sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump github.com/tus/tusd from 1.12.1 to 1.13.0

Browse Source 
Bumps [github.com/tus/tusd](https://github.com/tus/tusd) from 1.12.1 to 1.13.0.
- [Release notes](https://github.com/tus/tusd/releases)
- [Commits](https://github.com/tus/tusd/compare/v1.12.1...v1.13.0)

---
updated-dependencies:
- dependency-name: github.com/tus/tusd
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
This commit is contained in:
dependabot[bot]
2023-09-07 10:53:48 +02:00
committed by Ralf Haferkamp
parent 963c492a73
commit eca299789d
31 changed files with 4491 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vendor/github.com/tus/tusd/pkg/handler/config.go
Generated Vendored
+59
View File
@@ -5,6 +5,7 @@ import (
"log"
"net/url"
"os"
"regexp"
)
// Config provides a way to configure the Handler depending on your needs.
@@ -34,7 +35,14 @@ type Config struct {
DisableTermination bool
// Disable cors headers. If set to true, tusd will not send any CORS related header.
// This is useful if you have a proxy sitting in front of tusd that handles CORS.
//
// Deprecated: All CORS-related settings are available in via the Cors field. Use
// Cors.Disable instead of DisableCors.
DisableCors bool
// Cors can be used to customize the handling of Cross-Origin Resource Sharing (CORS).
// See the CorsConfig struct for more details.
// Defaults to DefaultCorsConfig.
Cors *CorsConfig
// NotifyCompleteUploads indicates whether sending notifications about
// completed uploads using the CompleteUploads channel should be enabled.
NotifyCompleteUploads bool
@@ -64,6 +72,48 @@ type Config struct {
PreFinishResponseCallback func(hook HookEvent) error
}
// CorsConfig provides a way to customize the the handling of Cross-Origin Resource Sharing (CORS).
// More details about CORS are available at https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS.
type CorsConfig struct {
// Disable instructs the handler to ignore all CORS-related headers and never set a
// CORS-related header in a response. This is useful if CORS is already handled by a proxy.
Disable bool
// AllowOrigin is a regular expression used to check if a request is allowed to participate in the
// CORS protocol. If the request's Origin header matches the regular expression, CORS is allowed.
// If not, a 403 Forbidden response is sent, rejecting the CORS request.
AllowOrigin *regexp.Regexp
// AllowCredentials defines whether the `Access-Control-Allow-Credentials: true` header should be
// included in CORS responses. This allows clients to share credentials using the Cookie and
// Authorization header
AllowCredentials bool
// AllowMethods defines the value for the `Access-Control-Allow-Methods` header in the response to
// preflight requests. You can add custom methods here, but make sure that all tus-specific methods
// from DefaultConfig.AllowMethods are included as well.
AllowMethods string
// AllowHeaders defines the value for the `Access-Control-Allow-Headers` header in the response to
// preflight requests. You can add custom headers here, but make sure that all tus-specific header
// from DefaultConfig.AllowHeaders are included as well.
AllowHeaders string
// MaxAge defines the value for the `Access-Control-Max-Age` header in the response to preflight
// requests.
MaxAge string
// ExposeHeaders defines the value for the `Access-Control-Expose-Headers` header in the response to
// actual requests. You can add custom headers here, but make sure that all tus-specific header
// from DefaultConfig.ExposeHeaders are included as well.
ExposeHeaders string
}
// DefaultCorsConfig is the configuration that will be used in none is provided.
var DefaultCorsConfig = CorsConfig{
Disable: false,
AllowOrigin: regexp.MustCompile(".*"),
AllowCredentials: false,
AllowMethods: "POST, HEAD, PATCH, OPTIONS, GET, DELETE",
AllowHeaders: "Authorization, Origin, X-Requested-With, X-Request-ID, X-HTTP-Method-Override, Content-Type, Upload-Length, Upload-Offset, Tus-Resumable, Upload-Metadata, Upload-Defer-Length, Upload-Concat, Upload-Incomplete, Upload-Draft-Interop-Version",
MaxAge: "86400",
ExposeHeaders: "Upload-Offset, Location, Upload-Length, Tus-Version, Tus-Resumable, Tus-Max-Size, Tus-Extension, Upload-Metadata, Upload-Defer-Length, Upload-Concat, Upload-Incomplete, Upload-Draft-Interop-Version",
}
func (config *Config) validate() error {
if config.Logger == nil {
config.Logger = log.New(os.Stdout, "[tusd] ", log.Ldate|log.Lmicroseconds)
@@ -95,5 +145,14 @@ func (config *Config) validate() error {
return errors.New("tusd: StoreComposer in Config needs to contain a non-nil core")
}
if config.Cors == nil {
config.Cors = &DefaultCorsConfig
}
// Support previous settings for disabling CORS.
