1.6.3

fixes #28

.travis.yml

@@ -2,10 +2,9 @@ language: node_js
 node_js:
   - "0.8"
   - "0.10"
-  - "0.11"
-matrix:
-  allow_failures:
-    - node_js: "0.11"
-  fast_finish: true
-script: "npm run-script test-travis"
+  - "0.12"
+  - "1.0"
+  - "1.5"
+sudo: false
+script: "npm run-script test-ci"
 after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"

HISTORY.md

@@ -1,3 +1,89 @@
+1.6.3 / 2015-03-13
+==================
+
+  * Properly escape file names in HTML
+  * deps: accepts@~1.2.5
+    - deps: mime-types@~2.0.10
+  * deps: debug@~2.1.3
+    - Fix high intensity foreground color for bold
+    - deps: ms@0.7.0
+  * deps: escape-html@1.0.1
+  * deps: mime-types@~2.0.10
+    - Add new mime types
+
+1.6.2 / 2015-02-16
+==================
+
+  * deps: accepts@~1.2.4
+    - deps: mime-types@~2.0.9
+    - deps: negotiator@0.5.1
+  * deps: http-errors@~1.3.1
+    - Construct errors using defined constructors from `createError`
+    - Fix error names that are not identifiers
+    - Set a meaningful `name` property on constructed errors
+  * deps: mime-types@~2.0.9
+    - Add new mime types
+    - deps: mime-db@~1.7.0
+
+1.6.1 / 2015-01-31
+==================
+
+  * deps: accepts@~1.2.3
+    - deps: mime-types@~2.0.8
+  * deps: mime-types@~2.0.8
+    - Add new mime types
+    - deps: mime-db@~1.6.0
+
+1.6.0 / 2015-01-01
+==================
+
+  * Add link to root directory
+  * deps: accepts@~1.2.2
+    - deps: mime-types@~2.0.7
+    - deps: negotiator@0.5.0
+  * deps: batch@0.5.2
+  * deps: debug@~2.1.1
+  * deps: mime-types@~2.0.7
+    - Add new mime types
+    - Fix missing extensions
+    - Fix various invalid MIME type entries
+    - Remove example template MIME types
+    - deps: mime-db@~1.5.0
+
+1.5.3 / 2014-12-10
+==================
+
+  * deps: accepts@~1.1.4
+    - deps: mime-types@~2.0.4
+  * deps: http-errors@~1.2.8
+    - Fix stack trace from exported function
+  * deps: mime-types@~2.0.4
+    - Add new mime types
+    - deps: mime-db@~1.3.0
+
+1.5.2 / 2014-12-03
+==================
+
+  * Fix icon name background alignment on mobile view
+
+1.5.1 / 2014-11-22
+==================
+
+  * deps: accepts@~1.1.3
+    - deps: mime-types@~2.0.3
+  * deps: mime-types@~2.0.3
+    - Add new mime types
+    - deps: mime-db@~1.2.0
+
+1.5.0 / 2014-10-16
+==================
+
+  * Create errors with `http-errors`
+  * deps: debug@~2.1.0
+    - Implement `DEBUG_FD` env variable support
+  * deps: mime-types@~2.0.2
+    - deps: mime-db@~1.1.0
+
 1.4.1 / 2014-10-15
 ==================
 

LICENSE

@@ -3,7 +3,7 @@
 Copyright (c) 2010 Sencha Inc.
 Copyright (c) 2011 LearnBoost
 Copyright (c) 2011 TJ Holowaychuk
-Copyright (c) 2014 Douglas Christopher Wilson
+Copyright (c) 2014-2015 Douglas Christopher Wilson
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -2,9 +2,10 @@
 
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
-[![Build Status][travis-image]][travis-url]
+[![Linux Build][travis-image]][travis-url]
+[![Windows Build][appveyor-image]][appveyor-url]
 [![Test Coverage][coveralls-image]][coveralls-url]
-[![Gittip][gittip-image]][gittip-url]
+[![Gratipay][gratipay-image]][gratipay-url]
 
   Serves pages that contain directory listings for a given path.
 
@@ -115,13 +116,15 @@ app.listen()
 [MIT](LICENSE). The [Silk](http://www.famfamfam.com/lab/icons/silk/) icons
 are created by/copyright of [FAMFAMFAM](http://www.famfamfam.com/).
 
