better code injection handling for js

samples/client/petstore-security-test/javascript/node_modules/superagent/.npmignore

@@ -0,0 +1,6 @@
+support
+test
+examples
+*.sock
+lib-cov
+coverage.html

samples/client/petstore-security-test/javascript/node_modules/superagent/.travis.yml

@@ -0,0 +1,18 @@
+sudo: false
+language: node_js
+node_js:
+  - "5.4"
+  - "4.2"
+  - "0.12"
+  - "0.10"
+  - "iojs"
+
+env:
+  global:
+    - SAUCE_USERNAME='shtylman-superagent'
+    - SAUCE_ACCESS_KEY='39a45464-cb1d-4b8d-aa1f-83c7c04fa673'
+
+matrix:
+  include:
+    - node_js: "4.2"
+      env: BROWSER=1

samples/client/petstore-security-test/javascript/node_modules/superagent/.zuul.yml

@@ -0,0 +1,15 @@
+ui: mocha-bdd
+server: ./test/support/server.js
+browsers:
+  - name: chrome
+    version: latest
+  - name: firefox
+    version: latest
+  - name: safari
+    version: latest
+  - name: iphone
+    version: latest
+  - name: android
+    version: latest
+  - name: ie
+    version: 9..latest

samples/client/petstore-security-test/javascript/node_modules/superagent/Contributing.md

@@ -0,0 +1,7 @@
+When submitting a PR, your chance of acceptance increases if you do the following:
+
+* Code style is consistent with existing in the file.
+* Tests are passing (client and server).
+* You add a test for the failing issue you are fixing.
+* Code changes are focused on the area of discussion.
+* Do not rebuild the distribution files or increment version numbers.

samples/client/petstore-security-test/javascript/node_modules/superagent/History.md

