constants.js 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124
  1. 'use strict'
  2. const corsSafeListedMethods = /** @type {const} */ (['GET', 'HEAD', 'POST'])
  3. const corsSafeListedMethodsSet = new Set(corsSafeListedMethods)
  4. const nullBodyStatus = /** @type {const} */ ([101, 204, 205, 304])
  5. const redirectStatus = /** @type {const} */ ([301, 302, 303, 307, 308])
  6. const redirectStatusSet = new Set(redirectStatus)
  7. /**
  8. * @see https://fetch.spec.whatwg.org/#block-bad-port
  9. */
  10. const badPorts = /** @type {const} */ ([
  11. '1', '7', '9', '11', '13', '15', '17', '19', '20', '21', '22', '23', '25', '37', '42', '43', '53', '69', '77', '79',
  12. '87', '95', '101', '102', '103', '104', '109', '110', '111', '113', '115', '117', '119', '123', '135', '137',
  13. '139', '143', '161', '179', '389', '427', '465', '512', '513', '514', '515', '526', '530', '531', '532',
  14. '540', '548', '554', '556', '563', '587', '601', '636', '989', '990', '993', '995', '1719', '1720', '1723',
  15. '2049', '3659', '4045', '4190', '5060', '5061', '6000', '6566', '6665', '6666', '6667', '6668', '6669', '6679',
  16. '6697', '10080'
  17. ])
  18. const badPortsSet = new Set(badPorts)
  19. /**
  20. * @see https://w3c.github.io/webappsec-referrer-policy/#referrer-policies
  21. */
  22. const referrerPolicy = /** @type {const} */ ([
  23. '',
  24. 'no-referrer',
  25. 'no-referrer-when-downgrade',
  26. 'same-origin',
  27. 'origin',
  28. 'strict-origin',
  29. 'origin-when-cross-origin',
  30. 'strict-origin-when-cross-origin',
  31. 'unsafe-url'
  32. ])
  33. const referrerPolicySet = new Set(referrerPolicy)
  34. const requestRedirect = /** @type {const} */ (['follow', 'manual', 'error'])
  35. const safeMethods = /** @type {const} */ (['GET', 'HEAD', 'OPTIONS', 'TRACE'])
  36. const safeMethodsSet = new Set(safeMethods)
  37. const requestMode = /** @type {const} */ (['navigate', 'same-origin', 'no-cors', 'cors'])
  38. const requestCredentials = /** @type {const} */ (['omit', 'same-origin', 'include'])
  39. const requestCache = /** @type {const} */ ([
  40. 'default',
  41. 'no-store',
  42. 'reload',
  43. 'no-cache',
  44. 'force-cache',
  45. 'only-if-cached'
  46. ])
  47. /**
  48. * @see https://fetch.spec.whatwg.org/#request-body-header-name
  49. */
  50. const requestBodyHeader = /** @type {const} */ ([
  51. 'content-encoding',
  52. 'content-language',
  53. 'content-location',
  54. 'content-type',
  55. // See https://github.com/nodejs/undici/issues/2021
  56. // 'Content-Length' is a forbidden header name, which is typically
  57. // removed in the Headers implementation. However, undici doesn't
  58. // filter out headers, so we add it here.
  59. 'content-length'
  60. ])
  61. /**
  62. * @see https://fetch.spec.whatwg.org/#enumdef-requestduplex
  63. */
  64. const requestDuplex = /** @type {const} */ ([
  65. 'half'
  66. ])
  67. /**
  68. * @see http://fetch.spec.whatwg.org/#forbidden-method
  69. */
  70. const forbiddenMethods = /** @type {const} */ (['CONNECT', 'TRACE', 'TRACK'])
  71. const forbiddenMethodsSet = new Set(forbiddenMethods)
  72. const subresource = /** @type {const} */ ([
  73. 'audio',
  74. 'audioworklet',
  75. 'font',
  76. 'image',
  77. 'manifest',
  78. 'paintworklet',
  79. 'script',
  80. 'style',
  81. 'track',
  82. 'video',
  83. 'xslt',
  84. ''
  85. ])
  86. const subresourceSet = new Set(subresource)
  87. module.exports = {
  88. subresource,
  89. forbiddenMethods,
  90. requestBodyHeader,
  91. referrerPolicy,
  92. requestRedirect,
  93. requestMode,
  94. requestCredentials,
  95. requestCache,
  96. redirectStatus,
  97. corsSafeListedMethods,
  98. nullBodyStatus,
  99. safeMethods,
  100. badPorts,
  101. requestDuplex,
  102. subresourceSet,
  103. badPortsSet,
  104. redirectStatusSet,
  105. corsSafeListedMethodsSet,
  106. safeMethodsSet,
  107. forbiddenMethodsSet,
  108. referrerPolicySet
  109. }