build(deps): bump github/codeql-action from 3.29.7 to 4.31.2

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.7 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](51f77329af...0499de31b9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.31.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

.editorconfig

@@ -0,0 +1,11 @@
+# http://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[{*.js,*.json,*.yml}]
+indent_size = 2
+indent_style = space

.eslintignore

@@ -0,0 +1,3 @@
+.nyc_output
+coverage
+node_modules

.eslintrc.yml

@@ -0,0 +1,13 @@
+root: true
+extends:
+  - plugin:markdown/recommended
+plugins:
+  - markdown
+overrides:
+  - files: '**/*.md'
+    processor: 'markdown/markdown'
+rules:
+  eol-last: error
+  eqeqeq: [error, allow-null]
+  indent: [error, 2, { SwitchCase: 1 }]
+  no-trailing-spaces: error

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 10
+    ignore:
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]

.github/workflows/ci.yml

@@ -0,0 +1,241 @@
+name: ci
+
+on:
+- pull_request
+- push
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+      contents: read  # for actions/checkout to fetch code
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        name:
+        - Node.js 0.8
+        - Node.js 0.10
+        - Node.js 0.12
+        - io.js 1.x
+        - io.js 2.x
+        - io.js 3.x
+        - Node.js 4.x
+        - Node.js 5.x
+        - Node.js 6.x
+        - Node.js 7.x
+        - Node.js 8.x
+        - Node.js 9.x
+        - Node.js 10.x
+        - Node.js 11.x
+        - Node.js 12.x
+        - Node.js 13.x
+        - Node.js 14.x
+        - Node.js 15.x
+        - Node.js 16.x
+        - Node.js 17.x
+        - Node.js 18.x
+        - Node.js 19.x
+        - Node.js 20.x
+        - Node.js 21.x
+        - Node.js 22.x
+        - Node.js 23.x
+        - Node.js 24.x
+
+        include:
+        - name: Node.js 0.8
+          node-version: "0.8"
+          npm-i: mocha@2.5.3 supertest@1.1.0
+          npm-rm: nyc
+
+        - name: Node.js 0.10
+          node-version: "0.10"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.1
+
+        - name: Node.js 0.12
+          node-version: "0.12"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.1
+
+        - name: io.js 1.x
+          node-version: "1"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.1
+
+        - name: io.js 2.x
+          node-version: "2"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.1
+
+        - name: io.js 3.x
+          node-version: "3"
+          npm-i: mocha@3.5.3 nyc@10.3.2 supertest@2.0.1
+
+        - name: Node.js 4.x
+          node-version: "4"
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+        - name: Node.js 5.x
+          node-version: "5"
+          npm-i: mocha@5.2.0 nyc@11.9.0 supertest@3.4.2
+
+        - name: Node.js 6.x
+          node-version: "6"
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.3
+
+        - name: Node.js 7.x
+          node-version: "7"
+          npm-i: mocha@6.2.2 nyc@14.1.1 supertest@6.1.3
+
+        - name: Node.js 8.x
+          node-version: "8"
+          npm-i: mocha@7.1.2 nyc@14.1.1 supertest@6.1.3
+
+        - name: Node.js 9.x
+          node-version: "9"
+          npm-i: mocha@7.1.2 nyc@14.1.1 supertest@6.1.3
+
+        - name: Node.js 10.x
+          node-version: "10"
+          npm-i: mocha@8.4.0 supertest@6.1.3
+
+        - name: Node.js 11.x
+          node-version: "11"
+          npm-i: mocha@8.4.0 supertest@6.1.3
+
+        - name: Node.js 12.x
+          node-version: "12"
+          npm-i: mocha@9.2.2 supertest@6.1.3
+
+        - name: Node.js 13.x
+          node-version: "13"
+          npm-i: mocha@9.2.2 supertest@6.1.3
+
+        - name: Node.js 14.x
+          node-version: "14"
+          npm-i: supertest@6.1.3
+
+        - name: Node.js 15.x
+          node-version: "15"
+          npm-i: supertest@6.1.3
+
+        - name: Node.js 16.x
+          node-version: "16"
+          npm-i: supertest@6.1.3
+
+        - name: Node.js 17.x
+          node-version: "17"
+          npm-i: supertest@6.1.3
+
+        - name: Node.js 18.x
+          node-version: "18"
+
+        - name: Node.js 19.x
+          node-version: "19"
+
+        - name: Node.js 20.x
+          node-version: "20"
+
+        - name: Node.js 21.x
+          node-version: "21"
+
+        - name: Node.js 22.x
+          node-version: "22"
+
+        - name: Node.js 23.x
+          node-version: "23"
+
+        - name: Node.js 24.x
+          node-version: "24"
+
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+    - name: Install Node.js ${{ matrix.node-version }}
+      shell: bash -eo pipefail -l {0}
+      run: |
+        nvm install --default ${{ matrix.node-version }}
+        if [[ "${{ matrix.node-version }}" == 0.* && "$(cut -d. -f2 <<< "${{ matrix.node-version }}")" -lt 10 ]]; then
+          nvm install --alias=npm 0.10
+          nvm use ${{ matrix.node-version }}
+          if [[ "$(npm -v)" == 1.1.* ]]; then
+            nvm exec npm npm install -g npm@1.1
+            ln -fs "$(which npm)" "$(dirname "$(nvm which npm)")/npm"
+          else
+            sed -i '1s;^.*$;'"$(printf '#!%q' "$(nvm which npm)")"';' "$(readlink -f "$(which npm)")"
+          fi
+          npm config set strict-ssl false
+        fi
+        dirname "$(nvm which ${{ matrix.node-version }})" >> "$GITHUB_PATH"
+
+    - name: Configure npm
+      run: |
+        if [[ "$(npm config get package-lock)" == "true" ]]; then
+          npm config set package-lock false
+        else
+          npm config set shrinkwrap false
+        fi
+
+    - name: Remove npm module(s) ${{ matrix.npm-rm }}
+      if: matrix.npm-rm != ''
+      run: npm rm --silent --save-dev ${{ matrix.npm-rm }}
+
+    - name: Install npm module(s) ${{ matrix.npm-i }}
+      if: matrix.npm-i != ''
+      run: npm install --save-dev ${{ matrix.npm-i }}
+
+    - name: Setup Node.js version-specific dependencies
+      shell: bash
+      run: |
+        # eslint for linting
+        # - remove on Node.js < 12
+        if [[ "$(cut -d. -f1 <<< "${{ matrix.node-version }}")" -lt 12 ]]; then
+          node -pe 'Object.keys(require("./package").devDependencies).join("\n")' | \
+            grep -E '^eslint(-|$)' | \
+            sort -r | \
+            xargs -n1 npm rm --silent --save-dev
+        fi
+
+    - name: Install Node.js dependencies
+      run: npm install
+
+    - name: List environment
+      id: list_env
+      shell: bash
+      run: |
+        echo "node@$(node -v)"
+        echo "npm@$(npm -v)"
+        npm -s ls ||:
+        (npm -s ls --depth=0 ||:) | awk -F'[ @]' 'NR>1 && $2 { print $2 "=" $3 }' >> "$GITHUB_OUTPUT"
+
+    - name: Run tests
+      shell: bash
+      run: |
+        if npm -ps ls nyc | grep -q nyc; then
+          npm run test-ci
+        else
+          npm test
+        fi
+
+    - name: Lint code
+      if: steps.list_env.outputs.eslint != ''
+      run: npm run lint
+
+    - name: Collect code coverage
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master
+      if: steps.list_env.outputs.nyc != ''
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        flag-name: run-${{ matrix.test_number }}
+        parallel: true
+
+  coverage:
+    permissions:
+      checks: write  # for coverallsapp/github-action to create new checks
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+    - name: Upload code coverage
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # master
+      with:
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+        parallel-finished: true

