better code injection handling for js

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text eol=lf

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/.jscsrc

@@ -0,0 +1,30 @@
+{
+    "requireCurlyBraces": ["do", "switch", "return", "try", "catch"],
+    "requireSpaceBeforeBinaryOperators": ["+", "-", "/", "*", "=", "==", "===", "!=", "!==", ">", "<", ">=", "<="],
+    "requireSpaceAfterBinaryOperators": ["+", "-", "/", "*", "=", "==", "===", "!=", "!==", ">", "<", ">=", "<="],
+    "requireSpaceAfterKeywords": ["else", "do", "switch", "return", "try"],
+    "disallowSpaceAfterKeywords": ["if", "catch", "for", "while"],
+    "disallowSpacesInFunctionExpression": { "beforeOpeningCurlyBrace": true },
+
+    "requireCapitalizedConstructors": true,
+    "requireCommaBeforeLineBreak": true,
+    "requireDotNotation": true,
+    "requireParenthesesAroundIIFE": true,
+
+    "disallowEmptyBlocks": true,
+
+    "disallowSpaceAfterPrefixUnaryOperators": ["!"],
+    "disallowSpaceBeforeBinaryOperators": [","],
+    "disallowSpaceAfterPrefixUnaryOperators": ["++", "--", "+", "-", "~", "!"],
+    "disallowSpaceBeforePostfixUnaryOperators": ["++", "--"],
+
+    "disallowKeywords": ["with"],
+    "disallowMultipleLineStrings": true,
+    "disallowTrailingWhitespace": true,
+
+    "validateIndentation": "\t",
+    "validateLineBreaks": "LF",
+    "validateQuoteMarks": "\"",
+
+    "safeContextKeyword": "_this"
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/.travis.yml

@@ -0,0 +1,8 @@
+language: node_js
+node_js:
+  - 0.10
+  - 0.11
+
+sudo: false
+
+script: npm run coveralls

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/LICENSE

@@ -0,0 +1,18 @@
+Copyright 2010, 2011, Chris Winberry <chris@winberry.net>. All rights reserved.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+ 
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+ 
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/README.md

@@ -0,0 +1,91 @@
+# htmlparser2
+
+[![NPM version](http://img.shields.io/npm/v/htmlparser2.svg?style=flat)](https://npmjs.org/package/htmlparser2)
+[![Downloads](https://img.shields.io/npm/dm/htmlparser2.svg?style=flat)](https://npmjs.org/package/htmlparser2)
+[![Build Status](http://img.shields.io/travis/fb55/htmlparser2/master.svg?style=flat)](http://travis-ci.org/fb55/htmlparser2)
+[![Coverage](http://img.shields.io/coveralls/fb55/htmlparser2.svg?style=flat)](https://coveralls.io/r/fb55/htmlparser2)
+
+A forgiving HTML/XML/RSS parser. The parser can handle streams and provides a callback interface.
+
+## Installation
+	npm install htmlparser2
+	
+A live demo of htmlparser2 is available [here](http://demos.forbeslindesay.co.uk/htmlparser2/).
+
+## Usage
+
+```javascript
+var htmlparser = require("htmlparser2");
+var parser = new htmlparser.Parser({
+	onopentag: function(name, attribs){
+		if(name === "script" && attribs.type === "text/javascript"){
+			console.log("JS! Hooray!");
+		}
+	},
+	ontext: function(text){
+		console.log("-->", text);
+	},
+	onclosetag: function(tagname){
+		if(tagname === "script"){
+			console.log("That's it?!");
+		}
+	}
+}, {decodeEntities: true});
+parser.write("Xyz <script type='text/javascript'>var foo = '<<bar>>';</ script>");
+parser.end();
+```
+
+Output (simplified):
+
+```javascript
+--> Xyz 
+JS! Hooray!
+--> var foo = '<<bar>>';
+That's it?!
+```
+
+## Documentation
+
+Read more about the parser and its options in the [wiki](https://github.com/fb55/htmlparser2/wiki/Parser-options).
+
+## Get a DOM
+The `DomHandler` (known as `DefaultHandler` in the original `htmlparser` module) produces a DOM (document object model) that can be manipulated using the [`DomUtils`](https://github.com/fb55/DomUtils) helper.
+
+The `DomHandler`, while still bundled with this module, was moved to its [own module](https://github.com/fb55/domhandler). Have a look at it for further information.
+
+## Parsing RSS/RDF/Atom Feeds
+
+```javascript
+new htmlparser.FeedHandler(function(<error> error, <object> feed){
+    ...
+});
+```
+
+Note: While the provided feed handler works for most feeds, you might want to use  [danmactough/node-feedparser](https://github.com/danmactough/node-feedparser), which is much better tested and actively maintained.
+
+## Performance
+
+After having some artificial benchmarks for some time, __@AndreasMadsen__ published his [`htmlparser-benchmark`](https://github.com/AndreasMadsen/htmlparser-benchmark), which benchmarks HTML parses based on real-world websites.
+
+At the time of writing, the latest versions of all supported parsers show the following performance characteristics on [Travis CI](https://travis-ci.org/AndreasMadsen/htmlparser-benchmark/builds/10805007) (please note that Travis doesn't guarantee equal conditions for all tests):
+
+```
+gumbo-parser   : 34.9208 ms/file ± 21.4238
+html-parser    : 24.8224 ms/file ± 15.8703
+html5          : 419.597 ms/file ± 264.265
+htmlparser     : 60.0722 ms/file ± 384.844
+htmlparser2-dom: 12.0749 ms/file ± 6.49474
+htmlparser2    : 7.49130 ms/file ± 5.74368
+hubbub         : 30.4980 ms/file ± 16.4682
+libxmljs       : 14.1338 ms/file ± 18.6541
+parse5         : 22.0439 ms/file ± 15.3743
+sax            : 49.6513 ms/file ± 26.6032
+```
+
+## How does this module differ from [node-htmlparser](https://github.com/tautologistics/node-htmlparser)?
+
+This is a fork of the `htmlparser` module. The main difference is that this is intended to be used only with node (it runs on other platforms using [browserify](https://github.com/substack/node-browserify)). `htmlparser2` was rewritten multiple times and, while it maintains an API that's compatible with `htmlparser` in most cases, the projects don't share any code anymore.
+
+The parser now provides a callback interface close to [sax.js](https://github.com/isaacs/sax-js) (originally targeted at [readabilitySAX](https://github.com/fb55/readabilitysax)). As a result, old handlers won't work anymore.
+
+The `DefaultHandler` and the `RssHandler` were renamed to clarify their purpose (to `DomHandler` and `FeedHandler`). The old names are still available when requiring `htmlparser2`, your code should work as expected.

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/CollectingHandler.js

@@ -0,0 +1,55 @@
+module.exports = CollectingHandler;
+
+function CollectingHandler(cbs){
+	this._cbs = cbs || {};
+	this.events = [];
+}
+
+var EVENTS = require("./").EVENTS;
+Object.keys(EVENTS).forEach(function(name){
+	if(EVENTS[name] === 0){
+		name = "on" + name;
+		CollectingHandler.prototype[name] = function(){
+			this.events.push([name]);
+			if(this._cbs[name]) this._cbs[name]();
+		};
+	} else if(EVENTS[name] === 1){
+		name = "on" + name;
+		CollectingHandler.prototype[name] = function(a){
+			this.events.push([name, a]);
+			if(this._cbs[name]) this._cbs[name](a);
+		};
+	} else if(EVENTS[name] === 2){
+		name = "on" + name;
+		CollectingHandler.prototype[name] = function(a, b){
+			this.events.push([name, a, b]);
+			if(this._cbs[name]) this._cbs[name](a, b);
+		};
+	} else {
+		throw Error("wrong number of arguments");
+	}
+});
+
+CollectingHandler.prototype.onreset = function(){
+	this.events = [];
+	if(this._cbs.onreset) this._cbs.onreset();
+};
+
+CollectingHandler.prototype.restart = function(){
+	if(this._cbs.onreset) this._cbs.onreset();
+
+	for(var i = 0, len = this.events.length; i < len; i++){
+		if(this._cbs[this.events[i][0]]){
+
+			var num = this.events[i].length;
+
+			if(num === 1){
+				this._cbs[this.events[i][0]]();
+			} else if(num === 2){
+				this._cbs[this.events[i][0]](this.events[i][1]);
+			} else {
+				this._cbs[this.events[i][0]](this.events[i][1], this.events[i][2]);
+			}
+		}
+	}
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/FeedHandler.js

@@ -0,0 +1,95 @@
+var index = require("./index.js"),
+    DomHandler = index.DomHandler,
+	DomUtils = index.DomUtils;
+
+//TODO: make this a streamable handler
+function FeedHandler(callback, options){
+	this.init(callback, options);
+}
+
+require("util").inherits(FeedHandler, DomHandler);
+
+FeedHandler.prototype.init = DomHandler;
+
+function getElements(what, where){
+	return DomUtils.getElementsByTagName(what, where, true);
+}
+function getOneElement(what, where){
+	return DomUtils.getElementsByTagName(what, where, true, 1)[0];
+}
+function fetch(what, where, recurse){
+	return DomUtils.getText(
+		DomUtils.getElementsByTagName(what, where, recurse, 1)
+	).trim();
+}
+
+function addConditionally(obj, prop, what, where, recurse){
+	var tmp = fetch(what, where, recurse);
+	if(tmp) obj[prop] = tmp;
+}
+
+var isValidFeed = function(value){
+	return value === "rss" || value === "feed" || value === "rdf:RDF";
+};
+
+FeedHandler.prototype.onend = function(){
+	var feed = {},
+		feedRoot = getOneElement(isValidFeed, this.dom),
+		tmp, childs;
+
+	if(feedRoot){
+		if(feedRoot.name === "feed"){
+			childs = feedRoot.children;
+
+			feed.type = "atom";
+			addConditionally(feed, "id", "id", childs);
+			addConditionally(feed, "title", "title", childs);
+			if((tmp = getOneElement("link", childs)) && (tmp = tmp.attribs) && (tmp = tmp.href)) feed.link = tmp;
+			addConditionally(feed, "description", "subtitle", childs);
+			if((tmp = fetch("updated", childs))) feed.updated = new Date(tmp);
+			addConditionally(feed, "author", "email", childs, true);
+
+			feed.items = getElements("entry", childs).map(function(item){
+				var entry = {}, tmp;
+
+				item = item.children;
+
+				addConditionally(entry, "id", "id", item);
+				addConditionally(entry, "title", "title", item);
+				if((tmp = getOneElement("link", item)) && (tmp = tmp.attribs) && (tmp = tmp.href)) entry.link = tmp;
+				if((tmp = fetch("summary", item) || fetch("content", item))) entry.description = tmp;
+				if((tmp = fetch("updated", item))) entry.pubDate = new Date(tmp);
+				return entry;
+			});
+		} else {
+			childs = getOneElement("channel", feedRoot.children).children;
+
+			feed.type = feedRoot.name.substr(0, 3);
+			feed.id = "";
+			addConditionally(feed, "title", "title", childs);
+			addConditionally(feed, "link", "link", childs);
+			addConditionally(feed, "description", "description", childs);
+			if((tmp = fetch("lastBuildDate", childs))) feed.updated = new Date(tmp);
+			addConditionally(feed, "author", "managingEditor", childs, true);
+
+			feed.items = getElements("item", feedRoot.children).map(function(item){
+				var entry = {}, tmp;
+
+				item = item.children;
+
+				addConditionally(entry, "id", "guid", item);
+				addConditionally(entry, "title", "title", item);
+				addConditionally(entry, "link", "link", item);
+				addConditionally(entry, "description", "description", item);
+				if((tmp = fetch("pubDate", item))) entry.pubDate = new Date(tmp);
+				return entry;
+			});
+		}
+	}
+	this.dom = feed;
+	DomHandler.prototype._handleCallback.call(
+		this, feedRoot ? null : Error("couldn't find root of feed")
+	);
+};
+
+module.exports = FeedHandler;

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/Parser.js

@@ -0,0 +1,350 @@
+var Tokenizer = require("./Tokenizer.js");
+
+/*
+	Options:
+
+	xmlMode: Disables the special behavior for script/style tags (false by default)
+	lowerCaseAttributeNames: call .toLowerCase for each attribute name (true if xmlMode is `false`)
+	lowerCaseTags: call .toLowerCase for each tag name (true if xmlMode is `false`)
+*/
+
+/*
+	Callbacks:
+
+	oncdataend,
+	oncdatastart,
+	onclosetag,
+	oncomment,
+	oncommentend,
+	onerror,
+	onopentag,
+	onprocessinginstruction,
+	onreset,
+	ontext
+*/
+
+var formTags = {
+	input: true,
+	option: true,
+	optgroup: true,
+	select: true,
+	button: true,
+	datalist: true,
+	textarea: true
+};
+
+var openImpliesClose = {
+	tr      : { tr:true, th:true, td:true },
+	th      : { th:true },
+	td      : { thead:true, th:true, td:true },
+	body    : { head:true, link:true, script:true },
+	li      : { li:true },
+	p       : { p:true },
+	h1      : { p:true },
+	h2      : { p:true },
+	h3      : { p:true },
+	h4      : { p:true },
+	h5      : { p:true },
+	h6      : { p:true },
+	select  : formTags,
+	input   : formTags,
+	output  : formTags,
+	button  : formTags,
+	datalist: formTags,
+	textarea: formTags,
+	option  : { option:true },
+	optgroup: { optgroup:true }
+};
+
+var voidElements = {
+	__proto__: null,
+	area: true,
+	base: true,
+	basefont: true,
+	br: true,
+	col: true,
+	command: true,
+	embed: true,
+	frame: true,
+	hr: true,
+	img: true,
+	input: true,
+	isindex: true,
+	keygen: true,
+	link: true,
+	meta: true,
+	param: true,
+	source: true,
+	track: true,
+	wbr: true,
+
+	//common self closing svg elements
+	path: true,
+	circle: true,
+	ellipse: true,
+	line: true,
+	rect: true,
+	use: true,
+	stop: true,
+	polyline: true,
+	polygon: true
+};
+
+var re_nameEnd = /\s|\//;
+
+function Parser(cbs, options){
+	this._options = options || {};
+	this._cbs = cbs || {};
+
+	this._tagname = "";
+	this._attribname = "";
+	this._attribvalue = "";
+	this._attribs = null;
+	this._stack = [];
+
+	this.startIndex = 0;
+	this.endIndex = null;
+
+	this._lowerCaseTagNames = "lowerCaseTags" in this._options ?
+									!!this._options.lowerCaseTags :
+									!this._options.xmlMode;
+	this._lowerCaseAttributeNames = "lowerCaseAttributeNames" in this._options ?
+									!!this._options.lowerCaseAttributeNames :
+									!this._options.xmlMode;
+
+	this._tokenizer = new Tokenizer(this._options, this);
+
+	if(this._cbs.onparserinit) this._cbs.onparserinit(this);
+}
+
+require("util").inherits(Parser, require("events").EventEmitter);
+
+Parser.prototype._updatePosition = function(initialOffset){
+	if(this.endIndex === null){
+		if(this._tokenizer._sectionStart <= initialOffset){
+			this.startIndex = 0;
+		} else {
+			this.startIndex = this._tokenizer._sectionStart - initialOffset;
+		}
+	}
+	else this.startIndex = this.endIndex + 1;
+	this.endIndex = this._tokenizer.getAbsoluteIndex();
+};
+
+//Tokenizer event handlers
+Parser.prototype.ontext = function(data){
+	this._updatePosition(1);
+	this.endIndex--;
+
+	if(this._cbs.ontext) this._cbs.ontext(data);
+};
+
+Parser.prototype.onopentagname = function(name){
+	if(this._lowerCaseTagNames){
+		name = name.toLowerCase();
+	}
+
+	this._tagname = name;
+
+	if(!this._options.xmlMode && name in openImpliesClose) {
+		for(
+			var el;
+			(el = this._stack[this._stack.length - 1]) in openImpliesClose[name];
+			this.onclosetag(el)
+		);
+	}
+
+	if(this._options.xmlMode || !(name in voidElements)){
+		this._stack.push(name);
+	}
+
+	if(this._cbs.onopentagname) this._cbs.onopentagname(name);
+	if(this._cbs.onopentag) this._attribs = {};
+};
+
+Parser.prototype.onopentagend = function(){
+	this._updatePosition(1);
+
+	if(this._attribs){
+		if(this._cbs.onopentag) this._cbs.onopentag(this._tagname, this._attribs);
+		this._attribs = null;
+	}
+
+	if(!this._options.xmlMode && this._cbs.onclosetag && this._tagname in voidElements){
+		this._cbs.onclosetag(this._tagname);
+	}
+
+	this._tagname = "";
+};
+
+Parser.prototype.onclosetag = function(name){
+	this._updatePosition(1);
+
+	if(this._lowerCaseTagNames){
+		name = name.toLowerCase();
+	}
+
+	if(this._stack.length && (!(name in voidElements) || this._options.xmlMode)){
+		var pos = this._stack.lastIndexOf(name);
+		if(pos !== -1){
+			if(this._cbs.onclosetag){
+				pos = this._stack.length - pos;
+				while(pos--) this._cbs.onclosetag(this._stack.pop());
+			}
+			else this._stack.length = pos;
+		} else if(name === "p" && !this._options.xmlMode){
+			this.onopentagname(name);
+			this._closeCurrentTag();
+		}
+	} else if(!this._options.xmlMode && (name === "br" || name === "p")){
+		this.onopentagname(name);
+		this._closeCurrentTag();
+	}
+};
+
+Parser.prototype.onselfclosingtag = function(){
+	if(this._options.xmlMode || this._options.recognizeSelfClosing){
+		this._closeCurrentTag();
+	} else {
+		this.onopentagend();
+	}
+};
+
+Parser.prototype._closeCurrentTag = function(){
+	var name = this._tagname;
+
+	this.onopentagend();
+
+	//self-closing tags will be on the top of the stack
+	//(cheaper check than in onclosetag)
+	if(this._stack[this._stack.length - 1] === name){
+		if(this._cbs.onclosetag){
+			this._cbs.onclosetag(name);
+		}
+		this._stack.pop();
+	}
+};
+
+Parser.prototype.onattribname = function(name){
+	if(this._lowerCaseAttributeNames){
+		name = name.toLowerCase();
+	}
+	this._attribname = name;
+};
+
+Parser.prototype.onattribdata = function(value){
+	this._attribvalue += value;
+};
+
+Parser.prototype.onattribend = function(){
+	if(this._cbs.onattribute) this._cbs.onattribute(this._attribname, this._attribvalue);
+	if(
+		this._attribs &&
+		!Object.prototype.hasOwnProperty.call(this._attribs, this._attribname)
+	){
+		this._attribs[this._attribname] = this._attribvalue;
+	}
+	this._attribname = "";
+	this._attribvalue = "";
+};
+
+Parser.prototype._getInstructionName = function(value){
+	var idx = value.search(re_nameEnd),
+	    name = idx < 0 ? value : value.substr(0, idx);
+
+	if(this._lowerCaseTagNames){
+		name = name.toLowerCase();
+	}
+
+	return name;
+};
+
+Parser.prototype.ondeclaration = function(value){
+	if(this._cbs.onprocessinginstruction){
+		var name = this._getInstructionName(value);
+		this._cbs.onprocessinginstruction("!" + name, "!" + value);
+	}
+};
+
+Parser.prototype.onprocessinginstruction = function(value){
+	if(this._cbs.onprocessinginstruction){
+		var name = this._getInstructionName(value);
+		this._cbs.onprocessinginstruction("?" + name, "?" + value);
+	}
+};
+
+Parser.prototype.oncomment = function(value){
+	this._updatePosition(4);
+
+	if(this._cbs.oncomment) this._cbs.oncomment(value);
+	if(this._cbs.oncommentend) this._cbs.oncommentend();
+};
+
+Parser.prototype.oncdata = function(value){
+	this._updatePosition(1);
+
+	if(this._options.xmlMode || this._options.recognizeCDATA){
+		if(this._cbs.oncdatastart) this._cbs.oncdatastart();
+		if(this._cbs.ontext) this._cbs.ontext(value);
+		if(this._cbs.oncdataend) this._cbs.oncdataend();
+	} else {
+		this.oncomment("[CDATA[" + value + "]]");
+	}
+};
+
+Parser.prototype.onerror = function(err){
+	if(this._cbs.onerror) this._cbs.onerror(err);
+};
+
+Parser.prototype.onend = function(){
+	if(this._cbs.onclosetag){
+		for(
+			var i = this._stack.length;
+			i > 0;
+			this._cbs.onclosetag(this._stack[--i])
+		);
+	}
+	if(this._cbs.onend) this._cbs.onend();
+};
+
+
+//Resets the parser to a blank state, ready to parse a new HTML document
+Parser.prototype.reset = function(){
+	if(this._cbs.onreset) this._cbs.onreset();
+	this._tokenizer.reset();
+
+	this._tagname = "";
+	this._attribname = "";
+	this._attribs = null;
+	this._stack = [];
+
+	if(this._cbs.onparserinit) this._cbs.onparserinit(this);
+};
+
+//Parses a complete HTML document and pushes it to the handler
+Parser.prototype.parseComplete = function(data){
+	this.reset();
+	this.end(data);
+};
+
+Parser.prototype.write = function(chunk){
+	this._tokenizer.write(chunk);
+};
+
+Parser.prototype.end = function(chunk){
+	this._tokenizer.end(chunk);
+};
+
+Parser.prototype.pause = function(){
+	this._tokenizer.pause();
+};
+
+Parser.prototype.resume = function(){
+	this._tokenizer.resume();
+};
+
+//alias for backwards compat
+Parser.prototype.parseChunk = Parser.prototype.write;
+Parser.prototype.done = Parser.prototype.end;
+
+module.exports = Parser;

