1.9.1

closes #64

.gitignore

@@ -1,3 +1,4 @@
 coverage
 node_modules
 npm-debug.log
+package-lock.json

.travis.yml

@@ -6,12 +6,25 @@ node_js:
   - "1.8"
   - "2.5"
   - "3.3"
-  - "4.2"
-  - "5.3"
+  - "4.8"
+  - "5.12"
+  - "6.11"
+  - "7.10"
+  - "8.3"
 sudo: false
+cache:
+  directories:
+    - node_modules
 before_install:
+  # Skip updating shrinkwrap / lock
+  - "npm config set shrinkwrap false"
+
   # Setup Node.js version-specific dependencies
   - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
+
+  # Update Node.js modules
+  - "test ! -d node_modules || npm prune"
+  - "test ! -d node_modules || npm rebuild"
 script:
   # Run test script, depending on istanbul install
   - "test ! -z $(npm -ps ls istanbul) || npm test"

HISTORY.md

@@ -1,3 +1,57 @@
+1.9.1 / 2017-09-28
+==================
+
+  * deps: accepts@~1.3.4
+    - deps: mime-types@~2.1.16
+  * deps: debug@2.6.9
+  * deps: http-errors@~1.6.2
+    - deps: depd@1.1.1
+  * deps: mime-types@~2.1.17
+    - Add new mime types
+    - deps: mime-db@~1.30.0
+  * deps: parseurl@~1.3.2
+    - perf: reduce overhead for full URLs
+    - perf: unroll the "fast-path" `RegExp`
+
+1.9.0 / 2017-05-25
+==================
+
+  * Set `X-Content-Type-Options: nosniff` header
+  * deps: batch@0.6.1
+  * deps: debug@2.6.8
+    - Allow colors in workers
+    - Deprecated `DEBUG_FD` environment variable set to `3` or higher
+    - Fix `DEBUG_MAX_ARRAY_LENGTH`
+    - Fix error when running under React Native
+    - Use same color for same namespace
+    - deps: ms@2.0.0
+  * deps: http-errors@~1.6.1
+    - Make `message` property enumerable for `HttpError`s
+    - deps: inherits@2.0.3
+    - deps: setprototypeof@1.0.3
+    - deps: statuses@'>= 1.3.1 < 2'
+  * deps: mime-types@~2.1.15
+    - Add new mime types
+    - Add `audio/mp3`
+
+1.8.0 / 2016-06-17
+==================
+
+  * Make inline file search case-insensitive
+  * deps: accepts@~1.3.3
+    - deps: mime-types@~2.1.11
+    - deps: negotiator@0.6.1
+    - perf: improve header parsing speed
+  * deps: http-errors@~1.5.0
+    - Use `setprototypeof` module to replace `__proto__` setting
+    - deps: inherits@2.0.1
+    - deps: statuses@'>= 1.3.0 < 2'
+    - perf: enable strict mode
+  * deps: mime-types@~2.1.11
+    - Add new mime types
+    - Update primary extension for `audio/mp4`
+    - deps: mime-db@~1.23.0
+
 1.7.3 / 2016-01-24
 ==================
 

README.md

@@ -11,6 +11,10 @@
 
 ## Install
 
+This is a [Node.js](https://nodejs.org/en/) module available through the
+[npm registry](https://www.npmjs.com/). Installation is done using the
+[`npm install` command](https://docs.npmjs.com/getting-started/installing-npm-packages-locally):
+
 ```sh
 $ npm install serve-index
 ```
@@ -123,8 +127,12 @@ var serveIndex = require('serve-index')
 var app = express()
 