.github/workflows/codeql.yml

@@ -0,0 +1,78 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: ["master"]
+  schedule:
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/scorecard.yml

@@ -0,0 +1,73 @@
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '16 21 * * 1'
+  push:
+    branches: [ "master" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecard on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
+        with:
+          sarif_file: results.sarif

.gitignore

@@ -1,3 +1,5 @@
+.nyc_output/
 coverage
 node_modules
 npm-debug.log
+package-lock.json

.travis.yml

@@ -1,29 +0,0 @@
-language: node_js
-node_js:
-  - "0.8"
-  - "0.10"
-  - "0.12"
-  - "1.8"
-  - "2.5"
-  - "3.3"
-  - "4.8"
-  - "5.12"
-  - "6.10"
-  - "7.10"
-sudo: false
-cache:
-  directories:
-    - node_modules
-before_install:
-  # Setup Node.js version-specific dependencies
-  - "test $TRAVIS_NODE_VERSION != '0.8' || npm rm --save-dev istanbul"
-
-  # Update Node.js modules
-  - "test ! -d node_modules || npm prune"
-  - "test ! -d node_modules || npm rebuild"
-script:
-  # Run test script, depending on istanbul install
-  - "test ! -z $(npm -ps ls istanbul) || npm test"
-  - "test   -z $(npm -ps ls istanbul) || npm run-script test-ci"
-after_script:
-  - "test -e ./coverage/lcov.info && npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"

HISTORY.md

@@ -1,3 +1,39 @@
+unreleased
+==========
+
+  * Fix icons for MIME types with `+`
+  * Fix text and json responses to match html sorting
+  * Show font icon for more font types
+  * Use 400 error on URI decode failure instead of 500
+  * deps: accepts@~1.3.7
+    - deps: mime-types@~2.1.24
+    - deps: negotiator@0.6.2
+  * deps: http-errors@~1.8.0
+    - Set constructor name when possible
+    - deps: depd@~1.1.2
+    - deps: inherits@2.0.4
+    - deps: setprototypeof@1.2.0
+    - deps: statuses@'>= 1.5.0 < 2'
+  * deps: mime-types@~2.1.30
+    - Add new mime types
+    - deps: mime-db@~1.47.0
+  * deps: parseurl@~1.3.3
+
+1.9.1 / 2017-09-28
+==================
+
+  * deps: accepts@~1.3.4
+    - deps: mime-types@~2.1.16
+  * deps: debug@2.6.9
+  * deps: http-errors@~1.6.2
+    - deps: depd@1.1.1
+  * deps: mime-types@~2.1.17
+    - Add new mime types
+    - deps: mime-db@~1.30.0
+  * deps: parseurl@~1.3.2
+    - perf: reduce overhead for full URLs
+    - perf: unroll the "fast-path" `RegExp`
+
 1.9.0 / 2017-05-25
 ==================
 

README.md

@@ -2,10 +2,9 @@
 
 [![NPM Version][npm-image]][npm-url]
 [![NPM Downloads][downloads-image]][downloads-url]
-[![Linux Build][travis-image]][travis-url]
+[![Linux Build Status][ci-image]][ci-url]
 [![Windows Build][appveyor-image]][appveyor-url]
-[![Test Coverage][coveralls-image]][coveralls-url]
-[![Gratipay][gratipay-image]][gratipay-url]
+[![Coverage Status][coveralls-image]][coveralls-url]
 
   Serves pages that contain directory listings for a given path.
 