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/ProxyHandler.js

@@ -0,0 +1,27 @@
+module.exports = ProxyHandler;
+
+function ProxyHandler(cbs){
+	this._cbs = cbs || {};
+}
+
+var EVENTS = require("./").EVENTS;
+Object.keys(EVENTS).forEach(function(name){
+	if(EVENTS[name] === 0){
+		name = "on" + name;
+		ProxyHandler.prototype[name] = function(){
+			if(this._cbs[name]) this._cbs[name]();
+		};
+	} else if(EVENTS[name] === 1){
+		name = "on" + name;
+		ProxyHandler.prototype[name] = function(a){
+			if(this._cbs[name]) this._cbs[name](a);
+		};
+	} else if(EVENTS[name] === 2){
+		name = "on" + name;
+		ProxyHandler.prototype[name] = function(a, b){
+			if(this._cbs[name]) this._cbs[name](a, b);
+		};
+	} else {
+		throw Error("wrong number of arguments");
+	}
+});

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/Stream.js

@@ -0,0 +1,35 @@
+module.exports = Stream;
+
+var Parser = require("./WritableStream.js");
+
+function Stream(options){
+	Parser.call(this, new Cbs(this), options);
+}
+
+require("util").inherits(Stream, Parser);
+
+Stream.prototype.readable = true;
+
+function Cbs(scope){
+	this.scope = scope;
+}
+
+var EVENTS = require("../").EVENTS;
+
+Object.keys(EVENTS).forEach(function(name){
+	if(EVENTS[name] === 0){
+		Cbs.prototype["on" + name] = function(){
+			this.scope.emit(name);
+		};
+	} else if(EVENTS[name] === 1){
+		Cbs.prototype["on" + name] = function(a){
+			this.scope.emit(name, a);
+		};
+	} else if(EVENTS[name] === 2){
+		Cbs.prototype["on" + name] = function(a, b){
+			this.scope.emit(name, a, b);
+		};
+	} else {
+		throw Error("wrong number of arguments!");
+	}
+});

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/Tokenizer.js

@@ -0,0 +1,906 @@
+module.exports = Tokenizer;
+
+var decodeCodePoint = require("entities/lib/decode_codepoint.js"),
+    entityMap = require("entities/maps/entities.json"),
+    legacyMap = require("entities/maps/legacy.json"),
+    xmlMap    = require("entities/maps/xml.json"),
+
+    i = 0,
+
+    TEXT                      = i++,
+    BEFORE_TAG_NAME           = i++, //after <
+    IN_TAG_NAME               = i++,
+    IN_SELF_CLOSING_TAG       = i++,
+    BEFORE_CLOSING_TAG_NAME   = i++,
+    IN_CLOSING_TAG_NAME       = i++,
+    AFTER_CLOSING_TAG_NAME    = i++,
+
+    //attributes
+    BEFORE_ATTRIBUTE_NAME     = i++,
+    IN_ATTRIBUTE_NAME         = i++,
+    AFTER_ATTRIBUTE_NAME      = i++,
+    BEFORE_ATTRIBUTE_VALUE    = i++,
+    IN_ATTRIBUTE_VALUE_DQ     = i++, // "
+    IN_ATTRIBUTE_VALUE_SQ     = i++, // '
+    IN_ATTRIBUTE_VALUE_NQ     = i++,
+
+    //declarations
+    BEFORE_DECLARATION        = i++, // !
+    IN_DECLARATION            = i++,
+
+    //processing instructions
+    IN_PROCESSING_INSTRUCTION = i++, // ?
+
+    //comments
+    BEFORE_COMMENT            = i++,
+    IN_COMMENT                = i++,
+    AFTER_COMMENT_1           = i++,
+    AFTER_COMMENT_2           = i++,
+
+    //cdata
+    BEFORE_CDATA_1            = i++, // [
+    BEFORE_CDATA_2            = i++, // C
+    BEFORE_CDATA_3            = i++, // D
+    BEFORE_CDATA_4            = i++, // A
+    BEFORE_CDATA_5            = i++, // T
+    BEFORE_CDATA_6            = i++, // A
+    IN_CDATA                  = i++, // [
+    AFTER_CDATA_1             = i++, // ]
+    AFTER_CDATA_2             = i++, // ]
+
+    //special tags
+    BEFORE_SPECIAL            = i++, //S
+    BEFORE_SPECIAL_END        = i++,   //S
+
+    BEFORE_SCRIPT_1           = i++, //C
+    BEFORE_SCRIPT_2           = i++, //R
+    BEFORE_SCRIPT_3           = i++, //I
+    BEFORE_SCRIPT_4           = i++, //P
+    BEFORE_SCRIPT_5           = i++, //T
+    AFTER_SCRIPT_1            = i++, //C
+    AFTER_SCRIPT_2            = i++, //R
+    AFTER_SCRIPT_3            = i++, //I
+    AFTER_SCRIPT_4            = i++, //P
+    AFTER_SCRIPT_5            = i++, //T
+
+    BEFORE_STYLE_1            = i++, //T
+    BEFORE_STYLE_2            = i++, //Y
+    BEFORE_STYLE_3            = i++, //L
+    BEFORE_STYLE_4            = i++, //E
+    AFTER_STYLE_1             = i++, //T
+    AFTER_STYLE_2             = i++, //Y
+    AFTER_STYLE_3             = i++, //L
+    AFTER_STYLE_4             = i++, //E
+
+    BEFORE_ENTITY             = i++, //&
+    BEFORE_NUMERIC_ENTITY     = i++, //#
+    IN_NAMED_ENTITY           = i++,
+    IN_NUMERIC_ENTITY         = i++,
+    IN_HEX_ENTITY             = i++, //X
+
+    j = 0,
+
+    SPECIAL_NONE              = j++,
+    SPECIAL_SCRIPT            = j++,
+    SPECIAL_STYLE             = j++;
+
+function whitespace(c){
+	return c === " " || c === "\n" || c === "\t" || c === "\f" || c === "\r";
+}
+
+function characterState(char, SUCCESS){
+	return function(c){
+		if(c === char) this._state = SUCCESS;
+	};
+}
+
+function ifElseState(upper, SUCCESS, FAILURE){
+	var lower = upper.toLowerCase();
+
+	if(upper === lower){
+		return function(c){
+			if(c === lower){
+				this._state = SUCCESS;
+			} else {
+				this._state = FAILURE;
+				this._index--;
+			}
+		};
+	} else {
+		return function(c){
+			if(c === lower || c === upper){
+				this._state = SUCCESS;
+			} else {
+				this._state = FAILURE;
+				this._index--;
+			}
+		};
+	}
+}
+
+function consumeSpecialNameChar(upper, NEXT_STATE){
+	var lower = upper.toLowerCase();
+
+	return function(c){
+		if(c === lower || c === upper){
+			this._state = NEXT_STATE;
+		} else {
+			this._state = IN_TAG_NAME;
+			this._index--; //consume the token again
+		}
+	};
+}
+
+function Tokenizer(options, cbs){
+	this._state = TEXT;
+	this._buffer = "";
+	this._sectionStart = 0;
+	this._index = 0;
+	this._bufferOffset = 0; //chars removed from _buffer
+	this._baseState = TEXT;
+	this._special = SPECIAL_NONE;
+	this._cbs = cbs;
+	this._running = true;
+	this._ended = false;
+	this._xmlMode = !!(options && options.xmlMode);
+	this._decodeEntities = !!(options && options.decodeEntities);
+}
+
+Tokenizer.prototype._stateText = function(c){
+	if(c === "<"){
+		if(this._index > this._sectionStart){
+			this._cbs.ontext(this._getSection());
+		}
+		this._state = BEFORE_TAG_NAME;
+		this._sectionStart = this._index;
+	} else if(this._decodeEntities && this._special === SPECIAL_NONE && c === "&"){
+		if(this._index > this._sectionStart){
+			this._cbs.ontext(this._getSection());
+		}
+		this._baseState = TEXT;
+		this._state = BEFORE_ENTITY;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateBeforeTagName = function(c){
+	if(c === "/"){
+		this._state = BEFORE_CLOSING_TAG_NAME;
+	} else if(c === ">" || this._special !== SPECIAL_NONE || whitespace(c)) {
+		this._state = TEXT;
+	} else if(c === "!"){
+		this._state = BEFORE_DECLARATION;
+		this._sectionStart = this._index + 1;
+	} else if(c === "?"){
+		this._state = IN_PROCESSING_INSTRUCTION;
+		this._sectionStart = this._index + 1;
+	} else if(c === "<"){
+		this._cbs.ontext(this._getSection());
+		this._sectionStart = this._index;
+	} else {
+		this._state = (!this._xmlMode && (c === "s" || c === "S")) ?
+						BEFORE_SPECIAL : IN_TAG_NAME;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateInTagName = function(c){
+	if(c === "/" || c === ">" || whitespace(c)){
+		this._emitToken("onopentagname");
+		this._state = BEFORE_ATTRIBUTE_NAME;
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._stateBeforeCloseingTagName = function(c){
+	if(whitespace(c));
+	else if(c === ">"){
+		this._state = TEXT;
+	} else if(this._special !== SPECIAL_NONE){
+		if(c === "s" || c === "S"){
+			this._state = BEFORE_SPECIAL_END;
+		} else {
+			this._state = TEXT;
+			this._index--;
+		}
+	} else {
+		this._state = IN_CLOSING_TAG_NAME;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateInCloseingTagName = function(c){
+	if(c === ">" || whitespace(c)){
+		this._emitToken("onclosetag");
+		this._state = AFTER_CLOSING_TAG_NAME;
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._stateAfterCloseingTagName = function(c){
+	//skip everything until ">"
+	if(c === ">"){
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	}
+};
+
+Tokenizer.prototype._stateBeforeAttributeName = function(c){
+	if(c === ">"){
+		this._cbs.onopentagend();
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	} else if(c === "/"){
+		this._state = IN_SELF_CLOSING_TAG;
+	} else if(!whitespace(c)){
+		this._state = IN_ATTRIBUTE_NAME;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateInSelfClosingTag = function(c){
+	if(c === ">"){
+		this._cbs.onselfclosingtag();
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	} else if(!whitespace(c)){
+		this._state = BEFORE_ATTRIBUTE_NAME;
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._stateInAttributeName = function(c){
+	if(c === "=" || c === "/" || c === ">" || whitespace(c)){
+		this._cbs.onattribname(this._getSection());
+		this._sectionStart = -1;
+		this._state = AFTER_ATTRIBUTE_NAME;
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._stateAfterAttributeName = function(c){
+	if(c === "="){
+		this._state = BEFORE_ATTRIBUTE_VALUE;
+	} else if(c === "/" || c === ">"){
+		this._cbs.onattribend();
+		this._state = BEFORE_ATTRIBUTE_NAME;
+		this._index--;
+	} else if(!whitespace(c)){
+		this._cbs.onattribend();
+		this._state = IN_ATTRIBUTE_NAME;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateBeforeAttributeValue = function(c){
+	if(c === "\""){
+		this._state = IN_ATTRIBUTE_VALUE_DQ;
+		this._sectionStart = this._index + 1;
+	} else if(c === "'"){
+		this._state = IN_ATTRIBUTE_VALUE_SQ;
+		this._sectionStart = this._index + 1;
+	} else if(!whitespace(c)){
+		this._state = IN_ATTRIBUTE_VALUE_NQ;
+		this._sectionStart = this._index;
+		this._index--; //reconsume token
+	}
+};
+
+Tokenizer.prototype._stateInAttributeValueDoubleQuotes = function(c){
+	if(c === "\""){
+		this._emitToken("onattribdata");
+		this._cbs.onattribend();
+		this._state = BEFORE_ATTRIBUTE_NAME;
+	} else if(this._decodeEntities && c === "&"){
+		this._emitToken("onattribdata");
+		this._baseState = this._state;
+		this._state = BEFORE_ENTITY;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateInAttributeValueSingleQuotes = function(c){
+	if(c === "'"){
+		this._emitToken("onattribdata");
+		this._cbs.onattribend();
+		this._state = BEFORE_ATTRIBUTE_NAME;
+	} else if(this._decodeEntities && c === "&"){
+		this._emitToken("onattribdata");
+		this._baseState = this._state;
+		this._state = BEFORE_ENTITY;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateInAttributeValueNoQuotes = function(c){
+	if(whitespace(c) || c === ">"){
+		this._emitToken("onattribdata");
+		this._cbs.onattribend();
+		this._state = BEFORE_ATTRIBUTE_NAME;
+		this._index--;
+	} else if(this._decodeEntities && c === "&"){
+		this._emitToken("onattribdata");
+		this._baseState = this._state;
+		this._state = BEFORE_ENTITY;
+		this._sectionStart = this._index;
+	}
+};
+
+Tokenizer.prototype._stateBeforeDeclaration = function(c){
+	this._state = c === "[" ? BEFORE_CDATA_1 :
+					c === "-" ? BEFORE_COMMENT :
+						IN_DECLARATION;
+};
+
+Tokenizer.prototype._stateInDeclaration = function(c){
+	if(c === ">"){
+		this._cbs.ondeclaration(this._getSection());
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	}
+};
+
+Tokenizer.prototype._stateInProcessingInstruction = function(c){
+	if(c === ">"){
+		this._cbs.onprocessinginstruction(this._getSection());
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	}
+};
+
+Tokenizer.prototype._stateBeforeComment = function(c){
+	if(c === "-"){
+		this._state = IN_COMMENT;
+		this._sectionStart = this._index + 1;
+	} else {
+		this._state = IN_DECLARATION;
+	}
+};
+
+Tokenizer.prototype._stateInComment = function(c){
+	if(c === "-") this._state = AFTER_COMMENT_1;
+};
+
+Tokenizer.prototype._stateAfterComment1 = function(c){
+	if(c === "-"){
+		this._state = AFTER_COMMENT_2;
+	} else {
+		this._state = IN_COMMENT;
+	}
+};
+
+Tokenizer.prototype._stateAfterComment2 = function(c){
+	if(c === ">"){
+		//remove 2 trailing chars
+		this._cbs.oncomment(this._buffer.substring(this._sectionStart, this._index - 2));
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	} else if(c !== "-"){
+		this._state = IN_COMMENT;
+	}
+	// else: stay in AFTER_COMMENT_2 (`--->`)
+};
+
+Tokenizer.prototype._stateBeforeCdata1 = ifElseState("C", BEFORE_CDATA_2, IN_DECLARATION);
+Tokenizer.prototype._stateBeforeCdata2 = ifElseState("D", BEFORE_CDATA_3, IN_DECLARATION);
+Tokenizer.prototype._stateBeforeCdata3 = ifElseState("A", BEFORE_CDATA_4, IN_DECLARATION);
+Tokenizer.prototype._stateBeforeCdata4 = ifElseState("T", BEFORE_CDATA_5, IN_DECLARATION);
+Tokenizer.prototype._stateBeforeCdata5 = ifElseState("A", BEFORE_CDATA_6, IN_DECLARATION);
+
+Tokenizer.prototype._stateBeforeCdata6 = function(c){
+	if(c === "["){
+		this._state = IN_CDATA;
+		this._sectionStart = this._index + 1;
+	} else {
+		this._state = IN_DECLARATION;
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._stateInCdata = function(c){
+	if(c === "]") this._state = AFTER_CDATA_1;
+};
+
+Tokenizer.prototype._stateAfterCdata1 = characterState("]", AFTER_CDATA_2);
+
+Tokenizer.prototype._stateAfterCdata2 = function(c){
+	if(c === ">"){
+		//remove 2 trailing chars
+		this._cbs.oncdata(this._buffer.substring(this._sectionStart, this._index - 2));
+		this._state = TEXT;
+		this._sectionStart = this._index + 1;
+	} else if(c !== "]") {
+		this._state = IN_CDATA;
+	}
+	//else: stay in AFTER_CDATA_2 (`]]]>`)
+};
+
+Tokenizer.prototype._stateBeforeSpecial = function(c){
+	if(c === "c" || c === "C"){
+		this._state = BEFORE_SCRIPT_1;
+	} else if(c === "t" || c === "T"){
+		this._state = BEFORE_STYLE_1;
+	} else {
+		this._state = IN_TAG_NAME;
+		this._index--; //consume the token again
+	}
+};
+
+Tokenizer.prototype._stateBeforeSpecialEnd = function(c){
+	if(this._special === SPECIAL_SCRIPT && (c === "c" || c === "C")){
+		this._state = AFTER_SCRIPT_1;
+	} else if(this._special === SPECIAL_STYLE && (c === "t" || c === "T")){
+		this._state = AFTER_STYLE_1;
+	}
+	else this._state = TEXT;
+};
+
+Tokenizer.prototype._stateBeforeScript1 = consumeSpecialNameChar("R", BEFORE_SCRIPT_2);
+Tokenizer.prototype._stateBeforeScript2 = consumeSpecialNameChar("I", BEFORE_SCRIPT_3);
+Tokenizer.prototype._stateBeforeScript3 = consumeSpecialNameChar("P", BEFORE_SCRIPT_4);
+Tokenizer.prototype._stateBeforeScript4 = consumeSpecialNameChar("T", BEFORE_SCRIPT_5);
+
+Tokenizer.prototype._stateBeforeScript5 = function(c){
+	if(c === "/" || c === ">" || whitespace(c)){
+		this._special = SPECIAL_SCRIPT;
+	}
+	this._state = IN_TAG_NAME;
+	this._index--; //consume the token again
+};
+
+Tokenizer.prototype._stateAfterScript1 = ifElseState("R", AFTER_SCRIPT_2, TEXT);
+Tokenizer.prototype._stateAfterScript2 = ifElseState("I", AFTER_SCRIPT_3, TEXT);
+Tokenizer.prototype._stateAfterScript3 = ifElseState("P", AFTER_SCRIPT_4, TEXT);
+Tokenizer.prototype._stateAfterScript4 = ifElseState("T", AFTER_SCRIPT_5, TEXT);
+
+Tokenizer.prototype._stateAfterScript5 = function(c){
+	if(c === ">" || whitespace(c)){
+		this._special = SPECIAL_NONE;
+		this._state = IN_CLOSING_TAG_NAME;
+		this._sectionStart = this._index - 6;
+		this._index--; //reconsume the token
+	}
+	else this._state = TEXT;
+};
+
+Tokenizer.prototype._stateBeforeStyle1 = consumeSpecialNameChar("Y", BEFORE_STYLE_2);
+Tokenizer.prototype._stateBeforeStyle2 = consumeSpecialNameChar("L", BEFORE_STYLE_3);
+Tokenizer.prototype._stateBeforeStyle3 = consumeSpecialNameChar("E", BEFORE_STYLE_4);
+
+Tokenizer.prototype._stateBeforeStyle4 = function(c){
+	if(c === "/" || c === ">" || whitespace(c)){
+		this._special = SPECIAL_STYLE;
+	}
+	this._state = IN_TAG_NAME;
+	this._index--; //consume the token again
+};
+
+Tokenizer.prototype._stateAfterStyle1 = ifElseState("Y", AFTER_STYLE_2, TEXT);
+Tokenizer.prototype._stateAfterStyle2 = ifElseState("L", AFTER_STYLE_3, TEXT);
+Tokenizer.prototype._stateAfterStyle3 = ifElseState("E", AFTER_STYLE_4, TEXT);
+
+Tokenizer.prototype._stateAfterStyle4 = function(c){
+	if(c === ">" || whitespace(c)){
+		this._special = SPECIAL_NONE;
+		this._state = IN_CLOSING_TAG_NAME;
+		this._sectionStart = this._index - 5;
+		this._index--; //reconsume the token
+	}
+	else this._state = TEXT;
+};
+
+Tokenizer.prototype._stateBeforeEntity = ifElseState("#", BEFORE_NUMERIC_ENTITY, IN_NAMED_ENTITY);
+Tokenizer.prototype._stateBeforeNumericEntity = ifElseState("X", IN_HEX_ENTITY, IN_NUMERIC_ENTITY);
+
+//for entities terminated with a semicolon
+Tokenizer.prototype._parseNamedEntityStrict = function(){
+	//offset = 1
+	if(this._sectionStart + 1 < this._index){
+		var entity = this._buffer.substring(this._sectionStart + 1, this._index),
+		    map = this._xmlMode ? xmlMap : entityMap;
+
+		if(map.hasOwnProperty(entity)){
+			this._emitPartial(map[entity]);
+			this._sectionStart = this._index + 1;
+		}
+	}
+};
+
+
+//parses legacy entities (without trailing semicolon)
+Tokenizer.prototype._parseLegacyEntity = function(){
+	var start = this._sectionStart + 1,
+	    limit = this._index - start;
+
+	if(limit > 6) limit = 6; //the max length of legacy entities is 6
+
+	while(limit >= 2){ //the min length of legacy entities is 2
+		var entity = this._buffer.substr(start, limit);
+
+		if(legacyMap.hasOwnProperty(entity)){
+			this._emitPartial(legacyMap[entity]);
+			this._sectionStart += limit + 1;
+			return;
+		} else {
+			limit--;
+		}
+	}
+};
+
+Tokenizer.prototype._stateInNamedEntity = function(c){
+	if(c === ";"){
+		this._parseNamedEntityStrict();
+		if(this._sectionStart + 1 < this._index && !this._xmlMode){
+			this._parseLegacyEntity();
+		}
+		this._state = this._baseState;
+	} else if((c < "a" || c > "z") && (c < "A" || c > "Z") && (c < "0" || c > "9")){
+		if(this._xmlMode);
+		else if(this._sectionStart + 1 === this._index);
+		else if(this._baseState !== TEXT){
+			if(c !== "="){
+				this._parseNamedEntityStrict();
+			}
+		} else {
+			this._parseLegacyEntity();
+		}
+
+		this._state = this._baseState;
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._decodeNumericEntity = function(offset, base){
+	var sectionStart = this._sectionStart + offset;
+
+	if(sectionStart !== this._index){
+		//parse entity
+		var entity = this._buffer.substring(sectionStart, this._index);
+		var parsed = parseInt(entity, base);
+
+		this._emitPartial(decodeCodePoint(parsed));
+		this._sectionStart = this._index;
+	} else {
+		this._sectionStart--;
+	}
+
+	this._state = this._baseState;
+};
+
+Tokenizer.prototype._stateInNumericEntity = function(c){
+	if(c === ";"){
+		this._decodeNumericEntity(2, 10);
+		this._sectionStart++;
+	} else if(c < "0" || c > "9"){
+		if(!this._xmlMode){
+			this._decodeNumericEntity(2, 10);
+		} else {
+			this._state = this._baseState;
+		}
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._stateInHexEntity = function(c){
+	if(c === ";"){
+		this._decodeNumericEntity(3, 16);
+		this._sectionStart++;
+	} else if((c < "a" || c > "f") && (c < "A" || c > "F") && (c < "0" || c > "9")){
+		if(!this._xmlMode){
+			this._decodeNumericEntity(3, 16);
+		} else {
+			this._state = this._baseState;
+		}
+		this._index--;
+	}
+};
+
+Tokenizer.prototype._cleanup = function (){
+	if(this._sectionStart < 0){
+		this._buffer = "";
+		this._index = 0;
+		this._bufferOffset += this._index;
+	} else if(this._running){
+		if(this._state === TEXT){
+			if(this._sectionStart !== this._index){
+				this._cbs.ontext(this._buffer.substr(this._sectionStart));
+			}
+			this._buffer = "";
+			this._index = 0;
+			this._bufferOffset += this._index;
+		} else if(this._sectionStart === this._index){
+			//the section just started
+			this._buffer = "";
+			this._index = 0;
+			this._bufferOffset += this._index;
+		} else {
+			//remove everything unnecessary
+			this._buffer = this._buffer.substr(this._sectionStart);
+			this._index -= this._sectionStart;
+			this._bufferOffset += this._sectionStart;
+		}
+
+		this._sectionStart = 0;
+	}
+};
+
+//TODO make events conditional
+Tokenizer.prototype.write = function(chunk){
+	if(this._ended) this._cbs.onerror(Error(".write() after done!"));
+
+	this._buffer += chunk;
+	this._parse();
+};
+
+Tokenizer.prototype._parse = function(){
+	while(this._index < this._buffer.length && this._running){
+		var c = this._buffer.charAt(this._index);
+		if(this._state === TEXT) {
+			this._stateText(c);
+		} else if(this._state === BEFORE_TAG_NAME){
+			this._stateBeforeTagName(c);
+		} else if(this._state === IN_TAG_NAME) {
+			this._stateInTagName(c);
+		} else if(this._state === BEFORE_CLOSING_TAG_NAME){
+			this._stateBeforeCloseingTagName(c);
+		} else if(this._state === IN_CLOSING_TAG_NAME){
+			this._stateInCloseingTagName(c);
+		} else if(this._state === AFTER_CLOSING_TAG_NAME){
+			this._stateAfterCloseingTagName(c);
+		} else if(this._state === IN_SELF_CLOSING_TAG){
+			this._stateInSelfClosingTag(c);
+		}
+
+		/*
+		*	attributes
+		*/
+		else if(this._state === BEFORE_ATTRIBUTE_NAME){
+			this._stateBeforeAttributeName(c);
+		} else if(this._state === IN_ATTRIBUTE_NAME){
+			this._stateInAttributeName(c);
+		} else if(this._state === AFTER_ATTRIBUTE_NAME){
+			this._stateAfterAttributeName(c);
+		} else if(this._state === BEFORE_ATTRIBUTE_VALUE){
+			this._stateBeforeAttributeValue(c);
+		} else if(this._state === IN_ATTRIBUTE_VALUE_DQ){
+			this._stateInAttributeValueDoubleQuotes(c);
+		} else if(this._state === IN_ATTRIBUTE_VALUE_SQ){
+			this._stateInAttributeValueSingleQuotes(c);
+		} else if(this._state === IN_ATTRIBUTE_VALUE_NQ){
+			this._stateInAttributeValueNoQuotes(c);
+		}
+
+		/*
+		*	declarations
+		*/
+		else if(this._state === BEFORE_DECLARATION){
+			this._stateBeforeDeclaration(c);
+		} else if(this._state === IN_DECLARATION){
+			this._stateInDeclaration(c);
+		}
+
+		/*
+		*	processing instructions
+		*/
+		else if(this._state === IN_PROCESSING_INSTRUCTION){
+			this._stateInProcessingInstruction(c);
+		}
+
+		/*
+		*	comments
+		*/
+		else if(this._state === BEFORE_COMMENT){
+			this._stateBeforeComment(c);
+		} else if(this._state === IN_COMMENT){
+			this._stateInComment(c);
+		} else if(this._state === AFTER_COMMENT_1){
+			this._stateAfterComment1(c);
+		} else if(this._state === AFTER_COMMENT_2){
+			this._stateAfterComment2(c);
+		}
+
+		/*
+		*	cdata
+		*/
+		else if(this._state === BEFORE_CDATA_1){
+			this._stateBeforeCdata1(c);
+		} else if(this._state === BEFORE_CDATA_2){
+			this._stateBeforeCdata2(c);
+		} else if(this._state === BEFORE_CDATA_3){
+			this._stateBeforeCdata3(c);
+		} else if(this._state === BEFORE_CDATA_4){
+			this._stateBeforeCdata4(c);
+		} else if(this._state === BEFORE_CDATA_5){
+			this._stateBeforeCdata5(c);
+		} else if(this._state === BEFORE_CDATA_6){
+			this._stateBeforeCdata6(c);
+		} else if(this._state === IN_CDATA){
+			this._stateInCdata(c);
+		} else if(this._state === AFTER_CDATA_1){
+			this._stateAfterCdata1(c);
+		} else if(this._state === AFTER_CDATA_2){
+			this._stateAfterCdata2(c);
+		}
+
+		/*
+		* special tags
+		*/
+		else if(this._state === BEFORE_SPECIAL){
+			this._stateBeforeSpecial(c);
+		} else if(this._state === BEFORE_SPECIAL_END){
+			this._stateBeforeSpecialEnd(c);
+		}
+
+		/*
+		* script
+		*/
+		else if(this._state === BEFORE_SCRIPT_1){
+			this._stateBeforeScript1(c);
+		} else if(this._state === BEFORE_SCRIPT_2){
+			this._stateBeforeScript2(c);
+		} else if(this._state === BEFORE_SCRIPT_3){
+			this._stateBeforeScript3(c);
+		} else if(this._state === BEFORE_SCRIPT_4){
+			this._stateBeforeScript4(c);
+		} else if(this._state === BEFORE_SCRIPT_5){
+			this._stateBeforeScript5(c);
+		}
+
+		else if(this._state === AFTER_SCRIPT_1){
+			this._stateAfterScript1(c);
+		} else if(this._state === AFTER_SCRIPT_2){
+			this._stateAfterScript2(c);
+		} else if(this._state === AFTER_SCRIPT_3){
+			this._stateAfterScript3(c);
+		} else if(this._state === AFTER_SCRIPT_4){
+			this._stateAfterScript4(c);
+		} else if(this._state === AFTER_SCRIPT_5){
+			this._stateAfterScript5(c);
+		}
+
+		/*
+		* style
+		*/
+		else if(this._state === BEFORE_STYLE_1){
+			this._stateBeforeStyle1(c);
+		} else if(this._state === BEFORE_STYLE_2){
+			this._stateBeforeStyle2(c);
+		} else if(this._state === BEFORE_STYLE_3){
+			this._stateBeforeStyle3(c);
+		} else if(this._state === BEFORE_STYLE_4){
+			this._stateBeforeStyle4(c);
+		}
+
+		else if(this._state === AFTER_STYLE_1){
+			this._stateAfterStyle1(c);
+		} else if(this._state === AFTER_STYLE_2){
+			this._stateAfterStyle2(c);
+		} else if(this._state === AFTER_STYLE_3){
+			this._stateAfterStyle3(c);
+		} else if(this._state === AFTER_STYLE_4){
+			this._stateAfterStyle4(c);
+		}
+
+		/*
+		* entities
+		*/
+		else if(this._state === BEFORE_ENTITY){
+			this._stateBeforeEntity(c);
+		} else if(this._state === BEFORE_NUMERIC_ENTITY){
+			this._stateBeforeNumericEntity(c);
+		} else if(this._state === IN_NAMED_ENTITY){
+			this._stateInNamedEntity(c);
+		} else if(this._state === IN_NUMERIC_ENTITY){
+			this._stateInNumericEntity(c);
+		} else if(this._state === IN_HEX_ENTITY){
+			this._stateInHexEntity(c);
+		}
+
+		else {
+			this._cbs.onerror(Error("unknown _state"), this._state);
+		}
+
+		this._index++;
+	}
+
+	this._cleanup();
+};
+
+Tokenizer.prototype.pause = function(){
+	this._running = false;
+};
+Tokenizer.prototype.resume = function(){
+	this._running = true;
+
+	if(this._index < this._buffer.length){
+		this._parse();
+	}
+	if(this._ended){
+		this._finish();
+	}
+};
+
+Tokenizer.prototype.end = function(chunk){
+	if(this._ended) this._cbs.onerror(Error(".end() after done!"));
+	if(chunk) this.write(chunk);
+
+	this._ended = true;
+
+	if(this._running) this._finish();
+};
+
+Tokenizer.prototype._finish = function(){
+	//if there is remaining data, emit it in a reasonable way
+	if(this._sectionStart < this._index){
+		this._handleTrailingData();
+	}
+
+	this._cbs.onend();
+};
+
+Tokenizer.prototype._handleTrailingData = function(){
+	var data = this._buffer.substr(this._sectionStart);
+
+	if(this._state === IN_CDATA || this._state === AFTER_CDATA_1 || this._state === AFTER_CDATA_2){
+		this._cbs.oncdata(data);
+	} else if(this._state === IN_COMMENT || this._state === AFTER_COMMENT_1 || this._state === AFTER_COMMENT_2){
+		this._cbs.oncomment(data);
+	} else if(this._state === IN_NAMED_ENTITY && !this._xmlMode){
+		this._parseLegacyEntity();
+		if(this._sectionStart < this._index){
+			this._state = this._baseState;
+			this._handleTrailingData();
+		}
+	} else if(this._state === IN_NUMERIC_ENTITY && !this._xmlMode){
+		this._decodeNumericEntity(2, 10);
+		if(this._sectionStart < this._index){
+			this._state = this._baseState;
+			this._handleTrailingData();
+		}
+	} else if(this._state === IN_HEX_ENTITY && !this._xmlMode){
+		this._decodeNumericEntity(3, 16);
+		if(this._sectionStart < this._index){
+			this._state = this._baseState;
+			this._handleTrailingData();
+		}
+	} else if(
+		this._state !== IN_TAG_NAME &&
+		this._state !== BEFORE_ATTRIBUTE_NAME &&
+		this._state !== BEFORE_ATTRIBUTE_VALUE &&
+		this._state !== AFTER_ATTRIBUTE_NAME &&
+		this._state !== IN_ATTRIBUTE_NAME &&
+		this._state !== IN_ATTRIBUTE_VALUE_SQ &&
+		this._state !== IN_ATTRIBUTE_VALUE_DQ &&
+		this._state !== IN_ATTRIBUTE_VALUE_NQ &&
+		this._state !== IN_CLOSING_TAG_NAME
+	){
+		this._cbs.ontext(data);
+	}
+	//else, ignore remaining data
+	//TODO add a way to remove current tag
+};
+
+Tokenizer.prototype.reset = function(){
+	Tokenizer.call(this, {xmlMode: this._xmlMode, decodeEntities: this._decodeEntities}, this._cbs);
+};
+
+Tokenizer.prototype.getAbsoluteIndex = function(){
+	return this._bufferOffset + this._index;
+};
+
+Tokenizer.prototype._getSection = function(){
+	return this._buffer.substring(this._sectionStart, this._index);
+};
+
+Tokenizer.prototype._emitToken = function(name){
+	this._cbs[name](this._getSection());
+	this._sectionStart = -1;
+};
+
+Tokenizer.prototype._emitPartial = function(value){
+	if(this._baseState !== TEXT){
+		this._cbs.onattribdata(value); //TODO implement the new event
+	} else {
+		this._cbs.ontext(value);
+	}
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/WritableStream.js