@@ -0,0 +1,527 @@
+# 1.7.1 (2016-01-21)
+
+ * Fixed a conflict with express when using npm 3.x (Glenn)
+ * Fixed redirects after a multipart/form-data POST request (cyclist2)
+
+# 1.7.0 (2016-01-18)
+
+ * When attaching files, read default filename from the `File` object (JD Isaacks)
+ * Add `direction` property to `progress` events (Joseph Dykstra)
+ * Update component-emitter & formidable (Kornel Lesiński)
+ * Don't re-encode query string needlessly (Ruben Verborgh)
+ * ensure querystring is appended when doing `stream.pipe(request)` (Keith Grennan)
+ * change set header function, not call `this.request()` until call `this.end()` (vicanso)
+ * Add no-op `withCredentials` to Node API (markdalgleish)
+ * fix `delete` breaking on ie8 (kenjiokabe)
+ * Don't let request error override responses (Clay Reimann)
+ * Increased number of tests shared between node and client (Kornel Lesiński)
+
+# 1.6.0/1.6.1 (2015-12-09)
+
+ * avoid misleading CORS error message
+ * added 'progress' event on file/form upload in Node (Olivier Lalonde)
+ * return raw response if the response parsing fails (Rei Colina)
+ * parse content-types ending with `+json` as JSON (Eiryyy)
+ * fix to avoid throwing errors on aborted requests (gjurgens)
+ * retain cookies on redirect when hosts match (Tom Conroy)
+ * added Bower manifest (Johnny Freeman)
+ * upgrade to latest cookiejar (Andy Burke)
+
+# 1.5.0 (2015-11-30)
+
+ * encode array values as `key=1&key=2&key=3` etc... (aalpern, Davis Kim)
+ * avoid the error which is omitted from 'socket hang up'
+ * faster JSON parsing, handling of zlib errors (jbellenger)
+ * fix IE11 sends 'undefined' string if data was undefined (Vadim Goncharov)
+ * alias `del()` method as `delete()` (Aaron Krause)
+ * revert Request#parse since it was actually Response#parse
+
+# 1.4.0 (2015-09-14)
+
+ * add Request#parse method to client library
+ * add missing statusCode in client response
+ * don't apply JSON heuristics if a valid parser is found
+ * fix detection of root object for webworkers
+
+# 1.3.0 (2015-08-05)
+
+ * fix incorrect content-length of data set to buffer
+ * serialize request data takes into account charsets
+ * add basic promise support via a `then` function
+
+# 1.2.0 (2015-04-13)
+
+ * add progress events to downlodas
+ * make usable in webworkers
+ * add support for 308 redirects
+ * update node-form-data dependency
+ * update to work in react native
+ * update node-mime dependency
+
+# 1.1.0 (2015-03-13)
+
+ * Fix responseType checks without xhr2 and ie9 tests (rase-)
+ * errors have .status and .response fields if applicable (defunctzombie)
+ * fix end callback called before saving cookies (rase-)
+
+1.0.0 / 2015-03-08
+==================
+
+ * All non-200 responses are treated as errors now. (The callback is called with an error when the response has a status < 200 or >= 300 now. In previous versions this would not have raised an error and the client would have to check the `res` object. See [#283](https://github.com/visionmedia/superagent/issues/283).
+ * keep timeouts intact across redirects (hopkinsth)
+ * handle falsy json values (themaarten)
+ * fire response events in browser version (Schoonology)
+ * getXHR exported in client version (KidsKilla)
+ * remove arity check on `.end()` callbacks (defunctzombie)
+ * avoid setting content-type for host objects (rexxars)
+ * don't index array strings in querystring (travisjeffery)
+ * fix pipe() with redirects (cyrilis)
+ * add xhr2 file download (vstirbu)
+ * set default response type to text/plain if not specified (warrenseine)
+
+0.21.0 / 2014-11-11
+==================
+
+ * Trim text before parsing json (gjohnson)
+ * Update tests to express 4 (gaastonsr)
+ * Prevent double callback when error is thrown (pgn-vole)
+ * Fix missing clearTimeout (nickdima)
+ * Update debug (TooTallNate)
+
+0.20.0 / 2014-10-02
+==================
+
+ * Add toJSON() to request and response instances. (yields)
+ * Prevent HEAD requests from getting parsed. (gjohnson)
+ * Update debug. (TooTallNate)
+
+0.19.1 / 2014-09-24
+==================
+
+ * Fix basic auth issue when password is falsey value. (gjohnson)
+
+0.19.0 / 2014-09-24
+==================
+
+ * Add unset() to browser. (shesek)
+ * Prefer XHR over ActiveX. (omeid)
+ * Catch parse errors. (jacwright)
+ * Update qs dependency. (wercker)
+ * Add use() to node. (Financial-Times)
+ * Add response text to errors. (yields)
+ * Don't send empty cookie headers. (undoZen)
+ * Don't parse empty response bodies. (DveMac)
+ * Use hostname when setting cookie host. (prasunsultania)
+
+0.18.2 / 2014-07-12
+==================
+
+ * Handle parser errors. (kof)
+ * Ensure not to use default parsers when there is a user defined one. (kof)
+
+0.18.1 / 2014-07-05
+==================
+
+ * Upgrade cookiejar dependency (juanpin)
+ * Support image mime types (nebulade)
+ * Make .agent chainable (kof)
+ * Upgrade debug (TooTallNate)
+ * Fix docs (aheckmann)
+
+0.18.0 / 2014-04-29
+===================
+
+* Use "form-data" module for the multipart/form-data implementation. (TooTallNate)
+* Add basic `field()` and `attach()` functions for HTML5 FormData. (TooTallNate)
+* Deprecate `part()`. (TooTallNate)
+* Set default user-agent header. (bevacqua)
+* Add `unset()` method for removing headers. (bevacqua)
+* Update cookiejar. (missinglink)
+* Fix response error formatting. (shesek)
+
+0.17.0 / 2014-03-06
+===================
+
+ * supply uri malformed error to the callback (yields)
+ * add request event (yields)
+ * allow simple auth (yields)
+ * add request event (yields)
+ * switch to component/reduce (visionmedia)
+ * fix part content-disposition (mscdex)
+ * add browser testing via zuul (defunctzombie)
+ * adds request.use() (johntron)
+
+0.16.0 / 2014-01-07
+==================
+
+ * remove support for 0.6 (superjoe30)
+ * fix CORS withCredentials (wejendorp)
+ * add "test" script (superjoe30)
+ * add request .accept() method (nickl-)
+ * add xml to mime types mappings (nickl-)
+ * fix parse body error on HEAD requests (gjohnson)
+ * fix documentation typos (matteofigus)
+ * fix content-type + charset (bengourley)
+ * fix null values on query parameters (cristiandouce)
+
+0.15.7 / 2013-10-19
+==================
+
+ * pin should.js to 1.3.0 due to breaking change in 2.0.x
+ * fix browserify regression
+
+0.15.5 / 2013-10-09
+==================
+
+ * add browser field to support browserify
+ * fix .field() value number support
+
+0.15.4 / 2013-07-09
+==================
+
+ * node: add a Request#agent() function to set the http Agent to use
+
+0.15.3 / 2013-07-05
+==================
+
+ * fix .pipe() unzipping on more recent nodes. Closes #240
+ * fix passing an empty object to .query() no longer appends "?"
+ * fix formidable error handling
+ * update formidable
+
+0.15.2 / 2013-07-02
+==================
+
+ * fix: emit 'end' when piping.
+
+0.15.1 / 2013-06-26
+==================
+
+ * add try/catch around parseLinks
+
+0.15.0 / 2013-06-25
+==================
+
+ * make `Response#toError()` have a more meaningful `message`
+
+0.14.9 / 2013-06-15
+==================
+
+ * add debug()s to the node client
+ * add .abort() method to node client
+
+0.14.8 / 2013-06-13
+==================
+
+ * set .agent = false always
+ * remove X-Requested-With. Closes #189
+
+0.14.7 / 2013-06-06
+==================
+
+ * fix unzip error handling
+
+0.14.6 / 2013-05-23
+==================
+
+ * fix HEAD unzip bug
+
+0.14.5 / 2013-05-23
+==================
+
+ * add flag to ensure the callback is __never__ invoked twice
+
+0.14.4 / 2013-05-22
+==================
+
+ * add superagent.js build output
+ * update qs
+ * update emitter-component
+ * revert "add browser field to support browserify" see GH-221
+
+0.14.3 / 2013-05-18
+==================
+
+ * add browser field to support browserify
+
+0.14.2/ 2013-05-07
+==================
+
+  * add host object check to fix serialization of File/Blobs etc as json
+
+0.14.1 / 2013-04-09
+==================
+
+  * update qs
+
+0.14.0 / 2013-04-02
+==================
+
+  * add client-side basic auth
+  * fix retaining of .set() header field case
+
+0.13.0 / 2013-03-13
+==================
+
+  * add progress events to client
+  * add simple example
+  * add res.headers as alias of res.header for browser client
+  * add res.get(field) to node/client
+
+0.12.4 / 2013-02-11
+==================
+
+  * fix get content-type even if can't get other headers in firefox. fixes #181
+
+0.12.3 / 2013-02-11
+==================
+
+  * add quick "progress" event support
+
+0.12.2 / 2013-02-04
+==================
+
+  * add test to check if response acts as a readable stream
+  * add ReadableStream in the Response prototype.
+  * add test to assert correct redirection when the host changes in the location header.
+  * add default Accept-Encoding. Closes #155
+  * fix req.pipe() return value of original stream for node parity. Closes #171
+  * remove the host header when cleaning headers to properly follow the redirection.
+
+0.12.1 / 2013-01-10
+==================
+
+  * add x-domain error handling
+
+0.12.0 / 2013-01-04
+==================
+
+  * add header persistence on redirects
+
+0.11.0 / 2013-01-02
+==================
+
+  * add .error Error object. Closes #156
+  * add forcing of res.text removal for FF HEAD responses. Closes #162
+  * add reduce component usage. Closes #90
+  * move better-assert dep to development deps
+
+0.10.0 / 2012-11-14
+==================
+
+  * add req.timeout(ms) support for the client
+
+0.9.10 / 2012-11-14
+==================
+
+  * fix client-side .query(str) support
+
+0.9.9 / 2012-11-14
+==================
+
+  * add .parse(fn) support
+  * fix socket hangup with dates in querystring. Closes #146
+  * fix socket hangup "error" event when a callback of arity 2 is provided
+
+0.9.8 / 2012-11-03
+==================
+
+  * add emission of error from `Request#callback()`
+  * add a better fix for nodes weird socket hang up error
+  * add PUT/POST/PATCH data support to client short-hand functions
+  * add .license property to component.json
+  * change client portion to build using component(1)
+  * fix GET body support [guille]
+
+0.9.7 / 2012-10-19
+==================
+
+  * fix `.buffer()` `res.text` when no parser matches
+
+0.9.6 / 2012-10-17
+==================
+
+  * change: use `this` when `window` is undefined
+  * update to new component spec [juliangruber]
+  * fix emission of "data" events for compressed responses without encoding. Closes #125
+
+0.9.5 / 2012-10-01
+==================
+
+  * add field name to .attach()
+  * add text "parser"
+  * refactor isObject()
+  * remove wtf isFunction() helper
+
+0.9.4 / 2012-09-20
+==================
+
+  * fix `Buffer` responses [TooTallNate]
+  * fix `res.type` when a "type" param is present [TooTallNate]
+
+0.9.3 / 2012-09-18
+==================
+
+  * remove __GET__ `.send()` == `.query()` special-case (__API__ change !!!)
+
+0.9.2 / 2012-09-17
+==================
+
+  * add `.aborted` prop
+  * add `.abort()`. Closes #115
+
+0.9.1 / 2012-09-07
+==================
+
+  * add `.forbidden` response property
+  * add component.json
+  * change emitter-component to 0.0.5
+  * fix client-side tests
+
+0.9.0 / 2012-08-28
+==================
+
+  * add `.timeout(ms)`. Closes #17
+
+0.8.2 / 2012-08-28
+==================
+
+  * fix pathname relative redirects. Closes #112
+
+0.8.1 / 2012-08-21
+==================
+
+  * fix redirects when schema is specified
+
+0.8.0 / 2012-08-19
+==================
+
+  * add `res.buffered` flag
+  * add buffering of text/*, json and forms only by default. Closes #61
+  * add `.buffer(false)` cancellation
+  * add cookie jar support [hunterloftis]
+  * add agent functionality [hunterloftis]
+
+0.7.0 / 2012-08-03
+==================
+
+  * allow `query()` to be called after the internal `req` has been created [tootallnate]
+
+0.6.0 / 2012-07-17
+==================
+
+  * add `res.send('foo=bar')` default of "application/x-www-form-urlencoded"
+
+0.5.1 / 2012-07-16
+==================
+
+  * add "methods" dep
+  * add `.end()` arity check to node callbacks
+  * fix unzip support due to weird node internals
+
+0.5.0 / 2012-06-16
+==================
+
+  * Added "Link" response header field parsing, exposing `res.links`
+
+0.4.3 / 2012-06-15
+==================
+
+  * Added 303, 305 and 307 as redirect status codes [slaskis]
+  * Fixed passing an object as the url
+
+0.4.2 / 2012-06-02
+==================
+
+  * Added component support
+  * Fixed redirect data
+
+0.4.1 / 2012-04-13
+==================
+
+  * Added HTTP PATCH support
+  * Fixed: GET / HEAD when following redirects. Closes #86
+  * Fixed Content-Length detection for multibyte chars
+
+0.4.0 / 2012-03-04
+==================
+
+  * Added `.head()` method [browser]. Closes #78
+  * Added `make test-cov` support
+  * Added multipart request support. Closes #11
+  * Added all methods that node supports. Closes #71
+  * Added "response" event providing a Response object. Closes #28
+  * Added `.query(obj)`. Closes #59
+  * Added `res.type` (browser). Closes #54
+  * Changed: default `res.body` and `res.files` to {}
+  * Fixed: port existing query-string fix (browser). Closes #57
+
+0.3.0 / 2012-01-24
+==================
+
+  * Added deflate/gzip support [guillermo]
+  * Added `res.type` (Content-Type void of params)
+  * Added `res.statusCode` to mirror node
+  * Added `res.headers` to mirror node
+  * Changed: parsers take callbacks
+  * Fixed optional schema support. Closes #49
+
+0.2.0 / 2012-01-05
+==================
+
+  * Added url auth support
+  * Added `.auth(username, password)`
+  * Added basic auth support [node]. Closes #41
+  * Added `make test-docs`
+  * Added guillermo's EventEmitter. Closes #16
+  * Removed `Request#data()` for SS, renamed to `send()`
+  * Removed `Request#data()` from client, renamed to `send()`
+  * Fixed array support. [browser]
+  * Fixed array support. Closes #35 [node]
+  * Fixed `EventEmitter#emit()`
+
+0.1.3 / 2011-10-25
+==================
+
+  * Added error to callback
+  * Bumped node dep for 0.5.x
+
+0.1.2 / 2011-09-24
+==================
+
+  * Added markdown documentation
+  * Added `request(url[, fn])` support to the client
+  * Added `qs` dependency to package.json
+  * Added options for `Request#pipe()`
+  * Added support for `request(url, callback)`
+  * Added `request(url)` as shortcut for `request.get(url)`
+  * Added `Request#pipe(stream)`
+  * Added inherit from `Stream`
+  * Added multipart support
+  * Added ssl support (node)
+  * Removed Content-Length field from client
+  * Fixed buffering, `setEncoding()` to utf8 [reported by stagas]
+  * Fixed "end" event when piping
+
+0.1.1 / 2011-08-20
+==================
+
+  * Added `res.redirect` flag (node)
+  * Added redirect support (node)
+  * Added `Request#redirects(n)` (node)
+  * Added `.set(object)` header field support
+  * Fixed `Content-Length` support
+
+0.1.0 / 2011-08-09
+==================
+
+  * Added support for multiple calls to `.data()`
+  * Added support for `.get(uri, obj)`
+  * Added GET `.data()` querystring support
+  * Added IE{6,7,8} support [alexyoung]
+
+0.0.1 / 2011-08-05
+==================
+
+  * Initial commit
+