@@ -127,8 +126,12 @@ var serveIndex = require('serve-index')
 var app = express()
 
 // Serve URLs like /ftp/thing as public/ftp/thing
-app.use('/ftp', serveIndex('public/ftp', {'icons': true}))
-app.listen()
+// The express.static serves the file contents
+// The serveIndex is this module serving the directory
+app.use('/ftp', express.static('public/ftp'), serveIndex('public/ftp', {'icons': true}))
+
+// Listen
+app.listen(3000)
 ```
 
 ## License
@@ -136,15 +139,13 @@ app.listen()
 [MIT](LICENSE). The [Silk](http://www.famfamfam.com/lab/icons/silk/) icons
 are created by/copyright of [FAMFAMFAM](http://www.famfamfam.com/).
 
-[npm-image]: https://img.shields.io/npm/v/serve-index.svg
-[npm-url]: https://npmjs.org/package/serve-index
-[travis-image]: https://img.shields.io/travis/expressjs/serve-index/master.svg?label=linux
-[travis-url]: https://travis-ci.org/expressjs/serve-index
 [appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/serve-index/master.svg?label=windows
 [appveyor-url]: https://ci.appveyor.com/project/dougwilson/serve-index
+[ci-image]: https://badgen.net/github/checks/expressjs/serve-index/master?label=ci
+[ci-url]: https://github.com/expressjs/serve-index/actions/workflows/ci.yml
 [coveralls-image]: https://img.shields.io/coveralls/expressjs/serve-index/master.svg
 [coveralls-url]: https://coveralls.io/r/expressjs/serve-index?branch=master
 [downloads-image]: https://img.shields.io/npm/dm/serve-index.svg
 [downloads-url]: https://npmjs.org/package/serve-index
-[gratipay-image]: https://img.shields.io/gratipay/dougwilson.svg
-[gratipay-url]: https://www.gratipay.com/dougwilson/
+[npm-image]: https://img.shields.io/npm/v/serve-index.svg
+[npm-url]: https://npmjs.org/package/serve-index

appveyor.yml

@@ -6,23 +6,87 @@ environment:
     - nodejs_version: "1.8"
     - nodejs_version: "2.5"
     - nodejs_version: "3.3"
-    - nodejs_version: "4.8"
+    - nodejs_version: "4.9"
     - nodejs_version: "5.12"
-    - nodejs_version: "6.10"
+    - nodejs_version: "6.17"
     - nodejs_version: "7.10"
+    - nodejs_version: "8.17"
+    - nodejs_version: "9.11"
+    - nodejs_version: "10.24"
+    - nodejs_version: "11.15"
+    - nodejs_version: "12.22"
+    - nodejs_version: "13.14"
+    - nodejs_version: "14.16"
+    - nodejs_version: "15.13"
 cache:
   - node_modules
 install:
-  - ps: Install-Product node $env:nodejs_version
-  - if "%nodejs_version%" equ "0.8" npm rm --save-dev istanbul
-  - if exist node_modules npm prune
-  - if exist node_modules npm rebuild
+  # Install Node.js
+  - ps: >-
+      try { Install-Product node $env:nodejs_version -ErrorAction Stop }
+      catch { Update-NodeJsInstallation (Get-NodeJsLatestBuild $env:nodejs_version) }
+  # Configure npm
+  - ps: |
+      # Skip updating shrinkwrap / lock
+      npm config set shrinkwrap false
+      # Skip SSL validation on Node.js < 0.10
+      if ([int]$env:nodejs_version.split(".")[0] -eq 0 -and [int]$env:nodejs_version.split(".")[1] -lt 10) {
+        npm config set strict-ssl false
+      }
+  # Remove all non-test dependencies
+  - ps: |
+      # Remove coverage dependency
+      npm rm --silent --save-dev nyc
+      # Remove lint dependencies
+      cmd.exe /c "node -pe `"Object.keys(require('./package').devDependencies).join('\n')`"" | `
+        sls "^eslint(-|$)" | `
+        %{ npm rm --silent --save-dev $_ }
+  # Setup Node.js version-specific dependencies
+  - ps: |
+      # mocha for testing
+      # - use 2.x for Node.js < 0.10
+      # - use 3.x for Node.js < 4
+      # - use 5.x for Node.js < 6
+      # - use 6.x for Node.js < 8
+      # - use 7.x for Node.js < 10
+      if ([int]$env:nodejs_version.split(".")[0] -eq 0 -and [int]$env:nodejs_version.split(".")[1] -lt 10) {
+        npm install --silent --save-dev mocha@2.5.3
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 4) {
+        npm install --silent --save-dev mocha@3.5.3
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev mocha@5.2.0
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 8) {
+        npm install --silent --save-dev mocha@6.2.2
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 10) {
+        npm install --silent --save-dev mocha@7.2.0
+      }
+  - ps: |
+      # mocha for testing
+      # - use 1.1.0 for Node.js < 0.10
+      # - use 2.0.0 for Node.js < 4
+      # - use 3.4.2 for Node.js < 6
+      if ([int]$env:nodejs_version.split(".")[0] -eq 0 -and [int]$env:nodejs_version.split(".")[1] -lt 10) {
+        npm install --silent --save-dev supertest@1.1.0
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 4) {
+        npm install --silent --save-dev supertest@2.0.0
+      } elseif ([int]$env:nodejs_version.split(".")[0] -lt 6) {
+        npm install --silent --save-dev supertest@3.4.2
+      }
+  # Update Node.js modules
+  - ps: |
+      # Prune & rebuild node_modules
+      if (Test-Path -Path node_modules) {
+        npm prune
+        npm rebuild
+      }
+  # Install Node.js modules
   - npm install
 build: off
 test_script:
-  - node --version
-  - npm --version
-  - set npm_test_command=test
-  - for /f %%l in ('npm -ps ls istanbul') do set npm_test_command=test-ci
-  - npm run %npm_test_command%
+  # Output version data
+  - ps: |
+      node --version
+      npm --version
+  # Run test script
+  - npm test
 version: "{build}"

index.js

@@ -107,10 +107,14 @@ function serveIndex(root, options) {
       return;
     }
 
+    // get dir
+    var dir = getRequestedDir(req)
+
+    // bad request
+    if (dir === null) return next(createError(400))
+
     // parse URLs
-    var url = parseUrl(req);
     var originalUrl = parseUrl.original(req);
-    var dir = decodeURIComponent(url.pathname);
     var originalDir = decodeURIComponent(originalUrl.pathname);
 
     // join / normalize from root dir
@@ -180,14 +184,9 @@ serveIndex.html = function _html(req, res, files, next, dir, showUp, icons, path
   }
 
   // stat all files
-  stat(path, files, function (err, stats) {
+  stat(path, files, function (err, fileList) {
     if (err) return next(err);
 
-    // combine the stats into the file list
-    var fileList = files.map(function (file, i) {
-      return { name: file, stat: stats[i] };
-    });
-
     // sort file list