@@ -0,0 +1,21 @@
+module.exports = Stream;
+
+var Parser = require("./Parser.js"),
+    WritableStream = require("stream").Writable || require("readable-stream").Writable;
+
+function Stream(cbs, options){
+	var parser = this._parser = new Parser(cbs, options);
+
+	WritableStream.call(this, {decodeStrings: false});
+
+	this.once("finish", function(){
+		parser.end();
+	});
+}
+
+require("util").inherits(Stream, WritableStream);
+
+WritableStream.prototype._write = function(chunk, encoding, cb){
+	this._parser.write(chunk);
+	cb();
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/lib/index.js

@@ -0,0 +1,68 @@
+var Parser = require("./Parser.js"),
+    DomHandler = require("domhandler");
+
+function defineProp(name, value){
+	delete module.exports[name];
+	module.exports[name] = value;
+	return value;
+}
+
+module.exports = {
+	Parser: Parser,
+	Tokenizer: require("./Tokenizer.js"),
+	ElementType: require("domelementtype"),
+	DomHandler: DomHandler,
+	get FeedHandler(){
+		return defineProp("FeedHandler", require("./FeedHandler.js"));
+	},
+	get Stream(){
+		return defineProp("Stream", require("./Stream.js"));
+	},
+	get WritableStream(){
+		return defineProp("WritableStream", require("./WritableStream.js"));
+	},
+	get ProxyHandler(){
+		return defineProp("ProxyHandler", require("./ProxyHandler.js"));
+	},
+	get DomUtils(){
+		return defineProp("DomUtils", require("domutils"));
+	},
+	get CollectingHandler(){
+		return defineProp("CollectingHandler", require("./CollectingHandler.js"));
+	},
+	// For legacy support
+	DefaultHandler: DomHandler,
+	get RssHandler(){
+		return defineProp("RssHandler", this.FeedHandler);
+	},
+	//helper methods
+	parseDOM: function(data, options){
+		var handler = new DomHandler(options);
+		new Parser(handler, options).end(data);
+		return handler.dom;
+	},
+	parseFeed: function(feed, options){
+		var handler = new module.exports.FeedHandler(options);
+		new Parser(handler, options).end(feed);
+		return handler.dom;
+	},
+	createDomStream: function(cb, options, elementCb){
+		var handler = new DomHandler(cb, options, elementCb);
+		return new Parser(handler, options);
+	},
+	// List of all events that the parser emits
+	EVENTS: { /* Format: eventname: number of arguments */
+		attribute: 2,
+		cdatastart: 0,
+		cdataend: 0,
+		text: 1,
+		processinginstruction: 2,
+		comment: 1,
+		commentend: 0,
+		closetag: 1,
+		opentag: 2,
+		opentagname: 1,
+		error: 1,
+		end: 0
+	}
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/.npmignore

@@ -0,0 +1,5 @@
+build/
+test/
+examples/
+fs.js
+zlib.js

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/LICENSE

@@ -0,0 +1,18 @@
+Copyright Joyent, Inc. and other Node contributors. All rights reserved.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to
+deal in the Software without restriction, including without limitation the
+rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+IN THE SOFTWARE.

