1.9.1

closes #64

.gitignore

@@ -1,65 +1,4 @@
-# Compiled source #
-###################
-*.com
-*.class
-*.dll
-*.exe
-*.o
-*.so
-
-# Packages #
-############
-# it's better to unpack these files and commit the raw source
-# git has its own built in compression methods
-*.7z
-*.dmg
-*.gz
-*.iso
-*.jar
-*.rar
-*.tar
-*.zip
-
-# Logs and databases #
-######################
-*.log
-*.sql
-*.sqlite
-
-# OS generated files #
-######################
-.DS_Store*
-ehthumbs.db
-Thumbs.db
-
-# Node.js #
-###########
-lib-cov
-*.seed
-*.log
-*.csv
-*.dat
-*.out
-*.pid
-*.gz
-
-pids
-logs
-results
-
+coverage
 node_modules
 npm-debug.log
-
-# Git #
-#######
-*.orig
-*.BASE.*
-*.BACKUP.*
-*.LOCAL.*
-*.REMOTE.*
-
-# Components #
-##############
-
-/build
-/components
+package-lock.json

.npmignore

@@ -1 +0,0 @@
-test

.travis.yml

@@ -2,4 +2,32 @@ language: node_js
 node_js:
   - "0.8"
   - "0.10"
-  - "0.11"
+  - "0.12"
+  - "1.8"
+  - "2.5"
+  - "3.3"
+  - "4.8"
+  - "5.12"
+  - "6.11"
+  - "7.10"
+  - "8.3"
+sudo: false
+cache:
+  directories:
+    - node_modules
+before_install:
+  # Skip updating shrinkwrap / lock
+  - "npm config set shrinkwrap false"
+
+  # Setup Node.js version-specific dependencies
+  - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
+
+  # Update Node.js modules
+  - "test ! -d node_modules || npm prune"
+  - "test ! -d node_modules || npm rebuild"
+script:
+  # Run test script, depending on istanbul install
+  - "test ! -z $(npm -ps ls istanbul) || npm test"
+  - "test   -z $(npm -ps ls istanbul) || npm run-script test-ci"
+after_script:
+  - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"

HISTORY.md

@@ -0,0 +1,305 @@
+1.9.1 / 2017-09-28
+==================
+
+  * deps: accepts@~1.3.4
+    - deps: mime-types@~2.1.16
+  * deps: debug@2.6.9
+  * deps: http-errors@~1.6.2
+    - deps: depd@1.1.1
+  * deps: mime-types@~2.1.17
+    - Add new mime types
+    - deps: mime-db@~1.30.0
+  * deps: parseurl@~1.3.2
+    - perf: reduce overhead for full URLs
+    - perf: unroll the "fast-path" `RegExp`
+
+1.9.0 / 2017-05-25
+==================
+
+  * Set `X-Content-Type-Options: nosniff` header
+  * deps: batch@0.6.1
+  * deps: debug@2.6.8
+    - Allow colors in workers
+    - Deprecated `DEBUG_FD` environment variable set to `3` or higher
+    - Fix `DEBUG_MAX_ARRAY_LENGTH`
+    - Fix error when running under React Native
+    - Use same color for same namespace
+    - deps: ms@2.0.0
+  * deps: http-errors@~1.6.1
+    - Make `message` property enumerable for `HttpError`s
+    - deps: inherits@2.0.3
+    - deps: setprototypeof@1.0.3
+    - deps: statuses@'>= 1.3.1 < 2'
+  * deps: mime-types@~2.1.15
+    - Add new mime types
+    - Add `audio/mp3`
+
+1.8.0 / 2016-06-17
+==================
+
+  * Make inline file search case-insensitive
+  * deps: accepts@~1.3.3
+    - deps: mime-types@~2.1.11
+    - deps: negotiator@0.6.1
+    - perf: improve header parsing speed
+  * deps: http-errors@~1.5.0
+    - Use `setprototypeof` module to replace `__proto__` setting
+    - deps: inherits@2.0.1
+    - deps: statuses@'>= 1.3.0 < 2'
+    - perf: enable strict mode
+  * deps: mime-types@~2.1.11
+    - Add new mime types
+    - Update primary extension for `audio/mp4`
+    - deps: mime-db@~1.23.0
+
+1.7.3 / 2016-01-24
+==================
+
+  * deps: accepts@~1.2.13
+    - deps: mime-types@~2.1.6
+  * deps: batch@0.5.3
+    - Fix invalid dependency for browserify
+  * deps: escape-html@~1.0.3
+    - perf: enable strict mode
+    - perf: optimize string replacement
+    - perf: use faster string coercion
+  * deps: mime-types@~2.1.9
+    - Add new mime types
+  * deps: parseurl@~1.3.1
+    - perf: enable strict mode
+
+1.7.2 / 2015-07-30
+==================
+
+  * deps: accepts@~1.2.12
+    - deps: mime-types@~2.1.4
+  * deps: mime-types@~2.1.4
+    - Add new mime types
+
+1.7.1 / 2015-07-05
+==================
+
+  * deps: accepts@~1.2.10
+    - deps: mime-types@~2.1.2
+  * deps: mime-types@~2.1.2
+    - Add new mime types
+
+1.7.0 / 2015-06-15
+==================
+
+  * Accept `function` value for `template` option
+  * Send non-chunked response for `OPTIONS`
+  * Stat parent directory when necessary
+  * Use `Date.prototype.toLocaleDateString` to format date
+  * deps: accepts@~1.2.9
+    - deps: mime-types@~2.1.1
+    - deps: negotiator@0.5.3
+    - perf: avoid argument reassignment & argument slice
+    - perf: avoid negotiator recursive construction
+    - perf: enable strict mode
+    - perf: remove unnecessary bitwise operator
+  * deps: escape-html@1.0.2
+  * deps: mime-types@~2.1.1
+    - Add new mime types
+  * perf: enable strict mode
+  * perf: remove argument reassignment
+
+1.6.4 / 2015-05-12
+==================
+
+  * deps: accepts@~1.2.7
+    - deps: mime-types@~2.0.11
+    - deps: negotiator@0.5.3
+  * deps: debug@~2.2.0
+    - deps: ms@0.7.1
+  * deps: mime-types@~2.0.11
+    - Add new mime types
+
+1.6.3 / 2015-03-13
+==================
+
+  * Properly escape file names in HTML
+  * deps: accepts@~1.2.5
+    - deps: mime-types@~2.0.10
+  * deps: debug@~2.1.3
+    - Fix high intensity foreground color for bold
+    - deps: ms@0.7.0
+  * deps: escape-html@1.0.1
+  * deps: mime-types@~2.0.10
+    - Add new mime types
+
+1.6.2 / 2015-02-16
+==================
+
+  * deps: accepts@~1.2.4
+    - deps: mime-types@~2.0.9
+    - deps: negotiator@0.5.1
+  * deps: http-errors@~1.3.1
+    - Construct errors using defined constructors from `createError`
+    - Fix error names that are not identifiers
+    - Set a meaningful `name` property on constructed errors
+  * deps: mime-types@~2.0.9
+    - Add new mime types
+    - deps: mime-db@~1.7.0
+
+1.6.1 / 2015-01-31
+==================
+
+  * deps: accepts@~1.2.3
+    - deps: mime-types@~2.0.8
+  * deps: mime-types@~2.0.8
+    - Add new mime types
+    - deps: mime-db@~1.6.0
+
+1.6.0 / 2015-01-01
+==================
+
+  * Add link to root directory
+  * deps: accepts@~1.2.2
+    - deps: mime-types@~2.0.7
+    - deps: negotiator@0.5.0
+  * deps: batch@0.5.2
+  * deps: debug@~2.1.1
+  * deps: mime-types@~2.0.7
+    - Add new mime types
+    - Fix missing extensions
+    - Fix various invalid MIME type entries
+    - Remove example template MIME types
+    - deps: mime-db@~1.5.0
+
+1.5.3 / 2014-12-10
+==================
+
+  * deps: accepts@~1.1.4
+    - deps: mime-types@~2.0.4
+  * deps: http-errors@~1.2.8
+    - Fix stack trace from exported function
+  * deps: mime-types@~2.0.4
+    - Add new mime types
+    - deps: mime-db@~1.3.0
+
+1.5.2 / 2014-12-03
+==================
+
+  * Fix icon name background alignment on mobile view
+
+1.5.1 / 2014-11-22
+==================
+
+  * deps: accepts@~1.1.3
+    - deps: mime-types@~2.0.3
+  * deps: mime-types@~2.0.3
+    - Add new mime types
+    - deps: mime-db@~1.2.0
+
+1.5.0 / 2014-10-16
+==================
+
+  * Create errors with `http-errors`
+  * deps: debug@~2.1.0
+    - Implement `DEBUG_FD` env variable support
+  * deps: mime-types@~2.0.2
+    - deps: mime-db@~1.1.0
+
+1.4.1 / 2014-10-15
+==================
+
+  * deps: accepts@~1.1.2
+    - Fix error when media type has invalid parameter
+    - deps: negotiator@0.4.9
+
+1.4.0 / 2014-10-03
+==================
+
+  * Add `dir` argument to `filter` function
+  * Support using tokens multiple times
+
+1.3.1 / 2014-10-01
+==================
+
+  * Fix incorrect 403 on Windows and Node.js 0.11
+  * deps: accepts@~1.1.1
+    - deps: mime-types@~2.0.2
+    - deps: negotiator@0.4.8
+
+1.3.0 / 2014-09-20
+==================
+
+  * Add icon for mkv files
+  * Lookup icon by mime type for greater icon support
+
+1.2.1 / 2014-09-05
+==================
+
+  * deps: accepts@~1.1.0
+  * deps: debug@~2.0.0
+
+1.2.0 / 2014-08-25
+==================
+
+  * Add `debug` messages
+  * Resolve relative paths at middleware setup
+
+1.1.6 / 2014-08-10
+==================
+
+  * Fix URL parsing
+  * deps: parseurl@~1.3.0
+
+1.1.5 / 2014-07-27
+==================
+
+  * Fix Content-Length calculation for multi-byte file names
+  * deps: accepts@~1.0.7
+    - deps: negotiator@0.4.7
+
+1.1.4 / 2014-06-20
+==================
+
+  * deps: accepts@~1.0.5
+
+1.1.3 / 2014-06-20
+==================
+
+  * deps: accepts@~1.0.4
+    - use `mime-types`
+
+1.1.2 / 2014-06-19
+==================
+
+  * deps: batch@0.5.1
+
+1.1.1 / 2014-06-11
+==================
+
+  * deps: accepts@1.0.3
+
+1.1.0 / 2014-05-29
+==================
+
+  * Fix content negotiation when no `Accept` header
+  * Properly support all HTTP methods
+  * Support vanilla node.js http servers
+  * Treat `ENAMETOOLONG` as code 414
+  * Use accepts for negotiation
+
+1.0.3 / 2014-05-20
+==================
+
+  * Fix error from non-statable files in HTML view
+
+1.0.2 / 2014-04-28
+==================
+
+  * Add `stylesheet` option
+  * deps: negotiator@0.4.3
+
+1.0.1 / 2014-03-05
+==================
+
+  * deps: negotiator@0.4.2
+
+1.0.0 / 2014-03-05
+==================
+
+  * Genesis from connect

