chore: Update dist

2026-09-02 05:55:10 +09:00 · 2026-08-04 03:58:29 +00:00
parent bc56d889a4
commit b04158f834
3 changed files with 177 additions and 13 deletions
@@ -1740,7 +1740,7 @@ SOFTWARE.

 The following npm package may be included in this product:

- - undici@6.27.0
+ - undici@6.28.0

 This package contains the following license:

@@ -1929,7 +1929,11 @@ var require_request = __commonJS({
          } else if (typeof val[i] === "object") {
            throw new InvalidArgumentError(`invalid ${key} header`);
          } else {
-            arr.push(`${val[i]}`);
+            const str = `${val[i]}`;
+            if (!isValidHeaderValue(str)) {
+              throw new InvalidArgumentError(`invalid ${key} header`);
+            }
+            arr.push(str);
          }
        }
        val = arr;
@@ -1941,6 +1945,9 @@ var require_request = __commonJS({
        val = "";
      } else {
        val = `${val}`;
+        if (!isValidHeaderValue(val)) {
+          throw new InvalidArgumentError(`invalid ${key} header`);
+        }
      }
      if (headerName === "host") {
        if (request.host !== null) {
@@ -5671,6 +5678,7 @@ var require_client_h1 = __commonJS({
      RequestContentLengthMismatchError,
      ResponseContentLengthMismatchError,
      RequestAbortedError,
+      InvalidArgumentError,
      HeadersTimeoutError,
      HeadersOverflowError,
      SocketError,
@@ -6397,8 +6405,16 @@ var require_client_h1 = __commonJS({
        }
        body = bodyStream.stream;
        contentLength = bodyStream.length;
-      } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-        headers.push("content-type", body.type);
+      } else if (util.isBlobLike(body) && request.contentType == null) {
+        const contentType = body.type;
+        if (contentType) {
+          const contentTypeValue = `${contentType}`;
+          if (!util.isValidHeaderValue(contentTypeValue)) {
+            util.errorRequest(client, request, new InvalidArgumentError("invalid content-type header"));
+            return false;
+          }
+          headers.push("content-type", contentTypeValue);
+        }
      }
      if (body && typeof body.read === "function") {
        body.read(0);
@@ -8950,6 +8966,24 @@ var require_retry_handler = __commonJS({
      const current = Date.now();
      return new Date(retryAfter).getTime() - current;
    }
+    function validatePartialResponseContentLength(headers, range, statusCode, retryCount) {
+      const contentLength = headers["content-length"];
+      if (contentLength == null) {
+        return null;
+      }
+      if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+        return null;
+      }
+      const length = Number(contentLength);
+      const expectedLength = range.end - range.start + 1;
+      if (!Number.isFinite(length) || length !== expectedLength) {
+        return new RequestRetryError("Content-Length mismatch", statusCode, {
+          headers,
+          data: { count: retryCount }
+        });
+      }
+      return null;
+    }
    var RetryHandler = class _RetryHandler {
      constructor(opts, handlers) {
        const { retryOptions, ...dispatchOpts } = opts;
@@ -9122,6 +9156,11 @@ var require_retry_handler = __commonJS({
            );
            return false;
          }
+          const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
+          if (contentLengthError != null) {
+            this.abort(contentLengthError);
+            return false;
+          }
          const { start, size, end = size - 1 } = contentRange;
          assert(this.start === start, "content-range mismatch");
          assert(this.end == null || this.end === end, "content-range mismatch");
@@ -9139,6 +9178,11 @@ var require_retry_handler = __commonJS({
                statusMessage
              );
            }
+            const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount);
+            if (contentLengthError != null) {
+              this.abort(contentLengthError);
+              return false;
+            }
            const { start, size, end = size - 1 } = range;
            assert(