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/README.md

@@ -0,0 +1,15 @@
+# readable-stream
+
+***Node-core streams for userland***
+
+[![NPM](https://nodei.co/npm/readable-stream.png?downloads=true&downloadRank=true)](https://nodei.co/npm/readable-stream/)
+[![NPM](https://nodei.co/npm-dl/readable-stream.png&months=6&height=3)](https://nodei.co/npm/readable-stream/)
+
+This package is a mirror of the Streams2 and Streams3 implementations in Node-core.
+
+If you want to guarantee a stable streams base, regardless of what version of Node you, or the users of your libraries are using, use **readable-stream** *only* and avoid the *"stream"* module in Node-core.
+
+**readable-stream** comes in two major versions, v1.0.x and v1.1.x. The former tracks the Streams2 implementation in Node 0.10, including bug-fixes and minor improvements as they are added. The latter tracks Streams3 as it develops in Node 0.11; we will likely see a v1.2.x branch for Node 0.12.
+
+**readable-stream** uses proper patch-level versioning so if you pin to `"~1.0.0"` you’ll get the latest Node 0.10 Streams2 implementation, including any fixes and minor non-breaking improvements. The patch-level versions of 1.0.x and 1.1.x should mirror the patch-level versions of Node-core releases. You should prefer the **1.0.x** releases for now and when you’re ready to start using Streams3, pin to `"~1.1.0"`
+

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/duplex.js

@@ -0,0 +1 @@
+module.exports = require("./lib/_stream_duplex.js")

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/float.patch

@@ -0,0 +1,923 @@
+diff --git a/lib/_stream_duplex.js b/lib/_stream_duplex.js
+index c5a741c..a2e0d8e 100644
+--- a/lib/_stream_duplex.js
++++ b/lib/_stream_duplex.js
+@@ -26,8 +26,8 @@
+ 
+ module.exports = Duplex;
+ var util = require('util');
+-var Readable = require('_stream_readable');
+-var Writable = require('_stream_writable');
++var Readable = require('./_stream_readable');
++var Writable = require('./_stream_writable');
+ 
+ util.inherits(Duplex, Readable);
+ 
+diff --git a/lib/_stream_passthrough.js b/lib/_stream_passthrough.js
+index a5e9864..330c247 100644
+--- a/lib/_stream_passthrough.js
++++ b/lib/_stream_passthrough.js
+@@ -25,7 +25,7 @@
+ 
+ module.exports = PassThrough;
+ 
+-var Transform = require('_stream_transform');
++var Transform = require('./_stream_transform');
+ var util = require('util');
+ util.inherits(PassThrough, Transform);
+ 
+diff --git a/lib/_stream_readable.js b/lib/_stream_readable.js
+index 0c3fe3e..90a8298 100644
+--- a/lib/_stream_readable.js
++++ b/lib/_stream_readable.js
+@@ -23,10 +23,34 @@ module.exports = Readable;
+ Readable.ReadableState = ReadableState;
+ 
+ var EE = require('events').EventEmitter;
++if (!EE.listenerCount) EE.listenerCount = function(emitter, type) {
++  return emitter.listeners(type).length;
++};
++
++if (!global.setImmediate) global.setImmediate = function setImmediate(fn) {
++  return setTimeout(fn, 0);
++};
++if (!global.clearImmediate) global.clearImmediate = function clearImmediate(i) {
++  return clearTimeout(i);
++};
++
+ var Stream = require('stream');
+ var util = require('util');
++if (!util.isUndefined) {
++  var utilIs = require('core-util-is');
++  for (var f in utilIs) {
++    util[f] = utilIs[f];
++  }
++}
+ var StringDecoder;
+-var debug = util.debuglog('stream');
++var debug;
++if (util.debuglog)
++  debug = util.debuglog('stream');
++else try {
++  debug = require('debuglog')('stream');
++} catch (er) {
++  debug = function() {};
++}
+ 
+ util.inherits(Readable, Stream);
+ 
+@@ -380,7 +404,7 @@ function chunkInvalid(state, chunk) {
+ 
+ 
+ function onEofChunk(stream, state) {
+-  if (state.decoder && !state.ended) {
++  if (state.decoder && !state.ended && state.decoder.end) {
+     var chunk = state.decoder.end();
+     if (chunk && chunk.length) {
+       state.buffer.push(chunk);
+diff --git a/lib/_stream_transform.js b/lib/_stream_transform.js
+index b1f9fcc..b0caf57 100644
+--- a/lib/_stream_transform.js
++++ b/lib/_stream_transform.js
+@@ -64,8 +64,14 @@
+ 
+ module.exports = Transform;
+ 
+-var Duplex = require('_stream_duplex');
++var Duplex = require('./_stream_duplex');
+ var util = require('util');
++if (!util.isUndefined) {
++  var utilIs = require('core-util-is');
++  for (var f in utilIs) {
++    util[f] = utilIs[f];
++  }
++}
+ util.inherits(Transform, Duplex);
+ 
+ 
+diff --git a/lib/_stream_writable.js b/lib/_stream_writable.js
+index ba2e920..f49288b 100644
+--- a/lib/_stream_writable.js
++++ b/lib/_stream_writable.js
+@@ -27,6 +27,12 @@ module.exports = Writable;
+ Writable.WritableState = WritableState;
+ 
+ var util = require('util');
++if (!util.isUndefined) {
++  var utilIs = require('core-util-is');
++  for (var f in utilIs) {
++    util[f] = utilIs[f];
++  }
++}
+ var Stream = require('stream');
+ 
+ util.inherits(Writable, Stream);
+@@ -119,7 +125,7 @@ function WritableState(options, stream) {
+ function Writable(options) {
+   // Writable ctor is applied to Duplexes, though they're not
+   // instanceof Writable, they're instanceof Readable.
+-  if (!(this instanceof Writable) && !(this instanceof Stream.Duplex))
++  if (!(this instanceof Writable) && !(this instanceof require('./_stream_duplex')))
+     return new Writable(options);
+ 
+   this._writableState = new WritableState(options, this);
+diff --git a/test/simple/test-stream-big-push.js b/test/simple/test-stream-big-push.js
+index e3787e4..8cd2127 100644
+--- a/test/simple/test-stream-big-push.js
++++ b/test/simple/test-stream-big-push.js
+@@ -21,7 +21,7 @@
+ 
+ var common = require('../common');
+ var assert = require('assert');
+-var stream = require('stream');
++var stream = require('../../');
+ var str = 'asdfasdfasdfasdfasdf';
+ 
+ var r = new stream.Readable({
+diff --git a/test/simple/test-stream-end-paused.js b/test/simple/test-stream-end-paused.js
+index bb73777..d40efc7 100644
+--- a/test/simple/test-stream-end-paused.js
++++ b/test/simple/test-stream-end-paused.js
+@@ -25,7 +25,7 @@ var gotEnd = false;
+ 
+ // Make sure we don't miss the end event for paused 0-length streams
+ 
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ var stream = new Readable();
+ var calledRead = false;
+ stream._read = function() {
+diff --git a/test/simple/test-stream-pipe-after-end.js b/test/simple/test-stream-pipe-after-end.js
+index b46ee90..0be8366 100644
+--- a/test/simple/test-stream-pipe-after-end.js
++++ b/test/simple/test-stream-pipe-after-end.js
+@@ -22,8 +22,8 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Readable = require('_stream_readable');
+-var Writable = require('_stream_writable');
++var Readable = require('../../lib/_stream_readable');
++var Writable = require('../../lib/_stream_writable');
+ var util = require('util');
+ 
+ util.inherits(TestReadable, Readable);
+diff --git a/test/simple/test-stream-pipe-cleanup.js b/test/simple/test-stream-pipe-cleanup.js
+deleted file mode 100644
+index f689358..0000000
+--- a/test/simple/test-stream-pipe-cleanup.js
++++ /dev/null
+@@ -1,122 +0,0 @@
+-// Copyright Joyent, Inc. and other Node contributors.
+-//
+-// Permission is hereby granted, free of charge, to any person obtaining a
+-// copy of this software and associated documentation files (the
+-// "Software"), to deal in the Software without restriction, including
+-// without limitation the rights to use, copy, modify, merge, publish,
+-// distribute, sublicense, and/or sell copies of the Software, and to permit
+-// persons to whom the Software is furnished to do so, subject to the
+-// following conditions:
+-//
+-// The above copyright notice and this permission notice shall be included
+-// in all copies or substantial portions of the Software.
+-//
+-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+-// USE OR OTHER DEALINGS IN THE SOFTWARE.
+-
+-// This test asserts that Stream.prototype.pipe does not leave listeners
+-// hanging on the source or dest.
+-
+-var common = require('../common');
+-var stream = require('stream');
+-var assert = require('assert');
+-var util = require('util');
+-
+-function Writable() {
+-  this.writable = true;
+-  this.endCalls = 0;
+-  stream.Stream.call(this);
+-}
+-util.inherits(Writable, stream.Stream);
+-Writable.prototype.end = function() {
+-  this.endCalls++;
+-};
+-
+-Writable.prototype.destroy = function() {
+-  this.endCalls++;
+-};
+-
+-function Readable() {
+-  this.readable = true;
+-  stream.Stream.call(this);
+-}
+-util.inherits(Readable, stream.Stream);
+-
+-function Duplex() {
+-  this.readable = true;
+-  Writable.call(this);
+-}
+-util.inherits(Duplex, Writable);
+-
+-var i = 0;
+-var limit = 100;
+-
+-var w = new Writable();
+-
+-var r;
+-
+-for (i = 0; i < limit; i++) {
+-  r = new Readable();
+-  r.pipe(w);
+-  r.emit('end');
+-}
+-assert.equal(0, r.listeners('end').length);
+-assert.equal(limit, w.endCalls);
+-
+-w.endCalls = 0;
+-
+-for (i = 0; i < limit; i++) {
+-  r = new Readable();
+-  r.pipe(w);
+-  r.emit('close');
+-}
+-assert.equal(0, r.listeners('close').length);
+-assert.equal(limit, w.endCalls);
+-
+-w.endCalls = 0;
+-
+-r = new Readable();
+-
+-for (i = 0; i < limit; i++) {
+-  w = new Writable();
+-  r.pipe(w);
+-  w.emit('close');
+-}
+-assert.equal(0, w.listeners('close').length);
+-
+-r = new Readable();
+-w = new Writable();
+-var d = new Duplex();
+-r.pipe(d); // pipeline A
+-d.pipe(w); // pipeline B
+-assert.equal(r.listeners('end').length, 2);   // A.onend, A.cleanup
+-assert.equal(r.listeners('close').length, 2); // A.onclose, A.cleanup
+-assert.equal(d.listeners('end').length, 2);   // B.onend, B.cleanup
+-assert.equal(d.listeners('close').length, 3); // A.cleanup, B.onclose, B.cleanup
+-assert.equal(w.listeners('end').length, 0);
+-assert.equal(w.listeners('close').length, 1); // B.cleanup
+-
+-r.emit('end');
+-assert.equal(d.endCalls, 1);
+-assert.equal(w.endCalls, 0);
+-assert.equal(r.listeners('end').length, 0);
+-assert.equal(r.listeners('close').length, 0);
+-assert.equal(d.listeners('end').length, 2);   // B.onend, B.cleanup
+-assert.equal(d.listeners('close').length, 2); // B.onclose, B.cleanup
+-assert.equal(w.listeners('end').length, 0);
+-assert.equal(w.listeners('close').length, 1); // B.cleanup
+-
+-d.emit('end');
+-assert.equal(d.endCalls, 1);
+-assert.equal(w.endCalls, 1);
+-assert.equal(r.listeners('end').length, 0);
+-assert.equal(r.listeners('close').length, 0);
+-assert.equal(d.listeners('end').length, 0);
+-assert.equal(d.listeners('close').length, 0);
+-assert.equal(w.listeners('end').length, 0);
+-assert.equal(w.listeners('close').length, 0);
+diff --git a/test/simple/test-stream-pipe-error-handling.js b/test/simple/test-stream-pipe-error-handling.js
+index c5d724b..c7d6b7d 100644
+--- a/test/simple/test-stream-pipe-error-handling.js
++++ b/test/simple/test-stream-pipe-error-handling.js
+@@ -21,7 +21,7 @@
+ 
+ var common = require('../common');
+ var assert = require('assert');
+-var Stream = require('stream').Stream;
++var Stream = require('../../').Stream;
+ 
+ (function testErrorListenerCatches() {
+   var source = new Stream();
+diff --git a/test/simple/test-stream-pipe-event.js b/test/simple/test-stream-pipe-event.js
+index cb9d5fe..56f8d61 100644
+--- a/test/simple/test-stream-pipe-event.js
++++ b/test/simple/test-stream-pipe-event.js
+@@ -20,7 +20,7 @@
+ // USE OR OTHER DEALINGS IN THE SOFTWARE.
+ 
+ var common = require('../common');
+-var stream = require('stream');
++var stream = require('../../');
+ var assert = require('assert');
+ var util = require('util');
+ 
+diff --git a/test/simple/test-stream-push-order.js b/test/simple/test-stream-push-order.js
+index f2e6ec2..a5c9bf9 100644
+--- a/test/simple/test-stream-push-order.js
++++ b/test/simple/test-stream-push-order.js
+@@ -20,7 +20,7 @@
+ // USE OR OTHER DEALINGS IN THE SOFTWARE.
+ 
+ var common = require('../common.js');
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ var assert = require('assert');
+ 
+ var s = new Readable({
+diff --git a/test/simple/test-stream-push-strings.js b/test/simple/test-stream-push-strings.js
+index 06f43dc..1701a9a 100644
+--- a/test/simple/test-stream-push-strings.js
++++ b/test/simple/test-stream-push-strings.js
+@@ -22,7 +22,7 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ var util = require('util');
+ 
+ util.inherits(MyStream, Readable);
+diff --git a/test/simple/test-stream-readable-event.js b/test/simple/test-stream-readable-event.js
+index ba6a577..a8e6f7b 100644
+--- a/test/simple/test-stream-readable-event.js
++++ b/test/simple/test-stream-readable-event.js
+@@ -22,7 +22,7 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ 
+ (function first() {
+   // First test, not reading when the readable is added.
+diff --git a/test/simple/test-stream-readable-flow-recursion.js b/test/simple/test-stream-readable-flow-recursion.js
+index 2891ad6..11689ba 100644
+--- a/test/simple/test-stream-readable-flow-recursion.js
++++ b/test/simple/test-stream-readable-flow-recursion.js
+@@ -27,7 +27,7 @@ var assert = require('assert');
+ // more data continuously, but without triggering a nextTick
+ // warning or RangeError.
+ 
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ 
+ // throw an error if we trigger a nextTick warning.
+ process.throwDeprecation = true;
+diff --git a/test/simple/test-stream-unshift-empty-chunk.js b/test/simple/test-stream-unshift-empty-chunk.js
+index 0c96476..7827538 100644
+--- a/test/simple/test-stream-unshift-empty-chunk.js
++++ b/test/simple/test-stream-unshift-empty-chunk.js
+@@ -24,7 +24,7 @@ var assert = require('assert');
+ 
+ // This test verifies that stream.unshift(Buffer(0)) or 
+ // stream.unshift('') does not set state.reading=false.
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ 
+ var r = new Readable();
+ var nChunks = 10;
+diff --git a/test/simple/test-stream-unshift-read-race.js b/test/simple/test-stream-unshift-read-race.js
+index 83fd9fa..17c18aa 100644
+--- a/test/simple/test-stream-unshift-read-race.js
++++ b/test/simple/test-stream-unshift-read-race.js
+@@ -29,7 +29,7 @@ var assert = require('assert');
+ // 3. push() after the EOF signaling null is an error.
+ // 4. _read() is not called after pushing the EOF null chunk.
+ 
+-var stream = require('stream');
++var stream = require('../../');
+ var hwm = 10;
+ var r = stream.Readable({ highWaterMark: hwm });
+ var chunks = 10;
+@@ -51,7 +51,14 @@ r._read = function(n) {
+ 
+   function push(fast) {
+     assert(!pushedNull, 'push() after null push');
+-    var c = pos >= data.length ? null : data.slice(pos, pos + n);
++    var c;
++    if (pos >= data.length)
++      c = null;
++    else {
++      if (n + pos > data.length)
++        n = data.length - pos;
++      c = data.slice(pos, pos + n);
++    }
+     pushedNull = c === null;
+     if (fast) {
+       pos += n;
+diff --git a/test/simple/test-stream-writev.js b/test/simple/test-stream-writev.js
+index 5b49e6e..b5321f3 100644
+--- a/test/simple/test-stream-writev.js
++++ b/test/simple/test-stream-writev.js
+@@ -22,7 +22,7 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var stream = require('stream');
++var stream = require('../../');
+ 
+ var queue = [];
+ for (var decode = 0; decode < 2; decode++) {
+diff --git a/test/simple/test-stream2-basic.js b/test/simple/test-stream2-basic.js
+index 3814bf0..248c1be 100644
+--- a/test/simple/test-stream2-basic.js
++++ b/test/simple/test-stream2-basic.js
+@@ -21,7 +21,7 @@
+ 
+ 
+ var common = require('../common.js');
+-var R = require('_stream_readable');
++var R = require('../../lib/_stream_readable');
+ var assert = require('assert');
+ 
+ var util = require('util');
+diff --git a/test/simple/test-stream2-compatibility.js b/test/simple/test-stream2-compatibility.js
+index 6cdd4e9..f0fa84b 100644
+--- a/test/simple/test-stream2-compatibility.js
++++ b/test/simple/test-stream2-compatibility.js
+@@ -21,7 +21,7 @@
+ 
+ 
+ var common = require('../common.js');
+-var R = require('_stream_readable');
++var R = require('../../lib/_stream_readable');
+ var assert = require('assert');
+ 
+ var util = require('util');
+diff --git a/test/simple/test-stream2-finish-pipe.js b/test/simple/test-stream2-finish-pipe.js
+index 39b274f..006a19b 100644
+--- a/test/simple/test-stream2-finish-pipe.js
++++ b/test/simple/test-stream2-finish-pipe.js
+@@ -20,7 +20,7 @@
+ // USE OR OTHER DEALINGS IN THE SOFTWARE.
+ 
+ var common = require('../common.js');
+-var stream = require('stream');
++var stream = require('../../');
+ var Buffer = require('buffer').Buffer;
+ 
+ var r = new stream.Readable();
+diff --git a/test/simple/test-stream2-fs.js b/test/simple/test-stream2-fs.js
+deleted file mode 100644
+index e162406..0000000
+--- a/test/simple/test-stream2-fs.js
++++ /dev/null
+@@ -1,72 +0,0 @@
+-// Copyright Joyent, Inc. and other Node contributors.
+-//
+-// Permission is hereby granted, free of charge, to any person obtaining a
+-// copy of this software and associated documentation files (the
+-// "Software"), to deal in the Software without restriction, including
+-// without limitation the rights to use, copy, modify, merge, publish,
+-// distribute, sublicense, and/or sell copies of the Software, and to permit
+-// persons to whom the Software is furnished to do so, subject to the
+-// following conditions:
+-//
+-// The above copyright notice and this permission notice shall be included
+-// in all copies or substantial portions of the Software.
+-//
+-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+-// USE OR OTHER DEALINGS IN THE SOFTWARE.
+-
+-
+-var common = require('../common.js');
+-var R = require('_stream_readable');
+-var assert = require('assert');
+-
+-var fs = require('fs');
+-var FSReadable = fs.ReadStream;
+-
+-var path = require('path');
+-var file = path.resolve(common.fixturesDir, 'x1024.txt');
+-
+-var size = fs.statSync(file).size;
+-
+-var expectLengths = [1024];
+-
+-var util = require('util');
+-var Stream = require('stream');
+-
+-util.inherits(TestWriter, Stream);
+-
+-function TestWriter() {
+-  Stream.apply(this);
+-  this.buffer = [];
+-  this.length = 0;
+-}
+-
+-TestWriter.prototype.write = function(c) {
+-  this.buffer.push(c.toString());
+-  this.length += c.length;
+-  return true;
+-};
+-
+-TestWriter.prototype.end = function(c) {
+-  if (c) this.buffer.push(c.toString());
+-  this.emit('results', this.buffer);
+-}
+-
+-var r = new FSReadable(file);
+-var w = new TestWriter();
+-
+-w.on('results', function(res) {
+-  console.error(res, w.length);
+-  assert.equal(w.length, size);
+-  var l = 0;
+-  assert.deepEqual(res.map(function (c) {
+-    return c.length;
+-  }), expectLengths);
+-  console.log('ok');
+-});
+-
+-r.pipe(w);
+diff --git a/test/simple/test-stream2-httpclient-response-end.js b/test/simple/test-stream2-httpclient-response-end.js
+deleted file mode 100644
+index 15cffc2..0000000
+--- a/test/simple/test-stream2-httpclient-response-end.js
++++ /dev/null
+@@ -1,52 +0,0 @@
+-// Copyright Joyent, Inc. and other Node contributors.
+-//
+-// Permission is hereby granted, free of charge, to any person obtaining a
+-// copy of this software and associated documentation files (the
+-// "Software"), to deal in the Software without restriction, including
+-// without limitation the rights to use, copy, modify, merge, publish,
+-// distribute, sublicense, and/or sell copies of the Software, and to permit
+-// persons to whom the Software is furnished to do so, subject to the
+-// following conditions:
+-//
+-// The above copyright notice and this permission notice shall be included
+-// in all copies or substantial portions of the Software.
+-//
+-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+-// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+-// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+-// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+-// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+-// USE OR OTHER DEALINGS IN THE SOFTWARE.
+-
+-var common = require('../common.js');
+-var assert = require('assert');
+-var http = require('http');
+-var msg = 'Hello';
+-var readable_event = false;
+-var end_event = false;
+-var server = http.createServer(function(req, res) {
+-  res.writeHead(200, {'Content-Type': 'text/plain'});
+-  res.end(msg);
+-}).listen(common.PORT, function() {
+-  http.get({port: common.PORT}, function(res) {
+-    var data = '';
+-    res.on('readable', function() {
+-      console.log('readable event');
+-      readable_event = true;
+-      data += res.read();
+-    });
+-    res.on('end', function() {
+-      console.log('end event');
+-      end_event = true;
+-      assert.strictEqual(msg, data);
+-      server.close();
+-    });
+-  });
+-});
+-
+-process.on('exit', function() {
+-  assert(readable_event);
+-  assert(end_event);
+-});
+-
+diff --git a/test/simple/test-stream2-large-read-stall.js b/test/simple/test-stream2-large-read-stall.js
+index 2fbfbca..667985b 100644
+--- a/test/simple/test-stream2-large-read-stall.js
++++ b/test/simple/test-stream2-large-read-stall.js
+@@ -30,7 +30,7 @@ var PUSHSIZE = 20;
+ var PUSHCOUNT = 1000;
+ var HWM = 50;
+ 
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ var r = new Readable({
+   highWaterMark: HWM
+ });
+@@ -39,23 +39,23 @@ var rs = r._readableState;
+ r._read = push;
+ 
+ r.on('readable', function() {
+-  console.error('>> readable');
++  //console.error('>> readable');
+   do {
+-    console.error('  > read(%d)', READSIZE);
++    //console.error('  > read(%d)', READSIZE);
+     var ret = r.read(READSIZE);
+-    console.error('  < %j (%d remain)', ret && ret.length, rs.length);
++    //console.error('  < %j (%d remain)', ret && ret.length, rs.length);
+   } while (ret && ret.length === READSIZE);
+ 
+-  console.error('<< after read()',
+-                ret && ret.length,
+-                rs.needReadable,
+-                rs.length);
++  //console.error('<< after read()',
++  //              ret && ret.length,
++  //              rs.needReadable,
++  //              rs.length);
+ });
+ 
+ var endEmitted = false;
+ r.on('end', function() {
+   endEmitted = true;
+-  console.error('end');
++  //console.error('end');
+ });
+ 
+ var pushes = 0;
+@@ -64,11 +64,11 @@ function push() {
+     return;
+ 
+   if (pushes++ === PUSHCOUNT) {
+-    console.error('   push(EOF)');
++    //console.error('   push(EOF)');
+     return r.push(null);
+   }
+ 
+-  console.error('   push #%d', pushes);
++  //console.error('   push #%d', pushes);
+   if (r.push(new Buffer(PUSHSIZE)))
+     setTimeout(push);
+ }
+diff --git a/test/simple/test-stream2-objects.js b/test/simple/test-stream2-objects.js
+index 3e6931d..ff47d89 100644
+--- a/test/simple/test-stream2-objects.js
++++ b/test/simple/test-stream2-objects.js
+@@ -21,8 +21,8 @@
+ 
+ 
+ var common = require('../common.js');
+-var Readable = require('_stream_readable');
+-var Writable = require('_stream_writable');
++var Readable = require('../../lib/_stream_readable');
++var Writable = require('../../lib/_stream_writable');
+ var assert = require('assert');
+ 
+ // tiny node-tap lookalike.
+diff --git a/test/simple/test-stream2-pipe-error-handling.js b/test/simple/test-stream2-pipe-error-handling.js
+index cf7531c..e3f3e4e 100644
+--- a/test/simple/test-stream2-pipe-error-handling.js
++++ b/test/simple/test-stream2-pipe-error-handling.js
+@@ -21,7 +21,7 @@
+ 
+ var common = require('../common');
+ var assert = require('assert');
+-var stream = require('stream');
++var stream = require('../../');
+ 
+ (function testErrorListenerCatches() {
+   var count = 1000;
+diff --git a/test/simple/test-stream2-pipe-error-once-listener.js b/test/simple/test-stream2-pipe-error-once-listener.js
+index 5e8e3cb..53b2616 100755
+--- a/test/simple/test-stream2-pipe-error-once-listener.js
++++ b/test/simple/test-stream2-pipe-error-once-listener.js
+@@ -24,7 +24,7 @@ var common = require('../common.js');
+ var assert = require('assert');
+ 
+ var util = require('util');
+-var stream = require('stream');
++var stream = require('../../');
+ 
+ 
+ var Read = function() {
+diff --git a/test/simple/test-stream2-push.js b/test/simple/test-stream2-push.js
+index b63edc3..eb2b0e9 100644
+--- a/test/simple/test-stream2-push.js
++++ b/test/simple/test-stream2-push.js
+@@ -20,7 +20,7 @@
+ // USE OR OTHER DEALINGS IN THE SOFTWARE.
+ 
+ var common = require('../common.js');
+-var stream = require('stream');
++var stream = require('../../');
+ var Readable = stream.Readable;
+ var Writable = stream.Writable;
+ var assert = require('assert');
+diff --git a/test/simple/test-stream2-read-sync-stack.js b/test/simple/test-stream2-read-sync-stack.js
+index e8a7305..9740a47 100644
+--- a/test/simple/test-stream2-read-sync-stack.js
++++ b/test/simple/test-stream2-read-sync-stack.js
+@@ -21,7 +21,7 @@
+ 
+ var common = require('../common');
+ var assert = require('assert');
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ var r = new Readable();
+ var N = 256 * 1024;
+ 
+diff --git a/test/simple/test-stream2-readable-empty-buffer-no-eof.js b/test/simple/test-stream2-readable-empty-buffer-no-eof.js
+index cd30178..4b1659d 100644
+--- a/test/simple/test-stream2-readable-empty-buffer-no-eof.js
++++ b/test/simple/test-stream2-readable-empty-buffer-no-eof.js
+@@ -22,10 +22,9 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Readable = require('stream').Readable;
++var Readable = require('../../').Readable;
+ 
+ test1();
+-test2();
+ 
+ function test1() {
+   var r = new Readable();
+@@ -88,31 +87,3 @@ function test1() {
+     console.log('ok');
+   });
+ }
+-
+-function test2() {
+-  var r = new Readable({ encoding: 'base64' });
+-  var reads = 5;
+-  r._read = function(n) {
+-    if (!reads--)
+-      return r.push(null); // EOF
+-    else
+-      return r.push(new Buffer('x'));
+-  };
+-
+-  var results = [];
+-  function flow() {
+-    var chunk;
+-    while (null !== (chunk = r.read()))
+-      results.push(chunk + '');
+-  }
+-  r.on('readable', flow);
+-  r.on('end', function() {
+-    results.push('EOF');
+-  });
+-  flow();
+-
+-  process.on('exit', function() {
+-    assert.deepEqual(results, [ 'eHh4', 'eHg=', 'EOF' ]);
+-    console.log('ok');
+-  });
+-}
+diff --git a/test/simple/test-stream2-readable-from-list.js b/test/simple/test-stream2-readable-from-list.js
+index 7c96ffe..04a96f5 100644
+--- a/test/simple/test-stream2-readable-from-list.js
++++ b/test/simple/test-stream2-readable-from-list.js
+@@ -21,7 +21,7 @@
+ 
+ var assert = require('assert');
+ var common = require('../common.js');
+-var fromList = require('_stream_readable')._fromList;
++var fromList = require('../../lib/_stream_readable')._fromList;
+ 
+ // tiny node-tap lookalike.
+ var tests = [];
+diff --git a/test/simple/test-stream2-readable-legacy-drain.js b/test/simple/test-stream2-readable-legacy-drain.js
+index 675da8e..51fd3d5 100644
+--- a/test/simple/test-stream2-readable-legacy-drain.js
++++ b/test/simple/test-stream2-readable-legacy-drain.js
+@@ -22,7 +22,7 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Stream = require('stream');
++var Stream = require('../../');
+ var Readable = Stream.Readable;
+ 
+ var r = new Readable();
+diff --git a/test/simple/test-stream2-readable-non-empty-end.js b/test/simple/test-stream2-readable-non-empty-end.js
+index 7314ae7..c971898 100644
+--- a/test/simple/test-stream2-readable-non-empty-end.js
++++ b/test/simple/test-stream2-readable-non-empty-end.js
+@@ -21,7 +21,7 @@
+ 
+ var assert = require('assert');
+ var common = require('../common.js');
+-var Readable = require('_stream_readable');
++var Readable = require('../../lib/_stream_readable');
+ 
+ var len = 0;
+ var chunks = new Array(10);
+diff --git a/test/simple/test-stream2-readable-wrap-empty.js b/test/simple/test-stream2-readable-wrap-empty.js
+index 2e5cf25..fd8a3dc 100644
+--- a/test/simple/test-stream2-readable-wrap-empty.js
++++ b/test/simple/test-stream2-readable-wrap-empty.js
+@@ -22,7 +22,7 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Readable = require('_stream_readable');
++var Readable = require('../../lib/_stream_readable');
+ var EE = require('events').EventEmitter;
+ 
+ var oldStream = new EE();
+diff --git a/test/simple/test-stream2-readable-wrap.js b/test/simple/test-stream2-readable-wrap.js
+index 90eea01..6b177f7 100644
+--- a/test/simple/test-stream2-readable-wrap.js
++++ b/test/simple/test-stream2-readable-wrap.js
+@@ -22,8 +22,8 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var Readable = require('_stream_readable');
+-var Writable = require('_stream_writable');
++var Readable = require('../../lib/_stream_readable');
++var Writable = require('../../lib/_stream_writable');
+ var EE = require('events').EventEmitter;
+ 
+ var testRuns = 0, completedRuns = 0;
+diff --git a/test/simple/test-stream2-set-encoding.js b/test/simple/test-stream2-set-encoding.js
+index 5d2c32a..685531b 100644
+--- a/test/simple/test-stream2-set-encoding.js
++++ b/test/simple/test-stream2-set-encoding.js
+@@ -22,7 +22,7 @@
+ 
+ var common = require('../common.js');
+ var assert = require('assert');
+-var R = require('_stream_readable');
++var R = require('../../lib/_stream_readable');
+ var util = require('util');
+ 
+ // tiny node-tap lookalike.
+diff --git a/test/simple/test-stream2-transform.js b/test/simple/test-stream2-transform.js
+index 9c9ddd8..a0cacc6 100644
+--- a/test/simple/test-stream2-transform.js
++++ b/test/simple/test-stream2-transform.js
+@@ -21,8 +21,8 @@
+ 
+ var assert = require('assert');
+ var common = require('../common.js');
+-var PassThrough = require('_stream_passthrough');
+-var Transform = require('_stream_transform');
++var PassThrough = require('../../').PassThrough;
++var Transform = require('../../').Transform;
+ 
+ // tiny node-tap lookalike.
+ var tests = [];
+diff --git a/test/simple/test-stream2-unpipe-drain.js b/test/simple/test-stream2-unpipe-drain.js
+index d66dc3c..365b327 100644
+--- a/test/simple/test-stream2-unpipe-drain.js
++++ b/test/simple/test-stream2-unpipe-drain.js
+@@ -22,7 +22,7 @@
+ 
+ var common = require('../common.js');
+ var assert = require('assert');
+-var stream = require('stream');
++var stream = require('../../');
+ var crypto = require('crypto');
+ 
+ var util = require('util');
+diff --git a/test/simple/test-stream2-unpipe-leak.js b/test/simple/test-stream2-unpipe-leak.js
+index 99f8746..17c92ae 100644
+--- a/test/simple/test-stream2-unpipe-leak.js
++++ b/test/simple/test-stream2-unpipe-leak.js
+@@ -22,7 +22,7 @@
+ 
+ var common = require('../common.js');
+ var assert = require('assert');
+-var stream = require('stream');
++var stream = require('../../');
+ 
+ var chunk = new Buffer('hallo');
+ 
+diff --git a/test/simple/test-stream2-writable.js b/test/simple/test-stream2-writable.js
+index 704100c..209c3a6 100644
+--- a/test/simple/test-stream2-writable.js
++++ b/test/simple/test-stream2-writable.js
+@@ -20,8 +20,8 @@
+ // USE OR OTHER DEALINGS IN THE SOFTWARE.
+ 
+ var common = require('../common.js');
+-var W = require('_stream_writable');
+-var D = require('_stream_duplex');
++var W = require('../../').Writable;
++var D = require('../../').Duplex;
+ var assert = require('assert');
+ 
+ var util = require('util');
+diff --git a/test/simple/test-stream3-pause-then-read.js b/test/simple/test-stream3-pause-then-read.js
+index b91bde3..2f72c15 100644
+--- a/test/simple/test-stream3-pause-then-read.js
++++ b/test/simple/test-stream3-pause-then-read.js
+@@ -22,7 +22,7 @@
+ var common = require('../common');
+ var assert = require('assert');
+ 
+-var stream = require('stream');
++var stream = require('../../');
+ var Readable = stream.Readable;
+ var Writable = stream.Writable;
+ 