LICENSE

@@ -3,7 +3,7 @@
 Copyright (c) 2010 Sencha Inc.
 Copyright (c) 2011 LearnBoost
 Copyright (c) 2011 TJ Holowaychuk
-Copyright (c) 2014 Douglas Christopher Wilson
+Copyright (c) 2014-2015 Douglas Christopher Wilson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -0,0 +1,154 @@
+# serve-index
+
+[![NPM Version][npm-image]][npm-url]
+[![NPM Downloads][downloads-image]][downloads-url]
+[![Linux Build][travis-image]][travis-url]
+[![Windows Build][appveyor-image]][appveyor-url]
+[![Test Coverage][coveralls-image]][coveralls-url]
+[![Gratipay][gratipay-image]][gratipay-url]
+
+  Serves pages that contain directory listings for a given path.
+
+## Install
+
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/). Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
+```sh
+$ npm install serve-index
+```
+
+## API
+
+```js
+var serveIndex = require('serve-index')
+```
+
+### serveIndex(path, options)
+
+Returns middlware that serves an index of the directory in the given `path`.
+
+The `path` is based off the `req.url` value, so a `req.url` of `'/some/dir`
+with a `path` of `'public'` will look at `'public/some/dir'`. If you are using
+something like `express`, you can change the URL "base" with `app.use` (see
+the express example).
+
+#### Options
+
+Serve index accepts these properties in the options object.
+
+##### filter
+
+Apply this filter function to files. Defaults to `false`. The `filter` function
+is called for each file, with the signature `filter(filename, index, files, dir)`
+where `filename` is the name of the file, `index` is the array index, `files` is
+the array of files and `dir` is the absolute path the file is located (and thus,
+the directory the listing is for).
+
+##### hidden
+
+Display hidden (dot) files. Defaults to `false`.
+
+##### icons
+
+Display icons. Defaults to `false`.
+
+##### stylesheet
+
+Optional path to a CSS stylesheet. Defaults to a built-in stylesheet.
+
+##### template
+
+Optional path to an HTML template or a function that will render a HTML
+string. Defaults to a built-in template.
+
+When given a string, the string is used as a file path to load and then the
+following tokens are replaced in templates:
+
+  * `{directory}` with the name of the directory.
+  * `{files}` with the HTML of an unordered list of file links.
+  * `{linked-path}` with the HTML of a link to the directory.
+  * `{style}` with the specified stylesheet and embedded images.
+
+When given as a function, the function is called as `template(locals, callback)`
+and it needs to invoke `callback(error, htmlString)`. The following are the
+provided locals:
+
+  * `directory` is the directory being displayed (where `/` is the root).
+  * `displayIcons` is a Boolean for if icons should be rendered or not.
+  * `fileList` is a sorted array of files in the directory. The array contains
+    objects with the following properties:
+    - `name` is the relative name for the file.
+    - `stat` is a `fs.Stats` object for the file.
+  * `path` is the full filesystem path to `directory`.
+  * `style` is the default stylesheet or the contents of the `stylesheet` option.
+  * `viewName` is the view name provided by the `view` option.
+
+##### view
+
+Display mode. `tiles` and `details` are available. Defaults to `tiles`.
+
+## Examples
+
+### Serve directory indexes with vanilla node.js http server
+
+```js
+var finalhandler = require('finalhandler')
+var http = require('http')
+var serveIndex = require('serve-index')
+var serveStatic = require('serve-static')
+
+// Serve directory indexes for public/ftp folder (with icons)
+var index = serveIndex('public/ftp', {'icons': true})
+
+// Serve up public/ftp folder files
+var serve = serveStatic('public/ftp')
+
+// Create server
+var server = http.createServer(function onRequest(req, res){
+  var done = finalhandler(req, res)
+  serve(req, res, function onNext(err) {
+    if (err) return done(err)
+    index(req, res, done)
+  })
+})
+
+// Listen
+server.listen(3000)
+```
+
+### Serve directory indexes with express
+
+```js
+var express    = require('express')
+var serveIndex = require('serve-index')
+
+var app = express()
+
+// Serve URLs like /ftp/thing as public/ftp/thing
+// The express.static serves the file contents
+// The serveIndex is this module serving the directory
+app.use('/ftp', express.static('public/ftp'), serveIndex('public/ftp', {'icons': true}))
+
+// Listen
+app.listen(3000)
+```
+
+## License
+
+[MIT](LICENSE). The [Silk](http://www.famfamfam.com/lab/icons/silk/) icons
+are created by/copyright of [FAMFAMFAM](http://www.famfamfam.com/).
+
+[npm-image]: https://img.shields.io/npm/v/serve-index.svg
+[npm-url]: https://npmjs.org/package/serve-index
+[travis-image]: https://img.shields.io/travis/expressjs/serve-index/master.svg?label=linux
+[travis-url]: https://travis-ci.org/expressjs/serve-index
+[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/serve-index/master.svg?label=windows
+[appveyor-url]: https://ci.appveyor.com/project/dougwilson/serve-index
+[coveralls-image]: https://img.shields.io/coveralls/expressjs/serve-index/master.svg
+[coveralls-url]: https://coveralls.io/r/expressjs/serve-index?branch=master
+[downloads-image]: https://img.shields.io/npm/dm/serve-index.svg
+[downloads-url]: https://npmjs.org/package/serve-index
+[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
+[gratipay-url]: https://www.gratipay.com/dougwilson/

Readme.md

@@ -1,44 +0,0 @@
-# Serve Index
-
-Previously `connect.directory()`.
-
-[![Build Status](https://travis-ci.org/expressjs/serve-index.svg?branch=master)](https://travis-ci.org/expressjs/serve-index)
-
-Usage:
-
-```js
-var connect = require('connect');
-var serveIndex = require('serve-index');
-
-var app = connect();
-
-app.use(serveIndex('public/ftp', {'icons': true}));
-app.listen();
-```
-
-## License
-
-The MIT License (MIT)
-
-Copyright (c) 2014 Douglas Christopher Wilson
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
-
-The [Silk](http://www.famfamfam.com/lab/icons/silk/) icons are created
-by/copyright of [FAMFAMFAM](http://www.famfamfam.com/).

