError (error) {
417 switch (error.code) {
421 this.error(404, error)
424 this.error(500, error)
430 * Check if the cache is fresh.
436 SendStream.prototype.isFresh = function isFresh () {
437 return fresh(this.req.headers, {
438 'etag': this.res.getHeader('ETag'),
439 'last-modified': this.res.getHeader('Last-Modified')
444 * Check if the range is fresh.
450 SendStream.prototype.isRangeFresh = function isRangeFresh () {
451 var ifRange = this.req.headers['if-range']
458 if (ifRange.indexOf('"') !== -1) {
459 var etag = this.res.getHeader('ETag')
460 return Boolean(etag && ifRange.indexOf(etag) !== -1)
463 // if-range as modified date
464 var lastModified = this.res.getHeader('Last-Modified')
465 return parseHttpDate(lastModified) <= parseHttpDate(ifRange)
471 * @param {string} path
475 SendStream.prototype.redirect = function redirect (path) {
478 if (hasListeners(this, 'directory')) {
479 this.emit('directory', res, path)
483 if (this.hasTrailingSlash()) {
488 var loc = encodeUrl(collapseLeadingSlashes(this.path + '/'))
489 var doc = createHtmlDocument('Redirecting', 'Redirecting to <a href="' + escapeHtml(loc) + '">' +
490 escapeHtml(loc) + '</a>')
494 res.setHeader('Content-Type', 'text/html; charset=UTF-8')
495 res.setHeader('Content-Length', Buffer.byteLength(doc))
496 res.setHeader('Content-Security-Policy', "default-src 'none'")
497 res.setHeader('X-Content-Type-Options', 'nosniff')
498 res.setHeader('Location', loc)
505 * @param {Stream} res
506 * @return {Stream} res
510 SendStream.prototype.pipe = function pipe (res) {
512 var root = this._root
518 var path = decode(this.path)
525 if (~path.indexOf('\0')) {
534 path = normalize('.' + sep + path)
538 if (UP_PATH_REGEXP.test(path)) {
539 debug('malicious path "%s"', path)
544 // explode path parts
545 parts = path.split(sep)
547 // join / normalize from optional root dir
548 path = normalize(join(root, path))
550 // ".." is malicious without "root"
551 if (UP_PATH_REGEXP.test(path)) {
552 debug('malicious path "%s"', path)
557 // explode path parts
558 parts = normalize(path).split(sep)
565 if (containsDotFile(parts)) {
566 var access = this._dotfiles
569 if (access === undefined) {
570 access = parts[parts.length - 1][0] === '.'
571 ? (this._hidden ? 'allow' : 'ignore')
575 debug('%s dotfile "%s"', access, path)
589 // index file support
590 if (this._index.length && this.hasTrailingSlash()) {
602 * @param {String} path
606 SendStream.prototype.send = function send (path, stat) {
608 var options = this.options
612 var ranges = req.headers.range
613 var offset = options.start || 0
615 if (headersSent(res)) {
616 // impossible to send now
617 this.headersAlreadySent()
621 debug('pipe "%s"', path)
624 this.setHeader(path, stat)
629 // conditional GET support
630 if (this.isConditionalGET()) {
631 if (this.isPreconditionFailure()) {
636 if (this.isCachable() && this.isFresh()) {
642 // adjust len to start/end options
643 len = Math.max(0, len - offset)
644 if (options.end !== undefined) {
645 var bytes = options.end - offset + 1
646 if (len > bytes) len = bytes
650 if (this._acceptRanges && BYTES_RANGE_REGEXP.test(ranges)) {
652 ranges = parseRange(len, ranges, {
657 if (!this.isRangeFresh()) {
664 debug('range unsatisfiable')
667 res.setHeader('Content-Range', contentRange('bytes', len))
669 // 416 Requested Range Not Satisfiable
670 return this.error(416, {
671 headers: { 'Content-Range': res.getHeader('Content-Range') }
675 // valid (syntactically invalid/multiple ranges are treated as a regular response)
676 if (ranges !== -2 && ranges.length === 1) {
677 debug('range %j', ranges)
681 res.setHeader('Content-Range', contentRange('bytes', len, ranges[0]))
683 // adjust for requested range
684 offset += ranges[0].start
685 len = ranges[0].end - ranges[0].start + 1
690 for (var prop in options) {
691 opts[prop] = options[prop]
696 opts.end = Math.max(offset, offset + len - 1)
699 res.setHeader('Content-Length', len)
702 if (req.method === 'HEAD') {
707 this.stream(path, opts)
711 * Transfer file for `path`.