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/lib/_stream_duplex.js

@@ -0,0 +1,89 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+// a duplex stream is just a stream that is both readable and writable.
+// Since JS doesn't have multiple prototypal inheritance, this class
+// prototypally inherits from Readable, and then parasitically from
+// Writable.
+
+module.exports = Duplex;
+
+/*<replacement>*/
+var objectKeys = Object.keys || function (obj) {
+  var keys = [];
+  for (var key in obj) keys.push(key);
+  return keys;
+}
+/*</replacement>*/
+
+
+/*<replacement>*/
+var util = require('core-util-is');
+util.inherits = require('inherits');
+/*</replacement>*/
+
+var Readable = require('./_stream_readable');
+var Writable = require('./_stream_writable');
+
+util.inherits(Duplex, Readable);
+
+forEach(objectKeys(Writable.prototype), function(method) {
+  if (!Duplex.prototype[method])
+    Duplex.prototype[method] = Writable.prototype[method];
+});
+
+function Duplex(options) {
+  if (!(this instanceof Duplex))
+    return new Duplex(options);
+
+  Readable.call(this, options);
+  Writable.call(this, options);
+
+  if (options && options.readable === false)
+    this.readable = false;
+
+  if (options && options.writable === false)
+    this.writable = false;
+
+  this.allowHalfOpen = true;
+  if (options && options.allowHalfOpen === false)
+    this.allowHalfOpen = false;
+
+  this.once('end', onend);
+}
+
+// the no-half-open enforcer
+function onend() {
+  // if we allow half-open state, or if the writable side ended,
+  // then we're ok.
+  if (this.allowHalfOpen || this._writableState.ended)
+    return;
+
+  // no more data can be written.
+  // But allow more writes to happen in this tick.
+  process.nextTick(this.end.bind(this));
+}
+
+function forEach (xs, f) {
+  for (var i = 0, l = xs.length; i < l; i++) {
+    f(xs[i], i);
+  }
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/lib/_stream_passthrough.js

@@ -0,0 +1,46 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+// a passthrough stream.
+// basically just the most minimal sort of Transform stream.
+// Every written chunk gets output as-is.
+
+module.exports = PassThrough;
+
+var Transform = require('./_stream_transform');
+
+/*<replacement>*/
+var util = require('core-util-is');
+util.inherits = require('inherits');
+/*</replacement>*/
+
+util.inherits(PassThrough, Transform);
+
+function PassThrough(options) {
+  if (!(this instanceof PassThrough))
+    return new PassThrough(options);
+
+  Transform.call(this, options);
+}
+
+PassThrough.prototype._transform = function(chunk, encoding, cb) {
+  cb(null, chunk);
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/lib/_stream_readable.js