              start != null && Number.isFinite(start),
@@ -15984,14 +16028,48 @@ var require_util6 = __commonJS({
      for (let i = 0; i < path.length; ++i) {
        const code = path.charCodeAt(i);
        if (code < 32 || // exclude CTLs (0-31)
-        code === 127 || // DEL
+        code > 126 || // exclude DEL and non-ascii
        code === 59) {
          throw new Error("Invalid cookie path");
        }
      }
    }
+    function isLetterOrDigit(code) {
+      return code >= 48 && code <= 57 || // 0-9
+      code >= 65 && code <= 90 || // A-Z
+      code >= 97 && code <= 122;
+    }
    function validateCookieDomain(domain) {
-      if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) {
+      if (domain === " ") {
+        return;
+      }
+      if (domain.length > 255) {
+        throw new Error("Invalid cookie domain");
+      }
+      let labelLength = 0;
+      for (let i = 0; i < domain.length; ++i) {
+        const code = domain.charCodeAt(i);
+        if (code === 46) {
+          if (labelLength === 0) {
+            throw new Error("Invalid cookie domain");
+          }
+          if (domain.charCodeAt(i - 1) === 45) {
+            throw new Error("Invalid cookie domain");
+          }
+          labelLength = 0;
+          continue;
+        }
+        if (labelLength === 0 && !isLetterOrDigit(code)) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (!isLetterOrDigit(code) && code !== 45) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (++labelLength > 63) {
+          throw new Error("Invalid cookie domain");
+        }
+      }
+      if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) {
        throw new Error("Invalid cookie domain");
      }
    }
@@ -16074,7 +16152,11 @@ var require_util6 = __commonJS({
          throw new Error("Invalid unparsed");
        }
        const [key, ...value] = part.split("=");
-        out.push(`${key.trim()}=${value.join("=")}`);
+        const trimmedKey = key.trim();
+        const joinedValue = value.join("=");
+        validateCookieName(trimmedKey);
+        validateCookieValue(joinedValue);
+        out.push(`${trimmedKey}=${joinedValue}`);
      }
      return out.join("; ");
    }
@@ -1937,7 +1937,11 @@ var require_request = __commonJS({
          } else if (typeof val[i5] === "object") {
            throw new InvalidArgumentError(`invalid ${key} header`);
          } else {
-            arr.push(`${val[i5]}`);
+            const str = `${val[i5]}`;
+            if (!isValidHeaderValue(str)) {
+              throw new InvalidArgumentError(`invalid ${key} header`);
+            }
+            arr.push(str);
          }
        }
        val = arr;
@@ -1949,6 +1953,9 @@ var require_request = __commonJS({
        val = "";
      } else {
        val = `${val}`;
+        if (!isValidHeaderValue(val)) {
+          throw new InvalidArgumentError(`invalid ${key} header`);
+        }
      }
      if (headerName === "host") {
        if (request.host !== null) {
@@ -5679,6 +5686,7 @@ var require_client_h1 = __commonJS({
      RequestContentLengthMismatchError,
      ResponseContentLengthMismatchError,
      RequestAbortedError,
+      InvalidArgumentError,
      HeadersTimeoutError,
      HeadersOverflowError,
      SocketError,
@@ -6405,8 +6413,16 @@ var require_client_h1 = __commonJS({
        }
        body = bodyStream.stream;
        contentLength = bodyStream.length;
-      } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-        headers.push("content-type", body.type);
+      } else if (util.isBlobLike(body) && request.contentType == null) {
+        const contentType = body.type;
+        if (contentType) {
+          const contentTypeValue = `${contentType}`;
+          if (!util.isValidHeaderValue(contentTypeValue)) {
+            util.errorRequest(client, request, new InvalidArgumentError("invalid content-type header"));
+            return false;
+          }
+          headers.push("content-type", contentTypeValue);
+        }
      }
      if (body && typeof body.read === "function") {
        body.read(0);
@@ -8958,6 +8974,24 @@ var require_retry_handler = __commonJS({
      const current = Date.now();