 // Serve URLs like /ftp/thing as public/ftp/thing
-app.use('/ftp', serveIndex('public/ftp', {'icons': true}))
-app.listen()
+// The express.static serves the file contents
+// The serveIndex is this module serving the directory
+app.use('/ftp', express.static('public/ftp'), serveIndex('public/ftp', {'icons': true}))
+
+// Listen
+app.listen(3000)
 ```
 
 ## License

appveyor.yml

@@ -6,11 +6,19 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.2"
-    - nodejs_version: "5.3"
+    - nodejs_version: "4.8"
+    - nodejs_version: "5.12"
+    - nodejs_version: "6.11"
+    - nodejs_version: "7.10"
+    - nodejs_version: "8.3"
+cache:
+  - node_modules
 install:
   - ps: Install-Product node $env:nodejs_version
+  - npm config set shrinkwrap false
   - if "%nodejs_version%" equ "0.8" npm rm --save-dev istanbul
+  - if exist node_modules npm prune
+  - if exist node_modules npm rebuild
   - npm install
 build: off
 test_script:

index.js

@@ -208,11 +208,7 @@ serveIndex.html = function _html(req, res, files, next, dir, showUp, icons, path
       // render html
       render(locals, function (err, body) {
         if (err) return next(err);
-
-        var buf = new Buffer(body, 'utf8');
-        res.setHeader('Content-Type', 'text/html; charset=utf-8');
-        res.setHeader('Content-Length', buf.length);
-        res.end(buf);
+        send(res, 'text/html', body)
       });
     });
   });
@@ -223,12 +219,7 @@ serveIndex.html = function _html(req, res, files, next, dir, showUp, icons, path
  */
 
 serveIndex.json = function _json(req, res, files) {
-  var body = JSON.stringify(files);
-  var buf = new Buffer(body, 'utf8');
-
-  res.setHeader('Content-Type', 'application/json; charset=utf-8');
-  res.setHeader('Content-Length', buf.length);
-  res.end(buf);
+  send(res, 'application/json', JSON.stringify(files))
 };
 
 /**
@@ -236,12 +227,7 @@ serveIndex.json = function _json(req, res, files) {
  */
 
 serveIndex.plain = function _plain(req, res, files) {
-  var body = files.join('\n') + '\n';
-  var buf = new Buffer(body, 'utf8');
-
-  res.setHeader('Content-Type', 'text/plain; charset=utf-8');
-  res.setHeader('Content-Length', buf.length);
-  res.end(buf);
+  send(res, 'text/plain', (files.join('\n') + '\n'))
 };
 
 /**
@@ -425,9 +411,7 @@ function iconLookup(filename) {
 
 function iconStyle(files, useIcons) {
   if (!useIcons) return '';
-  var className;
   var i;
-  var iconName;
   var list = [];
   var rules = {};
   var selector;
@@ -505,6 +489,23 @@ function removeHidden(files) {
   });
 }
 
+/**
+ * Send a response.
+ * @private
+ */
+
+function send (res, type, body) {
+  // security header for content sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+
+  // standard headers
+  res.setHeader('Content-Type', type + '; charset=utf-8')
+  res.setHeader('Content-Length', Buffer.byteLength(body, 'utf8'))
+
+  // body
+  res.end(body, 'utf8')
+}
+
 /**
  * Stat all files and return array of stat
  * in same order.

package.json

@@ -1,23 +1,23 @@
 {
   "name": "serve-index",
   "description": "Serve directory listings",
-  "version": "1.7.3",
+  "version": "1.9.1",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "repository": "expressjs/serve-index",
   "dependencies": {
-    "accepts": "~1.2.13",
-    "batch": "0.5.3",
-    "debug": "~2.2.0",
+    "accepts": "~1.3.4",
+    "batch": "0.6.1",
+    "debug": "2.6.9",
     "escape-html": "~1.0.3",
-    "http-errors": "~1.3.1",
-    "mime-types": "~2.1.9",
-    "parseurl": "~1.3.1"
+    "http-errors": "~1.6.2",
+    "mime-types": "~2.1.17",
+    "parseurl": "~1.3.2"
   },
   "devDependencies": {
-    "after": "0.8.1",
-    "istanbul": "0.4.2",
-    "mocha": "2.3.4",
+    "after": "0.8.2",
+    "istanbul": "0.4.5",
+    "mocha": "2.5.3",
     "supertest": "1.1.0"
   },
   "files": [

public/directory.html

@@ -52,11 +52,11 @@
       }
 
       function search() {
-        var str = $('search').value
-          , links = $('files').all('a');
+        var str = $('search').value.toLowerCase();
+        var links = $('files').all('a');
 
         links.each(function(link){
-          var text = link.textContent;
+          var text = link.textContent.toLowerCase();
 
           if ('..' == text) return;
           if (str.length && ~text.indexOf(str)) {

test/shared/index.js

@@ -1,26 +0,0 @@
-
-var bytes = require('bytes');
-
-exports['default request body'] = function(app){
-  it('should default to {}', function(done){
-    app.request()
-    .post('/')
-    .end(function(res){
-      res.body.should.equal('{}');
-      done();
-    })
-  })
-};
-
-exports['limit body to'] = function(size, type, app){
-  it('should accept a limit option', function(done){
-    app.request()
-    .post('/')
-    .set('Content-Length', bytes(size) + 1)
-    .set('Content-Type', type)
-    .end(function(res){
-      res.should.have.status(413);
-      done();
-    })
-  })
-}

test/test.js

@@ -26,6 +26,15 @@ describe('serveIndex(root)', function () {
     .expect(200, done)
   })
 
+  it('should include security header', function (done) {
+    var server = createServer()
+
+    request(server)
+    .get('/')
+    .expect('X-Content-Type-Options', 'nosniff')
+    .expect(200, done)
+  })
+
   it('should serve a directory index', function (done) {
     var server = createServer()
 
@@ -117,6 +126,16 @@ describe('serveIndex(root)', function () {
         .expect(/さくら\.txt/)
         .expect(200, done)
       });
+
+      it('should include security header', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'application/json')
+        .expect('X-Content-Type-Options', 'nosniff')
+        .expect(200, done)
+      })
     });
 
     describe('when Accept: text/html is given', function () {
@@ -136,6 +155,16 @@ describe('serveIndex(root)', function () {
         .end(done);
       });
 
+      it('should include security header', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect('X-Content-Type-Options', 'nosniff')
+        .expect(200, done)
+      })
+
       it('should property escape file names', function (done) {
         var server = createServer()
 
@@ -194,6 +223,16 @@ describe('serveIndex(root)', function () {
         .expect(/さくら\.txt/)
         .end(done);
       });
+
+      it('should include security header', function (done) {
+        var server = createServer()
+
+        request(server)
+        .get('/')
+        .set('Accept', 'text/plain')
+        .expect('X-Content-Type-Options', 'nosniff')
+        .expect(200, done)
+      })
     });
 
     describe('when Accept: application/x-bogus is given', function () {