@@ -0,0 +1,951 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+module.exports = Readable;
+
+/*<replacement>*/
+var isArray = require('isarray');
+/*</replacement>*/
+
+
+/*<replacement>*/
+var Buffer = require('buffer').Buffer;
+/*</replacement>*/
+
+Readable.ReadableState = ReadableState;
+
+var EE = require('events').EventEmitter;
+
+/*<replacement>*/
+if (!EE.listenerCount) EE.listenerCount = function(emitter, type) {
+  return emitter.listeners(type).length;
+};
+/*</replacement>*/
+
+var Stream = require('stream');
+
+/*<replacement>*/
+var util = require('core-util-is');
+util.inherits = require('inherits');
+/*</replacement>*/
+
+var StringDecoder;
+
+
+/*<replacement>*/
+var debug = require('util');
+if (debug && debug.debuglog) {
+  debug = debug.debuglog('stream');
+} else {
+  debug = function () {};
+}
+/*</replacement>*/
+
+
+util.inherits(Readable, Stream);
+
+function ReadableState(options, stream) {
+  var Duplex = require('./_stream_duplex');
+
+  options = options || {};
+
+  // the point at which it stops calling _read() to fill the buffer
+  // Note: 0 is a valid value, means "don't call _read preemptively ever"
+  var hwm = options.highWaterMark;
+  var defaultHwm = options.objectMode ? 16 : 16 * 1024;
+  this.highWaterMark = (hwm || hwm === 0) ? hwm : defaultHwm;
+
+  // cast to ints.
+  this.highWaterMark = ~~this.highWaterMark;
+
+  this.buffer = [];
+  this.length = 0;
+  this.pipes = null;
+  this.pipesCount = 0;
+  this.flowing = null;
+  this.ended = false;
+  this.endEmitted = false;
+  this.reading = false;
+
+  // a flag to be able to tell if the onwrite cb is called immediately,
+  // or on a later tick.  We set this to true at first, because any
+  // actions that shouldn't happen until "later" should generally also
+  // not happen before the first write call.
+  this.sync = true;
+
+  // whenever we return null, then we set a flag to say
+  // that we're awaiting a 'readable' event emission.
+  this.needReadable = false;
+  this.emittedReadable = false;
+  this.readableListening = false;
+
+
+  // object stream flag. Used to make read(n) ignore n and to
+  // make all the buffer merging and length checks go away
+  this.objectMode = !!options.objectMode;
+
+  if (stream instanceof Duplex)
+    this.objectMode = this.objectMode || !!options.readableObjectMode;
+
+  // Crypto is kind of old and crusty.  Historically, its default string
+  // encoding is 'binary' so we have to make this configurable.
+  // Everything else in the universe uses 'utf8', though.
+  this.defaultEncoding = options.defaultEncoding || 'utf8';
+
+  // when piping, we only care about 'readable' events that happen
+  // after read()ing all the bytes and not getting any pushback.
+  this.ranOut = false;
+
+  // the number of writers that are awaiting a drain event in .pipe()s
+  this.awaitDrain = 0;
+
+  // if true, a maybeReadMore has been scheduled
+  this.readingMore = false;
+
+  this.decoder = null;
+  this.encoding = null;
+  if (options.encoding) {
+    if (!StringDecoder)
+      StringDecoder = require('string_decoder/').StringDecoder;
+    this.decoder = new StringDecoder(options.encoding);
+    this.encoding = options.encoding;
+  }
+}
+
+function Readable(options) {
+  var Duplex = require('./_stream_duplex');
+
+  if (!(this instanceof Readable))
+    return new Readable(options);
+
+  this._readableState = new ReadableState(options, this);
+
+  // legacy
+  this.readable = true;
+
+  Stream.call(this);
+}
+
+// Manually shove something into the read() buffer.
+// This returns true if the highWaterMark has not been hit yet,
+// similar to how Writable.write() returns true if you should
+// write() some more.
+Readable.prototype.push = function(chunk, encoding) {
+  var state = this._readableState;
+
+  if (util.isString(chunk) && !state.objectMode) {
+    encoding = encoding || state.defaultEncoding;
+    if (encoding !== state.encoding) {
+      chunk = new Buffer(chunk, encoding);
+      encoding = '';
+    }
+  }
+
+  return readableAddChunk(this, state, chunk, encoding, false);
+};
+
+// Unshift should *always* be something directly out of read()
+Readable.prototype.unshift = function(chunk) {
+  var state = this._readableState;
+  return readableAddChunk(this, state, chunk, '', true);
+};
+
+function readableAddChunk(stream, state, chunk, encoding, addToFront) {
+  var er = chunkInvalid(state, chunk);
+  if (er) {
+    stream.emit('error', er);
+  } else if (util.isNullOrUndefined(chunk)) {
+    state.reading = false;
+    if (!state.ended)
+      onEofChunk(stream, state);
+  } else if (state.objectMode || chunk && chunk.length > 0) {
+    if (state.ended && !addToFront) {
+      var e = new Error('stream.push() after EOF');
+      stream.emit('error', e);
+    } else if (state.endEmitted && addToFront) {
+      var e = new Error('stream.unshift() after end event');
+      stream.emit('error', e);
+    } else {
+      if (state.decoder && !addToFront && !encoding)
+        chunk = state.decoder.write(chunk);
+
+      if (!addToFront)
+        state.reading = false;
+
+      // if we want the data now, just emit it.
+      if (state.flowing && state.length === 0 && !state.sync) {
+        stream.emit('data', chunk);
+        stream.read(0);
+      } else {
+        // update the buffer info.
+        state.length += state.objectMode ? 1 : chunk.length;
+        if (addToFront)
+          state.buffer.unshift(chunk);
+        else
+          state.buffer.push(chunk);
+
+        if (state.needReadable)
+          emitReadable(stream);
+      }
+
+      maybeReadMore(stream, state);
+    }
+  } else if (!addToFront) {
+    state.reading = false;
+  }
+
+  return needMoreData(state);
+}
+
+
+
+// if it's past the high water mark, we can push in some more.
+// Also, if we have no data yet, we can stand some
+// more bytes.  This is to work around cases where hwm=0,
+// such as the repl.  Also, if the push() triggered a
+// readable event, and the user called read(largeNumber) such that
+// needReadable was set, then we ought to push more, so that another
+// 'readable' event will be triggered.
+function needMoreData(state) {
+  return !state.ended &&
+         (state.needReadable ||
+          state.length < state.highWaterMark ||
+          state.length === 0);
+}
+
+// backwards compatibility.
+Readable.prototype.setEncoding = function(enc) {
+  if (!StringDecoder)
+    StringDecoder = require('string_decoder/').StringDecoder;
+  this._readableState.decoder = new StringDecoder(enc);
+  this._readableState.encoding = enc;
+  return this;
+};
+
+// Don't raise the hwm > 128MB
+var MAX_HWM = 0x800000;
+function roundUpToNextPowerOf2(n) {
+  if (n >= MAX_HWM) {
+    n = MAX_HWM;
+  } else {
+    // Get the next highest power of 2
+    n--;
+    for (var p = 1; p < 32; p <<= 1) n |= n >> p;
+    n++;
+  }
+  return n;
+}
+
+function howMuchToRead(n, state) {
+  if (state.length === 0 && state.ended)
+    return 0;
+
+  if (state.objectMode)
+    return n === 0 ? 0 : 1;
+
+  if (isNaN(n) || util.isNull(n)) {
+    // only flow one buffer at a time
+    if (state.flowing && state.buffer.length)
+      return state.buffer[0].length;
+    else
+      return state.length;
+  }
+
+  if (n <= 0)
+    return 0;
+
+  // If we're asking for more than the target buffer level,
+  // then raise the water mark.  Bump up to the next highest
+  // power of 2, to prevent increasing it excessively in tiny
+  // amounts.
+  if (n > state.highWaterMark)
+    state.highWaterMark = roundUpToNextPowerOf2(n);
+
+  // don't have that much.  return null, unless we've ended.
+  if (n > state.length) {
+    if (!state.ended) {
+      state.needReadable = true;
+      return 0;
+    } else
+      return state.length;
+  }
+
+  return n;
+}
+
+// you can override either this method, or the async _read(n) below.
+Readable.prototype.read = function(n) {
+  debug('read', n);
+  var state = this._readableState;
+  var nOrig = n;
+
+  if (!util.isNumber(n) || n > 0)
+    state.emittedReadable = false;
+
+  // if we're doing read(0) to trigger a readable event, but we
+  // already have a bunch of data in the buffer, then just trigger
+  // the 'readable' event and move on.
+  if (n === 0 &&
+      state.needReadable &&
+      (state.length >= state.highWaterMark || state.ended)) {
+    debug('read: emitReadable', state.length, state.ended);
+    if (state.length === 0 && state.ended)
+      endReadable(this);
+    else
+      emitReadable(this);
+    return null;
+  }
+
+  n = howMuchToRead(n, state);
+
+  // if we've ended, and we're now clear, then finish it up.
+  if (n === 0 && state.ended) {
+    if (state.length === 0)
+      endReadable(this);
+    return null;
+  }
+
+  // All the actual chunk generation logic needs to be
+  // *below* the call to _read.  The reason is that in certain
+  // synthetic stream cases, such as passthrough streams, _read
+  // may be a completely synchronous operation which may change
+  // the state of the read buffer, providing enough data when
+  // before there was *not* enough.
+  //
+  // So, the steps are:
+  // 1. Figure out what the state of things will be after we do
+  // a read from the buffer.
+  //
+  // 2. If that resulting state will trigger a _read, then call _read.
+  // Note that this may be asynchronous, or synchronous.  Yes, it is
+  // deeply ugly to write APIs this way, but that still doesn't mean
+  // that the Readable class should behave improperly, as streams are
+  // designed to be sync/async agnostic.
+  // Take note if the _read call is sync or async (ie, if the read call
+  // has returned yet), so that we know whether or not it's safe to emit
+  // 'readable' etc.
+  //
+  // 3. Actually pull the requested chunks out of the buffer and return.
+
+  // if we need a readable event, then we need to do some reading.
+  var doRead = state.needReadable;
+  debug('need readable', doRead);
+
+  // if we currently have less than the highWaterMark, then also read some
+  if (state.length === 0 || state.length - n < state.highWaterMark) {
+    doRead = true;
+    debug('length less than watermark', doRead);
+  }
+
+  // however, if we've ended, then there's no point, and if we're already
+  // reading, then it's unnecessary.
+  if (state.ended || state.reading) {
+    doRead = false;
+    debug('reading or ended', doRead);
+  }
+
+  if (doRead) {
+    debug('do read');
+    state.reading = true;
+    state.sync = true;
+    // if the length is currently zero, then we *need* a readable event.
+    if (state.length === 0)
+      state.needReadable = true;
+    // call internal read method
+    this._read(state.highWaterMark);
+    state.sync = false;
+  }
+
+  // If _read pushed data synchronously, then `reading` will be false,
+  // and we need to re-evaluate how much data we can return to the user.
+  if (doRead && !state.reading)
+    n = howMuchToRead(nOrig, state);
+
+  var ret;
+  if (n > 0)
+    ret = fromList(n, state);
+  else
+    ret = null;
+
+  if (util.isNull(ret)) {
+    state.needReadable = true;
+    n = 0;
+  }
+
+  state.length -= n;
+
+  // If we have nothing in the buffer, then we want to know
+  // as soon as we *do* get something into the buffer.
+  if (state.length === 0 && !state.ended)
+    state.needReadable = true;
+
+  // If we tried to read() past the EOF, then emit end on the next tick.
+  if (nOrig !== n && state.ended && state.length === 0)
+    endReadable(this);
+
+  if (!util.isNull(ret))
+    this.emit('data', ret);
+
+  return ret;
+};
+
+function chunkInvalid(state, chunk) {
+  var er = null;
+  if (!util.isBuffer(chunk) &&
+      !util.isString(chunk) &&
+      !util.isNullOrUndefined(chunk) &&
+      !state.objectMode) {
+    er = new TypeError('Invalid non-string/buffer chunk');
+  }
+  return er;
+}
+
+
+function onEofChunk(stream, state) {
+  if (state.decoder && !state.ended) {
+    var chunk = state.decoder.end();
+    if (chunk && chunk.length) {
+      state.buffer.push(chunk);
+      state.length += state.objectMode ? 1 : chunk.length;
+    }
+  }
+  state.ended = true;
+
+  // emit 'readable' now to make sure it gets picked up.
+  emitReadable(stream);
+}
+
+// Don't emit readable right away in sync mode, because this can trigger
+// another read() call => stack overflow.  This way, it might trigger
+// a nextTick recursion warning, but that's not so bad.
+function emitReadable(stream) {
+  var state = stream._readableState;
+  state.needReadable = false;
+  if (!state.emittedReadable) {
+    debug('emitReadable', state.flowing);
+    state.emittedReadable = true;
+    if (state.sync)
+      process.nextTick(function() {
+        emitReadable_(stream);
+      });
+    else
+      emitReadable_(stream);
+  }
+}
+
+function emitReadable_(stream) {
+  debug('emit readable');
+  stream.emit('readable');
+  flow(stream);
+}
+
+
+// at this point, the user has presumably seen the 'readable' event,
+// and called read() to consume some data.  that may have triggered
+// in turn another _read(n) call, in which case reading = true if
+// it's in progress.
+// However, if we're not ended, or reading, and the length < hwm,
+// then go ahead and try to read some more preemptively.
+function maybeReadMore(stream, state) {
+  if (!state.readingMore) {
+    state.readingMore = true;
+    process.nextTick(function() {
+      maybeReadMore_(stream, state);
+    });
+  }
+}
+
+function maybeReadMore_(stream, state) {
+  var len = state.length;
+  while (!state.reading && !state.flowing && !state.ended &&
+         state.length < state.highWaterMark) {
+    debug('maybeReadMore read 0');
+    stream.read(0);
+    if (len === state.length)
+      // didn't get any data, stop spinning.
+      break;
+    else
+      len = state.length;
+  }
+  state.readingMore = false;
+}
+
+// abstract method.  to be overridden in specific implementation classes.
+// call cb(er, data) where data is <= n in length.
+// for virtual (non-string, non-buffer) streams, "length" is somewhat
+// arbitrary, and perhaps not very meaningful.
+Readable.prototype._read = function(n) {
+  this.emit('error', new Error('not implemented'));
+};
+
+Readable.prototype.pipe = function(dest, pipeOpts) {
+  var src = this;
+  var state = this._readableState;
+
+  switch (state.pipesCount) {
+    case 0:
+      state.pipes = dest;
+      break;
+    case 1:
+      state.pipes = [state.pipes, dest];
+      break;
+    default:
+      state.pipes.push(dest);
+      break;
+  }
+  state.pipesCount += 1;
+  debug('pipe count=%d opts=%j', state.pipesCount, pipeOpts);
+
+  var doEnd = (!pipeOpts || pipeOpts.end !== false) &&
+              dest !== process.stdout &&
+              dest !== process.stderr;
+
+  var endFn = doEnd ? onend : cleanup;
+  if (state.endEmitted)
+    process.nextTick(endFn);
+  else
+    src.once('end', endFn);
+
+  dest.on('unpipe', onunpipe);
+  function onunpipe(readable) {
+    debug('onunpipe');
+    if (readable === src) {
+      cleanup();
+    }
+  }
+
+  function onend() {
+    debug('onend');
+    dest.end();
+  }
+
+  // when the dest drains, it reduces the awaitDrain counter
+  // on the source.  This would be more elegant with a .once()
+  // handler in flow(), but adding and removing repeatedly is
+  // too slow.
+  var ondrain = pipeOnDrain(src);
+  dest.on('drain', ondrain);
+
+  function cleanup() {
+    debug('cleanup');
+    // cleanup event handlers once the pipe is broken
+    dest.removeListener('close', onclose);
+    dest.removeListener('finish', onfinish);
+    dest.removeListener('drain', ondrain);
+    dest.removeListener('error', onerror);
+    dest.removeListener('unpipe', onunpipe);
+    src.removeListener('end', onend);
+    src.removeListener('end', cleanup);
+    src.removeListener('data', ondata);
+
+    // if the reader is waiting for a drain event from this
+    // specific writer, then it would cause it to never start
+    // flowing again.
+    // So, if this is awaiting a drain, then we just call it now.
+    // If we don't know, then assume that we are waiting for one.
+    if (state.awaitDrain &&
+        (!dest._writableState || dest._writableState.needDrain))
+      ondrain();
+  }
+
+  src.on('data', ondata);
+  function ondata(chunk) {
+    debug('ondata');
+    var ret = dest.write(chunk);
+    if (false === ret) {
+      debug('false write response, pause',
+            src._readableState.awaitDrain);
+      src._readableState.awaitDrain++;
+      src.pause();
+    }
+  }
+
+  // if the dest has an error, then stop piping into it.
+  // however, don't suppress the throwing behavior for this.
+  function onerror(er) {
+    debug('onerror', er);
+    unpipe();
+    dest.removeListener('error', onerror);
+    if (EE.listenerCount(dest, 'error') === 0)
+      dest.emit('error', er);
+  }
+  // This is a brutally ugly hack to make sure that our error handler
+  // is attached before any userland ones.  NEVER DO THIS.
+  if (!dest._events || !dest._events.error)
+    dest.on('error', onerror);
+  else if (isArray(dest._events.error))
+    dest._events.error.unshift(onerror);
+  else
+    dest._events.error = [onerror, dest._events.error];
+
+
+
+  // Both close and finish should trigger unpipe, but only once.
+  function onclose() {
+    dest.removeListener('finish', onfinish);
+    unpipe();
+  }
+  dest.once('close', onclose);
+  function onfinish() {
+    debug('onfinish');
+    dest.removeListener('close', onclose);
+    unpipe();
+  }
+  dest.once('finish', onfinish);
+
+  function unpipe() {
+    debug('unpipe');
+    src.unpipe(dest);
+  }
+
+  // tell the dest that it's being piped to
+  dest.emit('pipe', src);
+
+  // start the flow if it hasn't been started already.
+  if (!state.flowing) {
+    debug('pipe resume');
+    src.resume();
+  }
+
+  return dest;
+};
+
+function pipeOnDrain(src) {
+  return function() {
+    var state = src._readableState;
+    debug('pipeOnDrain', state.awaitDrain);
+    if (state.awaitDrain)
+      state.awaitDrain--;
+    if (state.awaitDrain === 0 && EE.listenerCount(src, 'data')) {
+      state.flowing = true;
+      flow(src);
+    }
+  };
+}
+
+
+Readable.prototype.unpipe = function(dest) {
+  var state = this._readableState;
+
+  // if we're not piping anywhere, then do nothing.
+  if (state.pipesCount === 0)
+    return this;
+
+  // just one destination.  most common case.
+  if (state.pipesCount === 1) {
+    // passed in one, but it's not the right one.
+    if (dest && dest !== state.pipes)
+      return this;
+
+    if (!dest)
+      dest = state.pipes;
+
+    // got a match.
+    state.pipes = null;
+    state.pipesCount = 0;
+    state.flowing = false;
+    if (dest)
+      dest.emit('unpipe', this);
+    return this;
+  }
+
+  // slow case. multiple pipe destinations.
+
+  if (!dest) {
+    // remove all.
+    var dests = state.pipes;
+    var len = state.pipesCount;
+    state.pipes = null;
+    state.pipesCount = 0;
+    state.flowing = false;
+
+    for (var i = 0; i < len; i++)
+      dests[i].emit('unpipe', this);
+    return this;
+  }
+
+  // try to find the right one.
+  var i = indexOf(state.pipes, dest);
+  if (i === -1)
+    return this;
+
+  state.pipes.splice(i, 1);
+  state.pipesCount -= 1;
+  if (state.pipesCount === 1)
+    state.pipes = state.pipes[0];
+
+  dest.emit('unpipe', this);
+
+  return this;
+};
+
+// set up data events if they are asked for
+// Ensure readable listeners eventually get something
+Readable.prototype.on = function(ev, fn) {
+  var res = Stream.prototype.on.call(this, ev, fn);
+
+  // If listening to data, and it has not explicitly been paused,
+  // then call resume to start the flow of data on the next tick.
+  if (ev === 'data' && false !== this._readableState.flowing) {
+    this.resume();
+  }
+
+  if (ev === 'readable' && this.readable) {
+    var state = this._readableState;
+    if (!state.readableListening) {
+      state.readableListening = true;
+      state.emittedReadable = false;
+      state.needReadable = true;
+      if (!state.reading) {
+        var self = this;
+        process.nextTick(function() {
+          debug('readable nexttick read 0');
+          self.read(0);
+        });
+      } else if (state.length) {
+        emitReadable(this, state);
+      }
+    }
+  }
+
+  return res;
+};
+Readable.prototype.addListener = Readable.prototype.on;
+
+// pause() and resume() are remnants of the legacy readable stream API
+// If the user uses them, then switch into old mode.
+Readable.prototype.resume = function() {
+  var state = this._readableState;
+  if (!state.flowing) {
+    debug('resume');
+    state.flowing = true;
+    if (!state.reading) {
+      debug('resume read 0');
+      this.read(0);
+    }
+    resume(this, state);
+  }
+  return this;
+};
+
+function resume(stream, state) {
+  if (!state.resumeScheduled) {
+    state.resumeScheduled = true;
+    process.nextTick(function() {
+      resume_(stream, state);
+    });
+  }
+}
+
+function resume_(stream, state) {
+  state.resumeScheduled = false;
+  stream.emit('resume');
+  flow(stream);
+  if (state.flowing && !state.reading)
+    stream.read(0);
+}
+
+Readable.prototype.pause = function() {
+  debug('call pause flowing=%j', this._readableState.flowing);
+  if (false !== this._readableState.flowing) {
+    debug('pause');
+    this._readableState.flowing = false;
+    this.emit('pause');
+  }
+  return this;
+};
+
+function flow(stream) {
+  var state = stream._readableState;
+  debug('flow', state.flowing);
+  if (state.flowing) {
+    do {
+      var chunk = stream.read();
+    } while (null !== chunk && state.flowing);
+  }
+}
+
+// wrap an old-style stream as the async data source.
+// This is *not* part of the readable stream interface.
+// It is an ugly unfortunate mess of history.
+Readable.prototype.wrap = function(stream) {
+  var state = this._readableState;
+  var paused = false;
+
+  var self = this;
+  stream.on('end', function() {
+    debug('wrapped end');
+    if (state.decoder && !state.ended) {
+      var chunk = state.decoder.end();
+      if (chunk && chunk.length)
+        self.push(chunk);
+    }
+
+    self.push(null);
+  });
+
+  stream.on('data', function(chunk) {
+    debug('wrapped data');
+    if (state.decoder)
+      chunk = state.decoder.write(chunk);
+    if (!chunk || !state.objectMode && !chunk.length)
+      return;
+
+    var ret = self.push(chunk);
+    if (!ret) {
+      paused = true;
+      stream.pause();
+    }
+  });
+
+  // proxy all the other methods.
+  // important when wrapping filters and duplexes.
+  for (var i in stream) {
+    if (util.isFunction(stream[i]) && util.isUndefined(this[i])) {
+      this[i] = function(method) { return function() {
+        return stream[method].apply(stream, arguments);
+      }}(i);
+    }
+  }
+
+  // proxy certain important events.
+  var events = ['error', 'close', 'destroy', 'pause', 'resume'];
+  forEach(events, function(ev) {
+    stream.on(ev, self.emit.bind(self, ev));
+  });
+
+  // when we try to consume some more bytes, simply unpause the
+  // underlying stream.
+  self._read = function(n) {
+    debug('wrapped _read', n);
+    if (paused) {
+      paused = false;
+      stream.resume();
+    }
+  };
+
+  return self;
+};
+
+
+
+// exposed for testing purposes only.
+Readable._fromList = fromList;
+
+// Pluck off n bytes from an array of buffers.
+// Length is the combined lengths of all the buffers in the list.
+function fromList(n, state) {
+  var list = state.buffer;
+  var length = state.length;
+  var stringMode = !!state.decoder;
+  var objectMode = !!state.objectMode;
+  var ret;
+
+  // nothing in the list, definitely empty.
+  if (list.length === 0)
+    return null;
+
+  if (length === 0)
+    ret = null;
+  else if (objectMode)
+    ret = list.shift();
+  else if (!n || n >= length) {
+    // read it all, truncate the array.
+    if (stringMode)
+      ret = list.join('');
+    else
+      ret = Buffer.concat(list, length);
+    list.length = 0;
+  } else {
+    // read just some of it.
+    if (n < list[0].length) {
+      // just take a part of the first list item.
+      // slice is the same for buffers and strings.
+      var buf = list[0];
+      ret = buf.slice(0, n);
+      list[0] = buf.slice(n);
+    } else if (n === list[0].length) {
+      // first list is a perfect match
+      ret = list.shift();
+    } else {
+      // complex case.
+      // we have enough to cover it, but it spans past the first buffer.
+      if (stringMode)
+        ret = '';
+      else
+        ret = new Buffer(n);
+
+      var c = 0;
+      for (var i = 0, l = list.length; i < l && c < n; i++) {
+        var buf = list[0];
+        var cpy = Math.min(n - c, buf.length);
+
+        if (stringMode)
+          ret += buf.slice(0, cpy);
+        else
+          buf.copy(ret, c, 0, cpy);
+
+        if (cpy < buf.length)
+          list[0] = buf.slice(cpy);
+        else
+          list.shift();
+
+        c += cpy;
+      }
+    }
+  }
+
+  return ret;
+}
+
+function endReadable(stream) {
+  var state = stream._readableState;
+
+  // If we get here before consuming all the bytes, then that is a
+  // bug in node.  Should never happen.
+  if (state.length > 0)
+    throw new Error('endReadable called on non-empty stream');
+
+  if (!state.endEmitted) {
+    state.ended = true;
+    process.nextTick(function() {
+      // Check that we didn't get one last unshift.
+      if (!state.endEmitted && state.length === 0) {
+        state.endEmitted = true;
+        stream.readable = false;
+        stream.emit('end');
+      }
+    });
+  }
+}
+
+function forEach (xs, f) {
+  for (var i = 0, l = xs.length; i < l; i++) {
+    f(xs[i], i);
+  }
+}
+
+function indexOf (xs, x) {
+  for (var i = 0, l = xs.length; i < l; i++) {
+    if (xs[i] === x) return i;
+  }
+  return -1;
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/lib/_stream_transform.js