     fileList.sort(fileSort);
 
@@ -218,16 +217,42 @@ serveIndex.html = function _html(req, res, files, next, dir, showUp, icons, path
  * Respond with application/json.
  */
 
-serveIndex.json = function _json(req, res, files) {
-  send(res, 'application/json', JSON.stringify(files))
+serveIndex.json = function _json (req, res, files, next, dir, showUp, icons, path) {
+  // stat all files
+  stat(path, files, function (err, fileList) {
+    if (err) return next(err)
+
+    // sort file list
+    fileList.sort(fileSort)
+
+    // serialize
+    var body = JSON.stringify(fileList.map(function (file) {
+      return file.name
+    }))
+
+    send(res, 'application/json', body)
+  })
 };
 
 /**
  * Respond with text/plain.
  */
 
-serveIndex.plain = function _plain(req, res, files) {
-  send(res, 'text/plain', (files.join('\n') + '\n'))
+serveIndex.plain = function _plain (req, res, files, next, dir, showUp, icons, path) {
+  // stat all files
+  stat(path, files, function (err, fileList) {
+    if (err) return next(err)
+
+    // sort file list
+    fileList.sort(fileSort)
+
+    // serialize
+    var body = fileList.map(function (file) {
+      return file.name
+    }).join('\n') + '\n'
+
+    send(res, 'text/plain', body)
+  })
 };
 
 /**
@@ -237,7 +262,7 @@ serveIndex.plain = function _plain(req, res, files) {
 
 function createHtmlFileList(files, dir, useIcons, view) {
   var html = '<ul id="files" class="view-' + escapeHtml(view) + '">'
-    + (view == 'details' ? (
+    + (view === 'details' ? (
       '<li class="header">'
       + '<span class="name">Name</span>'
       + '<span class="size">Size</span>'
@@ -327,6 +352,22 @@ function fileSort(a, b) {
     String(a.name).toLocaleLowerCase().localeCompare(String(b.name).toLocaleLowerCase());
 }
 
+/**
+ * Get the requested directory from request.
+ *
+ * @param req
+ * @return {string}
+ * @api private
+ */
+
+function getRequestedDir (req) {
+  try {
+    return decodeURIComponent(parseUrl(req).pathname)
+  } catch (e) {
+    return null
+  }
+}
+
 /**
  * Map html `dir`, returning a linked path.
  */
@@ -375,7 +416,7 @@ function iconLookup(filename) {
   // try by mime type
   if (icons[mimetype]) {
     return {
-      className: 'icon-' + mimetype.replace('/', '-'),
+      className: 'icon-' + mimetype.replace('/', '-').replace('+', '_'),
       fileName: icons[mimetype]
     };
   }
@@ -485,7 +526,7 @@ function normalizeSlashes(path) {
 
 function removeHidden(files) {
   return files.filter(function(file){
-    return '.' != file[0];
+    return file[0] !== '.'
   });
 }
 
@@ -507,8 +548,12 @@ function send (res, type, body) {
 }
 
 /**
- * Stat all files and return array of stat
- * in same order.
+ * Stat all files and return array of objects in the form
+ * `{ name, stat }`.
+ *
+ * @param {Array} files
+ * @return {Array}
+ * @api private
  */
 
 function stat(dir, files, cb) {
@@ -522,7 +567,10 @@ function stat(dir, files, cb) {
         if (err && err.code !== 'ENOENT') return done(err);
 
         // pass ENOENT as null stat, not error
-        done(null, stat || null);
+        done(null, {
+          name: file,
+          stat: stat || null
+        })
       });
     });
   });
@@ -540,6 +588,7 @@ var icons = {
   'folder': 'folder.png',
 
   // generic mime type icons
+  'font': 'font.png',
   'image': 'image.png',
   'text': 'page_white_text.png',
   'video': 'film.png',
@@ -550,7 +599,6 @@ var icons = {
   '+zip': 'box.png',
 
   // specific mime type icons
-  'application/font-woff': 'font.png',
   'application/javascript': 'page_white_code_red.png',
   'application/json': 'page_white_code.png',
   'application/msword': 'page_white_word.png',
@@ -564,7 +612,6 @@ var icons = {
   'application/vnd.oasis.opendocument.text': 'page_white_word.png',
   'application/x-7z-compressed': 'box.png',
   'application/x-sh': 'application_xp_terminal.png',
-  'application/x-font-ttf': 'font.png',
   'application/x-msaccess': 'page_white_database.png',
   'application/x-shockwave-flash': 'page_white_flash.png',
   'application/x-sql': 'page_white_database.png',
@@ -618,7 +665,6 @@ var icons = {
   '.map': 'map.png',
   '.msi': 'box.png',
   '.mv4': 'film.png',
-  '.otf': 'font.png',
   '.pdb': 'page_white_database.png',
   '.php': 'page_white_php.png',
   '.pl': 'page_white_code.png',

package.json

@@ -1,24 +1,30 @@
 {
   "name": "serve-index",
   "description": "Serve directory listings",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "author": "Douglas Christopher Wilson <doug@somethingdoug.com>",
   "license": "MIT",
   "repository": "expressjs/serve-index",
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/express"
+  },
   "dependencies": {
-    "accepts": "~1.3.3",
+    "accepts": "~1.3.7",
     "batch": "0.6.1",
-    "debug": "2.6.8",
+    "debug": "2.6.9",
     "escape-html": "~1.0.3",
-    "http-errors": "~1.6.1",
-    "mime-types": "~2.1.15",
-    "parseurl": "~1.3.1"
+    "http-errors": "~1.8.0",
+    "mime-types": "~2.1.29",
+    "parseurl": "~1.3.3"
   },
   "devDependencies": {
     "after": "0.8.2",
-    "istanbul": "0.4.5",
-    "mocha": "2.5.3",
-    "supertest": "1.1.0"
+    "eslint": "7.23.0",
+    "eslint-plugin-markdown": "2.0.0",
+    "mocha": "10.4.0",
+    "nyc": "15.1.0",
+    "supertest": "7.0.0"
   },
   "files": [
     "public/",
@@ -30,8 +36,9 @@
     "node": ">= 0.8.0"
   },
   "scripts": {
+    "lint": "eslint .",
     "test": "mocha --reporter spec --bail --check-leaks test/",
-    "test-ci": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter spec --check-leaks test/",
-    "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot --check-leaks test/"
+    "test-ci": "nyc --reporter=lcov --reporter=text npm test",
+    "test-cov": "nyc --reporter=html --reporter=text npm test"
   }
 }

test/test.js

@@ -21,92 +21,102 @@ describe('serveIndex(root)', function () {
     var server = createServer()
 
     request(server)
-    .get('/')
-    .expect('Content-Type', 'text/html; charset=utf-8')
-    .expect(200, done)
+      .get('/')
+      .expect('Content-Type', 'text/html; charset=utf-8')
+      .expect(200, done)
   })
 
   it('should include security header', function (done) {
     var server = createServer()
 
     request(server)
