1 |
3a515b92
|
cagy
|
/*!
|
2 |
|
|
* content-disposition
|
3 |
|
|
* Copyright(c) 2014-2017 Douglas Christopher Wilson
|
4 |
|
|
* MIT Licensed
|
5 |
|
|
*/
|
6 |
|
|
|
7 |
|
|
'use strict'
|
8 |
|
|
|
9 |
|
|
/**
|
10 |
|
|
* Module exports.
|
11 |
|
|
* @public
|
12 |
|
|
*/
|
13 |
|
|
|
14 |
|
|
module.exports = contentDisposition
|
15 |
|
|
module.exports.parse = parse
|
16 |
|
|
|
17 |
|
|
/**
|
18 |
|
|
* Module dependencies.
|
19 |
|
|
* @private
|
20 |
|
|
*/
|
21 |
|
|
|
22 |
|
|
var basename = require('path').basename
|
23 |
|
|
var Buffer = require('safe-buffer').Buffer
|
24 |
|
|
|
25 |
|
|
/**
|
26 |
|
|
* RegExp to match non attr-char, *after* encodeURIComponent (i.e. not including "%")
|
27 |
|
|
* @private
|
28 |
|
|
*/
|
29 |
|
|
|
30 |
|
|
var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g // eslint-disable-line no-control-regex
|
31 |
|
|
|
32 |
|
|
/**
|
33 |
|
|
* RegExp to match percent encoding escape.
|
34 |
|
|
* @private
|
35 |
|
|
*/
|
36 |
|
|
|
37 |
|
|
var HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/
|
38 |
|
|
var HEX_ESCAPE_REPLACE_REGEXP = /%([0-9A-Fa-f]{2})/g
|
39 |
|
|
|
40 |
|
|
/**
|
41 |
|
|
* RegExp to match non-latin1 characters.
|
42 |
|
|
* @private
|
43 |
|
|
*/
|
44 |
|
|
|
45 |
|
|
var NON_LATIN1_REGEXP = /[^\x20-\x7e\xa0-\xff]/g
|
46 |
|
|
|
47 |
|
|
/**
|
48 |
|
|
* RegExp to match quoted-pair in RFC 2616
|
49 |
|
|
*
|
50 |
|
|
* quoted-pair = "\" CHAR
|
51 |
|
|
* CHAR = <any US-ASCII character (octets 0 - 127)>
|
52 |
|
|
* @private
|
53 |
|
|
*/
|
54 |
|
|
|
55 |
|
|
var QESC_REGEXP = /\\([\u0000-\u007f])/g // eslint-disable-line no-control-regex
|
56 |
|
|
|
57 |
|
|
/**
|
58 |
|
|
* RegExp to match chars that must be quoted-pair in RFC 2616
|
59 |
|
|
* @private
|
60 |
|
|
*/
|
61 |
|
|
|
62 |
|
|
var QUOTE_REGEXP = /([\\"])/g
|
63 |
|
|
|
64 |
|
|
/**
|
65 |
|
|
* RegExp for various RFC 2616 grammar
|
66 |
|
|
*
|
67 |
|
|
* parameter = token "=" ( token | quoted-string )
|
68 |
|
|
* token = 1*<any CHAR except CTLs or separators>
|
69 |
|
|
* separators = "(" | ")" | "<" | ">" | "@"
|
70 |
|
|
* | "," | ";" | ":" | "\" | <">
|
71 |
|
|
* | "/" | "[" | "]" | "?" | "="
|
72 |
|
|
* | "{" | "}" | SP | HT
|
73 |
|
|
* quoted-string = ( <"> *(qdtext | quoted-pair ) <"> )
|
74 |
|
|
* qdtext = <any TEXT except <">>
|
75 |
|
|
* quoted-pair = "\" CHAR
|
76 |
|
|
* CHAR = <any US-ASCII character (octets 0 - 127)>
|
77 |
|
|
* TEXT = <any OCTET except CTLs, but including LWS>
|
78 |
|
|
* LWS = [CRLF] 1*( SP | HT )
|
79 |
|
|
* CRLF = CR LF
|
80 |
|
|
* CR = <US-ASCII CR, carriage return (13)>
|
81 |
|
|
* LF = <US-ASCII LF, linefeed (10)>
|
82 |
|
|
* SP = <US-ASCII SP, space (32)>
|
83 |
|
|
* HT = <US-ASCII HT, horizontal-tab (9)>
|
84 |
|
|
* CTL = <any US-ASCII control character (octets 0 - 31) and DEL (127)>
|
85 |
|
|
* OCTET = <any 8-bit sequence of data>
|
86 |
|
|
* @private
|
87 |
|
|
*/
|
88 |
|
|
|
89 |
|
|