appveyor.yml

@@ -0,0 +1,30 @@
+environment:
+  matrix:
+    - nodejs_version: "0.8"
+    - nodejs_version: "0.10"
+    - nodejs_version: "0.12"
+    - nodejs_version: "1.8"
+    - nodejs_version: "2.5"
+    - nodejs_version: "3.3"
+    - nodejs_version: "4.8"
+    - nodejs_version: "5.12"
+    - nodejs_version: "6.11"
+    - nodejs_version: "7.10"
+    - nodejs_version: "8.3"
+cache:
+  - node_modules
+install:
+  - ps: Install-Product node $env:nodejs_version
+  - npm config set shrinkwrap false
+  - if "%nodejs_version%" equ "0.8" npm rm --save-dev istanbul
+  - if exist node_modules npm prune
+  - if exist node_modules npm rebuild
+  - npm install
+build: off
+test_script:
+  - node --version
+  - npm --version
+  - set npm_test_command=test
+  - for /f %%l in ('npm -ps ls istanbul') do set npm_test_command=test-ci
+  - npm run %npm_test_command%
+version: "{build}"

index.js

@@ -1,29 +1,39 @@
-
 /*!
- * Connect - directory
+ * serve-index
  * Copyright(c) 2011 Sencha Inc.
  * Copyright(c) 2011 TJ Holowaychuk
- * Copyright(c) 2014 Douglas Christopher Wilson
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
  * MIT Licensed
  */
 
-// TODO: arrow key navigation
-// TODO: make icons extensible
+'use strict';
 
 /**
  * Module dependencies.
+ * @private
  */
 
-var http = require('http')
-  , fs = require('fs')
-  , parse = require('url').parse
+var accepts = require('accepts');
+var createError = require('http-errors');
+var debug = require('debug')('serve-index');
+var escapeHtml = require('escape-html');
+var fs = require('fs')
   , path = require('path')
   , normalize = path.normalize
   , sep = path.sep
   , extname = path.extname
   , join = path.join;
 var Batch = require('batch');
-var Negotiator = require('negotiator');
+var mime = require('mime-types');
+var parseUrl = require('parseurl');
+var resolve = require('path').resolve;
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = serveIndex;
 
 /*!
  * Icon cache.
@@ -60,79 +70,97 @@ var mediaType = {
 };
 
 /**
- * Directory:
- *
  * Serve directory listings with the given `root` path.
  *
- * Options:
- *
- *  - `hidden` display hidden (dot) files. Defaults to false.
- *  - `view` display mode. 'titles' and 'details' are available. Defaults to titles.
- *  - `icons`  display icons. Defaults to false.
- *  - `filter` Apply this filter function to files. Defaults to false.
- *  - `template` Optional path to html template. Defaults to a built-in template.
- *    The following tokens are replaced:
- *      - `{directory}` with the name of the directory.
- *      - `{files}` with the HTML of an unordered list of file links.
- *      - `{linked-path}` with the HTML of a link to the directory.
- *      - `{style}` with the built-in CSS and embedded images.
+ * See Readme.md for documentation of options.
  *
  * @param {String} root
  * @param {Object} options
- * @return {Function}
- * @api public
+ * @return {Function} middleware
+ * @public
  */
 
-exports = module.exports = function directory(root, options){
-  options = options || {};
+function serveIndex(root, options) {
+  var opts = options || {};
 
   // root required
-  if (!root) throw new Error('directory() root path required');
-  var hidden = options.hidden
-    , icons = options.icons
-    , view = options.view || 'tiles'
-    , filter = options.filter
-    , root = normalize(root + sep)
-    , template = options.template || defaultTemplate
-    , stylesheet = options.stylesheet || defaultStylesheet;
+  if (!root) {
+    throw new TypeError('serveIndex() root path required');
+  }
 
-  return function directory(req, res, next) {
-    if ('GET' != req.method && 'HEAD' != req.method) return next();
+  // resolve root to absolute and normalize
+  var rootPath = normalize(resolve(root) + sep);
 
-    var url = parse(req.url)
-      , dir = decodeURIComponent(url.pathname)
-      , path = normalize(join(root, dir))
-      , originalUrl = parse(req.originalUrl)
-      , originalDir = decodeURIComponent(originalUrl.pathname)
-      , showUp = path != root;
+  var filter = opts.filter;
+  var hidden = opts.hidden;
+  var icons = opts.icons;
+  var stylesheet = opts.stylesheet || defaultStylesheet;
+  var template = opts.template || defaultTemplate;
+  var view = opts.view || 'tiles';
+
+  return function (req, res, next) {
+    if (req.method !== 'GET' && req.method !== 'HEAD') {
+      res.statusCode = 'OPTIONS' === req.method ? 200 : 405;
+      res.setHeader('Allow', 'GET, HEAD, OPTIONS');
+      res.setHeader('Content-Length', '0');
+      res.end();
+      return;
+    }
+
+    // parse URLs
+    var url = parseUrl(req);
+    var originalUrl = parseUrl.original(req);
+    var dir = decodeURIComponent(url.pathname);
+    var originalDir = decodeURIComponent(originalUrl.pathname);
+
+    // join / normalize from root dir
+    var path = normalize(join(rootPath, dir));
 
     // null byte(s), bad request
     if (~path.indexOf('\0')) return next(createError(400));
 
-    // malicious path, forbidden
-    if (0 != path.indexOf(root)) return next(createError(403));
+    // malicious path
+    if ((path + sep).substr(0, rootPath.length) !== rootPath) {
+      debug('malicious path "%s"', path);
+      return next(createError(403));
+    }
+
+    // determine ".." display
+    var showUp = normalize(resolve(path) + sep) !== rootPath;
 
     // check if we have a directory
+    debug('stat "%s"', path);
     fs.stat(path, function(err, stat){
-      if (err) return 'ENOENT' == err.code
-        ? next()
-        : next(err);
+      if (err && err.code === 'ENOENT') {
+        return next();
+      }
+
+      if (err) {
+        err.status = err.code === 'ENAMETOOLONG'
+          ? 414
+          : 500;
+        return next(err);
+      }
 
       if (!stat.isDirectory()) return next();
 
       // fetch files
+      debug('readdir "%s"', path);
       fs.readdir(path, function(err, files){
         if (err) return next(err);
         if (!hidden) files = removeHidden(files);
-        if (filter) files = files.filter(filter);
+        if (filter) files = files.filter(function(filename, index, list) {
+          return filter(filename, index, list, path);
+        });
         files.sort();
 
         // content-negotiation
-        var type = new Negotiator(req).preferredMediaType(mediaTypes);
+        var accept = accepts(req);
+        var type = accept.type(mediaTypes);
 
         // not acceptable
         if (!type) return next(createError(406));
-        exports[mediaType[type]](req, res, files, next, originalDir, showUp, icons, path, view, template, stylesheet);
+        serveIndex[mediaType[type]](req, res, files, next, originalDir, showUp, icons, path, view, template, stylesheet);
       });
     });
   };
@@ -142,24 +170,45 @@ exports = module.exports = function directory(root, options){
  * Respond with text/html.
  */
 
-exports.html = function(req, res, files, next, dir, showUp, icons, path, view, template, stylesheet){
-  fs.readFile(template, 'utf8', function(err, str){
+serveIndex.html = function _html(req, res, files, next, dir, showUp, icons, path, view, template, stylesheet) {
+  var render = typeof template !== 'function'
+    ? createHtmlRender(template)
+    : template
+
+  if (showUp) {
+    files.unshift('..');
+  }
+
+  // stat all files
+  stat(path, files, function (err, stats) {
     if (err) return next(err);
-    fs.readFile(stylesheet, 'utf8', function(err, style){
+
+    // combine the stats into the file list
+    var fileList = files.map(function (file, i) {
+      return { name: file, stat: stats[i] };
+    });
+
+    // sort file list
+    fileList.sort(fileSort);
+
+    // read stylesheet
+    fs.readFile(stylesheet, 'utf8', function (err, style) {
       if (err) return next(err);
-      stat(path, files, function(err, stats){
+
+      // create locals for rendering
+      var locals = {
+        directory: dir,
+        displayIcons: Boolean(icons),
+        fileList: fileList,
+        path: path,
+        style: style,
+        viewName: view
+      };
+
+      // render html
+      render(locals, function (err, body) {
         if (err) return next(err);
-        files = files.map(function(file, i){ return { name: file, stat: stats[i] }; });
-        files.sort(fileSort);
-        if (showUp) files.unshift({ name: '..' });
-        str = str
-          .replace('{style}', style.concat(iconStyle(files, icons)))
-          .replace('{files}', html(files, dir, icons, view))
-          .replace('{directory}', dir)
-          .replace('{linked-path}', htmlPath(dir));
-        res.setHeader('Content-Type', 'text/html');
-        res.setHeader('Content-Length', str.length);
-        res.end(str);
+        send(res, 'text/html', body)
       });
     });
   });
@@ -169,45 +218,111 @@ exports.html = function(req, res, files, next, dir, showUp, icons, path, view, t
  * Respond with application/json.
  */
 
-exports.json = function(req, res, files){
-  files = JSON.stringify(files);
-  res.setHeader('Content-Type', 'application/json');
-  res.setHeader('Content-Length', files.length);
-  res.end(files);
+serveIndex.json = function _json(req, res, files) {
+  send(res, 'application/json', JSON.stringify(files))
 };
 