-    .get('/')
-    .expect('X-Content-Type-Options', 'nosniff')
-    .expect(200, done)
+      .get('/')
+      .expect('X-Content-Type-Options', 'nosniff')
+      .expect(200, done)
   })
 
   it('should serve a directory index', function (done) {
     var server = createServer()
 
     request(server)
-    .get('/')
-    .expect(200, /todo\.txt/, done)
+      .get('/')
+      .expect(200, /todo\.txt/, done)
   })
 
   it('should work with HEAD requests', function (done) {
     var server = createServer()
 
     request(server)
-    .head('/')
-    .expect(200, '', done)
+      .head('/')
+      .expect(200)
+      .expect(shouldNotHaveBody())
+      .end(done)
   })
 
   it('should work with OPTIONS requests', function (done) {
     var server = createServer()
 
     request(server)
-    .options('/')
-    .expect('Allow', 'GET, HEAD, OPTIONS')
-    .expect(200, done)
+      .options('/')
+      .expect('Allow', 'GET, HEAD, OPTIONS')
+      .expect(200, done)
   })
 
   it('should deny POST requests', function (done) {
     var server = createServer()
 
     request(server)
-    .post('/')
-    .expect(405, done)
+      .post('/')
+      .expect(405, done)
   })
 
   it('should deny path will NULL byte', function (done) {
     var server = createServer()
 
     request(server)
-    .get('/%00')
-    .expect(400, done)
+      .get('/%00')
+      .expect(400, done)
+  })
+
+  it('should deny path that does not decode', function (done) {
+    var server = createServer()
+
+    request(server)
+      .head('/%FF')
+      .expect(400, done)
   })
 
   it('should deny path outside root', function (done) {
     var server = createServer()
 
     request(server)
-    .get('/../')
-    .expect(403, done)
+      .get('/../')
+      .expect(403, done)
   })
 
   it('should skip non-existent paths', function (done) {
     var server = createServer()
 
     request(server)
-    .get('/bogus')
-    .expect(404, 'Not Found', done)
+      .get('/bogus')
+      .expect(404, 'Not Found', done)
   })
 
   it('should treat an ENAMETOOLONG as a 414', function (done) {
-    var path = Array(11000).join('foobar')
-    var server = createServer()
+    var dir = path.join(fixtures, Array(10000).join('/foobar'))
+    var server = createServer(dir)
 
     request(server)
-    .get('/' + path)
-    .expect(414, done)
+      .get('/')
+      .expect(414, done)
   })
 
   it('should skip non-directories', function (done) {
     var server = createServer()
 
     request(server)
-    .get('/nums')
-    .expect(404, 'Not Found', done)
+      .get('/nums')
+      .expect(404, 'Not Found', done)
   })
 
   describe('when given Accept: header', function () {
@@ -115,26 +125,46 @@ describe('serveIndex(root)', function () {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'application/json')
-        .expect('Content-Type', /json/)
-        .expect(/g# %3 o & %2525 %37 dir/)
-        .expect(/users/)
-        .expect(/file #1\.txt/)
-        .expect(/nums/)
-        .expect(/todo\.txt/)
-        .expect(/さくら\.txt/)
-        .expect(200, done)
+          .get('/')
+          .set('Accept', 'application/json')
+          .expect('Content-Type', /json/)
+          .expect(/g# %3 o & %2525 %37 dir/)
+          .expect(/users/)
+          .expect(/file #1\.txt/)
+          .expect(/nums/)
+          .expect(/todo\.txt/)
+          .expect(/さくら\.txt/)
+          .expect(200, done)
       });
 
       it('should include security header', function (done) {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'application/json')
-        .expect('X-Content-Type-Options', 'nosniff')
-        .expect(200, done)
+          .get('/')
+          .set('Accept', 'application/json')
+          .expect('X-Content-Type-Options', 'nosniff')
+          .expect(200, done)
+      })
+
+      it('should sort folders first', function (done) {
+        request(createServer())
+          .get('/')
+          .set('Accept', 'application/json')
+          .expect(200)
+          .expect('Content-Type', 'application/json; charset=utf-8')
+          .expect([
+            '#directory',
+            'collect',
+            'g# %3 o & %2525 %37 dir',
+            'users',
+            'file #1.txt',
+            'foo & bar',
+            'nums',
+            'todo.txt',
+            'さくら.txt'
+          ])
+          .end(done)
       })
     });
 
@@ -143,67 +173,67 @@ describe('serveIndex(root)', function () {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200)
-        .expect('Content-Type', 'text/html; charset=utf-8')
-        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
-        .expect(/<a href="\/users"/)
-        .expect(/<a href="\/file%20%231.txt"/)
-        .expect(/<a href="\/todo.txt"/)
-        .expect(/<a href="\/%E3%81%95%E3%81%8F%E3%82%89\.txt"/)
-        .end(done);
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200)
+          .expect('Content-Type', 'text/html; charset=utf-8')
+          .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+          .expect(/<a href="\/users"/)
+          .expect(/<a href="\/file%20%231.txt"/)
+          .expect(/<a href="\/todo.txt"/)
+          .expect(/<a href="\/%E3%81%95%E3%81%8F%E3%82%89\.txt"/)
+          .end(done)
       });
 
       it('should include security header', function (done) {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect('X-Content-Type-Options', 'nosniff')
-        .expect(200, done)
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect('X-Content-Type-Options', 'nosniff')
+          .expect(200, done)
       })
 
       it('should property escape file names', function (done) {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200)
-        .expect('Content-Type', 'text/html; charset=utf-8')
-        .expect(/<a href="\/foo%20%26%20bar"/)
-        .expect(/foo &amp; bar/)
-        .expect(bodyDoesNotContain('foo & bar'))
-        .end(done);
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200)
+          .expect('Content-Type', 'text/html; charset=utf-8')
+          .expect(/<a href="\/foo%20%26%20bar"/)
+          .expect(/foo &amp; bar/)
+          .expect(bodyDoesNotContain('foo & bar'))
+          .end(done)
       });
 