var PARAM_REGEXP = /;[\x09\x20]*([!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*=[\x09\x20]*("(?:[\x20!\x23-\x5b\x5d-\x7e\x80-\xff]|\\[\x20-\x7e])*"|[!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*/g // eslint-disable-line no-control-regex
|
90 |
|
|
var TEXT_REGEXP = /^[\x20-\x7e\x80-\xff]+$/
|
91 |
|
|
var TOKEN_REGEXP = /^[!#$%&'*+.0-9A-Z^_`a-z|~-]+$/
|
92 |
|
|
|
93 |
|
|
/**
|
94 |
|
|
* RegExp for various RFC 5987 grammar
|
95 |
|
|
*
|
96 |
|
|
* ext-value = charset "'" [ language ] "'" value-chars
|
97 |
|
|
* charset = "UTF-8" / "ISO-8859-1" / mime-charset
|
98 |
|
|
* mime-charset = 1*mime-charsetc
|
99 |
|
|
* mime-charsetc = ALPHA / DIGIT
|
100 |
|
|
* / "!" / "#" / "$" / "%" / "&"
|
101 |
|
|
* / "+" / "-" / "^" / "_" / "`"
|
102 |
|
|
* / "{" / "}" / "~"
|
103 |
|
|
* language = ( 2*3ALPHA [ extlang ] )
|
104 |
|
|
* / 4ALPHA
|
105 |
|
|
* / 5*8ALPHA
|
106 |
|
|
* extlang = *3( "-" 3ALPHA )
|
107 |
|
|
* value-chars = *( pct-encoded / attr-char )
|
108 |
|
|
* pct-encoded = "%" HEXDIG HEXDIG
|
109 |
|
|
* attr-char = ALPHA / DIGIT
|
110 |
|
|
* / "!" / "#" / "$" / "&" / "+" / "-" / "."
|
111 |
|
|
* / "^" / "_" / "`" / "|" / "~"
|
112 |
|
|
* @private
|
113 |
|
|
*/
|
114 |
|
|
|
115 |
|
|
var EXT_VALUE_REGEXP = /^([A-Za-z0-9!#$%&+\-^_`{}~]+)'(?:[A-Za-z]{2,3}(?:-[A-Za-z]{3}){0,3}|[A-Za-z]{4,8}|)'((?:%[0-9A-Fa-f]{2}|[A-Za-z0-9!#$&+.^_`|~-])+)$/
|
116 |
|
|
|
117 |
|
|
/**
|
118 |
|
|
* RegExp for various RFC 6266 grammar
|
119 |
|
|
*
|
120 |
|
|
* disposition-type = "inline" | "attachment" | disp-ext-type
|
121 |
|
|
* disp-ext-type = token
|
122 |
|
|
* disposition-parm = filename-parm | disp-ext-parm
|
123 |
|
|
* filename-parm = "filename" "=" value
|
124 |
|
|
* | "filename*" "=" ext-value
|
125 |
|
|
* disp-ext-parm = token "=" value
|
126 |
|
|
* | ext-token "=" ext-value
|
127 |
|
|
* ext-token = <the characters in token, followed by "*">
|
128 |
|
|
* @private
|
129 |
|
|
*/
|
130 |
|
|
|
131 |
|
|
var DISPOSITION_TYPE_REGEXP = /^([!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*(?:$|;)/ // eslint-disable-line no-control-regex
|
132 |
|
|
|
133 |
|
|
/**
|
134 |
|
|
* Create an attachment Content-Disposition header.
|
135 |
|
|
*
|
136 |
|
|
* @param {string} [filename]
|
137 |
|
|
* @param {object} [options]
|
138 |
|
|
* @param {string} [options.type=attachment]
|
139 |
|
|
* @param {string|boolean} [options.fallback=true]
|
140 |
|
|
* @return {string}
|
141 |
|
|
* @public
|
142 |
|
|
*/
|
143 |
|
|
|
144 |
|
|
function contentDisposition (filename, options) {
|
145 |
|
|
var opts = options || {}
|
146 |
|
|
|
147 |
|
|
// get type
|
148 |
|
|
var type = opts.type || 'attachment'
|
149 |
|
|
|
150 |
|
|
// get parameters
|
151 |
|
|
var params = createparams(filename, opts.fallback)
|
152 |
|
|
|
153 |
|
|
// format into string
|
154 |
|
|
return format(new ContentDisposition(type, params))
|
155 |
|
|
}
|
156 |
|
|
|
157 |
|
|
/**
|
158 |
|
|
* Create parameters object from filename and fallback.