 /**
  * Respond with text/plain.
  */
 
-exports.plain = function(req, res, files){
-  files = files.join('\n') + '\n';
-  res.setHeader('Content-Type', 'text/plain');
-  res.setHeader('Content-Length', files.length);
-  res.end(files);
+serveIndex.plain = function _plain(req, res, files) {
+  send(res, 'text/plain', (files.join('\n') + '\n'))
 };
 
 /**
- * Generate an `Error` from the given status `code`
- * and optional `msg`.
- *
- * @param {Number} code
- * @param {String} msg
- * @return {Error}
- * @api private
+ * Map html `files`, returning an html unordered list.
+ * @private
  */
 
-function createError(code, msg) {
-  var err = new Error(msg || http.STATUS_CODES[code]);
-  err.status = code;
-  return err;
-};
+function createHtmlFileList(files, dir, useIcons, view) {
+  var html = '<ul id="files" class="view-' + escapeHtml(view) + '">'
+    + (view == 'details' ? (
+      '<li class="header">'
+      + '<span class="name">Name</span>'
+      + '<span class="size">Size</span>'
+      + '<span class="date">Modified</span>'
+      + '</li>') : '');
+
+  html += files.map(function (file) {
+    var classes = [];
+    var isDir = file.stat && file.stat.isDirectory();
+    var path = dir.split('/').map(function (c) { return encodeURIComponent(c); });
+
+    if (useIcons) {
+      classes.push('icon');
+
+      if (isDir) {
+        classes.push('icon-directory');
+      } else {
+        var ext = extname(file.name);
+        var icon = iconLookup(file.name);
+
+        classes.push('icon');
+        classes.push('icon-' + ext.substring(1));
+
+        if (classes.indexOf(icon.className) === -1) {
+          classes.push(icon.className);
+        }
+      }
+    }
+
+    path.push(encodeURIComponent(file.name));
+
+    var date = file.stat && file.name !== '..'
+      ? file.stat.mtime.toLocaleDateString() + ' ' + file.stat.mtime.toLocaleTimeString()
+      : '';
+    var size = file.stat && !isDir
+      ? file.stat.size
+      : '';
+
+    return '<li><a href="'
+      + escapeHtml(normalizeSlashes(normalize(path.join('/'))))
+      + '" class="' + escapeHtml(classes.join(' ')) + '"'
+      + ' title="' + escapeHtml(file.name) + '">'
+      + '<span class="name">' + escapeHtml(file.name) + '</span>'
+      + '<span class="size">' + escapeHtml(size) + '</span>'
+      + '<span class="date">' + escapeHtml(date) + '</span>'
+      + '</a></li>';
+  }).join('\n');
+
+  html += '</ul>';
+
+  return html;
+}
+
+/**
+ * Create function to render html.
+ */
+
+function createHtmlRender(template) {
+  return function render(locals, callback) {
+    // read template
+    fs.readFile(template, 'utf8', function (err, str) {
+      if (err) return callback(err);
+
+      var body = str
+        .replace(/\{style\}/g, locals.style.concat(iconStyle(locals.fileList, locals.displayIcons)))
+        .replace(/\{files\}/g, createHtmlFileList(locals.fileList, locals.directory, locals.displayIcons, locals.viewName))
+        .replace(/\{directory\}/g, escapeHtml(locals.directory))
+        .replace(/\{linked-path\}/g, htmlPath(locals.directory));
+
+      callback(null, body);
+    });
+  };
+}
 
 /**
  * Sort function for with directories first.
  */
 
 function fileSort(a, b) {
+  // sort ".." to the top
+  if (a.name === '..' || b.name === '..') {
+    return a.name === b.name ? 0
+      : a.name === '..' ? -1 : 1;
+  }
+
   return Number(b.stat && b.stat.isDirectory()) - Number(a.stat && a.stat.isDirectory()) ||
     String(a.name).toLocaleLowerCase().localeCompare(String(b.name).toLocaleLowerCase());
 }
@@ -217,22 +332,86 @@ function fileSort(a, b) {
  */
 
 function htmlPath(dir) {
-  var curr = [];
-  return dir.split('/').map(function(part){
-    curr.push(encodeURIComponent(part));
-    return part ? '<a href="' + curr.join('/') + '">' + part + '</a>' : '';
-  }).join(' / ');
+  var parts = dir.split('/');
+  var crumb = new Array(parts.length);
+
+  for (var i = 0; i < parts.length; i++) {
+    var part = parts[i];
+
+    if (part) {
+      parts[i] = encodeURIComponent(part);
+      crumb[i] = '<a href="' + escapeHtml(parts.slice(0, i + 1).join('/')) + '">' + escapeHtml(part) + '</a>';
+    }
+  }
+
+  return crumb.join(' / ');
+}
+
+/**
+ * Get the icon data for the file name.
+ */
+
+function iconLookup(filename) {
+  var ext = extname(filename);
+
+  // try by extension
+  if (icons[ext]) {
+    return {
+      className: 'icon-' + ext.substring(1),
+      fileName: icons[ext]
+    };
+  }
+
+  var mimetype = mime.lookup(ext);
+
+  // default if no mime type
+  if (mimetype === false) {
+    return {
+      className: 'icon-default',
+      fileName: icons.default
+    };
+  }
+
+  // try by mime type
+  if (icons[mimetype]) {
+    return {
+      className: 'icon-' + mimetype.replace('/', '-'),
+      fileName: icons[mimetype]
+    };
+  }
+
+  var suffix = mimetype.split('+')[1];
+
+  if (suffix && icons['+' + suffix]) {
+    return {
+      className: 'icon-' + suffix,
+      fileName: icons['+' + suffix]
+    };
+  }
+
+  var type = mimetype.split('/')[0];
+
+  // try by type only
+  if (icons[type]) {
+    return {
+      className: 'icon-' + type,
+      fileName: icons[type]
+    };
+  }
+
+  return {
+    className: 'icon-default',
+    fileName: icons.default
+  };
 }
 
 /**
  * Load icon images, return css string.
  */
 
-function iconStyle (files, useIcons) {
+function iconStyle(files, useIcons) {
   if (!useIcons) return '';
-  var className;
   var i;
-  var icon;
   var list = [];
   var rules = {};
   var selector;
@@ -242,75 +421,33 @@ function iconStyle (files, useIcons) {
   for (i = 0; i < files.length; i++) {
     var file = files[i];
 
-    var isDir = '..' == file.name || (file.stat && file.stat.isDirectory());
-    icon = isDir ? icons.folder : icons[extname(file.name)] || icons.default;
+    var isDir = file.stat && file.stat.isDirectory();
+    var icon = isDir
+      ? { className: 'icon-directory', fileName: icons.folder }
+      : iconLookup(file.name);
+    var iconName = icon.fileName;
 
-    var ext = extname(file.name);
-    className = 'icon-' + (isDir ? 'directory' : (icons[ext] ? ext.substring(1) : 'default'));
-    selector = '#files .' + className + ' .name';
+    selector = '#files .' + icon.className + ' .name';
 
-    if (!rules[icon]) {
-      rules[icon] = 'background-image: url(data:image/png;base64,' + load(icon) + ');'
-      selectors[icon] = [];
-      list.push(icon);
+    if (!rules[iconName]) {
+      rules[iconName] = 'background-image: url(data:image/png;base64,' + load(iconName) + ');'
+      selectors[iconName] = [];
+      list.push(iconName);
     }
 
-    if (!~selectors[icon].indexOf(selector)) {
-      selectors[icon].push(selector);
+    if (selectors[iconName].indexOf(selector) === -1) {
+      selectors[iconName].push(selector);
     }
   }
 
   for (i = 0; i < list.length; i++) {
-    icon = list[i];
-    style += selectors[icon].join(',\n') + ' {\n  ' + rules[icon] + '\n}\n';
+    iconName = list[i];
+    style += selectors[iconName].join(',\n') + ' {\n  ' + rules[iconName] + '\n}\n';
   }
 
   return style;
 }
 
-/**
- * Map html `files`, returning an html unordered list.
- */
-
-function html(files, dir, useIcons, view) {
-  	return '<ul id="files" class="view-'+view+'">'
-    + (view == 'details' ? (
-      '<li class="header">'
-      + '<span class="name">Name</span>'
-      + '<span class="size">Size</span>'
-      + '<span class="date">Modified</span>'
-      + '</li>') : '')
-    + files.map(function(file){
-    var isDir = '..' == file.name || (file.stat && file.stat.isDirectory())
-      , classes = []
-      , path = dir.split('/').map(function (c) { return encodeURIComponent(c); });
-
-    if (useIcons) {
-      var ext = extname(file.name);
-      ext = isDir ? '.directory' : (icons[ext] ? ext : '.default');
-      classes.push('icon');
-      classes.push('icon-' + ext.substring(1));
-    }
-
-    path.push(encodeURIComponent(file.name));
-
-    var date = file.name == '..' ? ''
-      : file.stat.mtime.toDateString()+' '+file.stat.mtime.toLocaleTimeString();
-    var size = isDir ? '' : file.stat.size;
-
-    return '<li><a href="'
-      + normalizeSlashes(normalize(path.join('/')))
-      + '" class="'
-      + classes.join(' ') + '"'
-      + ' title="' + file.name + '">'
-      + '<span class="name">'+file.name+'</span>'
-      + '<span class="size">'+size+'</span>'
-      + '<span class="date">'+date+'</span>'
-      + '</a></li>';
-
-  }).join('\n') + '</ul>';
-}
-
 /**
  * Load and cache the given `icon`.
  *
@@ -352,6 +489,23 @@ function removeHidden(files) {
   });
 }
 