713 * @param {String} path
716 SendStream.prototype.sendFile = function sendFile (path) {
720 debug('stat "%s"', path)
721 fs.stat(path, function onstat (err, stat) {
722 if (err && err.code === 'ENOENT' && !extname(path) && path[path.length - 1] !== sep) {
723 // not found, check extensions
726 if (err) return self.onStatError(err)
727 if (stat.isDirectory()) return self.redirect(path)
728 self.emit('file', path, stat)
729 self.send(path, stat)
732 function next (err) {
733 if (self._extensions.length <= i) {
735 ? self.onStatError(err)
739 var p = path + '.' + self._extensions[i++]
741 debug('stat "%s"', p)
742 fs.stat(p, function (err, stat) {
743 if (err) return next(err)
744 if (stat.isDirectory()) return next()
745 self.emit('file', p, stat)
752 * Transfer index for `path`.
754 * @param {String} path
757 SendStream.prototype.sendIndex = function sendIndex (path) {
761 function next (err) {
762 if (++i >= self._index.length) {
763 if (err) return self.onStatError(err)
764 return self.error(404)
767 var p = join(path, self._index[i])
769 debug('stat "%s"', p)
770 fs.stat(p, function (err, stat) {
771 if (err) return next(err)
772 if (stat.isDirectory()) return next()
773 self.emit('file', p, stat)
782 * Stream `path` to the response.
784 * @param {String} path
785 * @param {Object} options
789 SendStream.prototype.stream = function stream (path, options) {
790 // TODO: this is all lame, refactor meeee
796 var stream = fs.createReadStream(path, options)
797 this.emit('stream', stream)
800 // response finished, done with the fd
801 onFinished(res, function onfinished () {
806 // error handling code-smell
807 stream.on('error', function onerror (err) {
808 // request already finished
816 self.onStatError(err)
820 stream.on('end', function onend () {
826 * Set content-type based on `path`
827 * if it hasn't been explicitly set.
829 * @param {String} path
833 SendStream.prototype.type = function type (path) {
836 if (res.getHeader('Content-Type')) return
838 var type = mime.lookup(path)
841 debug('no content-type')
845 var charset = mime.charsets.lookup(type)
847 debug('content-type %s', type)
848 res.setHeader('Content-Type', type + (charset ? '; charset=' + charset : ''))
852 * Set response header fields, most
853 * fields may be pre-defined.
855 * @param {String} path
856 * @param {Object} stat
860 SendStream.prototype.setHeader = function setHeader (path, stat) {
863 this.emit('headers', res, path, stat)
865 if (this._acceptRanges && !res.getHeader('Accept-Ranges')) {
866 debug('accept ranges')
867 res.setHeader('Accept-Ranges', 'bytes')
870 if (this._cacheControl && !res.getHeader('Cache-Control')) {
871 var cacheControl = 'public, max-age=' + Math.floor(this._maxage / 1000)
873 if (this._immutable) {
874 cacheControl += ', immutable'
877 debug('cache-control %s', cacheControl)
878 res.setHeader('Cache-Control', cacheControl)
881 if (this._lastModified && !res.getHeader('Last-Modified')) {
882 var modified = stat.mtime.toUTCString()
883 debug('modified %s', modified)
884 res.setHeader('Last-Modified', modified)
887 if (this._etag && !res.getHeader('ETag')) {
889 debug('etag %s', val)
890 res.setHeader('ETag', val)
895 * Clear all headers from a response.