|
159 |
|
|
*
|
160 |
|
|
* @param {string} [filename]
|
161 |
|
|
* @param {string|boolean} [fallback=true]
|
162 |
|
|
* @return {object}
|
163 |
|
|
* @private
|
164 |
|
|
*/
|
165 |
|
|
|
166 |
|
|
function createparams (filename, fallback) {
|
167 |
|
|
if (filename === undefined) {
|
168 |
|
|
return
|
169 |
|
|
}
|
170 |
|
|
|
171 |
|
|
var params = {}
|
172 |
|
|
|
173 |
|
|
if (typeof filename !== 'string') {
|
174 |
|
|
throw new TypeError('filename must be a string')
|
175 |
|
|
}
|
176 |
|
|
|
177 |
|
|
// fallback defaults to true
|
178 |
|
|
if (fallback === undefined) {
|
179 |
|
|
fallback = true
|
180 |
|
|
}
|
181 |
|
|
|
182 |
|
|
if (typeof fallback !== 'string' && typeof fallback !== 'boolean') {
|
183 |
|
|
throw new TypeError('fallback must be a string or boolean')
|
184 |
|
|
}
|
185 |
|
|
|
186 |
|
|
if (typeof fallback === 'string' && NON_LATIN1_REGEXP.test(fallback)) {
|
187 |
|
|
throw new TypeError('fallback must be ISO-8859-1 string')
|
188 |
|
|
}
|
189 |
|
|
|
190 |
|
|
// restrict to file base name
|
191 |
|
|
var name = basename(filename)
|
192 |
|
|
|
193 |
|
|
// determine if name is suitable for quoted string
|
194 |
|
|
var isQuotedString = TEXT_REGEXP.test(name)
|
195 |
|
|
|
196 |
|
|
// generate fallback name
|
197 |
|
|
var fallbackName = typeof fallback !== 'string'
|
198 |
|
|
? fallback && getlatin1(name)
|
199 |
|
|
: basename(fallback)
|
200 |
|
|
var hasFallback = typeof fallbackName === 'string' && fallbackName !== name
|
201 |
|
|
|
202 |
|
|
// set extended filename parameter
|
203 |
|
|
if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name)) {
|
204 |
|
|
params['filename*'] = name
|
205 |
|
|
}
|
206 |
|
|
|
207 |
|
|
// set filename parameter
|
208 |
|
|
if (isQuotedString || hasFallback) {
|
209 |
|
|
params.filename = hasFallback
|
210 |
|
|
? fallbackName
|
211 |
|
|
: name
|
212 |
|
|
}
|
213 |
|
|
|
214 |
|
|
return params
|
215 |
|
|
}
|
216 |
|
|
|
217 |
|
|
/**
|
218 |
|
|
* Format object to Content-Disposition header.
|
219 |
|
|
*
|
220 |
|
|
* @param {object} obj
|
221 |
|
|
* @param {string} obj.type
|
222 |
|
|
* @param {object} [obj.parameters]
|
223 |
|
|
* @return {string}
|
224 |
|
|
* @private
|
225 |
|
|
*/
|
226 |
|
|
|
227 |
|
|
function format (obj) {
|
228 |
|
|
var parameters = obj.parameters
|
229 |
|
|
var type = obj.type
|
230 |
|
|
|
231 |
|
|
if (!type || typeof type !== 'string' || !TOKEN_REGEXP.test(type)) {
|
232 |
|
|
throw new TypeError('invalid type')
|
233 |
|
|
}
|
234 |
|
|
|
235 |
|
|
// start with normalized type
|
236 |
|
|
var string = String(type).toLowerCase()
|
237 |
|
|
|
238 |
|
|
// append parameters
|
239 |
|
|
if (parameters && typeof parameters === 'object') {
|
240 |
|
|
var param
|
241 |
|
|
var params = Object.keys(parameters).sort()
|
242 |
|
|
|
243 |
|
|
for (var i = 0; i < params.length; i++) {
|
244 |
|
|
param = params[i]
|
245 |
|
|
|
246 |
|
|
var val = param.substr(-1) === '*'
|
247 |
|
|
? ustring(parameters[param])
|
248 |
|
|
: qstring(parameters[param])
|
249 |
|
|
|
250 |
|
|
string += '; ' + param + '=' + val
|
251 |
|
|
}
|
252 |
|
|
}
|
253 |
|
|
|
254 |
|
|
return string
|
255 |
|
|
}
|
256 |
|
|
|
257 |
|
|
/**
|
258 |
|
|
* Decode a RFC 6987 field value (gracefully).