+/**
+ * Send a response.
+ * @private
+ */
+
+function send (res, type, body) {
+  // security header for content sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+
+  // standard headers
+  res.setHeader('Content-Type', type + '; charset=utf-8')
+  res.setHeader('Content-Length', Buffer.byteLength(body, 'utf8'))
+
+  // body
+  res.end(body, 'utf8')
+}
+
 /**
  * Stat all files and return array of stat
  * in same order.
@@ -364,7 +518,12 @@ function stat(dir, files, cb) {
 
   files.forEach(function(file){
     batch.push(function(done){
-      fs.stat(join(dir, file), done);
+      fs.stat(join(dir, file), function(err, stat){
+        if (err && err.code !== 'ENOENT') return done(err);
+
+        // pass ENOENT as null stat, not error
+        done(null, stat || null);
+      });
     });
   });
 
@@ -376,125 +535,112 @@ function stat(dir, files, cb) {
  */
 
 var icons = {
-    '.js': 'page_white_code_red.png'
-  , '.json': 'page_white_code.png'
-  , '.c': 'page_white_c.png'
-  , '.h': 'page_white_h.png'
-  , '.cc': 'page_white_cplusplus.png'
-  , '.php': 'page_white_php.png'
-  , '.rb': 'page_white_ruby.png'
-  , '.erb': 'page_white_ruby.png'
-  , '.cpp': 'page_white_cplusplus.png'
-  , '.as': 'page_white_actionscript.png'
-  , '.cfm': 'page_white_coldfusion.png'
-  , '.cs': 'page_white_csharp.png'
-  , '.java': 'page_white_cup.png'
-  , '.jsp': 'page_white_cup.png'
-  , '.dll': 'page_white_gear.png'
-  , '.ini': 'page_white_gear.png'
-  , '.asp': 'page_white_code.png'
-  , '.aspx': 'page_white_code.png'
-  , '.clj': 'page_white_code.png'
-  , '.css': 'page_white_code.png'
-  , '.sass': 'page_white_code.png'
-  , '.scss': 'page_white_code.png'
-  , '.less': 'page_white_code.png'
-  , '.htm': 'page_white_code.png'
-  , '.html': 'page_white_code.png'
-  , '.xhtml': 'page_white_code.png'
-  , '.lua': 'page_white_code.png'
-  , '.m': 'page_white_code.png'
-  , '.pl': 'page_white_code.png'
-  , '.py': 'page_white_code.png'
-  , '.vb': 'page_white_code.png'
-  , '.vbs': 'page_white_code.png'
-  , '.xml': 'page_white_code.png'
-  , '.yaws': 'page_white_code.png'
-  , '.map': 'map.png'
+  // base icons
+  'default': 'page_white.png',
+  'folder': 'folder.png',
 
-  , '.app': 'application_xp.png'
-  , '.exe': 'application_xp.png'
-  , '.bat': 'application_xp_terminal.png'
-  , '.cgi': 'application_xp_terminal.png'
-  , '.sh': 'application_xp_terminal.png'
+  // generic mime type icons
+  'image': 'image.png',
+  'text': 'page_white_text.png',
+  'video': 'film.png',
 
-  , '.avi': 'film.png'
-  , '.flv': 'film.png'
-  , '.mv4': 'film.png'
-  , '.mov': 'film.png'
-  , '.mp4': 'film.png'
-  , '.mpeg': 'film.png'
-  , '.mpg': 'film.png'
-  , '.ogv': 'film.png'
-  , '.rm': 'film.png'
-  , '.webm': 'film.png'
-  , '.wmv': 'film.png'
-  , '.fnt': 'font.png'
-  , '.otf': 'font.png'
-  , '.ttf': 'font.png'
-  , '.woff': 'font.png'
-  , '.bmp': 'image.png'
-  , '.gif': 'image.png'
-  , '.ico': 'image.png'
-  , '.jpeg': 'image.png'
-  , '.jpg': 'image.png'
-  , '.png': 'image.png'
-  , '.psd': 'page_white_picture.png'
-  , '.xcf': 'page_white_picture.png'
-  , '.pdf': 'page_white_acrobat.png'
-  , '.swf': 'page_white_flash.png'
-  , '.ai': 'page_white_vector.png'
-  , '.eps': 'page_white_vector.png'
-  , '.ps': 'page_white_vector.png'
-  , '.svg': 'page_white_vector.png'
+  // generic mime suffix icons
+  '+json': 'page_white_code.png',
+  '+xml': 'page_white_code.png',
+  '+zip': 'box.png',
 
-  , '.ods': 'page_white_excel.png'
-  , '.xls': 'page_white_excel.png'
-  , '.xlsx': 'page_white_excel.png'
-  , '.odp': 'page_white_powerpoint.png'
-  , '.ppt': 'page_white_powerpoint.png'
-  , '.pptx': 'page_white_powerpoint.png'
-  , '.md': 'page_white_text.png'
-  , '.srt': 'page_white_text.png'
-  , '.txt': 'page_white_text.png'
-  , '.doc': 'page_white_word.png'
-  , '.docx': 'page_white_word.png'
-  , '.odt': 'page_white_word.png'
-  , '.rtf': 'page_white_word.png'
+  // specific mime type icons
+  'application/font-woff': 'font.png',
+  'application/javascript': 'page_white_code_red.png',
+  'application/json': 'page_white_code.png',
+  'application/msword': 'page_white_word.png',
+  'application/pdf': 'page_white_acrobat.png',
+  'application/postscript': 'page_white_vector.png',
+  'application/rtf': 'page_white_word.png',
+  'application/vnd.ms-excel': 'page_white_excel.png',
+  'application/vnd.ms-powerpoint': 'page_white_powerpoint.png',
+  'application/vnd.oasis.opendocument.presentation': 'page_white_powerpoint.png',
+  'application/vnd.oasis.opendocument.spreadsheet': 'page_white_excel.png',
+  'application/vnd.oasis.opendocument.text': 'page_white_word.png',
+  'application/x-7z-compressed': 'box.png',
+  'application/x-sh': 'application_xp_terminal.png',
+  'application/x-font-ttf': 'font.png',
+  'application/x-msaccess': 'page_white_database.png',
+  'application/x-shockwave-flash': 'page_white_flash.png',
+  'application/x-sql': 'page_white_database.png',
+  'application/x-tar': 'box.png',
+  'application/x-xz': 'box.png',
+  'application/xml': 'page_white_code.png',
+  'application/zip': 'box.png',
+  'image/svg+xml': 'page_white_vector.png',
+  'text/css': 'page_white_code.png',
+  'text/html': 'page_white_code.png',
+  'text/less': 'page_white_code.png',
 
