Initial commit

node_modules/x-xss-protection/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+## 1.3.0 - 2019-09-01
+### Added
+- Added `mode: null` to disable `mode=block`
+
+### Changed
+- Minor performance improvements with Internet Explorer <9 detection
+
+## 1.2.0 - 2019-06-15
+### Added
+- Added TypeScript type definitions. See [#8](https://github.com/helmetjs/x-xss-protection/pull/8)
+- Created a changelog
+- Added some additional package metadata
+
+### Changed
+- Updated documentation
+- Excluded some files from npm package
+
+Changes in versions 1.1.0 and below can be found in [Helmet's changelog](https://github.com/helmetjs/helmet/blob/master/CHANGELOG.md).

node_modules/x-xss-protection/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014-2019 Evan Hahn, Adam Baldwin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

node_modules/x-xss-protection/README.md

@@ -0,0 +1,33 @@
+X-XSS-Protection middleware
+===========================
+[![Build Status](https://travis-ci.org/helmetjs/x-xss-protection.svg?branch=master)](https://travis-ci.org/helmetjs/x-xss-protection)
+
+The `X-XSS-Protection` HTTP header is a basic protection against XSS. It was originally [by Microsoft](http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx) but Chrome has since adopted it as well.
+
+This middleware sets the `X-XSS-Protection` header. On modern browsers, it will set the value to `1; mode=block`. On old versions of Internet Explorer, this creates a vulnerability (see [here](http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/) and [here](http://technet.microsoft.com/en-us/security/bulletin/MS10-002)), and so the header is set to `0` to disable it.
+
+To use this middleware:
+
+```javascript
+const xssFilter = require('x-xss-protection')
+app.use(xssFilter())
+```
+
+To force the header to be set to `1; mode=block` on all versions of IE, add the option:
+
+```javascript
+app.use(xssFilter({ setOnOldIE: true }))
+// This has some security problems for old IE!
+```
+
+You can also optionally configure a report URI, though the flag is [specific to Chrome-based browsers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection). This option will report the violation to the specified URI:
+
+```javascript
+app.use(xssFilter({ reportUri: '/report-xss-violation' }))
+```
+
+To remove `mode=block` from the header, which isn't recommended, set the `mode` option to `null`:
+
+```javascript
+app.use(xssFilter({ mode: null }))
+```

node_modules/x-xss-protection/dist/index.d.ts

@@ -0,0 +1,9 @@
+/// <reference types="node" />
+import { IncomingMessage, ServerResponse } from 'http';
+interface XXssProtectionOptions {
+    mode?: 'block' | null;
+    reportUri?: string;
+    setOnOldIE?: boolean;
+}
+declare const _default: (options?: XXssProtectionOptions) => (_req: IncomingMessage, res: ServerResponse, next: () => void) => void;
+export = _default;

node_modules/x-xss-protection/dist/index.js

@@ -0,0 +1,50 @@
+"use strict";
+function doesUserAgentMatchOldInternetExplorer(userAgent) {
+    if (!userAgent) {
+        return false;
+    }
+    var matches = /msie\s*(\d{1,2})/i.exec(userAgent);
+    return matches ? parseFloat(matches[1]) < 9 : false;
+}
+function getHeaderValueFromOptions(options) {
+    var directives = ['1'];
+    var isBlockMode;
+    if ('mode' in options) {
+        if (options.mode === 'block') {
+            isBlockMode = true;
+        }
+        else if (options.mode === null) {
+            isBlockMode = false;
+        }
+        else {
+            throw new Error('The `mode` option must be set to "block" or null.');
+        }
+    }
+    else {
+        isBlockMode = true;
+    }
+    if (isBlockMode) {
+        directives.push('mode=block');
+    }
+    if (options.reportUri) {
+        directives.push("report=" + options.reportUri);
+    }
+    return directives.join('; ');
+}
+module.exports = function xXssProtection(options) {
+    if (options === void 0) { options = {}; }
+    var headerValue = getHeaderValueFromOptions(options);
+    if (options.setOnOldIE) {
+        return function xXssProtection(_req, res, next) {
+            res.setHeader('X-XSS-Protection', headerValue);
+            next();
+        };
+    }
+    else {
+        return function xXssProtection(req, res, next) {
+            var value = doesUserAgentMatchOldInternetExplorer(req.headers['user-agent']) ? '0' : headerValue;
+            res.setHeader('X-XSS-Protection', value);
+            next();
+        };
+    }
+};