samples/client/petstore-security-test/javascript/node_modules/superagent/LICENSE

@@ -0,0 +1,22 @@
+(The MIT License)
+
+Copyright (c) 2014-2016 TJ Holowaychuk <tj@vision-media.ca>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

samples/client/petstore-security-test/javascript/node_modules/superagent/Makefile

@@ -0,0 +1,57 @@
+
+NODETESTS ?= test/*.js test/node/*.js
+BROWSERTESTS ?= test/*.js test/client/*.js
+REPORTER = spec
+
+all: superagent.js
+
+test:
+	@if [ "x$(BROWSER)" = "x" ]; then make test-node; else make test-browser; fi
+
+test-node:
+	@NODE_ENV=test NODE_TLS_REJECT_UNAUTHORIZED=0 ./node_modules/.bin/mocha \
+		--require should \
+		--reporter $(REPORTER) \
+		--timeout 5000 \
+		--growl \
+		$(NODETESTS)
+
+test-cov: lib-cov
+	SUPERAGENT_COV=1 $(MAKE) test REPORTER=html-cov > coverage.html
+
+test-browser:
+	./node_modules/.bin/zuul -- $(BROWSERTESTS)
+
+test-browser-local:
+	./node_modules/.bin/zuul --local 4000 -- $(BROWSERTESTS)
+
+lib-cov:
+	jscoverage lib lib-cov
+
+superagent.js: lib/node/*.js lib/node/parsers/*.js
+	@./node_modules/.bin/browserify \
+		--standalone superagent \
+		--outfile superagent.js .
+
+test-server:
+	@node test/server
+
+docs: index.html test-docs
+
+index.html: docs/index.md
+	marked < $< \
+		| cat docs/head.html - docs/tail.html \
+		> $@
+
+docclean:
+	rm -f index.html test.html
+
+test-docs:
+	make test REPORTER=doc \
+		| cat docs/head.html - docs/tail.html \
+		> test.html
+
+clean:
+	rm -fr superagent.js components
+
+.PHONY: test-cov test docs test-docs clean test-browser-local

samples/client/petstore-security-test/javascript/node_modules/superagent/Readme.md

@@ -0,0 +1,113 @@
+# SuperAgent [![Build Status](https://travis-ci.org/visionmedia/superagent.svg?branch=master)](https://travis-ci.org/visionmedia/superagent)
+
+[![Sauce Test Status](https://saucelabs.com/browser-matrix/shtylman-superagent.svg)](https://saucelabs.com/u/shtylman-superagent)
+
+SuperAgent is a small progressive __client-side__ HTTP request library, and __Node.js__ module with the same API, sporting many high-level HTTP client features. View the [docs](http://visionmedia.github.io/superagent/).
+
+![super agent](http://f.cl.ly/items/3d282n3A0h0Z0K2w0q2a/Screenshot.png)
+
+## Installation
+
+node:
+
+```
+$ npm install superagent
+```
+
+component:
+
+```
+$ component install visionmedia/superagent
+```
+
+Works with [browserify](https://github.com/substack/node-browserify) and should work with [webpack](https://github.com/visionmedia/superagent/wiki/Superagent-for-Webpack)
+
+```js
+request
+  .post('/api/pet')
+  .send({ name: 'Manny', species: 'cat' })
+  .set('X-API-Key', 'foobar')
+  .set('Accept', 'application/json')
+  .end(function(err, res){
+    // Calling the end function will send the request
+  });
+```
+
+## Supported browsers
+
+Tested browsers:
+
+- Latest Android
+- Latest Firefox
+- Latest Chrome
+- IE9 through latest
+- Latest iPhone
+- Latest Safari
+
+Even though IE9 is supported, a polyfill `window.btoa` is needed to use basic auth.
+
+# Plugins
+
+Superagent is easily extended via plugins.
+
+```js
+var nocache = require('superagent-no-cache');
+var request = require('superagent');
+var prefix = require('superagent-prefix')('/static');
+
+request
+.get('/some-url')
+.use(prefix) // Prefixes *only* this request
+.use(nocache) // Prevents caching of *only* this request
+.end(function(err, res){
+    // Do something
+});
+```
+
+Existing plugins:
+ * [superagent-no-cache](https://github.com/johntron/superagent-no-cache) - prevents caching by including Cache-Control header
+ * [superagent-prefix](https://github.com/johntron/superagent-prefix) - prefixes absolute URLs (useful in test environment)
+ * [superagent-mock](https://github.com/M6Web/superagent-mock) - simulate HTTP calls by returning data fixtures based on the requested URL
+ * [superagent-mocker](https://github.com/shuvalov-anton/superagent-mocker) — simulate REST API
+ * [superagent-cache](https://github.com/jpodwys/superagent-cache) - superagent with built-in, flexible caching
+ * [superagent-jsonapify](https://github.com/alex94puchades/superagent-jsonapify) - A lightweight [json-api](http://jsonapi.org/format/) client addon for superagent
+ * [superagent-serializer](https://github.com/zzarcon/superagent-serializer) - Converts server payload into different cases
+ 
+Please prefix your plugin with `superagent-*` so that it can easily be found by others.
+
+For superagent extensions such as couchdb and oauth visit the [wiki](https://github.com/visionmedia/superagent/wiki).
+
+## Running node tests
+
+Install dependencies:
+
+```shell
+$ npm install
+```
+Run em!
+
+```shell
+$ make test
+```
+
+## Running browser tests
+
+Install dependencies:
+
+```shell
+$ npm install
+```
+
+Start the test runner:
+
+```shell
+$ make test-browser-local
+```
+
+Visit `http://localhost:4000/__zuul` in your browser.
+
+Edit tests and refresh your browser. You do not have to restart the test runner.
+
+## License
+
+MIT

samples/client/petstore-security-test/javascript/node_modules/superagent/bower.json

@@ -0,0 +1,4 @@
+{
+  "name": "superagent",
+  "main": "lib/client.js"
+}

samples/client/petstore-security-test/javascript/node_modules/superagent/component.json