-[npm-image]: https://img.shields.io/npm/v/serve-index.svg?style=flat
+[npm-image]: https://img.shields.io/npm/v/serve-index.svg
 [npm-url]: https://npmjs.org/package/serve-index
-[travis-image]: https://img.shields.io/travis/expressjs/serve-index.svg?style=flat
+[travis-image]: https://img.shields.io/travis/expressjs/serve-index/master.svg?label=linux
 [travis-url]: https://travis-ci.org/expressjs/serve-index
-[coveralls-image]: https://img.shields.io/coveralls/expressjs/serve-index.svg?style=flat
+[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/serve-index/master.svg?label=windows
+[appveyor-url]: https://ci.appveyor.com/project/dougwilson/serve-index
+[coveralls-image]: https://img.shields.io/coveralls/expressjs/serve-index/master.svg
 [coveralls-url]: https://coveralls.io/r/expressjs/serve-index?branch=master
-[downloads-image]: https://img.shields.io/npm/dm/serve-index.svg?style=flat
+[downloads-image]: https://img.shields.io/npm/dm/serve-index.svg
 [downloads-url]: https://npmjs.org/package/serve-index
-[gittip-image]: https://img.shields.io/gittip/dougwilson.svg?style=flat
-[gittip-url]: https://www.gittip.com/dougwilson/
+[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
+[gratipay-url]: https://www.gratipay.com/dougwilson/

appveyor.yml

@@ -0,0 +1,16 @@
+environment:
+  matrix:
+    - nodejs_version: "0.8"
+    - nodejs_version: "0.10"
+    - nodejs_version: "0.12"
+    - nodejs_version: "1.0"
+    - nodejs_version: "1.5"
+install:
+  - ps: Install-Product node $env:nodejs_version
+  - npm install
+build: off
+test_script:
+  - node --version
+  - npm --version
+  - npm run test-ci
+version: "{build}"

index.js

@@ -1,9 +1,8 @@
-
 /*!
  * serve-index
  * Copyright(c) 2011 Sencha Inc.
  * Copyright(c) 2011 TJ Holowaychuk
- * Copyright(c) 2014 Douglas Christopher Wilson
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
  * MIT Licensed
  */
 
@@ -12,12 +11,14 @@
 
 /**
  * Module dependencies.
+ * @private
  */
 
 var accepts = require('accepts');
+var createError = require('http-errors');
 var debug = require('debug')('serve-index');
-var http = require('http')
-  , fs = require('fs')
+var escapeHtml = require('escape-html');
+var fs = require('fs')
   , path = require('path')
   , normalize = path.normalize
   , sep = path.sep
@@ -149,7 +150,7 @@ exports = module.exports = function serveIndex(root, options){
 
         // content-negotiation
         var accept = accepts(req);
-        var type = accept.types(mediaTypes);
+        var type = accept.type(mediaTypes);
 
         // not acceptable
         if (!type) return next(createError(406));
@@ -176,7 +177,7 @@ exports.html = function(req, res, files, next, dir, showUp, icons, path, view, t
         str = str
           .replace(/\{style\}/g, style.concat(iconStyle(files, icons)))
           .replace(/\{files\}/g, html(files, dir, icons, view))
-          .replace(/\{directory\}/g, dir)
+          .replace(/\{directory\}/g, escapeHtml(dir))
           .replace(/\{linked-path\}/g, htmlPath(dir));
 
         var buf = new Buffer(str, 'utf8');
@@ -214,22 +215,6 @@ exports.plain = function(req, res, files){
   res.end(buf);
 };
 