node_modules/x-xss-protection/package.json

@@ -0,0 +1,94 @@
+{
+  "_from": "x-xss-protection@1.3.0",
+  "_id": "x-xss-protection@1.3.0",
+  "_inBundle": false,
+  "_integrity": "sha512-kpyBI9TlVipZO4diReZMAHWtS0MMa/7Kgx8hwG/EuZLiA6sg4Ah/4TRdASHhRRN3boobzcYgFRUFSgHRge6Qhg==",
+  "_location": "/x-xss-protection",
+  "_phantomChildren": {},
+  "_requested": {
+    "type": "version",
+    "registry": true,
+    "raw": "x-xss-protection@1.3.0",
+    "name": "x-xss-protection",
+    "escapedName": "x-xss-protection",
+    "rawSpec": "1.3.0",
+    "saveSpec": null,
+    "fetchSpec": "1.3.0"
+  },
+  "_requiredBy": [
+    "/helmet"
+  ],
+  "_resolved": "https://registry.npmjs.org/x-xss-protection/-/x-xss-protection-1.3.0.tgz",
+  "_shasum": "3e3a8dd638da80421b0e9fff11a2dbe168f6d52c",
+  "_spec": "x-xss-protection@1.3.0",
+  "_where": "/home/runner/Socketio-Chat-Template/node_modules/helmet",
+  "author": {
+    "name": "Adam Baldwin",
+    "email": "adam@npmjs.com",
+    "url": "https://evilpacket.net"
+  },
+  "bugs": {
+    "url": "https://github.com/helmetjs/x-xss-protection/issues",
+    "email": "me@evanhahn.com"
+  },
+  "bundleDependencies": false,
+  "contributors": [
+    {
+      "name": "Evan Hahn",
+      "email": "me@evanhahn.com",
+      "url": "https://evanhahn.com"
+    }
+  ],
+  "deprecated": false,
+  "description": "Middleware to set the X-XSS-Protection header",
+  "devDependencies": {
+    "@types/connect": "^3.4.32",
+    "@types/jest": "^24.0.18",
+    "@types/supertest": "^2.0.8",
+    "@typescript-eslint/eslint-plugin": "^2.0.0",
+    "@typescript-eslint/parser": "^2.0.0",
+    "connect": "^3.7.0",
+    "eslint": "^5.16.0",
+    "eslint-config-helmet": "^0.2.0",
+    "jest": "^24.9.0",
+    "supertest": "^4.0.2",
+    "ts-jest": "^24.0.2",
+    "typescript": "^3.6.2"
+  },
+  "engines": {
+    "node": ">=4.0.0"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "CHANGELOG.md",
+    "dist/index.js",
+    "dist/index.d.ts"
+  ],
+  "homepage": "https://helmetjs.github.io/docs/xss-filter/",
+  "keywords": [
+    "helmet",
+    "security",
+    "express",
+    "connect",
+    "xss",
+    "x-xss-protection"
+  ],
+  "license": "MIT",
+  "main": "./dist/index.js",
+  "name": "x-xss-protection",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/helmetjs/x-xss-protection.git"
+  },
+  "scripts": {
+    "build": "npm run clean && tsc",
+    "clean": "rm -rf dist",
+    "lint": "eslint --fix '**/*.ts'",
+    "prepublishOnly": "npm run build",
+    "pretest": "npm run lint",
+    "test": "jest --config test/jest-config.json"
+  },
+  "typings": "./dist/index.d.ts",
+  "version": "1.3.0"
+}