@@ -0,0 +1,21 @@
+{
+  "name": "superagent",
+  "repo": "visionmedia/superagent",
+  "description": "awesome http requests",
+  "version": "1.2.0",
+  "keywords": [
+    "http",
+    "ajax",
+    "request",
+    "agent"
+  ],
+  "scripts": [
+    "lib/client.js"
+  ],
+  "main": "lib/client.js",
+  "dependencies": {
+    "component/emitter": "*",
+    "component/reduce": "*"
+  },
+  "license": "MIT"
+}

samples/client/petstore-security-test/javascript/node_modules/superagent/docs/head.html

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <title>SuperAgent - Ajax with less suck</title>
+    <link rel="stylesheet" href="docs/style.css">
+    <script src="docs/jquery.js"></script>
+    <script src="docs/jquery-ui.min.js"></script>
+    <script src="docs/highlight.js"></script>
+    <script src="docs/jquery.tocify.min.js"></script>
+    <script>
+      $(function(){
+        $('#menu').tocify({
+          selectors: 'h2',
+          hashGenerator: 'pretty'
+        });
+      });
+    </script>
+  </head>
+  <body>
+    <ul id="menu"></ul>
+    <div id="content">

samples/client/petstore-security-test/javascript/node_modules/superagent/docs/highlight.js

@@ -0,0 +1,17 @@
+
+$(function(){
+  $('code').each(function(){
+    $(this).html(highlight($(this).text()));
+  });
+});
+
+function highlight(js) {
+  return js
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/('.*?')/gm, '<span class="string">$1</span>')
+    .replace(/(\d+\.\d+)/gm, '<span class="number">$1</span>')
+    .replace(/(\d+)/gm, '<span class="number">$1</span>')
+    .replace(/\bnew *(\w+)/gm, '<span class="keyword">new</span> <span class="init">$1</span>')
+    .replace(/\b(function|new|throw|return|var|if|else)\b/gm, '<span class="keyword">$1</span>')
+}

samples/client/petstore-security-test/javascript/node_modules/superagent/docs/index.md