      return new Date(retryAfter).getTime() - current;
    }
+    function validatePartialResponseContentLength(headers, range2, statusCode, retryCount) {
+      const contentLength = headers["content-length"];
+      if (contentLength == null) {
+        return null;
+      }
+      if (!Number.isFinite(range2.start) || !Number.isFinite(range2.end)) {
+        return null;
+      }
+      const length = Number(contentLength);
+      const expectedLength = range2.end - range2.start + 1;
+      if (!Number.isFinite(length) || length !== expectedLength) {
+        return new RequestRetryError("Content-Length mismatch", statusCode, {
+          headers,
+          data: { count: retryCount }
+        });
+      }
+      return null;
+    }
    var RetryHandler = class _RetryHandler {
      constructor(opts, handlers) {
        const { retryOptions, ...dispatchOpts } = opts;
@@ -9130,6 +9164,11 @@ var require_retry_handler = __commonJS({
            );
            return false;
          }
+          const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount);
+          if (contentLengthError != null) {
+            this.abort(contentLengthError);
+            return false;
+          }
          const { start, size, end: end2 = size - 1 } = contentRange;
          assert4(this.start === start, "content-range mismatch");
          assert4(this.end == null || this.end === end2, "content-range mismatch");
@@ -9147,6 +9186,11 @@ var require_retry_handler = __commonJS({
                statusMessage
              );
            }
+            const contentLengthError = validatePartialResponseContentLength(headers, range2, statusCode, this.retryCount);
+            if (contentLengthError != null) {
+              this.abort(contentLengthError);
+              return false;
+            }
            const { start, size, end: end2 = size - 1 } = range2;
            assert4(
              start != null && Number.isFinite(start),
@@ -15992,14 +16036,48 @@ var require_util6 = __commonJS({
      for (let i5 = 0; i5 < path4.length; ++i5) {
        const code = path4.charCodeAt(i5);
        if (code < 32 || // exclude CTLs (0-31)
-        code === 127 || // DEL
+        code > 126 || // exclude DEL and non-ascii
        code === 59) {
          throw new Error("Invalid cookie path");
        }
      }
    }
+    function isLetterOrDigit(code) {
+      return code >= 48 && code <= 57 || // 0-9
+      code >= 65 && code <= 90 || // A-Z
+      code >= 97 && code <= 122;
+    }
    function validateCookieDomain(domain) {
-      if (domain.startsWith("-") || domain.endsWith(".") || domain.endsWith("-")) {
+      if (domain === " ") {
+        return;
+      }
+      if (domain.length > 255) {
+        throw new Error("Invalid cookie domain");
+      }
+      let labelLength = 0;
+      for (let i5 = 0; i5 < domain.length; ++i5) {
+        const code = domain.charCodeAt(i5);
+        if (code === 46) {
+          if (labelLength === 0) {
+            throw new Error("Invalid cookie domain");
+          }
+          if (domain.charCodeAt(i5 - 1) === 45) {
+            throw new Error("Invalid cookie domain");
+          }
+          labelLength = 0;
+          continue;
+        }
+        if (labelLength === 0 && !isLetterOrDigit(code)) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (!isLetterOrDigit(code) && code !== 45) {
+          throw new Error("Invalid cookie domain");
+        }
+        if (++labelLength > 63) {
+          throw new Error("Invalid cookie domain");
+        }
+      }
+      if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 45) {
        throw new Error("Invalid cookie domain");
      }
    }
@@ -16082,7 +16160,11 @@ var require_util6 = __commonJS({
          throw new Error("Invalid unparsed");
        }
        const [key, ...value] = part.split("=");
-        out.push(`${key.trim()}=${value.join("=")}`);
+        const trimmedKey = key.trim();
+        const joinedValue = value.join("=");
+        validateCookieName(trimmedKey);
+        validateCookieValue(joinedValue);
+        out.push(`${trimmedKey}=${joinedValue}`);
      }
      return out.join("; ");
    }