mderazon · rlustemberg · Jan 4, 2023
diff --git a/.gitignore b/.gitignore
@@ -15,4 +15,5 @@ results
 npm-debug.log
 node_modules
 
-*.sublime-workspace
+*.sublime-workspace
+.vscode/launch.json
diff --git a/README.md b/README.md
@@ -1,10 +1,15 @@
-# node-deeplink [![Build Status](https://travis-ci.org/mderazon/node-deeplink.svg?branch=master)](https://travis-ci.org/mderazon/node-deeplink) [![styled with prettier](https://img.shields.io/badge/styled_with-prettier-ff69b4.svg)](https://github.com/prettier/prettier)
+# deeplink-handler [![Build Status](https://travis-ci.org/mderazon/node-deeplink.svg?branch=master)](https://travis-ci.org/mderazon/node-deeplink) [![styled with prettier](https://img.shields.io/badge/styled_with-prettier-ff69b4.svg)](https://github.com/prettier/prettier)
 
 > Easily create express endpoint to handle mobile deeplinks in your web server
 
 Takes away the pain of forwarding users to the right app store / mobile app depending on their platform.
+## Important
+This is a fork of node-deeplink ( https://github.com/mderazon/node-deeplink ). The original module has security issue due to its dependency on `html-inline`, which is no longer maintained.
+This module depends on `inline-source` instead. For the rest, its API has remained the same and can be used as drop in replacement for `node-deeplink`.
 
-## Important update
+
+
+## Notice regarding Apple's handling of url schemes.
 
 In ios >= 9, Apple has made it impossible to provide a smooth user experience to redirect user to app / fallback to app store from javascript. Their clear direction is pushing towards using Universal Links instead.
 

diff --git a/lib/deeplink.js b/lib/deeplink.js
@@ -1,7 +1,8 @@
 const fs = require('fs');
-const inliner = require('html-inline');
 const stream = require('stream');
 const path = require('path');
+const { Transform} = require('stream');
+const {inlineSource} = require('inline-source');
 
 module.exports = function (options) {
   options = options || {};
@@ -12,6 +13,30 @@ module.exports = function (options) {
   options.ios_store_link = options.ios_store_link || '';
   options.title = options.title || '';
 
+  //html-inline replacement. It returns a writable stream with a transform function that inlines the html file
+  function inlineHtmlStream({basedir}) {
+    async function inlineHtml(chunk, basedir) {
+      try {
+        return await inlineSource(chunk.toString(),{
+          rootpath: basedir
+        });
+      } catch (err) {
+        throw err;
+      }
+    }
+    return new Transform({
+      async transform(chunk, encoding, callback) {
+        try {
+          const html = await inlineHtml(chunk, basedir);
+          this.push(html);
+          callback();
+        } catch (err) {
+          callback(err);
+        }
+      }
+    });
+  }
+
   const deeplink = function (req, res, next) {
     const opts = {};
     Object.keys(options).forEach(function (k) {
@@ -49,7 +74,7 @@ module.exports = function (options) {
     };
 
     // inline template js with html
-    const inline = inliner({ basedir: path.join(__dirname, '/public') });
+    const inline = inlineHtmlStream({ basedir: path.join(__dirname, '/public') });
 
     // make sure the page is being sent as html
     res.set('Content-Type', 'text/html;charset=utf-8');
@@ -59,4 +84,4 @@ module.exports = function (options) {
   };
 
   return deeplink;
-};
+};
diff --git a/lib/public/index.html b/lib/public/index.html
@@ -6,7 +6,7 @@
   </head>
 
   <body>
-    <script type="text/javascript" src="script.js"></script>
+    <script inline type="text/javascript" src="script.js"></script>
     <script type="text/javascript">
       var options = {
         fallback: '{{fallback}}',