Commit graph

13 commits

Author SHA1 Message Date
Isiah Meadows
d4551f49f5
Add streams to releases again, include minified bundle, drop in… (#2539)
* Minify stream, add stream stuff to releases again

* Kill off a lot of tech debt, drop internal utilities from npm

1. Kill `module/`, internalize `bundler/`, privatize `test-utils/`

We've been telling people to move elsewhere from these for a while, and
it's about time we just pull the plug here and finally remove them.

- We officially removed the bundler from the public API in v2.0, and
  that was the only one of these that was ever publicly documented.
  Usage should be low enough by now it shouldn't break anyone- I'm not
  seeing bundler bugs being reported anymore, either.
- The `module/` utility was so narrow and caveat-filled that I'm not
  sure anyone really used it (even us core Mithril devs never really
  used it), and we only had it documented in the repo folder it lived
  in. I think only one bug was ever filed, and it's because it somehow
  ended up completely non-functional without any of us realizing it.
- The test utilities were meant to be internal from day 1, but people
  started using it despite us core developers constantly telling people
  to look elsewhere and even the docs recommending specific alternatives
  without mention of our internal mocks. (Now if people would RTFM,
  that'd be nice...)

2. Add dedicated HTML test files to verify ospec and the promise
   polyfill, and ensure the promise tests are in pure ES5.

These are made specially for those and should be much easier to just run
now.

3. Fix the benchmark script to use the real DOM in browsers and to not
   require as many dependencies to create. Also, tweak them to be much
   more effective and precise on what's being tested.

Previously, it was rendering to the HTML file itself, while now it's
rendering to the `body`. This means in browsers, it's triggering layout
and everything, benchmarking how well Mithril optimizes for style and
layout recalcs, too. It also puts some pressure on the hyperscript
parser attribute application, so that can be noticed as well.

* Update dependencies
2019-10-03 04:58:14 -04:00
Isiah Meadows
e58e9186f8 Take 2 2019-07-27 20:53:19 -04:00
Isiah Meadows
97fa1788c2
Prevent prototype pollution while parsing query strings (#2494)
* Prevent prototype pollution while parsing query strings

* Update changelog [skip ci]
2019-07-27 17:39:55 -04:00
Isiah Meadows
85bfd0f77d
Clarify pathname docs, follow spec with fragments (#2448)
* Clarify pathname docs, follow spec with fragments

- Valid URLs must not contain a `#` within its fragment.
  https://github.com/MithrilJS/mithril.js/issues/2445
- Our docs were a little confusing and misleading - `m.pathname` isn't
  aware of URLs, just path names.
- Removed the relevant extension to `m.parseQueryString` required to
  support the hash parsing extension. Now we just shave it off and
  ignore it.
- Fix support for arbitrary prefixes, so prefixes like `?#` are
  handled correctly.
- Add a bunch of tests to cover various areas of confusion and unusual
  edge cases.

* Update with PR [skip ci]
2019-07-03 06:22:25 -04:00
Isiah Meadows
58f1c74394
Streamline route/request path handling and split params + body in requests (#2361)
Fixes #2360
Fixes #1138
Fixes #1788 a little less hackishly
Probably fixes a few other issues I'm not aware of.

This more or less goes with @lhorie's comment here, just with a minor name
change from `query` to `params`:

https://github.com/MithrilJS/mithril.js/issues/1138#issuecomment-231363395

Specifically, here's what this patch entails:

- I changed `data` and `useBody` to `params` and `body` in `m.request`.
  Migration is trivial: just use `params` or `body` depending on which you
  intend to send. Most servers do actually care where the data goes, so you can
  generally pretty easily translate this accordingly. If you *really* need the
  old behavior, pass the old value in `params` and if `method === "GET"` or
  `method === "TRACE"`, also in `body`.
- I opened up all methods to have request bodies.
- I fixed `m.parseQueryString` to prefer later values over earlier values and
  to ensure that objects and arrays are persisted across both hash and query
  param parsing. That method also accepts an existing key/value map to append
  to, to simplify deduplication.
- I normalized path interpolation to be identical between routes and requests.
- I no longer include interpolated values in query strings. If you need to
  duplicate values again, rename the interpolation to be a distinct property
  and pass the value you want to duplicate as it.
- I converted `m.route` to use pre-compiled routes instead of its existing
  system of dynamic runtime checking. This shouldn't have a major effect on
  performance short-term, but it'll ease the migration to built-in userland
  components and make it a little easier to reconcile. It'll also come handy
  for large numbers of routes.
- I added support for matching routes like `"/:file.:ext"` or
  `"/:lang-:region"`, giving each defined semantics.
- I added support for matching against routes with static query strings, such
  as `"/edit?type=image": { ... }`.
- I'm throwing a few new informative errors.
- And I've updated the docs accordingly.

I also made a few drive-by edits:

- I fixed a bug in the `Stream.HALT` warning where it warned all but the first
  usage when the intent was to warn only on first use.
- Some of the tests were erroneously using `Stream.HALT` when they should've
  been using `Stream.SKIP`. I've fixed the tests to only test that
  `Stream.HALT === Stream.SKIP` and that it only warns on first use.
- The `m.request` and `m.jsonp` docs signatures were improved to more clearly
  explain how `m.request(url, options?)` and `m.jsonp(url, options?)` translate
  to `m.request(options)` and `m.jsonp(options)` respectively.

-----

There is some justification to these changes:

- In general, it matters surprisingly more than you would expect how things
  translate to HTTP requests. So the comment there suggesting a thing that
  papers over the difference has led to plenty of confusion in both Gitter and
  in GitHub issues.

- A lot of servers expect a GET with a body and no parameters, and leaving
  `m.request` open to working with that makes it much more flexible.

- Sometimes, servers expect a POST with query parameters *instead* of a JSON
  object. I've seen this quite a bit, even with more popular REST APIs like
  Stack Overflow's.

- I've encountered a few servers that expect both parameters and a body, each
  with distinct semantic meaning, so the separation makes it much easier to
  translate into a request.

- Most of the time, path segments are treated individually, and URL-escaping
  the contents is much less error-prone. It also avoids being potentially
  lossy, and when the variable in question isn't trusted, escaping the path
  segment enables you to pass it through the URL and not risk being redirected
  to unexpected locations, avoiding some risks of vulnerabilities and client
  side crashes.

If you really don't care how the template and parameters translate to an
eventual URL, just pass the same object for the `params` and `body` and use
`:param...` for each segment. Either way, the more explicit nature should help
a lot in making the intent clearer, whether you care or not.
2019-05-29 09:28:40 -04:00
Leo Horie
e798bd34ae fix test 2016-10-18 18:07:01 -04:00
Leo Horie
6514a38162 document querystring apis 2016-10-18 10:16:20 -04:00
Leo Horie
9b482be0ca do not attempt to parse dates 2016-10-05 17:11:08 -04:00
Douglas Brown
391e7f43f5 Prevent undesired Date parsing
Native Date parsing is unpredictable and will occasionally turn a string
like "/foo/1" into a valid date of Jan 1, 2001.  This can be prevented
by not parsing a string that begins with a slash.

It's likely that this is a rare case, but it's annoying when it does
come up.
2016-09-15 16:05:30 -04:00
impinball
b4fb21475c Add editorconfig, resolve differences
This includes newlines, tabs, among other things.
2016-06-18 03:22:12 -04:00
Leo Horie
5815a590a8 test empty object 2016-05-24 23:18:11 -04:00
Leo Horie
d8a402f4f5 utf-8 handling in router 2016-05-13 07:02:32 -04:00
Leo Horie
559369016d initial commit (work in progress) 2016-04-20 20:02:37 -04:00