@@ -0,0 +1,448 @@
+
+# SuperAgent
+
+ Super Agent is light-weight progressive ajax API crafted for flexibility, readability, and a low learning curve after being frustrated with many of the existing request APIs. It also works with Node.js!
+
+     request
+       .post('/api/pet')
+       .send({ name: 'Manny', species: 'cat' })
+       .set('X-API-Key', 'foobar')
+       .set('Accept', 'application/json')
+       .end(function(err, res){
+         if (err || !res.ok) {
+           alert('Oh no! error');
+         } else {
+           alert('yay got ' + JSON.stringify(res.body));
+         }
+       });
+
+## Test documentation
+
+  The following [test documentation](docs/test.html) was generated with [Mocha's](http://visionmedia.github.com/mocha) "doc" reporter, and directly reflects the test suite. This provides an additional source of documentation.
+
+## Request basics
+
+ A request can be initiated by invoking the appropriate method on the `request` object, then calling `.end()` to send the request. For example a simple GET request:
+
+     request
+       .get('/search')
+       .end(function(err, res){
+
+       });
+
+  A method string may also be passed:
+
+    request('GET', '/search').end(callback);
+
+ The __node__ client may also provide absolute urls:
+
+     request
+       .get('http://example.com/search')
+       .end(function(err, res){
+
+       });
+
+  __DELETE__, __HEAD__, __POST__, __PUT__ and other __HTTP__ verbs may also be used, simply change the method name:
+
+    request
+      .head('/favicon.ico')
+      .end(function(err, res){
+
+      });
+
+  __DELETE__ is a special-case, as it's a reserved word, so the method is named `.del()`:
+
+    request
+      .del('/user/1')
+      .end(function(err, res){
+
+      });
+
+  The HTTP method defaults to __GET__, so if you wish, the following is valid:
+
+     request('/search', function(err, res){
+
+     });
+
+## Setting header fields
+
+  Setting header fields is simple, invoke `.set()` with a field name and value:
+
+     request
+       .get('/search')
+       .set('API-Key', 'foobar')
+       .set('Accept', 'application/json')
+       .end(callback);
+
+  You may also pass an object to set several fields in a single call:
+
+     request
+       .get('/search')
+       .set({ 'API-Key': 'foobar', Accept: 'application/json' })
+       .end(callback);
+
+## GET requests
+
+ The `.query()` method accepts objects, which when used with the __GET__ method will form a query-string. The following will produce the path `/search?query=Manny&range=1..5&order=desc`.
+
+     request
+       .get('/search')
+       .query({ query: 'Manny' })
+       .query({ range: '1..5' })
+       .query({ order: 'desc' })
+       .end(function(err, res){
+
+       });
+
+  Or as a single object:
+
+    request
+      .get('/search')
+      .query({ query: 'Manny', range: '1..5', order: 'desc' })
+      .end(function(err, res){
+
+      });
+
+  The `.query()` method accepts strings as well:
+
+      request
+        .get('/querystring')
+        .query('search=Manny&range=1..5')
+        .end(function(err, res){
+
+        });
+
+  Or joined:
+
+      request
+        .get('/querystring')
+        .query('search=Manny')
+        .query('range=1..5')
+        .end(function(err, res){
+
+        });
+
+## HEAD requests
+
+You can also use the `.query()` method for HEAD requests. The following will produce the path `/users?email=joe@smith.com`.
+
+      request
+        .head('/users')
+        .query({ email: 'joe@smith.com' })
+        .end(function(err, res){
+
+        });
+
+## POST / PUT requests
+
+  A typical JSON __POST__ request might look a little like the following, where we set the Content-Type header field appropriately, and "write" some data, in this case just a JSON string.
+
+      request.post('/user')
+        .set('Content-Type', 'application/json')
+        .send('{"name":"tj","pet":"tobi"}')
+        .end(callback)
+
+  Since JSON is undoubtably the most common, it's the _default_! The following example is equivalent to the previous.
+
+      request.post('/user')
+        .send({ name: 'tj', pet: 'tobi' })
+        .end(callback)
+
+  Or using multiple `.send()` calls:
+
+      request.post('/user')
+        .send({ name: 'tj' })
+        .send({ pet: 'tobi' })
+        .end(callback)
+
+  By default sending strings will set the Content-Type to `application/x-www-form-urlencoded`,
+  multiple calls will be concatenated with `&`, here resulting in `name=tj&pet=tobi`:
+
+      request.post('/user')
+        .send('name=tj')
+        .send('pet=tobi')
+        .end(callback);
+
+  SuperAgent formats are extensible, however by default "json" and "form" are supported. To send the data as `application/x-www-form-urlencoded` simply invoke `.type()` with "form", where the default is "json". This request will POST the body "name=tj&pet=tobi".
+
+      request.post('/user')
+        .type('form')
+        .send({ name: 'tj' })
+        .send({ pet: 'tobi' })
+        .end(callback)
+
+ Note: "form" is aliased as "form-data" and "urlencoded" for backwards compat.
+
+## Setting the Content-Type
+
+  The obvious solution is to use the `.set()` method:
+
+     request.post('/user')
+       .set('Content-Type', 'application/json')
+
+  As a short-hand the `.type()` method is also available, accepting
+  the canonicalized MIME type name complete with type/subtype, or
+  simply the extension name such as "xml", "json", "png", etc:
+
+     request.post('/user')
+       .type('application/json')
+
+     request.post('/user')
+       .type('json')
+
+     request.post('/user')
+       .type('png')
+
+## Setting Accept
+
+In a similar fashion to the `.type()` method it is also possible to set the Accept header via the short hand method `.accept()`. Which references `request.types` as well allowing you to specify either the full canonicalized MIME type name as type/subtype, or the extension suffix form as "xml", "json", "png", etc for convenience:
+
+     request.get('/user')
+       .accept('application/json')
+
+     request.get('/user')
+       .accept('json')
+
+     request.post('/user')
+       .accept('png')
+
+## Query strings
+
+  `res.query(obj)` is a method which may be used to build up a query-string. For example populating `?format=json&dest=/login` on a __POST__:
+
+    request
+      .post('/')
+      .query({ format: 'json' })
+      .query({ dest: '/login' })
+      .send({ post: 'data', here: 'wahoo' })
+      .end(callback);
+
+## Parsing response bodies
+
+  Super Agent will parse known response-body data for you, currently supporting _application/x-www-form-urlencoded_, _application/json_, and _multipart/form-data_.
+
+### JSON / Urlencoded
+
+  The property `res.body` is the parsed object, for example if a request responded with the JSON string '{"user":{"name":"tobi"}}', `res.body.user.name` would be "tobi". Likewise the x-www-form-urlencoded value of "user[name]=tobi" would yield the same result.
+
+### Multipart
+
+  The Node client supports _multipart/form-data_ via the [Formidable](https://github.com/felixge/node-formidable) module. When parsing multipart responses, the object `res.files` is also available to you. Suppose for example a request responds with the following multipart body:
+
+    --whoop
+    Content-Disposition: attachment; name="image"; filename="tobi.png"
+    Content-Type: image/png
+
+    ... data here ...
+    --whoop
+    Content-Disposition: form-data; name="name"
+    Content-Type: text/plain
+
+    Tobi
+    --whoop--
+
+  You would have the values `res.body.name` provided as "Tobi", and `res.files.image` as a `File` object containing the path on disk, filename, and other properties.
+
+## Response properties
+
+  Many helpful flags and properties are set on the `Response` object, ranging from the response text, parsed response body, header fields, status flags and more.
+
+### Response text
+
+  The `res.text` property contains the unparsed response body string. This
+  property is always present for the client API, and only when the mime type
+  matches "text/*", "*/json", or "x-www-form-urlencoding" by default for node. The
+  reasoning is to conserve memory, as buffering text of large bodies such as multipart files or images is extremely inefficient.
+
+  To force buffering see the "Buffering responses" section.
+
+### Response body
+
+  Much like SuperAgent can auto-serialize request data, it can also automatically parse it. When a parser is defined for the Content-Type, it is parsed, which by default includes "application/json" and "application/x-www-form-urlencoded". The parsed object is then available via `res.body`.
+
+### Response header fields
+
+  The `res.header` contains an object of parsed header fields, lowercasing field names much like node does. For example `res.header['content-length']`.
+
+### Response Content-Type
+
+  The Content-Type response header is special-cased, providing `res.type`, which is void of the charset (if any). For example the Content-Type of "text/html; charset=utf8" will provide "text/html" as `res.type`, and the `res.charset` property would then contain "utf8".
+
+### Response status
+
+  The response status flags help determine if the request was a success, among other useful information, making SuperAgent ideal for interacting with RESTful web services. These flags are currently defined as:
+
+     var type = status / 100 | 0;
+
+     // status / class
+     res.status = status;
+     res.statusType = type;
+
+     // basics
+     res.info = 1 == type;
+     res.ok = 2 == type;
+     res.clientError = 4 == type;
+     res.serverError = 5 == type;
+     res.error = 4 == type || 5 == type;
+
+     // sugar
+     res.accepted = 202 == status;
+     res.noContent = 204 == status || 1223 == status;
+     res.badRequest = 400 == status;
+     res.unauthorized = 401 == status;
+     res.notAcceptable = 406 == status;
+     res.notFound = 404 == status;
+     res.forbidden = 403 == status;
+
+## Aborting requests
+
+  To abort requests simply invoke the `req.abort()` method.
+
+## Request timeouts
+
+  A timeout can be applied by invoking `req.timeout(ms)`, after which an error
+  will be triggered. To differentiate between other errors the `err.timeout` property
+  is set to the `ms` value. __NOTE__ that this is a timeout applied to the request
+  and all subsequent redirects, not per request.
+
+## Basic authentication
+
+  Basic auth is currently provided by the _node_ client in two forms, first via the URL as "user:pass":
+
+    request.get('http://tobi:learnboost@local').end(callback);
+
+  As well as via the `.auth()` method:
+
+    request
+      .get('http://local')
+      .auth('tobi', 'learnboost')
+      .end(callback);
+
+## Following redirects
+
+  By default up to 5 redirects will be followed, however you may specify this with the `res.redirects(n)` method:
+
+    request
+      .get('/some.png')
+      .redirects(2)
+      .end(callback);
+
+## Piping data
+
+  The Node client allows you to pipe data to and from the request. For example piping a file's contents as the request:
+
+    var request = require('superagent')
+      , fs = require('fs');
+
+    var stream = fs.createReadStream('path/to/my.json');
+    var req = request.post('/somewhere');
+    req.type('json');
+    stream.pipe(req);
+
+  Or piping the response to a file:
+
+    var request = require('superagent')
+      , fs = require('fs');
+
+    var stream = fs.createWriteStream('path/to/my.json');
+    var req = request.get('/some.json');
+    req.pipe(stream);
+
+## Multipart requests
+
+  Super Agent is also great for _building_ multipart requests for which it provides methods `.attach()` and `.field()`.
+
+### Attaching files
+
+  As mentioned a higher-level API is also provided, in the form of `.attach(name, [path], [filename])` and `.field(name, value)`. Attaching several files is simple, you can also provide a custom filename for the attachment, otherwise the basename of the attached file is used.
+
+    request
+      .post('/upload')
+      .attach('avatar', 'path/to/tobi.png', 'user.png')
+      .attach('image', 'path/to/loki.png')
+      .attach('file', 'path/to/jane.png')
+      .end(callback);
+
+### Field values
+
+  Much like form fields in HTML, you can set field values with the `.field(name, value)` method. Suppose you want to upload a few images with your name and email, your request might look something like this:
+
+     request
+       .post('/upload')
+       .field('user[name]', 'Tobi')
+       .field('user[email]', 'tobi@learnboost.com')
+       .attach('image', 'path/to/tobi.png')
+       .end(callback);
+
+## Compression
+
+  The node client supports compressed responses, best of all, you don't have to do anything! It just works.
+
+## Buffering responses
+
+  To force buffering of response bodies as `res.text` you may invoke `req.buffer()`. To undo the default of buffering for text responses such
+  as "text/plain", "text/html" etc you may invoke `req.buffer(false)`.
+
+  When buffered the `res.buffered` flag is provided, you may use this to
+  handle both buffered and unbuffered responses in the same callback.
+
+## CORS
+
+  The `.withCredentials()` method enables the ability to send cookies
+  from the origin, however only when "Access-Control-Allow-Origin" is
+  _not_ a wildcard ("*"), and "Access-Control-Allow-Credentials" is "true".
+
+    request
+      .get('http://localhost:4001/')
+      .withCredentials()
+      .end(function(err, res){
+        assert(200 == res.status);
+        assert('tobi' == res.text);
+        next();
+      })
+
+## Error handling
+
+Your callback function will always be passed two arguments: error and response. If no error occurred, the first argument will be null:
+
+    request
+     .post('/upload')
+     .attach('image', 'path/to/tobi.png')
+     .end(function(err, res){
+
+     });
+
+     An "error" event is also emitted, with you can listen for:
+
+    request
+      .post('/upload')
+      .attach('image', 'path/to/tobi.png')
+      .on('error', handle)
+      .end(function(err, res){
+
+      });
+
+  Note that a 4xx or 5xx response with super agent **are** considered an error by default. For example if you get a 500 or 403 response, this status information will be available via `err.status`. Errors from such responses also contain an `err.response` field with all of the properties mentioned in "Response properties". The library behaves in this way to handle the common case of wanting success responses and treating HTTP error status codes as errors while still allowing for custom logic around specific error conditions.
+
+  Network failures, timeouts, and other errors that produce no response will contain no `err.status` or `err.response` fields.
+
+  If you wish to handle 404 or other HTTP error responses, you can query the `err.status` property.
+  When an HTTP error occurs (4xx or 5xx response) the `res.error` property is an `Error` object,
+  this allows you to perform checks such as:
+
+    if (err && err.status === 404) {
+      alert('oh no ' + res.body.message);
+    }
+    else if (err) {
+      // all other error types we handle generically
+    }
+
+## Generator support
+
+Superagent now supports easier control flow using generators. By using a generator control flow
+like [co](https://github.com/tj/co) or a web framework like [koa](https://github.com/koajs/koa),
+you can `yield` on any superagent method:
+
+    var res = yield request
+      .get('http://local')
+      .auth('tobi', 'learnboost')

samples/client/petstore-security-test/javascript/node_modules/superagent/docs/style.css