@@ -0,0 +1,209 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
+// a transform stream is a readable/writable stream where you do
+// something with the data.  Sometimes it's called a "filter",
+// but that's not a great name for it, since that implies a thing where
+// some bits pass through, and others are simply ignored.  (That would
+// be a valid example of a transform, of course.)
+//
+// While the output is causally related to the input, it's not a
+// necessarily symmetric or synchronous transformation.  For example,
+// a zlib stream might take multiple plain-text writes(), and then
+// emit a single compressed chunk some time in the future.
+//
+// Here's how this works:
+//
+// The Transform stream has all the aspects of the readable and writable
+// stream classes.  When you write(chunk), that calls _write(chunk,cb)
+// internally, and returns false if there's a lot of pending writes
+// buffered up.  When you call read(), that calls _read(n) until
+// there's enough pending readable data buffered up.
+//
+// In a transform stream, the written data is placed in a buffer.  When
+// _read(n) is called, it transforms the queued up data, calling the
+// buffered _write cb's as it consumes chunks.  If consuming a single
+// written chunk would result in multiple output chunks, then the first
+// outputted bit calls the readcb, and subsequent chunks just go into
+// the read buffer, and will cause it to emit 'readable' if necessary.
+//
+// This way, back-pressure is actually determined by the reading side,
+// since _read has to be called to start processing a new chunk.  However,
+// a pathological inflate type of transform can cause excessive buffering
+// here.  For example, imagine a stream where every byte of input is
+// interpreted as an integer from 0-255, and then results in that many
+// bytes of output.  Writing the 4 bytes {ff,ff,ff,ff} would result in
+// 1kb of data being output.  In this case, you could write a very small
+// amount of input, and end up with a very large amount of output.  In
+// such a pathological inflating mechanism, there'd be no way to tell
+// the system to stop doing the transform.  A single 4MB write could
+// cause the system to run out of memory.
+//
+// However, even in such a pathological case, only a single written chunk
+// would be consumed, and then the rest would wait (un-transformed) until
+// the results of the previous transformed chunk were consumed.
+
+module.exports = Transform;
+
+var Duplex = require('./_stream_duplex');
+
+/*<replacement>*/
+var util = require('core-util-is');
+util.inherits = require('inherits');
+/*</replacement>*/
+
+util.inherits(Transform, Duplex);
+
+
+function TransformState(options, stream) {
+  this.afterTransform = function(er, data) {
+    return afterTransform(stream, er, data);
+  };
+
+  this.needTransform = false;
+  this.transforming = false;
+  this.writecb = null;
+  this.writechunk = null;
+}
+
+function afterTransform(stream, er, data) {
+  var ts = stream._transformState;
+  ts.transforming = false;
+
+  var cb = ts.writecb;
+
+  if (!cb)
+    return stream.emit('error', new Error('no writecb in Transform class'));
+
+  ts.writechunk = null;
+  ts.writecb = null;
+
+  if (!util.isNullOrUndefined(data))
+    stream.push(data);
+
+  if (cb)
+    cb(er);
+
+  var rs = stream._readableState;
+  rs.reading = false;
+  if (rs.needReadable || rs.length < rs.highWaterMark) {
+    stream._read(rs.highWaterMark);
+  }
+}
+
+
+function Transform(options) {
+  if (!(this instanceof Transform))
+    return new Transform(options);
+
+  Duplex.call(this, options);
+
+  this._transformState = new TransformState(options, this);
+
+  // when the writable side finishes, then flush out anything remaining.
+  var stream = this;
+
+  // start out asking for a readable event once data is transformed.
+  this._readableState.needReadable = true;
+
+  // we have implemented the _read method, and done the other things
+  // that Readable wants before the first _read call, so unset the
+  // sync guard flag.
+  this._readableState.sync = false;
+
+  this.once('prefinish', function() {
+    if (util.isFunction(this._flush))
+      this._flush(function(er) {
+        done(stream, er);
+      });
+    else
+      done(stream);
+  });
+}
+
+Transform.prototype.push = function(chunk, encoding) {
+  this._transformState.needTransform = false;
+  return Duplex.prototype.push.call(this, chunk, encoding);
+};
+
+// This is the part where you do stuff!
+// override this function in implementation classes.
+// 'chunk' is an input chunk.
+//
+// Call `push(newChunk)` to pass along transformed output
+// to the readable side.  You may call 'push' zero or more times.
+//
+// Call `cb(err)` when you are done with this chunk.  If you pass
+// an error, then that'll put the hurt on the whole operation.  If you
+// never call cb(), then you'll never get another chunk.
+Transform.prototype._transform = function(chunk, encoding, cb) {
+  throw new Error('not implemented');
+};
+
+Transform.prototype._write = function(chunk, encoding, cb) {
+  var ts = this._transformState;
+  ts.writecb = cb;
+  ts.writechunk = chunk;
+  ts.writeencoding = encoding;
+  if (!ts.transforming) {
+    var rs = this._readableState;
+    if (ts.needTransform ||
+        rs.needReadable ||
+        rs.length < rs.highWaterMark)
+      this._read(rs.highWaterMark);
+  }
+};
+
+// Doesn't matter what the args are here.
+// _transform does all the work.
+// That we got here means that the readable side wants more data.
+Transform.prototype._read = function(n) {
+  var ts = this._transformState;
+
+  if (!util.isNull(ts.writechunk) && ts.writecb && !ts.transforming) {
+    ts.transforming = true;
+    this._transform(ts.writechunk, ts.writeencoding, ts.afterTransform);
+  } else {
+    // mark that we need a transform, so that any data that comes in
+    // will get processed, now that we've asked for it.
+    ts.needTransform = true;
+  }
+};
+
+
+function done(stream, er) {
+  if (er)
+    return stream.emit('error', er);
+
+  // if there's nothing in the write buffer, then that means
+  // that nothing more will ever be provided
+  var ws = stream._writableState;
+  var ts = stream._transformState;
+
+  if (ws.length)
+    throw new Error('calling transform done when ws.length != 0');
+
+  if (ts.transforming)
+    throw new Error('calling transform done when still transforming');
+
+  return stream.push(null);
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/lib/_stream_writable.js

@@ -0,0 +1,477 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+// A bit simpler than readable streams.
+// Implement an async ._write(chunk, cb), and it'll handle all
+// the drain event emission and buffering.
+
+module.exports = Writable;
+
+/*<replacement>*/
+var Buffer = require('buffer').Buffer;
+/*</replacement>*/
+
+Writable.WritableState = WritableState;
+
+
+/*<replacement>*/
+var util = require('core-util-is');
+util.inherits = require('inherits');
+/*</replacement>*/
+
+var Stream = require('stream');
+
+util.inherits(Writable, Stream);
+
+function WriteReq(chunk, encoding, cb) {
+  this.chunk = chunk;
+  this.encoding = encoding;
+  this.callback = cb;
+}
+
+function WritableState(options, stream) {
+  var Duplex = require('./_stream_duplex');
+
+  options = options || {};
+
+  // the point at which write() starts returning false
+  // Note: 0 is a valid value, means that we always return false if
+  // the entire buffer is not flushed immediately on write()
+  var hwm = options.highWaterMark;
+  var defaultHwm = options.objectMode ? 16 : 16 * 1024;
+  this.highWaterMark = (hwm || hwm === 0) ? hwm : defaultHwm;
+
+  // object stream flag to indicate whether or not this stream
+  // contains buffers or objects.
+  this.objectMode = !!options.objectMode;
+
+  if (stream instanceof Duplex)
+    this.objectMode = this.objectMode || !!options.writableObjectMode;
+
+  // cast to ints.
+  this.highWaterMark = ~~this.highWaterMark;
+
+  this.needDrain = false;
+  // at the start of calling end()
+  this.ending = false;
+  // when end() has been called, and returned
+  this.ended = false;
+  // when 'finish' is emitted
+  this.finished = false;
+
+  // should we decode strings into buffers before passing to _write?
+  // this is here so that some node-core streams can optimize string
+  // handling at a lower level.
+  var noDecode = options.decodeStrings === false;
+  this.decodeStrings = !noDecode;
+
+  // Crypto is kind of old and crusty.  Historically, its default string
+  // encoding is 'binary' so we have to make this configurable.
+  // Everything else in the universe uses 'utf8', though.
+  this.defaultEncoding = options.defaultEncoding || 'utf8';
+
+  // not an actual buffer we keep track of, but a measurement
+  // of how much we're waiting to get pushed to some underlying
+  // socket or file.
+  this.length = 0;
+
+  // a flag to see when we're in the middle of a write.
+  this.writing = false;
+
+  // when true all writes will be buffered until .uncork() call
+  this.corked = 0;
+
+  // a flag to be able to tell if the onwrite cb is called immediately,
+  // or on a later tick.  We set this to true at first, because any
+  // actions that shouldn't happen until "later" should generally also
+  // not happen before the first write call.
+  this.sync = true;
+
+  // a flag to know if we're processing previously buffered items, which
+  // may call the _write() callback in the same tick, so that we don't
+  // end up in an overlapped onwrite situation.
+  this.bufferProcessing = false;
+
+  // the callback that's passed to _write(chunk,cb)
+  this.onwrite = function(er) {
+    onwrite(stream, er);
+  };
+
+  // the callback that the user supplies to write(chunk,encoding,cb)
+  this.writecb = null;
+
+  // the amount that is being written when _write is called.
+  this.writelen = 0;
+
+  this.buffer = [];
+
+  // number of pending user-supplied write callbacks
+  // this must be 0 before 'finish' can be emitted
+  this.pendingcb = 0;
+
+  // emit prefinish if the only thing we're waiting for is _write cbs
+  // This is relevant for synchronous Transform streams
+  this.prefinished = false;
+
+  // True if the error was already emitted and should not be thrown again
+  this.errorEmitted = false;
+}
+
+function Writable(options) {
+  var Duplex = require('./_stream_duplex');
+
+  // Writable ctor is applied to Duplexes, though they're not
+  // instanceof Writable, they're instanceof Readable.
+  if (!(this instanceof Writable) && !(this instanceof Duplex))
+    return new Writable(options);
+
+  this._writableState = new WritableState(options, this);
+
+  // legacy.
+  this.writable = true;
+
+  Stream.call(this);
+}
+
+// Otherwise people can pipe Writable streams, which is just wrong.
+Writable.prototype.pipe = function() {
+  this.emit('error', new Error('Cannot pipe. Not readable.'));
+};
+
+
+function writeAfterEnd(stream, state, cb) {
+  var er = new Error('write after end');
+  // TODO: defer error events consistently everywhere, not just the cb
+  stream.emit('error', er);
+  process.nextTick(function() {
+    cb(er);
+  });
+}
+
+// If we get something that is not a buffer, string, null, or undefined,
+// and we're not in objectMode, then that's an error.
+// Otherwise stream chunks are all considered to be of length=1, and the
+// watermarks determine how many objects to keep in the buffer, rather than
+// how many bytes or characters.
+function validChunk(stream, state, chunk, cb) {
+  var valid = true;
+  if (!util.isBuffer(chunk) &&
+      !util.isString(chunk) &&
+      !util.isNullOrUndefined(chunk) &&
+      !state.objectMode) {
+    var er = new TypeError('Invalid non-string/buffer chunk');
+    stream.emit('error', er);
+    process.nextTick(function() {
+      cb(er);
+    });
+    valid = false;
+  }
+  return valid;
+}
+
+Writable.prototype.write = function(chunk, encoding, cb) {
+  var state = this._writableState;
+  var ret = false;
+
+  if (util.isFunction(encoding)) {
+    cb = encoding;
+    encoding = null;
+  }
+
+  if (util.isBuffer(chunk))
+    encoding = 'buffer';
+  else if (!encoding)
+    encoding = state.defaultEncoding;
+
+  if (!util.isFunction(cb))
+    cb = function() {};
+
+  if (state.ended)
+    writeAfterEnd(this, state, cb);
+  else if (validChunk(this, state, chunk, cb)) {
+    state.pendingcb++;
+    ret = writeOrBuffer(this, state, chunk, encoding, cb);
+  }
+
+  return ret;
+};
+
+Writable.prototype.cork = function() {
+  var state = this._writableState;
+
+  state.corked++;
+};
+
+Writable.prototype.uncork = function() {
+  var state = this._writableState;
+
+  if (state.corked) {
+    state.corked--;
+
+    if (!state.writing &&
+        !state.corked &&
+        !state.finished &&
+        !state.bufferProcessing &&
+        state.buffer.length)
+      clearBuffer(this, state);
+  }
+};
+
+function decodeChunk(state, chunk, encoding) {
+  if (!state.objectMode &&
+      state.decodeStrings !== false &&
+      util.isString(chunk)) {
+    chunk = new Buffer(chunk, encoding);
+  }
+  return chunk;
+}
+
+// if we're already writing something, then just put this
+// in the queue, and wait our turn.  Otherwise, call _write
+// If we return false, then we need a drain event, so set that flag.
+function writeOrBuffer(stream, state, chunk, encoding, cb) {
+  chunk = decodeChunk(state, chunk, encoding);
+  if (util.isBuffer(chunk))
+    encoding = 'buffer';
+  var len = state.objectMode ? 1 : chunk.length;
+
+  state.length += len;
+
+  var ret = state.length < state.highWaterMark;
+  // we must ensure that previous needDrain will not be reset to false.
+  if (!ret)
+    state.needDrain = true;
+
+  if (state.writing || state.corked)
+    state.buffer.push(new WriteReq(chunk, encoding, cb));
+  else
+    doWrite(stream, state, false, len, chunk, encoding, cb);
+
+  return ret;
+}
+
+function doWrite(stream, state, writev, len, chunk, encoding, cb) {
+  state.writelen = len;
+  state.writecb = cb;
+  state.writing = true;
+  state.sync = true;
+  if (writev)
+    stream._writev(chunk, state.onwrite);
+  else
+    stream._write(chunk, encoding, state.onwrite);
+  state.sync = false;
+}
+
+function onwriteError(stream, state, sync, er, cb) {
+  if (sync)
+    process.nextTick(function() {
+      state.pendingcb--;
+      cb(er);
+    });
+  else {
+    state.pendingcb--;
+    cb(er);
+  }
+
+  stream._writableState.errorEmitted = true;
+  stream.emit('error', er);
+}
+
+function onwriteStateUpdate(state) {
+  state.writing = false;
+  state.writecb = null;
+  state.length -= state.writelen;
+  state.writelen = 0;
+}
+
+function onwrite(stream, er) {
+  var state = stream._writableState;
+  var sync = state.sync;
+  var cb = state.writecb;
+
+  onwriteStateUpdate(state);
+
+  if (er)
+    onwriteError(stream, state, sync, er, cb);
+  else {
+    // Check if we're actually ready to finish, but don't emit yet
+    var finished = needFinish(stream, state);
+
+    if (!finished &&
+        !state.corked &&
+        !state.bufferProcessing &&
+        state.buffer.length) {
+      clearBuffer(stream, state);
+    }
+
+    if (sync) {
+      process.nextTick(function() {
+        afterWrite(stream, state, finished, cb);
+      });
+    } else {
+      afterWrite(stream, state, finished, cb);
+    }
+  }
+}
+
+function afterWrite(stream, state, finished, cb) {
+  if (!finished)
+    onwriteDrain(stream, state);
+  state.pendingcb--;
+  cb();
+  finishMaybe(stream, state);
+}
+
+// Must force callback to be called on nextTick, so that we don't
+// emit 'drain' before the write() consumer gets the 'false' return
+// value, and has a chance to attach a 'drain' listener.
+function onwriteDrain(stream, state) {
+  if (state.length === 0 && state.needDrain) {
+    state.needDrain = false;
+    stream.emit('drain');
+  }
+}
+
+
+// if there's something in the buffer waiting, then process it
+function clearBuffer(stream, state) {
+  state.bufferProcessing = true;
+
+  if (stream._writev && state.buffer.length > 1) {
+    // Fast case, write everything using _writev()
+    var cbs = [];
+    for (var c = 0; c < state.buffer.length; c++)
+      cbs.push(state.buffer[c].callback);
+
+    // count the one we are adding, as well.
+    // TODO(isaacs) clean this up
+    state.pendingcb++;
+    doWrite(stream, state, true, state.length, state.buffer, '', function(err) {
+      for (var i = 0; i < cbs.length; i++) {
+        state.pendingcb--;
+        cbs[i](err);
+      }
+    });
+
+    // Clear buffer
+    state.buffer = [];
+  } else {
+    // Slow case, write chunks one-by-one
+    for (var c = 0; c < state.buffer.length; c++) {
+      var entry = state.buffer[c];
+      var chunk = entry.chunk;
+      var encoding = entry.encoding;
+      var cb = entry.callback;
+      var len = state.objectMode ? 1 : chunk.length;
+
+      doWrite(stream, state, false, len, chunk, encoding, cb);
+
+      // if we didn't call the onwrite immediately, then
+      // it means that we need to wait until it does.
+      // also, that means that the chunk and cb are currently
+      // being processed, so move the buffer counter past them.
+      if (state.writing) {
+        c++;
+        break;
+      }
+    }
+
+    if (c < state.buffer.length)
+      state.buffer = state.buffer.slice(c);
+    else
+      state.buffer.length = 0;
+  }
+
+  state.bufferProcessing = false;
+}
+
+Writable.prototype._write = function(chunk, encoding, cb) {
+  cb(new Error('not implemented'));
+
+};
+
+Writable.prototype._writev = null;
+
+Writable.prototype.end = function(chunk, encoding, cb) {
+  var state = this._writableState;
+
+  if (util.isFunction(chunk)) {
+    cb = chunk;
+    chunk = null;
+    encoding = null;
+  } else if (util.isFunction(encoding)) {
+    cb = encoding;
+    encoding = null;
+  }
+
+  if (!util.isNullOrUndefined(chunk))
+    this.write(chunk, encoding);
+
+  // .end() fully uncorks
+  if (state.corked) {
+    state.corked = 1;
+    this.uncork();
+  }
+
+  // ignore unnecessary end() calls.
+  if (!state.ending && !state.finished)
+    endWritable(this, state, cb);
+};
+
+
+function needFinish(stream, state) {
+  return (state.ending &&
+          state.length === 0 &&
+          !state.finished &&
+          !state.writing);
+}
+
+function prefinish(stream, state) {
+  if (!state.prefinished) {
+    state.prefinished = true;
+    stream.emit('prefinish');
+  }
+}
+
+function finishMaybe(stream, state) {
+  var need = needFinish(stream, state);
+  if (need) {
+    if (state.pendingcb === 0) {
+      prefinish(stream, state);
+      state.finished = true;
+      stream.emit('finish');
+    } else
+      prefinish(stream, state);
+  }
+  return need;
+}
+
+function endWritable(stream, state, cb) {
+  state.ending = true;
+  finishMaybe(stream, state);
+  if (cb) {
+    if (state.finished)
+      process.nextTick(cb);
+    else
+      stream.once('finish', cb);
+  }
+  state.ended = true;
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/package.json