-  , '.dmg': 'drive.png'
-  , '.iso': 'cd.png'
-  , '.7z': 'box.png'
-  , '.apk': 'box.png'
-  , '.bz2': 'box.png'
-  , '.cab': 'box.png'
-  , '.deb': 'box.png'
-  , '.gz': 'box.png'
-  , '.jar': 'box.png'
-  , '.lz': 'box.png'
-  , '.lzma': 'box.png'
-  , '.msi': 'box.png'
-  , '.pkg': 'box.png'
-  , '.rar': 'box.png'
-  , '.rpm': 'box.png'
-  , '.tar': 'box.png'
-  , '.tbz2': 'box.png'
-  , '.tgz': 'box.png'
-  , '.tlz': 'box.png'
-  , '.xz': 'box.png'
-  , '.zip': 'box.png'
-
-  , '.accdb': 'page_white_database.png'
-  , '.db': 'page_white_database.png'
-  , '.dbf': 'page_white_database.png'
-  , '.mdb': 'page_white_database.png'
-  , '.pdb': 'page_white_database.png'
-  , '.sql': 'page_white_database.png'
-
-  , '.gam': 'controller.png'
-  , '.rom': 'controller.png'
-  , '.sav': 'controller.png'
-
-  , 'folder': 'folder.png'
-  , 'default': 'page_white.png'
+  // other, extension-specific icons
+  '.accdb': 'page_white_database.png',
+  '.apk': 'box.png',
+  '.app': 'application_xp.png',
+  '.as': 'page_white_actionscript.png',
+  '.asp': 'page_white_code.png',
+  '.aspx': 'page_white_code.png',
+  '.bat': 'application_xp_terminal.png',
+  '.bz2': 'box.png',
+  '.c': 'page_white_c.png',
+  '.cab': 'box.png',
+  '.cfm': 'page_white_coldfusion.png',
+  '.clj': 'page_white_code.png',
+  '.cc': 'page_white_cplusplus.png',
+  '.cgi': 'application_xp_terminal.png',
+  '.cpp': 'page_white_cplusplus.png',
+  '.cs': 'page_white_csharp.png',
+  '.db': 'page_white_database.png',
+  '.dbf': 'page_white_database.png',
+  '.deb': 'box.png',
+  '.dll': 'page_white_gear.png',
+  '.dmg': 'drive.png',
+  '.docx': 'page_white_word.png',
+  '.erb': 'page_white_ruby.png',
+  '.exe': 'application_xp.png',
+  '.fnt': 'font.png',
+  '.gam': 'controller.png',
+  '.gz': 'box.png',
+  '.h': 'page_white_h.png',
+  '.ini': 'page_white_gear.png',
+  '.iso': 'cd.png',
+  '.jar': 'box.png',
+  '.java': 'page_white_cup.png',
+  '.jsp': 'page_white_cup.png',
+  '.lua': 'page_white_code.png',
+  '.lz': 'box.png',
+  '.lzma': 'box.png',
+  '.m': 'page_white_code.png',
+  '.map': 'map.png',
+  '.msi': 'box.png',
+  '.mv4': 'film.png',
+  '.otf': 'font.png',
+  '.pdb': 'page_white_database.png',
+  '.php': 'page_white_php.png',
+  '.pl': 'page_white_code.png',
+  '.pkg': 'box.png',
+  '.pptx': 'page_white_powerpoint.png',
+  '.psd': 'page_white_picture.png',
+  '.py': 'page_white_code.png',
+  '.rar': 'box.png',
+  '.rb': 'page_white_ruby.png',
+  '.rm': 'film.png',
+  '.rom': 'controller.png',
+  '.rpm': 'box.png',
+  '.sass': 'page_white_code.png',
+  '.sav': 'controller.png',
+  '.scss': 'page_white_code.png',
+  '.srt': 'page_white_text.png',
+  '.tbz2': 'box.png',
+  '.tgz': 'box.png',
+  '.tlz': 'box.png',
+  '.vb': 'page_white_code.png',
+  '.vbs': 'page_white_code.png',
+  '.xcf': 'page_white_picture.png',
+  '.xlsx': 'page_white_excel.png',
+  '.yaws': 'page_white_code.png'
 };

package.json

@@ -1,30 +1,37 @@
 {
   "name": "serve-index",
   "description": "Serve directory listings",
-  "version": "1.0.2",
+  "version": "1.9.1",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/expressjs/serve-index.git"
-  },
-  "bugs": {
-    "url": "https://github.com/expressjs/serve-index/issues"
-  },
+  "repository": "expressjs/serve-index",
   "dependencies": {
-    "batch": "0.5.0",
-    "negotiator": "0.4.3"
+    "accepts": "~1.3.4",
+    "batch": "0.6.1",
+    "debug": "2.6.9",
+    "escape-html": "~1.0.3",
+    "http-errors": "~1.6.2",
+    "mime-types": "~2.1.17",
+    "parseurl": "~1.3.2"
   },
   "devDependencies": {
-    "connect": "~2.14.1",
-    "mocha": "~1.17.1",
-    "should": "~3.1.3",
-    "supertest": "~0.9.0"
+    "after": "0.8.2",
+    "istanbul": "0.4.5",
+    "mocha": "2.5.3",
+    "supertest": "1.1.0"
   },
+  "files": [
+    "public/",
+    "LICENSE",
+    "HISTORY.md",
+    "index.js"
+  ],
   "engines": {
     "node": ">= 0.8.0"
   },
   "scripts": {
-    "test": "mocha --reporter spec --require should"
+    "test": "mocha --reporter spec --bail --check-leaks test/",
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/"
   }
 }

public/directory.html

@@ -52,11 +52,11 @@
       }
 
       function search() {
-        var str = $('search').value
-          , links = $('files').all('a');
+        var str = $('search').value.toLowerCase();
+        var links = $('files').all('a');
 
         links.each(function(link){
-          var text = link.textContent;
+          var text = link.textContent.toLowerCase();
 
           if ('..' == text) return;
           if (str.length && ~text.indexOf(str)) {
@@ -75,7 +75,7 @@
   <body class="directory">
     <input id="search" type="text" placeholder="Search" autocomplete="off" />
     <div id="wrapper">
-      <h1>{linked-path}</h1>
+      <h1><a href="/">~</a>{linked-path}</h1>
       {files}
     </div>
   </body>

public/style.css

@@ -249,7 +249,7 @@ ul#files.view-details li.header {
     display: inline-block;
     width: 100%;
     text-indent: 0;
-    background-position: 0 0;
+    background-position: 0 50%;
   }
   #files .icon .name {
     text-indent: 41px;

test/fixtures/users/#dir/tobi.txt

@@ -0,0 +1 @@
+ferret

test/shared/index.js

@@ -1,26 +0,0 @@
-
-var bytes = require('bytes');
-
-exports['default request body'] = function(app){
-  it('should default to {}', function(done){
-    app.request()
-    .post('/')
-    .end(function(res){
-      res.body.should.equal('{}');
-      done();
-    })
-  })
-};
-
-exports['limit body to'] = function(size, type, app){
-  it('should accept a limit option', function(done){
-    app.request()
-    .post('/')
-    .set('Content-Length', bytes(size) + 1)
-    .set('Content-Type', type)
-    .end(function(res){
-      res.should.have.status(413);
-      done();
-    })
-  })
-}

test/shared/template.html

@@ -6,6 +6,7 @@
   </head>
   <body class="directory">
     <h1>This is the test template</h1>
+    <h2>directory {directory}</h2>
     <div id="wrapper">
       <h1>{linked-path}</h1>
       {files}

test/test.js

@@ -1,70 +1,206 @@
 
-process.env.NODE_ENV = 'test';
-
-var connect = require('connect');
+var after = require('after');
+var assert = require('assert');
+var http = require('http');
+var fs = require('fs');
+var path = require('path');
 var request = require('supertest');
 var serveIndex = require('..');
 
-describe('directory()', function(){
-  describe('when given Accept: header', function () {
-    var server;
-    before(function () {
-      server = createServer();
-    });
-    after(function (done) {
-      server.close(done);
-    });
+var fixtures = path.join(__dirname, '/fixtures');
+var relative = path.relative(process.cwd(), fixtures);
 
-    describe('of application/json', function () {
+var skipRelative = ~relative.indexOf('..') || path.resolve(relative) === relative;
+
+describe('serveIndex(root)', function () {
+  it('should require root', function () {
+    assert.throws(serveIndex, /root path required/)
+  })
+
+  it('should serve text/html without Accept header', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/')
+    .expect('Content-Type', 'text/html; charset=utf-8')
+    .expect(200, done)
+  })
+
+  it('should include security header', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/')
+    .expect('X-Content-Type-Options', 'nosniff')
+    .expect(200, done)
+  })
+
+  it('should serve a directory index', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/')
+    .expect(200, /todo\.txt/, done)
+  })
+
+  it('should work with HEAD requests', function (done) {
+    var server = createServer()
+
+    request(server)
+    .head('/')
+    .expect(200, '', done)
+  })
+
+  it('should work with OPTIONS requests', function (done) {
+    var server = createServer()
+
+    request(server)
+    .options('/')
+    .expect('Allow', 'GET, HEAD, OPTIONS')
+    .expect(200, done)
+  })
+
+  it('should deny POST requests', function (done) {
+    var server = createServer()
+
+    request(server)
+    .post('/')
+    .expect(405, done)
+  })
+
+  it('should deny path will NULL byte', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/%00')
+    .expect(400, done)
+  })
+
+  it('should deny path outside root', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/../')
+    .expect(403, done)
+  })
+
+  it('should skip non-existent paths', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/bogus')
+    .expect(404, 'Not Found', done)
+  })
+
+  it('should treat an ENAMETOOLONG as a 414', function (done) {
+    var path = Array(11000).join('foobar')
+    var server = createServer()
+
+    request(server)
+    .get('/' + path)
+    .expect(414, done)
+  })
+
+  it('should skip non-directories', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/nums')
+    .expect(404, 'Not Found', done)
+  })
+
+  describe('when given Accept: header', function () {
+    describe('when Accept: application/json is given', function () {
       it('should respond with json', function (done) {
+        var server = createServer()
+
         request(server)
         .get('/')
         .set('Accept', 'application/json')
-        .expect(200)
         .expect('Content-Type', /json/)
-        .end(function (err, res) {
-          if (err) throw err;
-          res.body.should.include('g# %3 o %2525 %37 dir');
-          res.body.should.include('users');
-          res.body.should.include('file #1.txt');
-          res.body.should.include('nums');
-          res.body.should.include('todo.txt');
-          done();
-        });
+        .expect(/g# %3 o & %2525 %37 dir/)
+        .expect(/users/)
+        .expect(/file #1\.txt/)
+        .expect(/nums/)
+        .expect(/todo\.txt/)
+        .expect(/さくら\.txt/)
+        .expect(200, done)
       });
+
+      it('should include security header', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'application/json')
+        .expect('X-Content-Type-Options', 'nosniff')
+        .expect(200, done)
+      })
     });
 