@@ -0,0 +1,81 @@
+body {
+  padding: 40px 80px;
+  font: 14px/1.5 "Helvetica Neue", Helvetica, sans-serif;
+  background: #181818 url(images/bg.png);
+  text-align: center;
+}
+
+#content {
+  margin: 0 auto;
+  padding: 10px 40px;
+  text-align: left;
+  background: white;
+  width: 50%;
+  -webkit-border-radius: 2px;
+  -moz-border-radius: 2px;
+  border-radius: 2px;
+  -webkit-box-shadow: 0 2px 5px 0 black;
+}
+
+#menu {
+  font-size: 13px;
+  margin: 0;
+  padding: 0;
+  text-align: left;
+  position: fixed;
+  top: 15px;
+  left: 15px;
+}
+
+#menu ul {
+  margin: 0;
+  padding: 0;
+}
+
+#menu li {
+  list-style: none;
+}
+
+#menu a {
+  color: rgba(255,255,255,.5);
+  text-decoration: none;
+}
+
+#menu a:hover {
+  color: white;
+}
+
+#menu .active a {
+  color: white;
+}
+
+pre {
+  padding: 10px;
+}
+
+code {
+  font: 12px/1 monaco, monospace;
+}
+
+p code {
+  border: 1px solid #ECEA75;
+  padding: 1px 3px;
+  -webkit-border-radius: 2px;
+  -moz-border-radius: 2px;
+  border-radius: 2px;
+  background: #FDFCD1;
+}
+
+pre {
+  padding: 20px 25px;
+  border: 1px solid #ddd;
+  -webkit-box-shadow: inset 0 0 5px #eee;
+  -moz-box-shadow: inset 0 0 5px #eee;
+  box-shadow: inset 0 0 5px #eee;
+}
+
+code .comment { color: #ddd }
+code .init { color: #2F6FAD }
+code .string { color: #5890AD }
+code .keyword { color: #8A6343 }
+code .number { color: #2F6FAD }

samples/client/petstore-security-test/javascript/node_modules/superagent/docs/tail.html

@@ -0,0 +1,4 @@
+    </div>
+    <a href="http://github.com/visionmedia/superagent"><img style="position: absolute; top: 0; right: 0; border: 0;" src="https://s3.amazonaws.com/github/ribbons/forkme_right_white_ffffff.png" alt="Fork me on GitHub"></a>
+  </body>
+</html>

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/agent.js

@@ -0,0 +1,82 @@
+
+/**
+ * Module dependencies.
+ */
+
+var CookieJar = require('cookiejar').CookieJar;
+var CookieAccess = require('cookiejar').CookieAccessInfo;
+var parse = require('url').parse;
+var request = require('./index');
+var methods = require('methods');
+
+/**
+ * Expose `Agent`.
+ */
+
+module.exports = Agent;
+
+/**
+ * Initialize a new `Agent`.
+ *
+ * @api public
+ */
+
+function Agent(options) {
+  if (!(this instanceof Agent)) return new Agent(options);
+  if (options) this._ca = options.ca;
+  this.jar = new CookieJar;
+}
+
+/**
+ * Save the cookies in the given `res` to
+ * the agent's cookie jar for persistence.
+ *
+ * @param {Response} res
+ * @api private
+ */
+
+Agent.prototype.saveCookies = function(res){
+  var cookies = res.headers['set-cookie'];
+  if (cookies) this.jar.setCookies(cookies);
+};
+
+/**
+ * Attach cookies when available to the given `req`.
+ *
+ * @param {Request} req
+ * @api private
+ */
+
+Agent.prototype.attachCookies = function(req){
+  var url = parse(req.url);
+  var access = CookieAccess(url.hostname, url.pathname, 'https:' == url.protocol);
+  var cookies = this.jar.getCookies(access).toValueString();
+  req.cookies = cookies;
+};
+
+// generate HTTP verb methods
+if (methods.indexOf('del') == -1) {
+  // create a copy so we don't cause conflicts with
+  // other packages using the methods package and
+  // npm 3.x
+  methods = methods.slice(0);
+  methods.push('del');
+}
+methods.forEach(function(method){
+  var name = method;
+  method = 'del' == method ? 'delete' : method;
+
+  method = method.toUpperCase();
+  Agent.prototype[name] = function(url, fn){
+    var req = request(method, url);
+    req.ca(this._ca);
+
+    req.on('response', this.saveCookies.bind(this));
+    req.on('redirect', this.saveCookies.bind(this));
+    req.on('redirect', this.attachCookies.bind(this, req));
+    this.attachCookies(req);
+
+    fn && req.end(fn);
+    return req;
+  };
+});

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/parsers/image.js

@@ -0,0 +1,10 @@
+module.exports = function(res, fn){
+  var data = []; // Binary data needs binary storage
+
+  res.on('data', function(chunk){
+      data.push(chunk);
+  });
+  res.on('end', function () {
+      fn(null, Buffer.concat(data));
+  });
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/parsers/index.js

@@ -0,0 +1,5 @@
+
+exports['application/x-www-form-urlencoded'] = require('./urlencoded');
+exports['application/json'] = require('./json');
+exports.text = require('./text');
+exports.image = require('./image');

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/parsers/json.js

@@ -0,0 +1,17 @@
+
+module.exports = function parseJSON(res, fn){
+  res.text = '';
+  res.setEncoding('utf8');
+  res.on('data', function(chunk){ res.text += chunk;});
+  res.on('end', function(){
+    try {
+      var body = res.text && JSON.parse(res.text);
+    } catch (e) {
+      var err = e;
+      // issue #675: return the raw response if the response parsing fails
+      err.rawResponse = res.text || null;
+    } finally {
+      fn(err, body);
+    }
+  });
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/parsers/text.js

@@ -0,0 +1,7 @@
+
+module.exports = function(res, fn){
+  res.text = '';
+  res.setEncoding('utf8');
+  res.on('data', function(chunk){ res.text += chunk; });
+  res.on('end', fn);
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/parsers/urlencoded.js

@@ -0,0 +1,19 @@
+
+/**
+ * Module dependencies.
+ */
+
+var qs = require('qs');
+
+module.exports = function(res, fn){
+  res.text = '';
+  res.setEncoding('ascii');
+  res.on('data', function(chunk){ res.text += chunk; });
+  res.on('end', function(){
+    try {
+      fn(null, qs.parse(res.text));
+    } catch (err) {
+      fn(err);
+    }
+  });
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/part.js