-/**
- * Generate an `Error` from the given status `code`
- * and optional `msg`.
- *
- * @param {Number} code
- * @param {String} msg
- * @return {Error}
- * @api private
- */
-
-function createError(code, msg) {
-  var err = new Error(msg || http.STATUS_CODES[code]);
-  err.status = code;
-  return err;
-};
-
 /**
  * Sort function for with directories first.
  */
@@ -244,11 +229,19 @@ function fileSort(a, b) {
  */
 
 function htmlPath(dir) {
-  var curr = [];
-  return dir.split('/').map(function(part){
-    curr.push(encodeURIComponent(part));
-    return part ? '<a href="' + curr.join('/') + '">' + part + '</a>' : '';
-  }).join(' / ');
+  var parts = dir.split('/');
+  var crumb = new Array(parts.length);
+
+  for (var i = 0; i < parts.length; i++) {
+    var part = parts[i];
+
+    if (part) {
+      parts[i] = encodeURIComponent(part);
+      crumb[i] = '<a href="' + escapeHtml(parts.slice(0, i + 1).join('/')) + '">' + escapeHtml(part) + '</a>';
+    }
+  }
+
+  return crumb.join(' / ');
 }
 
 /**
@@ -359,7 +352,7 @@ function iconStyle (files, useIcons) {
  */
 
 function html(files, dir, useIcons, view) {
-  return '<ul id="files" class="view-' + view + '">'
+  return '<ul id="files" class="view-' + escapeHtml(view) + '">'
     + (view == 'details' ? (
       '<li class="header">'
       + '<span class="name">Name</span>'
@@ -399,13 +392,12 @@ function html(files, dir, useIcons, view) {
       : '';
 
     return '<li><a href="'
-      + normalizeSlashes(normalize(path.join('/')))
-      + '" class="'
-      + classes.join(' ') + '"'
-      + ' title="' + file.name + '">'
-      + '<span class="name">'+file.name+'</span>'
-      + '<span class="size">'+size+'</span>'
-      + '<span class="date">'+date+'</span>'
+      + escapeHtml(normalizeSlashes(normalize(path.join('/'))))
+      + '" class="' + escapeHtml(classes.join(' ')) + '"'
+      + ' title="' + escapeHtml(file.name) + '">'
+      + '<span class="name">' + escapeHtml(file.name) + '</span>'
+      + '<span class="size">' + escapeHtml(size) + '</span>'
+      + '<span class="date">' + escapeHtml(date) + '</span>'
       + '</a></li>';
 
   }).join('\n') + '</ul>';

package.json

@@ -1,22 +1,24 @@
 {
   "name": "serve-index",
   "description": "Serve directory listings",
-  "version": "1.4.1",
+  "version": "1.6.3",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "repository": "expressjs/serve-index",
   "dependencies": {
-    "accepts": "~1.1.2",
-    "batch": "0.5.1",
-    "debug": "~2.0.0",
-    "mime-types": "~2.0.1",
+    "accepts": "~1.2.5",
+    "batch": "0.5.2",
+    "debug": "~2.1.3",
+    "escape-html": "1.0.1",
+    "http-errors": "~1.3.1",
+    "mime-types": "~2.0.10",
     "parseurl": "~1.3.0"
   },
   "devDependencies": {
-    "istanbul": "0.3.2",
-    "mocha": "~1.21.5",
-    "should": "~4.0.0",
-    "supertest": "~0.14.0"
+    "after": "0.8.1",
+    "istanbul": "0.3.7",
+    "mocha": "~2.2.1",
+    "supertest": "~0.15.0"
   },
   "files": [
     "public/",
@@ -29,7 +31,7 @@
   },
   "scripts": {
     "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/",
-    "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/"
+    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
+    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/"
   }
 }

public/directory.html

@@ -75,7 +75,7 @@
   <body class="directory">
     <input id="search" type="text" placeholder="Search" autocomplete="off" />
     <div id="wrapper">
-      <h1>{linked-path}</h1>
+      <h1><a href="/">~</a>{linked-path}</h1>
       {files}
     </div>
   </body>

public/style.css

@@ -249,7 +249,7 @@ ul#files.view-details li.header {
     display: inline-block;
     width: 100%;
     text-indent: 0;
-    background-position: 0 0;
+    background-position: 0 50%;
   }
   #files .icon .name {
     text-indent: 41px;

test/test.js

@@ -1,9 +1,10 @@
 
+var after = require('after');
+var assert = require('assert');
 var http = require('http');
 var fs = require('fs');
 var path = require('path');
 var request = require('supertest');
-var should = require('should');
 var serveIndex = require('..');
 
 var fixtures = path.join(__dirname, '/fixtures');
@@ -13,7 +14,7 @@ var skipRelative = ~relative.indexOf('..') || path.resolve(relative) === relativ
 