       it('should sort folders first', function (done) {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200)
-        .expect('Content-Type', 'text/html; charset=utf-8')
-        .end(function (err, res) {
-          if (err) done(err);
-          var body = res.text.split('</h1>')[1];
-          var urls = body.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
-          assert.deepEqual(urls, [
-            '/%23directory',
-            '/collect',
-            '/g%23%20%253%20o%20%26%20%252525%20%2537%20dir',
-            '/users',
-            '/file%20%231.txt',
-            '/foo%20%26%20bar',
-            '/nums',
-            '/todo.txt',
-            '/%E3%81%95%E3%81%8F%E3%82%89.txt'
-          ]);
-          done();
-        });
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200)
+          .expect('Content-Type', 'text/html; charset=utf-8')
+          .expect(function (res) {
+            var urls = res.text
+              .split('</h1>')[1]
+              .split(/<a href="([^"]*)"/).filter(function (s, i) { return i % 2 })
+            assert.deepEqual(urls, [
+              '/%23directory',
+              '/collect',
+              '/g%23%20%253%20o%20%26%20%252525%20%2537%20dir',
+              '/users',
+              '/file%20%231.txt',
+              '/foo%20%26%20bar',
+              '/nums',
+              '/todo.txt',
+              '/%E3%81%95%E3%81%8F%E3%82%89.txt'
+            ])
+          })
+          .end(done)
       });
     });
 
@@ -212,26 +242,47 @@ describe('serveIndex(root)', function () {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/plain')
-        .expect(200)
-        .expect('Content-Type', 'text/plain; charset=utf-8')
-        .expect(/users/)
-        .expect(/g# %3 o & %2525 %37 dir/)
-        .expect(/file #1.txt/)
-        .expect(/todo.txt/)
-        .expect(/さくら\.txt/)
-        .end(done);
+          .get('/')
+          .set('Accept', 'text/plain')
+          .expect(200)
+          .expect('Content-Type', 'text/plain; charset=utf-8')
+          .expect(/users/)
+          .expect(/g# %3 o & %2525 %37 dir/)
+          .expect(/file #1.txt/)
+          .expect(/todo.txt/)
+          .expect(/さくら\.txt/)
+          .end(done)
       });
 
       it('should include security header', function (done) {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/plain')
-        .expect('X-Content-Type-Options', 'nosniff')
-        .expect(200, done)
+          .get('/')
+          .set('Accept', 'text/plain')
+          .expect('X-Content-Type-Options', 'nosniff')
+          .expect(200, done)
+      })
+
+      it('should sort folders first', function (done) {
+        request(createServer())
+          .get('/')
+          .set('Accept', 'text/plain')
+          .expect(200)
+          .expect('Content-Type', 'text/plain; charset=utf-8')
+          .expect([
+            '#directory',
+            'collect',
+            'g# %3 o & %2525 %37 dir',
+            'users',
+            'file #1.txt',
+            'foo & bar',
+            'nums',
+            'todo.txt',
+            'さくら.txt',
+            ''
+          ].join('\n'))
+          .end(done)
       })
     });
 
@@ -240,9 +291,9 @@ describe('serveIndex(root)', function () {
         var server = createServer()
 
         request(server)
-        .get('/')
-        .set('Accept', 'application/x-bogus')
-        .expect(406, done)
+          .get('/')
+          .set('Accept', 'application/x-bogus')
+          .expect(406, done)
       });
     });
   });
@@ -252,26 +303,26 @@ describe('serveIndex(root)', function () {
       var server = createServer()
 
       request(server)
-      .get('/')
-      .expect(bodyDoesNotContain('.hidden'))
-      .expect(200, done)
+        .get('/')
+        .expect(bodyDoesNotContain('.hidden'))
+        .expect(200, done)
     });
 
     it('should filter hidden files', function (done) {
       var server = createServer('test/fixtures', {'hidden': false})
 
       request(server)
-      .get('/')
-      .expect(bodyDoesNotContain('.hidden'))
-      .expect(200, done)
+        .get('/')
+        .expect(bodyDoesNotContain('.hidden'))
+        .expect(200, done)
     });
 
     it('should not filter hidden files', function (done) {
       var server = createServer('test/fixtures', {'hidden': true})
 
       request(server)
-      .get('/')
-      .expect(200, /\.hidden/, done)
+        .get('/')
+        .expect(200, /\.hidden/, done)
     });
   });
 
@@ -287,9 +338,9 @@ describe('serveIndex(root)', function () {
       }
 
       request(server)
-      .get('/')
-      .expect(bodyDoesNotContain('foo'))
-      .expect(200, cb)
+        .get('/')
+        .expect(bodyDoesNotContain('foo'))
+        .expect(200, cb)
     });
 
     it('should filter after hidden filter', function (done) {
@@ -304,8 +355,8 @@ describe('serveIndex(root)', function () {
       }
 
       request(server)
-      .get('/')
-      .expect(200, done)
+        .get('/')
+        .expect(200, done)
     });
 
     it('should filter directory paths', function (done) {
@@ -320,8 +371,8 @@ describe('serveIndex(root)', function () {
       }
 
       request(server)
-      .get('/users')
-      .expect(200, cb)
+        .get('/users')
+        .expect(200, cb)
     });
   });
 
@@ -330,16 +381,17 @@ describe('serveIndex(root)', function () {
       var server = createServer(fixtures, {'icons': true})
 
       request(server)
-      .get('/collect')
-      .expect(/data:image\/png/)
-      .expect(/icon-default/)
-      .expect(/icon-directory/)
-      .expect(/icon-image/)
-      .expect(/icon-txt/)
-      .expect(/icon-application-pdf/)
-      .expect(/icon-video/)
-      .expect(/icon-xml/)
-      .expect(200, done)
+        .get('/collect')
+        .expect(/data:image\/png/)
+        .expect(/icon-default/)
+        .expect(/icon-directory/)
+        .expect(/icon-image/)
+        .expect(/icon-image-svg_xml/)
+        .expect(/icon-txt/)
+        .expect(/icon-application-pdf/)
+        .expect(/icon-video/)
+        .expect(/icon-xml/)
+        .expect(200, done)
     });
   });
 
@@ -352,39 +404,39 @@ describe('serveIndex(root)', function () {
 
       it('should respond with file list', function (done) {
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