@@ -0,0 +1,150 @@
+
+/**
+ * Module dependencies.
+ */
+
+var util = require('util');
+var mime = require('mime');
+var FormData = require('form-data');
+var PassThrough = require('readable-stream/passthrough');
+
+/**
+ * Initialize a new `Part` for the given `req`.
+ *
+ * @param {Request} req
+ * @api public
+ * @deprecated pass a readable stream in to `Request#attach()` instead
+ */
+
+var Part = function (req) {
+  PassThrough.call(this);
+  this._req = req;
+  this._attached = false;
+  this._name = null;
+  this._type = null;
+  this._header = null;
+  this._filename = null;
+
+  this.once('pipe', this._attach.bind(this));
+};
+Part = util.deprecate(Part, 'The `Part()` constructor is deprecated. ' +
+   'Pass a readable stream in to `Request#attach()` instead.');
+
+/**
+ * Inherit from `PassThrough`.
+ */
+
+util.inherits(Part, PassThrough);
+
+/**
+ * Expose `Part`.
+ */
+
+module.exports = Part;
+
+/**
+ * Set header `field` to `val`.
+ *
+ * @param {String} field
+ * @param {String} val
+ * @return {Part} for chaining
+ * @api public
+ */
+
+Part.prototype.set = function(field, val){
+  //if (!this._header) this._header = {};
+  //this._header[field] = val;
+  //return this;
+  throw new TypeError('setting custom form-data part headers is unsupported');
+};
+
+/**
+ * Set _Content-Type_ response header passed through `mime.lookup()`.
+ *
+ * Examples:
+ *
+ *     res.type('html');
+ *     res.type('.html');
+ *
+ * @param {String} type
+ * @return {Part} for chaining
+ * @api public
+ */
+
+Part.prototype.type = function(type){
+  var lookup = mime.lookup(type);
+  this._type = lookup;
+  //this.set('Content-Type', lookup);
+  return this;
+};
+
+/**
+ * Set the "name" portion for the _Content-Disposition_ header field.
+ *
+ * @param {String} name
+ * @return {Part} for chaining
+ * @api public
+ */
+
+Part.prototype.name = function(name){
+  this._name = name;
+  return this;
+};
+
+/**
+ * Set _Content-Disposition_ header field to _attachment_ with `filename`
+ * and field `name`.
+ *
+ * @param {String} name
+ * @param {String} filename
+ * @return {Part} for chaining
+ * @api public
+ */
+
+Part.prototype.attachment = function(name, filename){
+  this.name(name);
+  if (filename) {
+    this.type(filename);
+    this._filename = filename;
+  }
+  return this;
+};
+
+/**
+ * Calls `FormData#append()` on the Request instance's FormData object.
+ *
+ * Gets called implicitly upon the first `write()` call, or the "pipe" event.
+ *
+ * @api private
+ */
+
+Part.prototype._attach = function(){
+  if (this._attached) return;
+  this._attached = true;
+
+  if (!this._name) throw new Error('must call `Part#name()` first!');
+
+  // add `this` Stream's readable side as a stream for this Part
+  if (!this._req._formData) this._req._formData = new FormData();
+  this._req._formData.append(this._name, this, {
+    contentType: this._type,
+    filename: this._filename
+  });
+
+  // restore PassThrough's default `write()` function now that we're setup
+  this.write = PassThrough.prototype.write;
+};
+
+/**
+ * Write `data` with `encoding`.
+ *
+ * @param {Buffer|String} data
+ * @param {String} encoding
+ * @return {Boolean}
+ * @api public
+ */
+
+Part.prototype.write = function(){
+  this._attach();
+  return this.write.apply(this, arguments);
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/response.js

@@ -0,0 +1,210 @@
+
+/**
+ * Module dependencies.
+ */
+
+var util = require('util');
+var utils = require('./utils');
+var Stream = require('stream');
+
+/**
+ * Expose `Response`.
+ */
+
+module.exports = Response;
+
+/**
+ * Initialize a new `Response` with the given `xhr`.
+ *
+ *  - set flags (.ok, .error, etc)
+ *  - parse header
+ *
+ * @param {Request} req
+ * @param {Object} options
+ * @constructor
+ * @extends {Stream}
+ * @implements {ReadableStream}
+ * @api private
+ */
+
+function Response(req, options) {
+  Stream.call(this);
+  options = options || {};
+  var res = this.res = req.res;
+  this.request = req;
+  this.req = req.req;
+  this.links = {};
+  this.text = res.text;
+  this.body = res.body !== undefined ? res.body : {};
+  this.files = res.files || {};
+  this.buffered = 'string' == typeof this.text;
+  this.header = this.headers = res.headers;
+  this.setStatusProperties(res.statusCode);
+  this.setHeaderProperties(this.header);
+  this.setEncoding = res.setEncoding.bind(res);
+  res.on('data', this.emit.bind(this, 'data'));
+  res.on('end', this.emit.bind(this, 'end'));
+  res.on('close', this.emit.bind(this, 'close'));
+  res.on('error', this.emit.bind(this, 'error'));
+}
+
+/**
+ * Inherit from `Stream`.
+ */
+
+util.inherits(Response, Stream);
+
+/**
+ * Get case-insensitive `field` value.
+ *
+ * @param {String} field
+ * @return {String}
+ * @api public
+ */
+
+Response.prototype.get = function(field){
+  return this.header[field.toLowerCase()];
+};
+
+/**
+ * Implements methods of a `ReadableStream`
+ */
+
+Response.prototype.destroy = function(err){
+  this.res.destroy(err);
+};
+
+/**
+ * Pause.
+ */
+
+Response.prototype.pause = function(){
+  this.res.pause();
+};
+
+/**
+ * Resume.
+ */
+
+Response.prototype.resume = function(){
+  this.res.resume();
+};
+
+/**
+ * Return an `Error` representative of this response.
+ *
+ * @return {Error}
+ * @api public
+ */
+
+Response.prototype.toError = function(){
+  var req = this.req;
+  var method = req.method;
+  var path = req.path;
+
+  var msg = 'cannot ' + method + ' ' + path + ' (' + this.status + ')';
+  var err = new Error(msg);
+  err.status = this.status;
+  err.text = this.text;
+  err.method = method;
+  err.path = path;
+
+  return err;
+};
+
+/**
+ * Set header related properties:
+ *
+ *   - `.type` the content type without params
+ *
+ * A response of "Content-Type: text/plain; charset=utf-8"
+ * will provide you with a `.type` of "text/plain".
+ *
+ * @param {Object} header
+ * @api private
+ */
+
+Response.prototype.setHeaderProperties = function(header){
+  // TODO: moar!
+  // TODO: make this a util
+
+  // content-type
+  var ct = this.header['content-type'] || '';
+
+  // params
+  var params = utils.params(ct);
+  for (var key in params) this[key] = params[key];
+
+  this.type = utils.type(ct);
+
+  // links
+  try {
+    if (header.link) this.links = utils.parseLinks(header.link);
+  } catch (err) {
+    // ignore
+  }
+};
+
+/**
+ * Set flags such as `.ok` based on `status`.
+ *
+ * For example a 2xx response will give you a `.ok` of __true__
+ * whereas 5xx will be __false__ and `.error` will be __true__. The
+ * `.clientError` and `.serverError` are also available to be more
+ * specific, and `.statusType` is the class of error ranging from 1..5
+ * sometimes useful for mapping respond colors etc.
+ *
+ * "sugar" properties are also defined for common cases. Currently providing:
+ *
+ *   - .noContent
+ *   - .badRequest
+ *   - .unauthorized
+ *   - .notAcceptable
+ *   - .notFound
+ *
+ * @param {Number} status
+ * @api private
+ */
+
+Response.prototype.setStatusProperties = function(status){
+  var type = status / 100 | 0;
+
+  // status / class
+  this.status = this.statusCode = status;
+  this.statusType = type;
+
+  // basics
+  this.info = 1 == type;
+  this.ok = 2 == type;
+  this.redirect = 3 == type;
+  this.clientError = 4 == type;
+  this.serverError = 5 == type;
+  this.error = (4 == type || 5 == type)
+    ? this.toError()
+    : false;
+
+  // sugar
+  this.accepted = 202 == status;
+  this.noContent = 204 == status;
+  this.badRequest = 400 == status;
+  this.unauthorized = 401 == status;
+  this.notAcceptable = 406 == status;
+  this.forbidden = 403 == status;
+  this.notFound = 404 == status;
+};
+
+/**
+ * To json.
+ *
+ * @return {Object}
+ * @api public
+ */
+
+Response.prototype.toJSON = function(){
+  return {
+    req: this.request.toJSON(),
+    header: this.header,
+    status: this.status,
+    text: this.text
+  };
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/lib/node/utils.js