|
259 |
|
|
*
|
260 |
|
|
* @param {string} str
|
261 |
|
|
* @return {string}
|
262 |
|
|
* @private
|
263 |
|
|
*/
|
264 |
|
|
|
265 |
|
|
function decodefield (str) {
|
266 |
|
|
var match = EXT_VALUE_REGEXP.exec(str)
|
267 |
|
|
|
268 |
|
|
if (!match) {
|
269 |
|
|
throw new TypeError('invalid extended field value')
|
270 |
|
|
}
|
271 |
|
|
|
272 |
|
|
var charset = match[1].toLowerCase()
|
273 |
|
|
var encoded = match[2]
|
274 |
|
|
var value
|
275 |
|
|
|
276 |
|
|
// to binary string
|
277 |
|
|
var binary = encoded.replace(HEX_ESCAPE_REPLACE_REGEXP, pdecode)
|
278 |
|
|
|
279 |
|
|
switch (charset) {
|
280 |
|
|
case 'iso-8859-1':
|
281 |
|
|
value = getlatin1(binary)
|
282 |
|
|
break
|
283 |
|
|
case 'utf-8':
|
284 |
|
|
value = Buffer.from(binary, 'binary').toString('utf8')
|
285 |
|
|
break
|
286 |
|
|
default:
|
287 |
|
|
throw new TypeError('unsupported charset in extended field')
|
288 |
|
|
}
|
289 |
|
|
|
290 |
|
|
return value
|
291 |
|
|
}
|
292 |
|
|
|
293 |
|
|
/**
|
294 |
|
|
* Get ISO-8859-1 version of string.
|
295 |
|
|
*
|
296 |
|
|
* @param {string} val
|
297 |
|
|
* @return {string}
|
298 |
|
|
* @private
|
299 |
|
|
*/
|
300 |
|
|
|
301 |
|
|
function getlatin1 (val) {
|
302 |
|
|
// simple Unicode -> ISO-8859-1 transformation
|
303 |
|
|
return String(val).replace(NON_LATIN1_REGEXP, '?')
|
304 |
|
|
}
|
305 |
|
|
|
306 |
|
|
/**
|
307 |
|
|
* Parse Content-Disposition header string.
|
308 |
|
|
*
|
309 |
|
|
* @param {string} string
|
310 |
|
|
* @return {object}
|
311 |
|
|
* @public
|
312 |
|
|
*/
|
313 |
|
|
|
314 |
|
|
function parse (string) {
|
315 |
|
|
if (!string || typeof string !== 'string') {
|
316 |
|
|
throw new TypeError('argument string is required')
|
317 |
|
|
}
|
318 |
|
|
|
319 |
|
|
var match = DISPOSITION_TYPE_REGEXP.exec(string)
|
320 |
|
|
|
321 |
|
|
if (!match) {
|
322 |
|
|
throw new TypeError('invalid type format')
|
323 |
|
|
}
|
324 |
|
|
|
325 |
|
|
// normalize type
|
326 |
|
|
var index = match[0].length
|
327 |
|
|
var type = match[1].toLowerCase()
|
328 |
|
|
|
329 |
|
|
var key
|
330 |
|
|
var names = []
|
331 |
|
|
var params = {}
|
332 |
|
|
var value
|
333 |
|
|
|
334 |
|
|
// calculate index to start at
|
335 |
|
|
index = PARAM_REGEXP.lastIndex = match[0].substr(-1) === ';'
|
336 |
|
|
? index - 1
|
337 |
|
|
: index
|
338 |
|
|
|
339 |
|
|
// match parameters
|
340 |
|
|
while ((match = PARAM_REGEXP.exec(string))) {
|
341 |
|
|
if (match.index !== index) {
|
342 |
|
|
throw new TypeError('invalid parameter format')
|
343 |
|
|
}
|
344 |
|
|
|
345 |
|
|
index += match[0].length
|
346 |
|
|
key = match[1].toLowerCase()
|
347 |
|
|
value = match[2]
|
348 |
|
|
|
349 |
|
|
if (names.indexOf(key) !== -1) {
|
350 |
|
|
throw new TypeError('invalid duplicate parameter')
|
351 |
|
|
}
|
352 |
|
|
|
353 |
|
|
names.push(key)
|
354 |
|
|
|
355 |
|
|