if config.DisableCors {
config.Cors.Disable = true
}
return nil
}
vendor/github.com/tus/tusd/pkg/handler/unrouted_handler.go
Generated Vendored
+21 -18
View File
@@ -72,6 +72,7 @@ var (
ErrUploadLengthAndUploadDeferLength = NewHTTPError(errors.New("provided both Upload-Length and Upload-Defer-Length"), http.StatusBadRequest)
ErrInvalidUploadDeferLength = NewHTTPError(errors.New("invalid Upload-Defer-Length header"), http.StatusBadRequest)
ErrUploadStoppedByServer = NewHTTPError(errors.New("upload has been stopped by server"), http.StatusBadRequest)
ErrOriginNotAllowed = NewHTTPError(errors.New("request origin is not allowed"), http.StatusForbidden)
errReadTimeout = errors.New("read tcp: i/o timeout")
errConnectionReset = errors.New("read tcp: connection reset by peer")
@@ -213,9 +214,9 @@ func (handler *UnroutedHandler) SupportedExtensions() string {
func (handler *UnroutedHandler) Middleware(h http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
// Allow overriding the HTTP method. The reason for this is
// that some libraries/environments to not support PATCH and
// DELETE requests, e.g. Flash in a browser and parts of Java
if newMethod := r.Header.Get("X-HTTP-Method-Override"); newMethod != "" {
// that some libraries/environments do not support PATCH and
// DELETE requests, e.g. Flash in a browser and parts of Java.
if newMethod := r.Header.Get("X-HTTP-Method-Override"); r.Method == "POST" && newMethod != "" {
r.Method = newMethod
}
@@ -225,27 +226,29 @@ func (handler *UnroutedHandler) Middleware(h http.Handler) http.Handler {
header := w.Header()
if origin := r.Header.Get("Origin"); !handler.config.DisableCors && origin != "" {
cors := handler.config.Cors
if origin := r.Header.Get("Origin"); !cors.Disable && origin != "" {
originIsAllowed := cors.AllowOrigin.MatchString(origin)
if !originIsAllowed {
handler.sendError(w, r, ErrOriginNotAllowed)
return
}
header.Set("Access-Control-Allow-Origin", origin)
header.Set("Vary", "Origin")
if cors.AllowCredentials {
header.Add("Access-Control-Allow-Credentials", "true")
}
if r.Method == "OPTIONS" {
allowedMethods := "POST, HEAD, PATCH, OPTIONS"
if !handler.config.DisableDownload {
allowedMethods += ", GET"
}
if !handler.config.DisableTermination {
allowedMethods += ", DELETE"
}
// Preflight request
header.Add("Access-Control-Allow-Methods", allowedMethods)
header.Add("Access-Control-Allow-Headers", "Authorization, Origin, X-Requested-With, X-Request-ID, X-HTTP-Method-Override, Content-Type, Upload-Length, Upload-Offset, Tus-Resumable, Upload-Metadata, Upload-Defer-Length, Upload-Concat, Upload-Incomplete, Upload-Draft-Interop-Version")
header.Set("Access-Control-Max-Age", "86400")
header.Add("Access-Control-Allow-Methods", cors.AllowMethods)
header.Add("Access-Control-Allow-Headers", cors.AllowHeaders)
header.Set("Access-Control-Max-Age", cors.MaxAge)
} else {
// Actual request
header.Add("Access-Control-Expose-Headers", "Upload-Offset, Location, Upload-Length, Tus-Version, Tus-Resumable, Tus-Max-Size, Tus-Extension, Upload-Metadata, Upload-Defer-Length, Upload-Concat, Upload-Incomplete, Upload-Draft-Interop-Version")
header.Add("Access-Control-Expose-Headers", cors.ExposeHeaders)
}
}