@@ -0,0 +1,142 @@
+
+/**
+ * Module dependencies.
+ */
+
+var StringDecoder = require('string_decoder').StringDecoder;
+var Stream = require('stream');
+var zlib;
+
+/**
+ * Require zlib module for Node 0.6+
+ */
+
+try {
+  zlib = require('zlib');
+} catch (e) { }
+
+/**
+ * Return the mime type for the given `str`.
+ *
+ * @param {String} str
+ * @return {String}
+ * @api private
+ */
+
+exports.type = function(str){
+  return str.split(/ *; */).shift();
+};
+
+/**
+ * Return header field parameters.
+ *
+ * @param {String} str
+ * @return {Object}
+ * @api private
+ */
+
+exports.params = function(str){
+  return str.split(/ *; */).reduce(function(obj, str){
+    var parts = str.split(/ *= */);
+    var key = parts.shift();
+    var val = parts.shift();
+
+    if (key && val) obj[key] = val;
+    return obj;
+  }, {});
+};
+
+/**
+ * Parse Link header fields.
+ *
+ * @param {String} str
+ * @return {Object}
+ * @api private
+ */
+
+exports.parseLinks = function(str){
+  return str.split(/ *, */).reduce(function(obj, str){
+    var parts = str.split(/ *; */);
+    var url = parts[0].slice(1, -1);
+    var rel = parts[1].split(/ *= */)[1].slice(1, -1);
+    obj[rel] = url;
+    return obj;
+  }, {});
+};
+
+/**
+ * Buffers response data events and re-emits when they're unzipped.
+ *
+ * @param {Request} req
+ * @param {Response} res
+ * @api private
+ */
+
+exports.unzip = function(req, res){
+  if (!zlib) return;
+
+  var unzip = zlib.createUnzip();
+  var stream = new Stream;
+  var decoder;
+
+  // make node responseOnEnd() happy
+  stream.req = req;
+
+  unzip.on('error', function(err){
+    stream.emit('error', err);
+  });
+
+  // pipe to unzip
+  res.pipe(unzip);
+
+  // override `setEncoding` to capture encoding
+  res.setEncoding = function(type){
+    decoder = new StringDecoder(type);
+  };
+
+  // decode upon decompressing with captured encoding
+  unzip.on('data', function(buf){
+    if (decoder) {
+      var str = decoder.write(buf);
+      if (str.length) stream.emit('data', str);
+    } else {
+      stream.emit('data', buf);
+    }
+  });
+
+  unzip.on('end', function(){
+    stream.emit('end');
+  });
+
+  // override `on` to capture data listeners
+  var _on = res.on;
+  res.on = function(type, fn){
+    if ('data' == type || 'end' == type) {
+      stream.on(type, fn);
+    } else if ('error' == type) {
+      stream.on(type, fn);
+      _on.call(res, type, fn);
+    } else {
+      _on.call(res, type, fn);
+    }
+  };
+};
+
+/**
+ * Strip content related fields from `header`.
+ *
+ * @param {Object} header
+ * @return {Object} header
+ * @api private
+ */
+
+exports.cleanHeader = function(header, shouldStripCookie){
+  delete header['content-type'];
+  delete header['content-length'];
+  delete header['transfer-encoding'];
+  delete header['host'];
+  if (shouldStripCookie) {
+    delete header['cookie'];
+  }
+  return header;
+};

samples/client/petstore-security-test/javascript/node_modules/superagent/package.json

@@ -0,0 +1,159 @@
+{
+  "_args": [
+    [
+      "superagent@1.7.1",
+      "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript"
+    ]
+  ],
+  "_from": "superagent@1.7.1",
+  "_id": "superagent@1.7.1",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/superagent",
+  "_nodeVersion": "5.4.0",
+  "_npmUser": {
+    "email": "pornel@pornel.net",
+    "name": "kornel"
+  },
+  "_npmVersion": "3.5.3",
+  "_phantomChildren": {},
+  "_requested": {
+    "name": "superagent",
+    "raw": "superagent@1.7.1",
+    "rawSpec": "1.7.1",
+    "scope": null,
+    "spec": "1.7.1",
+    "type": "version"
+  },
+  "_requiredBy": [
+    "/"
+  ],
+  "_resolved": "https://registry.npmjs.org/superagent/-/superagent-1.7.1.tgz",
+  "_shasum": "bc2ed6629055e6f18557ceaa2cb2a07d9e16d327",
+  "_shrinkwrap": null,
+  "_spec": "superagent@1.7.1",
+  "_where": "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript",
+  "author": {
+    "email": "tj@vision-media.ca",
+    "name": "TJ Holowaychuk"
+  },
+  "browser": {
+    "./lib/node/index.js": "./lib/client.js",
+    "./test/support/server.js": "./test/support/blank.js",
+    "emitter": "component-emitter",
+    "reduce": "reduce-component"
+  },
+  "bugs": {
+    "url": "https://github.com/visionmedia/superagent/issues"
+  },
+  "component": {
+    "scripts": {
+      "superagent": "lib/client.js"
+    }
+  },
+  "contributors": [
+    {
+      "name": "Hunter Loftis",
+      "email": "hunter@hunterloftis.com"
+    }
+  ],
+  "dependencies": {
+    "component-emitter": "~1.2.0",
+    "cookiejar": "2.0.6",
+    "debug": "2",
+    "extend": "1.2.1",
+    "form-data": "0.2.0",
+    "formidable": "~1.0.14",
+    "methods": "~1.1.1",
+    "mime": "1.3.4",
+    "qs": "2.3.3",
+    "readable-stream": "1.0.27-1",
+    "reduce-component": "1.0.1"
+  },
+  "description": "elegant & feature rich browser / node HTTP with a fluent API",
+  "devDependencies": {
+    "Base64": "~0.3.0",
+    "basic-auth-connect": "~1.0.0",
+    "better-assert": "~1.0.1",
+    "body-parser": "~1.9.2",
+    "browserify": "~6.3.2",
+    "cookie-parser": "~1.3.3",
+    "express": "~4.9.8",
+    "express-session": "~1.9.1",
+    "marked": "0.3.5",
+    "mocha": "~2.0.1",
+    "should": "~3.1.3",
+    "zuul": "~1.19.0"
+  },
+  "directories": {},
+  "dist": {
+    "shasum": "bc2ed6629055e6f18557ceaa2cb2a07d9e16d327",
+    "tarball": "https://registry.npmjs.org/superagent/-/superagent-1.7.1.tgz"
+  },
+  "engines": {
+    "node": ">= 0.8"
+  },
+  "gitHead": "2a3cc1dfceda348bf9dc57ddeafa5dc0ec64893c",
+  "homepage": "https://github.com/visionmedia/superagent#readme",
+  "keywords": [
+    "agent",
+    "ajax",
+    "http",
+    "request"
+  ],
+  "license": "MIT",
+  "main": "./lib/node/index.js",
+  "maintainers": [
+    {
+      "name": "defunctzombie",
+      "email": "shtylman@gmail.com"
+    },
+    {
+      "name": "kof",
+      "email": "oleg008@gmail.com"
+    },
+    {
+      "name": "kornel",
+      "email": "pornel@pornel.net"
+    },
+    {
+      "name": "naman34",
+      "email": "naman34@gmail.com"
+    },
+    {
+      "name": "nw",
+      "email": "nw@nwhite.net"
+    },
+    {
+      "name": "rauchg",
+      "email": "rauchg@gmail.com"
+    },
+    {
+      "name": "superjoe",
+      "email": "superjoe30@gmail.com"
+    },
+    {
+      "name": "tjholowaychuk",
+      "email": "tj@vision-media.ca"
+    },
+    {
+      "name": "travisjeffery",
+      "email": "tj@travisjeffery.com"
+    },
+    {
+      "name": "yields",
+      "email": "yields@icloud.com"
+    }
+  ],
+  "name": "superagent",
+  "optionalDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/visionmedia/superagent.git"
+  },
+  "scripts": {
+    "prepublish": "make all",
+    "test": "make test"
+  },
+  "version": "1.7.1"
+}

samples/client/petstore-security-test/javascript/node_modules/superagent/test.js

@@ -0,0 +1,6 @@
+
+var bla = require('.');
+
+bla.get('http://localhost:8080/')
+	.then(function(){return 1;})
+	.then(console.log.bind(console));