 describe('serveIndex(root)', function () {
   it('should require root', function () {
-    serveIndex.should.throw(/root path required/)
+    assert.throws(serveIndex, /root path required/)
   })
 
   it('should serve text/html without Accept header', function (done) {
@@ -108,7 +109,7 @@ describe('serveIndex(root)', function () {
         .get('/')
         .set('Accept', 'application/json')
         .expect('Content-Type', /json/)
-        .expect(/g# %3 o %2525 %37 dir/)
+        .expect(/g# %3 o & %2525 %37 dir/)
         .expect(/users/)
         .expect(/file #1\.txt/)
         .expect(/nums/)
@@ -127,7 +128,7 @@ describe('serveIndex(root)', function () {
         .set('Accept', 'text/html')
         .expect(200)
         .expect('Content-Type', 'text/html; charset=utf-8')
-        .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir"/)
+        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
         .expect(/<a href="\/users"/)
         .expect(/<a href="\/file%20%231.txt"/)
         .expect(/<a href="\/todo.txt"/)
@@ -135,6 +136,20 @@ describe('serveIndex(root)', function () {
         .end(done);
       });
 
+      it('should property escape file names', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/foo%20%26%20bar"/)
+        .expect(/foo &amp; bar/)
+        .expect(bodyDoesNotContain('foo & bar'))
+        .end(done);
+      });
+
       it('should sort folders first', function (done) {
         var server = createServer()
 
@@ -144,15 +159,16 @@ describe('serveIndex(root)', function () {
         .expect(200)
         .expect('Content-Type', 'text/html; charset=utf-8')
         .end(function (err, res) {
-          if (err) throw err;
-          var urls = res.text.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
-          urls.should.eql([
+          if (err) done(err);
+          var body = res.text.split('</h1>')[1];
+          var urls = body.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
+          assert.deepEqual(urls, [
             '/%23directory',
             '/collect',
-            '/g%23%20%253%20o%20%252525%20%2537%20dir',
+            '/g%23%20%253%20o%20%26%20%252525%20%2537%20dir',
             '/users',
             '/file%20%231.txt',
-            '/foo%20bar',
+            '/foo%20%26%20bar',
             '/nums',
             '/todo.txt',
             '/%E3%81%95%E3%81%8F%E3%82%89.txt'
@@ -172,7 +188,7 @@ describe('serveIndex(root)', function () {
         .expect(200)
         .expect('Content-Type', 'text/plain; charset=utf-8')
         .expect(/users/)
-        .expect(/g# %3 o %2525 %37 dir/)
+        .expect(/g# %3 o & %2525 %37 dir/)
         .expect(/file #1.txt/)
         .expect(/todo.txt/)
         .expect(/さくら\.txt/)
@@ -198,11 +214,8 @@ describe('serveIndex(root)', function () {
 
       request(server)
       .get('/')
-      .expect(200, function (err, res) {
-        if (err) return done(err)
-        res.text.should.not.containEql('.hidden')
-        done()
-      });
+      .expect(bodyDoesNotContain('.hidden'))
+      .expect(200, done)
     });
 
     it('should filter hidden files', function (done) {
@@ -210,11 +223,8 @@ describe('serveIndex(root)', function () {
 
       request(server)
       .get('/')
-      .expect(200, function (err, res) {
-        if (err) return done(err)
-        res.text.should.not.containEql('.hidden')
-        done()
-      });
+      .expect(bodyDoesNotContain('.hidden'))
+      .expect(200, done)
     });
 
     it('should not filter hidden files', function (done) {
@@ -228,61 +238,51 @@ describe('serveIndex(root)', function () {
 
   describe('with "filter" option', function () {
     it('should custom filter files', function (done) {
-      var seen = false
+      var cb = after(2, done)
       var server = createServer(fixtures, {'filter': filter})
 
       function filter(name) {
         if (name.indexOf('foo') === -1) return true
-        seen = true
+        cb()
         return false
       }
 
       request(server)
       .get('/')
-      .expect(200, function (err, res) {
-        if (err) return done(err)
-        seen.should.be.true
-        res.text.should.not.containEql('foo')
-        done()
-      });
+      .expect(bodyDoesNotContain('foo'))
+      .expect(200, cb)
     });
 