     describe('when Accept: text/html is given', function () {
       it('should respond with html', function (done) {
+        var server = createServer()
+
         request(server)
         .get('/')
         .set('Accept', 'text/html')
         .expect(200)
-        .expect('Content-Type', /html/)
-        .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir"/)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
         .expect(/<a href="\/users"/)
         .expect(/<a href="\/file%20%231.txt"/)
         .expect(/<a href="\/todo.txt"/)
+        .expect(/<a href="\/%E3%81%95%E3%81%8F%E3%82%89\.txt"/)
+        .end(done);
+      });
+
+      it('should include security header', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect('X-Content-Type-Options', 'nosniff')
+        .expect(200, done)
+      })
+
+      it('should property escape file names', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/foo%20%26%20bar"/)
+        .expect(/foo &amp; bar/)
+        .expect(bodyDoesNotContain('foo & bar'))
         .end(done);
       });
 
       it('should sort folders first', function (done) {
+        var server = createServer()
+
         request(server)
         .get('/')
         .set('Accept', 'text/html')
         .expect(200)
-        .expect('Content-Type', /html/)
+        .expect('Content-Type', 'text/html; charset=utf-8')
         .end(function (err, res) {
-          if (err) throw err;
-          var urls = res.text.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
-          urls.should.eql([
+          if (err) done(err);
+          var body = res.text.split('</h1>')[1];
+          var urls = body.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
+          assert.deepEqual(urls, [
             '/%23directory',
-            '/g%23%20%253%20o%20%252525%20%2537%20dir',
+            '/collect',
+            '/g%23%20%253%20o%20%26%20%252525%20%2537%20dir',
             '/users',
             '/file%20%231.txt',
-            '/foo%20bar',
+            '/foo%20%26%20bar',
             '/nums',
             '/todo.txt',
+            '/%E3%81%95%E3%81%8F%E3%82%89.txt'
           ]);
           done();
         });
@@ -73,63 +209,489 @@ describe('directory()', function(){
 
     describe('when Accept: text/plain is given', function () {
       it('should respond with text', function (done) {
+        var server = createServer()
+
         request(server)
         .get('/')
         .set('Accept', 'text/plain')
         .expect(200)
-        .expect('Content-Type', /plain/)
+        .expect('Content-Type', 'text/plain; charset=utf-8')
         .expect(/users/)
-        .expect(/g# %3 o %2525 %37 dir/)
+        .expect(/g# %3 o & %2525 %37 dir/)
         .expect(/file #1.txt/)
         .expect(/todo.txt/)
+        .expect(/さくら\.txt/)
         .end(done);
       });
+
+      it('should include security header', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/plain')
+        .expect('X-Content-Type-Options', 'nosniff')
+        .expect(200, done)
+      })
+    });
+
+    describe('when Accept: application/x-bogus is given', function () {
+      it('should respond with 406', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'application/x-bogus')
+        .expect(406, done)
+      });
+    });
+  });
+
+  describe('with "hidden" option', function () {
+    it('should filter hidden files by default', function (done) {
+      var server = createServer()
+
+      request(server)
+      .get('/')
+      .expect(bodyDoesNotContain('.hidden'))
+      .expect(200, done)
+    });
+
+    it('should filter hidden files', function (done) {
+      var server = createServer('test/fixtures', {'hidden': false})
+
+      request(server)
+      .get('/')
+      .expect(bodyDoesNotContain('.hidden'))
+      .expect(200, done)
+    });
+
+    it('should not filter hidden files', function (done) {
+      var server = createServer('test/fixtures', {'hidden': true})
+
+      request(server)
+      .get('/')
+      .expect(200, /\.hidden/, done)
+    });
+  });
+
+  describe('with "filter" option', function () {
+    it('should custom filter files', function (done) {
+      var cb = after(2, done)
+      var server = createServer(fixtures, {'filter': filter})
+
+      function filter(name) {
+        if (name.indexOf('foo') === -1) return true
+        cb()
+        return false
+      }
+
+      request(server)
+      .get('/')
+      .expect(bodyDoesNotContain('foo'))
+      .expect(200, cb)
+    });
+
+    it('should filter after hidden filter', function (done) {
+      var server = createServer(fixtures, {'filter': filter, 'hidden': false})
+
+      function filter(name) {
+        if (name.indexOf('.') === 0) {
+          done(new Error('unexpected hidden file'))
+        }
+
+        return true
+      }
+
+      request(server)
+      .get('/')
+      .expect(200, done)
+    });
+
+    it('should filter directory paths', function (done) {
+      var cb = after(4, done)
+      var server = createServer(fixtures, {'filter': filter})
+
+      function filter(name, index, list, dir) {
+        if (path.normalize(dir) === path.normalize(path.join(fixtures, '/users'))) {
+          cb()
+        }
+        return true
+      }
+
+      request(server)
+      .get('/users')
+      .expect(200, cb)
+    });
+  });
+
+  describe('with "icons" option', function () {
+    it('should include icons for html', function (done) {
+      var server = createServer(fixtures, {'icons': true})
+
+      request(server)
+      .get('/collect')
+      .expect(/data:image\/png/)
+      .expect(/icon-default/)
+      .expect(/icon-directory/)
+      .expect(/icon-image/)
+      .expect(/icon-txt/)
+      .expect(/icon-application-pdf/)
+      .expect(/icon-video/)
+      .expect(/icon-xml/)
+      .expect(200, done)
+    });
+  });
+
+  describe('with "template" option', function () {
+    describe('when setting a custom template file', function () {
+      var server;
+      before(function () {
+        server = createServer(fixtures, {'template': __dirname + '/shared/template.html'});
+      });
+
+      it('should respond with file list', function (done) {
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+        .expect(/<a href="\/users"/)
+        .expect(/<a href="\/file%20%231.txt"/)
+        .expect(/<a href="\/todo.txt"/)
+        .expect(200, done)
+      });
+
+      it('should respond with testing template sentence', function (done) {
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200, /This is the test template/, done)
+      });
+
+      it('should have default styles', function (done) {
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200, /ul#files/, done)
+      });
+
+      it('should list directory twice', function (done) {
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(function (res) {
+          var occurances = res.text.match(/directory \/users\//g)
+          if (occurances && occurances.length === 2) return
+          throw new Error('directory not listed twice')
+        })
+        .expect(200, done)
+      });
+    });
+
+    describe('when setting a custom template function', function () {
+      it('should invoke function to render', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, 'This is a template.');
+        }});
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200, 'This is a template.', done);
+      });
+
+      it('should handle render errors', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(new Error('boom!'));
+        }});
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(500, 'boom!', done);
+      });
+
+      it('should provide "directory" local', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, JSON.stringify(locals.directory));
+        }});
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, '"/users/"', done);
+      });
+
+      it('should provide "displayIcons" local', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, JSON.stringify(locals.displayIcons));
+        }});
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, 'false', done);
+      });
+
+      it('should provide "fileList" local', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, JSON.stringify(locals.fileList.map(function (file) {
+            file.stat = file.stat instanceof fs.Stats;
+            return file;
+          })));
+        }});
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect('[{"name":"..","stat":true},{"name":"#dir","stat":true},{"name":"index.html","stat":true},{"name":"tobi.txt","stat":true}]')
+        .expect(200, done);
+      });
+
+      it('should provide "path" local', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, JSON.stringify(locals.path));
+        }});
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, JSON.stringify(path.join(fixtures, 'users/')), done);
+      });
+
+      it('should provide "style" local', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, JSON.stringify(locals.style));
+        }});
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, /#files \.icon \.name/, done);
+      });
+
+      it('should provide "viewName" local', function (done) {
+        var server = createServer(fixtures, {'template': function (locals, callback) {
+          callback(null, JSON.stringify(locals.viewName));
+        }});
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, '"tiles"', done);
+      });
+    });
+  });
+
+  describe('when using custom handler', function () {
+    describe('exports.html', function () {
+      alterProperty(serveIndex, 'html', serveIndex.html)
+
+      it('should get called with Accept: text/html', function (done) {
+        var server = createServer()
+
+        serveIndex.html = function (req, res, files) {
+          res.setHeader('Content-Type', 'text/html');
+          res.end('called');
+        }
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200, 'called', done)
+      });
+
+      it('should get file list', function (done) {
+        var server = createServer()
+
+        serveIndex.html = function (req, res, files) {
+          var text = files
+            .filter(function (f) { return /\.txt$/.test(f) })
+            .sort()
+          res.setHeader('Content-Type', 'text/html')
+          res.end('<b>' + text.length + ' text files</b>')
+        }
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200, '<b>3 text files</b>', done)
+      });
+
+      it('should get dir name', function (done) {
+        var server = createServer()
+
+        serveIndex.html = function (req, res, files, next, dir) {
+          res.setHeader('Content-Type', 'text/html')
+          res.end('<b>' + dir + '</b>')
+        }
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, '<b>/users/</b>', done)
+      });
+
+      it('should get template path', function (done) {
+        var server = createServer()
+
+        serveIndex.html = function (req, res, files, next, dir, showUp, icons, path, view, template) {
+          res.setHeader('Content-Type', 'text/html')
+          res.end(String(fs.existsSync(template)))
+        }
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, 'true', done)
+      });
+
+      it('should get template with tokens', function (done) {
+        var server = createServer()
+
+        serveIndex.html = function (req, res, files, next, dir, showUp, icons, path, view, template) {
+          res.setHeader('Content-Type', 'text/html')
+          res.end(fs.readFileSync(template, 'utf8'))
+        }
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(/{directory}/)
+        .expect(/{files}/)
+        .expect(/{linked-path}/)
+        .expect(/{style}/)
+        .expect(200, done)
+      });
+
+      it('should get stylesheet path', function (done) {
+        var server = createServer()
+
+        serveIndex.html = function (req, res, files, next, dir, showUp, icons, path, view, template, stylesheet) {
+          res.setHeader('Content-Type', 'text/html')
+          res.end(String(fs.existsSync(stylesheet)))
+        }
+
+        request(server)
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200, 'true', done)
+      });
+    });
+
+    describe('exports.plain', function () {
+      alterProperty(serveIndex, 'plain', serveIndex.plain)
+
+      it('should get called with Accept: text/plain', function (done) {
+        var server = createServer()
+
+        serveIndex.plain = function (req, res, files) {
+          res.setHeader('Content-Type', 'text/plain');
+          res.end('called');
+        }
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/plain')
+        .expect(200, 'called', done)
+      });
+    });
+
+    describe('exports.json', function () {
+      alterProperty(serveIndex, 'json', serveIndex.json)
+
+      it('should get called with Accept: application/json', function (done) {
+        var server = createServer()
+
+        serveIndex.json = function (req, res, files) {
+          res.setHeader('Content-Type', 'application/json');
+          res.end('"called"');
+        }
+
+        request(server)
+        .get('/')
+        .set('Accept', 'application/json')
+        .expect(200, '"called"', done)
+      });
     });
   });
 