897 * @param {object} res
901 function clearHeaders (res) {
902 var headers = getHeaderNames(res)
904 for (var i = 0; i < headers.length; i++) {
905 res.removeHeader(headers[i])
910 * Collapse all leading slashes into a single slash
912 * @param {string} str
915 function collapseLeadingSlashes (str) {
916 for (var i = 0; i < str.length; i++) {
917 if (str[i] !== '/') {
923 ? '/' + str.substr(i)
928 * Determine if path parts contain a dotfile.
933 function containsDotFile (parts) {
934 for (var i = 0; i < parts.length; i++) {
936 if (part.length > 1 && part[0] === '.') {
945 * Create a Content-Range header.
947 * @param {string} type
948 * @param {number} size
949 * @param {array} [range]
952 function contentRange (type, size, range) {
953 return type + ' ' + (range ? range.start + '-' + range.end : '*') + '/' + size
957 * Create a minimal HTML document.
959 * @param {string} title
960 * @param {string} body
964 function createHtmlDocument (title, body) {
965 return '<!DOCTYPE html>\n' +
966 '<html lang="en">\n' +
968 '<meta charset="utf-8">\n' +
969 '<title>' + title + '</title>\n' +
972 '<pre>' + body + '</pre>\n' +
978 * decodeURIComponent.
980 * Allows V8 to only deoptimize this fn instead of all
983 * @param {String} path
987 function decode (path) {
989 return decodeURIComponent(path)
996 * Get the header names on a respnse.
998 * @param {object} res
999 * @returns {array[string]}
1003 function getHeaderNames (res) {
1004 return typeof res.getHeaderNames !== 'function'
1005 ? Object.keys(res._headers || {})
1006 : res.getHeaderNames()
1010 * Determine if emitter has listeners of a given type.
1012 * The way to do this check is done three different ways in Node.js >= 0.8
1013 * so this consolidates them into a minimal set using instance methods.
1015 * @param {EventEmitter} emitter
1016 * @param {string} type
1017 * @returns {boolean}
1021 function hasListeners (emitter, type) {
1022 var count = typeof emitter.listenerCount !== 'function'
1023 ? emitter.listeners(type).length
1024 : emitter.listenerCount(type)
1030 * Determine if the response headers have been sent.
1032 * @param {object} res
1033 * @returns {boolean}
1037 function headersSent (res) {
1038 return typeof res.headersSent !== 'boolean'
1039 ? Boolean(res._header)
1044 * Normalize the index option into an array.
1046 * @param {boolean|string|array} val
1047 * @param {string} name
1051 function normalizeList (val, name) {
1052 var list = [].concat(val || [])
1054 for (var i = 0; i < list.length; i++) {
1055 if (typeof list[i] !== 'string') {
1056 throw new TypeError(name + ' must be array of strings or false')
1064 * Parse an HTTP Date into a number.
1066 * @param {string} date
1070 function parseHttpDate (date) {
1071 var timestamp = date && Date.parse(date)
1073 return typeof timestamp === 'number'
1079 * Parse a HTTP token list.
1081 * @param {string} str
1085 function parseTokenList (str) {
1091 for (var i = 0, len = str.length; i < len; i++) {
1092 switch (str.charCodeAt(i)) {
1094 if (start === end) {
1099 list.push(str.substring(start, end))
1109 list.push(str.substring(start, end))
1115 * Set an object of headers on a response.
1117 * @param {object} res
1118 * @param {object} headers
1122 function setHeaders (res, headers) {
1123 var keys = Object.keys(headers)
1125 for (var i = 0; i < keys.length; i++) {
1127 res.setHeader(key, headers[key])