     it('should filter after hidden filter', function (done) {
-      var seen = false
       var server = createServer(fixtures, {'filter': filter, 'hidden': false})
 
       function filter(name) {
-        seen = seen || name.indexOf('.') === 0
+        if (name.indexOf('.') === 0) {
+          done(new Error('unexpected hidden file'))
+        }
+
         return true
       }
 
       request(server)
       .get('/')
-      .expect(200, function (err, res) {
-        if (err) return done(err)
-        seen.should.be.false
-        done()
-      });
+      .expect(200, done)
     });
 
     it('should filter directory paths', function (done) {
-      var seen = false
+      var cb = after(3, done)
       var server = createServer(fixtures, {'filter': filter})
 
       function filter(name, index, list, dir) {
         if (path.normalize(dir) === path.normalize(path.join(fixtures, '/users'))) {
-          seen = true
+          cb()
         }
         return true
       }
 
       request(server)
       .get('/users')
-      .expect(200, function (err, res) {
-        if (err) return done(err)
-        seen.should.be.true
-        done()
-      });
+      .expect(200, cb)
     });
   });
 
@@ -306,10 +306,7 @@ describe('serveIndex(root)', function () {
 
   describe('when using custom handler', function () {
     describe('exports.html', function () {
-      var orig = serveIndex.html
-      after(function () {
-        serveIndex.html = orig
-      })
+      alterProperty(serveIndex, 'html', serveIndex.html)
 
       it('should get called with Accept: text/html', function (done) {
         var server = createServer()
@@ -404,10 +401,7 @@ describe('serveIndex(root)', function () {
     });
 
     describe('exports.plain', function () {
-      var orig = serveIndex.plain
-      after(function () {
-        serveIndex.plain = orig
-      })
+      alterProperty(serveIndex, 'plain', serveIndex.plain)
 
       it('should get called with Accept: text/plain', function (done) {
         var server = createServer()
@@ -425,10 +419,7 @@ describe('serveIndex(root)', function () {
     });
 
     describe('exports.json', function () {
-      var orig = serveIndex.json
-      after(function () {
-        serveIndex.json = orig
-      })
+      alterProperty(serveIndex, 'json', serveIndex.json)
 
       it('should get called with Accept: application/json', function (done) {
         var server = createServer()
@@ -477,12 +468,26 @@ describe('serveIndex(root)', function () {
       var server = createServer()
 
       request(server)
-      .get('/g%23%20%253%20o%20%252525%20%2537%20dir/')
+      .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
       .set('Accept', 'text/html')
       .expect(200)
       .expect('Content-Type', 'text/html; charset=utf-8')
-      .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir"/)
-      .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir\/empty.txt"/)
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir\/empty.txt"/)
+      .end(done);
+    });
+
+    it('should property escape directory names', function (done) {
+      var server = createServer()
+
+      request(server)
+      .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
+      .set('Accept', 'text/html')
+      .expect(200)
+      .expect('Content-Type', 'text/html; charset=utf-8')
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+      .expect(/g# %3 o &amp; %2525 %37 dir/)
+      .expect(bodyDoesNotContain('g# %3 o & %2525 %37 dir'))
       .end(done);
     });
 
@@ -506,7 +511,7 @@ describe('serveIndex(root)', function () {
       request(server)
       .get('/')
       .set('Accept', 'text/html')
-      .expect(/<a href="\/g%23%20%253%20o%20%252525%20%2537%20dir"/)
+      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
       .expect(/<a href="\/users"/)
       .expect(/<a href="\/file%20%231.txt"/)
       .expect(/<a href="\/todo.txt"/)
@@ -604,6 +609,18 @@ describe('serveIndex(root)', function () {
   });
 });
 
+function alterProperty(obj, prop, val) {
+  var prev
+
+  beforeEach(function () {
+    prev = obj[prop]
+    obj[prop] = val
+  })
+  afterEach(function () {
+    obj[prop] = prev
+  })
+}
+
 function createServer(dir, opts) {
   dir = dir || fixtures
 
@@ -616,3 +633,9 @@ function createServer(dir, opts) {
     })
   })
 }
+
+function bodyDoesNotContain(text) {
+  return function (res) {
+    assert.equal(res.text.indexOf(text), -1)
+  }
+}