-        .expect(/<a href="\/users"/)
-        .expect(/<a href="\/file%20%231.txt"/)
-        .expect(/<a href="\/todo.txt"/)
-        .expect(200, done)
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+          .expect(/<a href="\/users"/)
+          .expect(/<a href="\/file%20%231.txt"/)
+          .expect(/<a href="\/todo.txt"/)
+          .expect(200, done)
       });
 
       it('should respond with testing template sentence', function (done) {
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200, /This is the test template/, done)
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200, /This is the test template/, done)
       });
 
       it('should have default styles', function (done) {
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200, /ul#files/, done)
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200, /ul#files/, done)
       });
 
       it('should list directory twice', function (done) {
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(function (res) {
-          var occurances = res.text.match(/directory \/users\//g)
-          if (occurances && occurances.length === 2) return
-          throw new Error('directory not listed twice')
-        })
-        .expect(200, done)
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(function (res) {
+            var occurances = res.text.match(/directory \/users\//g)
+            if (occurances && occurances.length === 2) return
+            throw new Error('directory not listed twice')
+          })
+          .expect(200, done)
       });
     });
 
@@ -395,9 +447,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200, 'This is a template.', done);
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200, 'This is a template.', done)
       });
 
       it('should handle render errors', function (done) {
@@ -406,9 +458,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(500, 'boom!', done);
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(500, 'boom!', done)
       });
 
       it('should provide "directory" local', function (done) {
@@ -417,9 +469,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, '"/users/"', done);
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, '"/users/"', done)
       });
 
       it('should provide "displayIcons" local', function (done) {
@@ -428,9 +480,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, 'false', done);
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, 'false', done)
       });
 
       it('should provide "fileList" local', function (done) {
@@ -442,10 +494,10 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect('[{"name":"..","stat":true},{"name":"#dir","stat":true},{"name":"index.html","stat":true},{"name":"tobi.txt","stat":true}]')
-        .expect(200, done);
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect('[{"name":"..","stat":true},{"name":"#dir","stat":true},{"name":"index.html","stat":true},{"name":"tobi.txt","stat":true}]')
+          .expect(200, done)
       });
 
       it('should provide "path" local', function (done) {
@@ -454,9 +506,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, JSON.stringify(path.join(fixtures, 'users/')), done);
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, JSON.stringify(path.join(fixtures, 'users/')), done)
       });
 
       it('should provide "style" local', function (done) {
@@ -465,9 +517,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, /#files \.icon \.name/, done);
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, /#files \.icon \.name/, done)
       });
 
       it('should provide "viewName" local', function (done) {
@@ -476,9 +528,9 @@ describe('serveIndex(root)', function () {
         }});
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, '"tiles"', done);
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, '"tiles"', done)
       });
     });
   });
@@ -496,9 +548,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200, 'called', done)
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200, 'called', done)
       });
 
       it('should get file list', function (done) {
@@ -513,9 +565,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/html')
-        .expect(200, '<b>3 text files</b>', done)
+          .get('/')
+          .set('Accept', 'text/html')
+          .expect(200, '<b>3 text files</b>', done)
       });
 
       it('should get dir name', function (done) {
@@ -527,9 +579,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, '<b>/users/</b>', done)
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, '<b>/users/</b>', done)
       });
 
       it('should get template path', function (done) {
@@ -541,9 +593,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, 'true', done)
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, 'true', done)
       });
 
       it('should get template with tokens', function (done) {
@@ -555,13 +607,13 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(/{directory}/)
-        .expect(/{files}/)
-        .expect(/{linked-path}/)
-        .expect(/{style}/)
-        .expect(200, done)
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(/{directory}/)
+          .expect(/{files}/)
+          .expect(/{linked-path}/)
+          .expect(/{style}/)
+          .expect(200, done)
       });
 
       it('should get stylesheet path', function (done) {
@@ -573,9 +625,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/users/')
-        .set('Accept', 'text/html')
-        .expect(200, 'true', done)
+          .get('/users/')
+          .set('Accept', 'text/html')
+          .expect(200, 'true', done)
       });
     });
 
@@ -591,9 +643,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/')
-        .set('Accept', 'text/plain')
-        .expect(200, 'called', done)
+          .get('/')
+          .set('Accept', 'text/plain')
+          .expect(200, 'called', done)
       });
     });
 
@@ -609,9 +661,9 @@ describe('serveIndex(root)', function () {
         }
 
         request(server)
-        .get('/')
-        .set('Accept', 'application/json')
-        .expect(200, '"called"', done)
+          .get('/')
+          .set('Accept', 'application/json')
+          .expect(200, '"called"', done)
       });
     });
   });