if (key.indexOf('*') + 1 === key.length) {
|
356 |
|
|
// decode extended value
|
357 |
|
|
key = key.slice(0, -1)
|
358 |
|
|
value = decodefield(value)
|
359 |
|
|
|
360 |
|
|
// overwrite existing value
|
361 |
|
|
params[key] = value
|
362 |
|
|
continue
|
363 |
|
|
}
|
364 |
|
|
|
365 |
|
|
if (typeof params[key] === 'string') {
|
366 |
|
|
continue
|
367 |
|
|
}
|
368 |
|
|
|
369 |
|
|
if (value[0] === '"') {
|
370 |
|
|
// remove quotes and escapes
|
371 |
|
|
value = value
|
372 |
|
|
.substr(1, value.length - 2)
|
373 |
|
|
.replace(QESC_REGEXP, '$1')
|
374 |
|
|
}
|
375 |
|
|
|
376 |
|
|
params[key] = value
|
377 |
|
|
}
|
378 |
|
|
|
379 |
|
|
if (index !== -1 && index !== string.length) {
|
380 |
|
|
throw new TypeError('invalid parameter format')
|
381 |
|
|
}
|
382 |
|
|
|
383 |
|
|
return new ContentDisposition(type, params)
|
384 |
|
|
}
|
385 |
|
|
|
386 |
|
|
/**
|
387 |
|
|
* Percent decode a single character.
|
388 |
|
|
*
|
389 |
|
|
* @param {string} str
|
390 |
|
|
* @param {string} hex
|
391 |
|
|
* @return {string}
|
392 |
|
|
* @private
|
393 |
|
|
*/
|
394 |
|
|
|
395 |
|
|
function pdecode (str, hex) {
|
396 |
|
|
return String.fromCharCode(parseInt(hex, 16))
|
397 |
|
|
}
|
398 |
|
|
|
399 |
|
|
/**
|
400 |
|
|
* Percent encode a single character.
|
401 |
|
|
*
|
402 |
|
|
* @param {string} char
|
403 |
|
|
* @return {string}
|
404 |
|
|
* @private
|
405 |
|
|
*/
|
406 |
|
|
|
407 |
|
|
function pencode (char) {
|
408 |
|
|
return '%' + String(char)
|
409 |
|
|
.charCodeAt(0)
|
410 |
|
|
.toString(16)
|
411 |
|
|
.toUpperCase()
|
412 |
|
|
}
|
413 |
|
|
|
414 |
|
|
/**
|
415 |
|
|
* Quote a string for HTTP.
|
416 |
|
|
*
|
417 |
|
|
* @param {string} val
|
418 |
|
|
* @return {string}
|
419 |
|
|
* @private
|
420 |
|
|
*/
|
421 |
|
|
|
422 |
|
|
function qstring (val) {
|
423 |
|
|
var str = String(val)
|
424 |
|
|
|
425 |
|
|
return '"' + str.replace(QUOTE_REGEXP, '\\$1') + '"'
|
426 |
|
|
}
|
427 |
|
|
|
428 |
|
|
/**
|
429 |
|
|
* Encode a Unicode string for HTTP (RFC 5987).
|
430 |
|
|
*
|
431 |
|
|
* @param {string} val
|
432 |
|
|
* @return {string}
|
433 |
|
|
* @private
|
434 |
|
|
*/
|
435 |
|
|
|
436 |
|
|
function ustring (val) {
|
437 |
|
|
var str = String(val)
|
438 |
|
|
|
439 |
|
|
// percent encode as UTF-8
|
440 |
|
|
var encoded = encodeURIComponent(str)
|
441 |
|
|
.replace(ENCODE_URL_ATTR_CHAR_REGEXP, pencode)
|
442 |
|
|
|
443 |
|
|
return 'UTF-8\'\'' + encoded
|
444 |
|
|
}
|
445 |
|
|
|
446 |
|
|
/**
|
447 |
|
|
* Class for parsed Content-Disposition header for v8 optimization
|
448 |
|
|
*
|
449 |
|
|
* @public
|
450 |
|
|
* @param {string} type
|
451 |
|
|
* @param {object} parameters
|
452 |
|
|
* @constructor
|
453 |
|
|
*/
|
454 |
|
|
|
455 |
|
|
function ContentDisposition (type, parameters) {
|
456 |
|
|
this.type = type
|
457 |
|
|
this.parameters = parameters
|
458 |
|
|
}
|