   describe('when navigating to other directory', function () {
-    var server;
-    before(function () {
-      server = createServer();
-    });
-    after(function (done) {
-      server.close(done);
-    });
-
     it('should respond with correct listing', function (done) {
+      var server = createServer()
+
       request(server)
       .get('/users/')
       .set('Accept', 'text/html')
       .expect(200)
-      .expect('Content-Type', /html/)
+      .expect('Content-Type', 'text/html; charset=utf-8')
       .expect(/<a href="\/users\/index.html"/)
       .expect(/<a href="\/users\/tobi.txt"/)
       .end(done);
     });
 
+    it('should include link to parent directory', function (done) {
+      var server = createServer()
+
+      request(server)
+      .get('/users')
+      .end(function (err, res) {
+        if (err) return done(err);
+        var body = res.text.split('</h1>')[1];
+        var urls = body.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
+        assert.deepEqual(urls, [
+          '/',
+          '/users/%23dir',
+          '/users/index.html',
+          '/users/tobi.txt'
+        ]);
+        done();
+      });
+    });
+
     it('should work for directory with #', function (done) {
+      var server = createServer()
+
       request(server)
       .get('/%23directory/')
       .set('Accept', 'text/html')
       .expect(200)
-      .expect('Content-Type', /html/)
+      .expect('Content-Type', 'text/html; charset=utf-8')
       .expect(/<a href="\/%23directory"/)
       .expect(/<a href="\/%23directory\/index.html"/)
       .end(done);
     });
 
     it('should work for directory with special chars', function (done) {
+      var server = createServer()
+
       request(server)
-      .get('/g%23%20%253%20o%20%252525%20%2537%20dir/')
+      .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
       .set('Accept', 'text/html')
       .expect(200)
-      .expect('Content-Type', /html/)
-      .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir"/)
-      .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir\/empty.txt"/)
+      .expect('Content-Type', 'text/html; charset=utf-8')
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir\/empty.txt"/)
+      .end(done);
+    });
+
+    it('should property escape directory names', function (done) {
+      var server = createServer()
+
+      request(server)
+      .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
+      .set('Accept', 'text/html')
+      .expect(200)
+      .expect('Content-Type', 'text/html; charset=utf-8')
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+      .expect(/g# %3 o &amp; %2525 %37 dir/)
+      .expect(bodyDoesNotContain('g# %3 o & %2525 %37 dir'))
       .end(done);
     });
 
     it('should not work for outside root', function (done) {
+      var server = createServer()
+
       request(server)
       .get('/../support/')
       .set('Accept', 'text/html')
@@ -137,37 +699,10 @@ describe('directory()', function(){
     });
   });
 
-  describe('when setting a custom template', function () {
-    var server;
-    before(function () {
-      server = createServer('test/fixtures', {'template': __dirname + '/shared/template.html'});
-    });
-    after(function (done) {
-      server.close(done);
-    });
-
-    it('should respond with file list and testing template sentence', function (done) {
-      request(server)
-      .get('/')
-      .set('Accept', 'text/html')
-      .expect(200)
-      .expect('Content-Type', /html/)
-      .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir"/)
-      .expect(/<a href="\/users"/)
-      .expect(/<a href="\/file%20%231.txt"/)
-      .expect(/<a href="\/todo.txt"/)
-      .expect(/This is the test template/)
-      .end(done);
-    });
-  });
-
   describe('when setting a custom stylesheet', function () {
     var server;
     before(function () {
-      server = createServer('test/fixtures', {'stylesheet': __dirname + '/shared/styles.css'});
-    });
-    after(function (done) {
-      server.close(done);
+      server = createServer(fixtures, {'stylesheet': __dirname + '/shared/styles.css'});
     });
 
     it('should respond with appropriate embedded styles', function (done) {
@@ -175,7 +710,7 @@ describe('directory()', function(){
       .get('/')
       .set('Accept', 'text/html')
       .expect(200)
-      .expect('Content-Type', /html/)
+      .expect('Content-Type', 'text/html; charset=utf-8')
       .expect(/color: #00ff00;/)
       .end(done);
     });
@@ -184,51 +719,39 @@ describe('directory()', function(){
   describe('when set with trailing slash', function () {
     var server;
     before(function () {
-      server = createServer('test/fixtures/');
-    });
-    after(function (done) {
-      server.close(done);
+      server = createServer(fixtures + '/');
     });
 
     it('should respond with file list', function (done) {
       request(server)
       .get('/')
       .set('Accept', 'application/json')
-      .expect(200)
       .expect('Content-Type', /json/)
-      .end(function (err, res) {
-        if (err) throw err;
-        res.body.should.include('users');
-        res.body.should.include('file #1.txt');
-        res.body.should.include('nums');
-        res.body.should.include('todo.txt');
-        done();
-      });
+      .expect(/users/)
+      .expect(/file #1\.txt/)
+      .expect(/nums/)
+      .expect(/todo\.txt/)
+      .expect(200, done)
     });
   });
 
-  describe('when set to \'.\'', function () {
+  (skipRelative ? describe.skip : describe)('when set to \'.\'', function () {
     var server;
     before(function () {
       server = createServer('.');
     });
-    after(function (done) {
-      server.close(done);
-    });
 
     it('should respond with file list', function (done) {
+      var dest = relative.split(path.sep).join('/');
       request(server)
-      .get('/')
+      .get('/' + dest + '/')
       .set('Accept', 'application/json')
-      .expect(200)
       .expect('Content-Type', /json/)
-      .end(function (err, res) {
-        if (err) throw err;
-        res.body.should.include('LICENSE');
-        res.body.should.include('public');
-        res.body.should.include('test');
-        done();
-      });
+      .expect(/users/)
+      .expect(/file #1\.txt/)
+      .expect(/nums/)
+      .expect(/todo\.txt/)
+      .expect(200, done)
     });
 
     it('should not allow serving outside root', function (done) {
@@ -240,9 +763,33 @@ describe('directory()', function(){
   });
 });
 
-function createServer(dir, opts) {
-  var app = connect();
-  dir = dir || 'test/fixtures';
-  app.use(serveIndex(dir, opts));
-  return app.listen();
+function alterProperty(obj, prop, val) {
+  var prev
+
+  beforeEach(function () {
+    prev = obj[prop]
+    obj[prop] = val
+  })
+  afterEach(function () {
+    obj[prop] = prev
+  })
+}
+
+function createServer(dir, opts) {
+  dir = dir || fixtures
+
+  var _serveIndex = serveIndex(dir, opts)
+
+  return http.createServer(function (req, res) {
+    _serveIndex(req, res, function (err) {
+      res.statusCode = err ? (err.status || 500) : 404
+      res.end(err ? err.message : 'Not Found')
+    })
+  })
+}
+
+function bodyDoesNotContain(text) {
+  return function (res) {
+    assert.equal(res.text.indexOf(text), -1)
+  }
 }