@@ -621,81 +673,82 @@ describe('serveIndex(root)', function () {
       var server = createServer()
 
       request(server)
-      .get('/users/')
-      .set('Accept', 'text/html')
-      .expect(200)
-      .expect('Content-Type', 'text/html; charset=utf-8')
-      .expect(/<a href="\/users\/index.html"/)
-      .expect(/<a href="\/users\/tobi.txt"/)
-      .end(done);
+        .get('/users/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/users\/index.html"/)
+        .expect(/<a href="\/users\/tobi.txt"/)
+        .end(done)
     });
 
     it('should include link to parent directory', function (done) {
       var server = createServer()
 
       request(server)
-      .get('/users')
-      .end(function (err, res) {
-        if (err) return done(err);
-        var body = res.text.split('</h1>')[1];
-        var urls = body.split(/<a href="([^"]*)"/).filter(function(s, i){ return i%2; });
-        assert.deepEqual(urls, [
-          '/',
-          '/users/%23dir',
-          '/users/index.html',
-          '/users/tobi.txt'
-        ]);
-        done();
-      });
+        .get('/users')
+        .expect(200)
+        .expect(function (res) {
+          var urls = res.text
+            .split('</h1>')[1]
+            .split(/<a href="([^"]*)"/).filter(function (s, i) { return i % 2 })
+          assert.deepEqual(urls, [
+            '/',
+            '/users/%23dir',
+            '/users/index.html',
+            '/users/tobi.txt'
+          ])
+        })
+        .end(done)
     });
 
     it('should work for directory with #', function (done) {
       var server = createServer()
 
       request(server)
-      .get('/%23directory/')
-      .set('Accept', 'text/html')
-      .expect(200)
-      .expect('Content-Type', 'text/html; charset=utf-8')
-      .expect(/<a href="\/%23directory"/)
-      .expect(/<a href="\/%23directory\/index.html"/)
-      .end(done);
+        .get('/%23directory/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/%23directory"/)
+        .expect(/<a href="\/%23directory\/index.html"/)
+        .end(done)
     });
 
     it('should work for directory with special chars', function (done) {
       var server = createServer()
 
       request(server)
-      .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
-      .set('Accept', 'text/html')
-      .expect(200)
-      .expect('Content-Type', 'text/html; charset=utf-8')
-      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
-      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir\/empty.txt"/)
-      .end(done);
+        .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir\/empty.txt"/)
+        .end(done)
     });
 
     it('should property escape directory names', function (done) {
       var server = createServer()
 
       request(server)
-      .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
-      .set('Accept', 'text/html')
-      .expect(200)
-      .expect('Content-Type', 'text/html; charset=utf-8')
-      .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
-      .expect(/g# %3 o &amp; %2525 %37 dir/)
-      .expect(bodyDoesNotContain('g# %3 o & %2525 %37 dir'))
-      .end(done);
+        .get('/g%23%20%253%20o%20%26%20%252525%20%2537%20dir/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/<a href="\/g%23%20%253%20o%20%26%20%252525%20%2537%20dir"/)
+        .expect(/g# %3 o &amp; %2525 %37 dir/)
+        .expect(bodyDoesNotContain('g# %3 o & %2525 %37 dir'))
+        .end(done)
     });
 
     it('should not work for outside root', function (done) {
       var server = createServer()
 
       request(server)
-      .get('/../support/')
-      .set('Accept', 'text/html')
-      .expect(403, done);
+        .get('/../support/')
+        .set('Accept', 'text/html')
+        .expect(403, done)
     });
   });
 
@@ -707,12 +760,12 @@ describe('serveIndex(root)', function () {
 
     it('should respond with appropriate embedded styles', function (done) {
       request(server)
-      .get('/')
-      .set('Accept', 'text/html')
-      .expect(200)
-      .expect('Content-Type', 'text/html; charset=utf-8')
-      .expect(/color: #00ff00;/)
-      .end(done);
+        .get('/')
+        .set('Accept', 'text/html')
+        .expect(200)
+        .expect('Content-Type', 'text/html; charset=utf-8')
+        .expect(/color: #00ff00;/)
+        .end(done)
     });
   });
 
@@ -724,14 +777,14 @@ describe('serveIndex(root)', function () {
 
     it('should respond with file list', function (done) {
       request(server)
-      .get('/')
-      .set('Accept', 'application/json')
-      .expect('Content-Type', /json/)
-      .expect(/users/)
-      .expect(/file #1\.txt/)
-      .expect(/nums/)
-      .expect(/todo\.txt/)
-      .expect(200, done)
+        .get('/')
+        .set('Accept', 'application/json')
+        .expect('Content-Type', /json/)
+        .expect(/users/)
+        .expect(/file #1\.txt/)
+        .expect(/nums/)
+        .expect(/todo\.txt/)
+        .expect(200, done)
     });
   });
 
@@ -744,21 +797,21 @@ describe('serveIndex(root)', function () {
     it('should respond with file list', function (done) {
       var dest = relative.split(path.sep).join('/');
       request(server)
-      .get('/' + dest + '/')
-      .set('Accept', 'application/json')
-      .expect('Content-Type', /json/)
-      .expect(/users/)
-      .expect(/file #1\.txt/)
-      .expect(/nums/)
-      .expect(/todo\.txt/)
-      .expect(200, done)
+        .get('/' + dest + '/')
+        .set('Accept', 'application/json')
+        .expect('Content-Type', /json/)
+        .expect(/users/)
+        .expect(/file #1\.txt/)
+        .expect(/nums/)
+        .expect(/todo\.txt/)
+        .expect(200, done)
     });
 
     it('should not allow serving outside root', function (done) {
       request(server)
-      .get('/../')
-      .set('Accept', 'text/html')
-      .expect(403, done);
+        .get('/../')
+        .set('Accept', 'text/html')
+        .expect(403, done)
     });
   });
 });
@@ -793,3 +846,9 @@ function bodyDoesNotContain(text) {
     assert.equal(res.text.indexOf(text), -1)
   }
 }
+
+function shouldNotHaveBody () {
+  return function (res) {
+    assert.ok(res.text === '' || res.text === undefined)
+  }
+}