@@ -0,0 +1,102 @@
+{
+  "_args": [
+    [
+      "readable-stream@1.1",
+      "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript/node_modules/htmlparser2"
+    ]
+  ],
+  "_from": "readable-stream@>=1.1.0 <1.2.0",
+  "_id": "readable-stream@1.1.14",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/htmlparser2/readable-stream",
+  "_nodeVersion": "5.10.1",
+  "_npmOperationalInternal": {
+    "host": "packages-16-east.internal.npmjs.com",
+    "tmp": "tmp/readable-stream-1.1.14.tgz_1460563293219_0.5682175166439265"
+  },
+  "_npmUser": {
+    "email": "calvin.metcalf@gmail.com",
+    "name": "cwmma"
+  },
+  "_npmVersion": "3.8.3",
+  "_phantomChildren": {},
+  "_requested": {
+    "name": "readable-stream",
+    "raw": "readable-stream@1.1",
+    "rawSpec": "1.1",
+    "scope": null,
+    "spec": ">=1.1.0 <1.2.0",
+    "type": "range"
+  },
+  "_requiredBy": [
+    "/htmlparser2"
+  ],
+  "_resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-1.1.14.tgz",
+  "_shasum": "7cf4c54ef648e3813084c636dd2079e166c081d9",
+  "_shrinkwrap": null,
+  "_spec": "readable-stream@1.1",
+  "_where": "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript/node_modules/htmlparser2",
+  "author": {
+    "email": "i@izs.me",
+    "name": "Isaac Z. Schlueter",
+    "url": "http://blog.izs.me/"
+  },
+  "browser": {
+    "util": false
+  },
+  "bugs": {
+    "url": "https://github.com/isaacs/readable-stream/issues"
+  },
+  "dependencies": {
+    "core-util-is": "~1.0.0",
+    "inherits": "~2.0.1",
+    "isarray": "0.0.1",
+    "string_decoder": "~0.10.x"
+  },
+  "description": "Streams3, a user-land copy of the stream library from Node.js v0.11.x",
+  "devDependencies": {
+    "tap": "~0.2.6"
+  },
+  "directories": {},
+  "dist": {
+    "shasum": "7cf4c54ef648e3813084c636dd2079e166c081d9",
+    "tarball": "https://registry.npmjs.org/readable-stream/-/readable-stream-1.1.14.tgz"
+  },
+  "gitHead": "52550840cb1d6e8a98ef9a909a4bea360bc6f7da",
+  "keywords": [
+    "pipe",
+    "readable",
+    "stream"
+  ],
+  "license": "MIT",
+  "main": "readable.js",
+  "maintainers": [
+    {
+      "name": "isaacs",
+      "email": "isaacs@npmjs.com"
+    },
+    {
+      "name": "tootallnate",
+      "email": "nathan@tootallnate.net"
+    },
+    {
+      "name": "rvagg",
+      "email": "rod@vagg.org"
+    },
+    {
+      "name": "cwmma",
+      "email": "calvin.metcalf@gmail.com"
+    }
+  ],
+  "name": "readable-stream",
+  "optionalDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/isaacs/readable-stream"
+  },
+  "scripts": {
+    "test": "tap test/simple/*.js"
+  },
+  "version": "1.1.14"
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/passthrough.js

@@ -0,0 +1 @@
+module.exports = require("./lib/_stream_passthrough.js")

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/readable.js

@@ -0,0 +1,10 @@
+exports = module.exports = require('./lib/_stream_readable.js');
+exports.Stream = require('stream');
+exports.Readable = exports;
+exports.Writable = require('./lib/_stream_writable.js');
+exports.Duplex = require('./lib/_stream_duplex.js');
+exports.Transform = require('./lib/_stream_transform.js');
+exports.PassThrough = require('./lib/_stream_passthrough.js');
+if (!process.browser && process.env.READABLE_STREAM === 'disable') {
+  module.exports = require('stream');
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/transform.js

@@ -0,0 +1 @@
+module.exports = require("./lib/_stream_transform.js")

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/node_modules/readable-stream/writable.js

@@ -0,0 +1 @@
+module.exports = require("./lib/_stream_writable.js")

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/package.json

@@ -0,0 +1,126 @@
+{
+  "_args": [
+    [
+      "htmlparser2@3.8.x",
+      "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript/node_modules/jshint"
+    ]
+  ],
+  "_from": "htmlparser2@>=3.8.0 <3.9.0",
+  "_id": "htmlparser2@3.8.3",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/htmlparser2",
+  "_nodeVersion": "2.2.1",
+  "_npmUser": {
+    "email": "me@feedic.com",
+    "name": "feedic"
+  },
+  "_npmVersion": "2.11.1",
+  "_phantomChildren": {
+    "core-util-is": "1.0.2",
+    "inherits": "2.0.1",
+    "isarray": "0.0.1",
+    "string_decoder": "0.10.31"
+  },
+  "_requested": {
+    "name": "htmlparser2",
+    "raw": "htmlparser2@3.8.x",
+    "rawSpec": "3.8.x",
+    "scope": null,
+    "spec": ">=3.8.0 <3.9.0",
+    "type": "range"
+  },
+  "_requiredBy": [
+    "/jshint"
+  ],
+  "_resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-3.8.3.tgz",
+  "_shasum": "996c28b191516a8be86501a7d79757e5c70c1068",
+  "_shrinkwrap": null,
+  "_spec": "htmlparser2@3.8.x",
+  "_where": "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript/node_modules/jshint",
+  "author": {
+    "email": "me@feedic.com",
+    "name": "Felix Boehm"
+  },
+  "browser": {
+    "readable-stream": false
+  },
+  "bugs": {
+    "url": "http://github.com/fb55/htmlparser2/issues"
+  },
+  "dependencies": {
+    "domelementtype": "1",
+    "domhandler": "2.3",
+    "domutils": "1.5",
+    "entities": "1.0",
+    "readable-stream": "1.1"
+  },
+  "description": "Fast & forgiving HTML/XML/RSS parser",
+  "devDependencies": {
+    "coveralls": "*",
+    "istanbul": "*",
+    "jscs": "1.5.8",
+    "jshint": "2",
+    "mocha": "1",
+    "mocha-lcov-reporter": "*"
+  },
+  "directories": {
+    "lib": "lib/"
+  },
+  "dist": {
+    "shasum": "996c28b191516a8be86501a7d79757e5c70c1068",
+    "tarball": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-3.8.3.tgz"
+  },
+  "gitHead": "44e48f58526de05d2639199f4baaaef235521f6b",
+  "homepage": "https://github.com/fb55/htmlparser2#readme",
+  "jshintConfig": {
+    "eqeqeq": true,
+    "eqnull": true,
+    "freeze": true,
+    "globals": {
+      "describe": true,
+      "it": true
+    },
+    "latedef": "nofunc",
+    "noarg": true,
+    "node": true,
+    "nonbsp": true,
+    "proto": true,
+    "quotmark": "double",
+    "smarttabs": true,
+    "trailing": true,
+    "undef": true,
+    "unused": true
+  },
+  "keywords": [
+    "atom",
+    "dom",
+    "feed",
+    "html",
+    "parser",
+    "rss",
+    "streams",
+    "xml"
+  ],
+  "license": "MIT",
+  "main": "lib/index.js",
+  "maintainers": [
+    {
+      "name": "feedic",
+      "email": "me@feedic.com"
+    }
+  ],
+  "name": "htmlparser2",
+  "optionalDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/fb55/htmlparser2.git"
+  },
+  "scripts": {
+    "coveralls": "npm run lint && npm run lcov && (cat coverage/lcov.info | coveralls || exit 0)",
+    "lcov": "istanbul cover _mocha --report lcovonly -- -R spec",
+    "lint": "jshint lib test && jscs lib test",
+    "test": "mocha && npm run lint"
+  },
+  "version": "3.8.3"
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/01-events.js

@@ -0,0 +1,9 @@
+var helper = require("./test-helper.js");
+
+helper.mochaTest("Events", __dirname, function(test, cb){
+	helper.writeToParser(
+		helper.getEventCollector(cb),
+		test.options.parser,
+		test.html
+	);
+});

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/02-stream.js

@@ -0,0 +1,23 @@
+var helper = require("./test-helper.js"),
+	Stream = require("..").WritableStream,
+	fs = require("fs"),
+	path = require("path");
+
+helper.mochaTest("Stream", __dirname, function(test, cb){
+	var filePath = path.join(__dirname, "Documents", test.file);
+	fs.createReadStream(filePath).pipe(
+		new Stream(
+			helper.getEventCollector(function(err, events){
+				cb(err, events);
+
+				var handler = helper.getEventCollector(cb),
+				    stream = new Stream(handler, test.options);
+
+				fs.readFile(filePath, function(err, data){
+					if(err) throw err;
+					else stream.end(data);
+				});
+			}
+		), test.options)
+	).on("error", cb);
+});

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/03-feed.js

@@ -0,0 +1,19 @@
+//Runs tests for feeds
+
+var helper = require("./test-helper.js"),
+	FeedHandler = require("..").RssHandler,
+	fs = require("fs"),
+	path = require("path");
+
+helper.mochaTest("Feeds", __dirname, function(test, cb){
+	fs.readFile(
+		path.join(__dirname, "Documents", test.file),
+		function(err, file){
+			helper.writeToParser(
+				new FeedHandler(cb),
+				{ xmlMode: true },
+				file.toString()
+			);
+		}
+	);
+});

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Documents/Atom_Example.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- http://en.wikipedia.org/wiki/Atom_%28standard%29 -->
+<feed xmlns="http://www.w3.org/2005/Atom">
+	<title>Example Feed</title>
+	<subtitle>A subtitle.</subtitle>
+	<link href="http://example.org/feed/" rel="self" />
+	<link href="http://example.org/" />
+	<id>urn:uuid:60a76c80-d399-11d9-b91C-0003939e0af6</id>
+	<updated>2003-12-13T18:30:02Z</updated>
+	<author>
+		<name>John Doe</name>
+		<email>johndoe@example.com</email>
+	</author>
+
+	<entry>
+		<title>Atom-Powered Robots Run Amok</title>
+		<link href="http://example.org/2003/12/13/atom03" />
+		<link rel="alternate" type="text/html" href="http://example.org/2003/12/13/atom03.html"/>
+		<link rel="edit" href="http://example.org/2003/12/13/atom03/edit"/>
+		<id>urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a</id>
+		<updated>2003-12-13T18:30:02Z</updated>
+		<content type="html"><p>Some content.</p></content>
+	</entry>
+
+</feed>

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Documents/Attributes.html

@@ -0,0 +1,16 @@
+<!doctype html>
+<html>
+<head>
+	<title>Attributes test</title>
+</head>
+<body>
+	<!-- Normal attributes -->
+	<button id="test0" class="value0" title="value1">class="value0" title="value1"</button>
+
+	<!-- Attributes with no quotes or value -->
+	<button id="test1" class=value2 disabled>class=value2 disabled</button>
+
+	<!-- Attributes with no space between them. No valid, but accepted by the browser -->
+	<button id="test2" class="value4"title="value5">class="value4"title="value5"</button>
+</body>
+</html>

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Documents/Basic.html

@@ -0,0 +1 @@
+<!DOCTYPE html><html><title>The Title</title><body>Hello world</body></html>

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Documents/RDF_Example.xml

@@ -0,0 +1,63 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns="http://purl.org/rss/1.0/" xmlns:ev="http://purl.org/rss/1.0/modules/event/" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:syn="http://purl.org/rss/1.0/modules/syndication/" xmlns:dcterms="http://purl.org/dc/terms/" xmlns:admin="http://webns.net/mvcb/">
+	<channel rdf:about="http://sfbay.craigslist.org/ccc/">
+		<title>craigslist | all community in SF bay area</title>
+		<link>http://sfbay.craigslist.org/ccc/</link>
+		<description/>
+		<dc:language>en-us</dc:language>
+		<dc:rights>Copyright 2011 craigslist, inc.</dc:rights>
+		<dc:publisher>webmaster@craigslist.org</dc:publisher>
+		<dc:creator>webmaster@craigslist.org</dc:creator>
+		<dc:source>http://sfbay.craigslist.org/ccc//</dc:source>
+		<dc:title>craigslist | all community in SF bay area</dc:title>
+		<dc:type>Collection</dc:type>
+		<syn:updateBase>2011-11-04T09:39:10-07:00</syn:updateBase>
+		<syn:updateFrequency>4</syn:updateFrequency>
+		<syn:updatePeriod>hourly</syn:updatePeriod>
+		<items>
+			<rdf:Seq>
+				<rdf:li rdf:resource="http://sfbay.craigslist.org/sby/muc/2681301534.html"/>
+			</rdf:Seq>
+		</items>
+	</channel>
+	<item rdf:about="http://sfbay.craigslist.org/sby/muc/2681301534.html">
+		<title><![CDATA[ Music Equipment Repair and Consignment ]]></title>
+		<link>
+http://sfbay.craigslist.org/sby/muc/2681301534.html
+</link>
+		<description><![CDATA[
+San Jose Rock Shop offers musical instrument repair and consignment! (408) 215-2065<br> <br> We are pleased to announce our NEW LOCATION: 1199 N 5th st. San Jose, ca 95112. Please call ahead, by appointment only.<br> <br> Recently featured by Metro Newspaper in their 2011 Best of the Silicon Valley edition see it online here:<br> <a href="http://www.metroactive.com/best-of-silicon-valley/2011/music-nightlife/editor-picks.html" rel="nofollow">http://www.metroactive.com/best-of-silicon-valley/2011/music-nightlife/editor-picks.html</a><br> <br> Guitar Set up (acoustic and electronic) $40!<!-- END CLTAGS -->
+]]></description>
+		<dc:date>2011-11-04T09:35:17-07:00</dc:date>
+		<dc:language>en-us</dc:language>
+		<dc:rights>Copyright 2011 craigslist, inc.</dc:rights>
+		<dc:source>
+http://sfbay.craigslist.org/sby/muc/2681301534.html
+</dc:source>
+		<dc:title><![CDATA[ Music Equipment Repair and Consignment ]]></dc:title>
+		<dc:type>text</dc:type>
+		<dcterms:issued>2011-11-04T09:35:17-07:00</dcterms:issued>
+	</item>
+	<item rdf:about="http://sfbay.craigslist.org/eby/rid/2685010755.html">
+		<title><![CDATA[
+Ride Offered - Oakland/BART to LA/SFV - TODAY 3PM 11/04 (oakland north / temescal)
+]]></title>
+		<link>
+http://sfbay.craigslist.org/eby/rid/2685010755.html
+</link>
+		<description><![CDATA[
+Im offering a lift for up to two people from Oakland (or near any BART station in the East Bay/580/880 Corridor, or San Jose/Morgan Hill, Gilroy) to the San Fernando Valley / Los Angeles area. Specifically, Im leaving from Oakland between 2:30 and 3:00pm (this is flexible, but if I leave too late my girlfriend will kill me), and heading to Woodland Hills via the 580, I-5, 405, and 101.<!-- END CLTAGS -->
+]]></description>
+		<dc:date>2011-11-04T09:34:54-07:00</dc:date>
+		<dc:language>en-us</dc:language>
+		<dc:rights>Copyright 2011 craigslist, inc.</dc:rights>
+		<dc:source>
+http://sfbay.craigslist.org/eby/rid/2685010755.html
+</dc:source>
+		<dc:title><![CDATA[
+Ride Offered - Oakland/BART to LA/SFV - TODAY 3PM 11/04 (oakland north / temescal)
+]]></dc:title>
+		<dc:type>text</dc:type>
+		<dcterms:issued>2011-11-04T09:34:54-07:00</dcterms:issued>
+	</item>
+</rdf:RDF>

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Documents/RSS_Example.xml

@@ -0,0 +1,48 @@
+<?xml version="1.0"?>
+<!-- http://cyber.law.harvard.edu/rss/examples/rss2sample.xml -->
+<rss version="2.0">
+   <channel>
+      <title>Liftoff News</title>
+      <link>http://liftoff.msfc.nasa.gov/</link>
+      <description>Liftoff to Space Exploration.</description>
+      <language>en-us</language>
+      <pubDate>Tue, 10 Jun 2003 04:00:00 GMT</pubDate>
+
+      <lastBuildDate>Tue, 10 Jun 2003 09:41:01 GMT</lastBuildDate>
+      <docs>http://blogs.law.harvard.edu/tech/rss</docs>
+      <generator>Weblog Editor 2.0</generator>
+      <managingEditor>editor@example.com</managingEditor>
+      <webMaster>webmaster@example.com</webMaster>
+      <item>
+
+         <title>Star City</title>
+         <link>http://liftoff.msfc.nasa.gov/news/2003/news-starcity.asp</link>
+         <description>How do Americans get ready to work with Russians aboard the International Space Station? They take a crash course in culture, language and protocol at Russia's &lt;a href="http://howe.iki.rssi.ru/GCTC/gctc_e.htm"&gt;Star City&lt;/a&gt;.</description>
+         <pubDate>Tue, 03 Jun 2003 09:39:21 GMT</pubDate>
+         <guid>http://liftoff.msfc.nasa.gov/2003/06/03.html#item573</guid>
+
+      </item>
+      <item>
+         <description>Sky watchers in Europe, Asia, and parts of Alaska and Canada will experience a &lt;a href="http://science.nasa.gov/headlines/y2003/30may_solareclipse.htm"&gt;partial eclipse of the Sun&lt;/a&gt; on Saturday, May 31st.</description>
+         <pubDate>Fri, 30 May 2003 11:06:42 GMT</pubDate>
+         <guid>http://liftoff.msfc.nasa.gov/2003/05/30.html#item572</guid>
+
+      </item>
+      <item>
+         <title>The Engine That Does More</title>
+         <link>http://liftoff.msfc.nasa.gov/news/2003/news-VASIMR.asp</link>
+         <description>Before man travels to Mars, NASA hopes to design new engines that will let us fly through the Solar System more quickly.  The proposed VASIMR engine would do that.</description>
+         <pubDate>Tue, 27 May 2003 08:37:32 GMT</pubDate>
+         <guid>http://liftoff.msfc.nasa.gov/2003/05/27.html#item571</guid>
+
+      </item>
+      <item>
+         <title>Astronauts' Dirty Laundry</title>
+         <link>http://liftoff.msfc.nasa.gov/news/2003/news-laundry.asp</link>
+         <description>Compared to earlier spacecraft, the International Space Station has many luxuries, but laundry facilities are not one of them.  Instead, astronauts have other options.</description>
+         <pubDate>Tue, 20 May 2003 08:56:02 GMT</pubDate>
+         <guid>http://liftoff.msfc.nasa.gov/2003/05/20.html#item570</guid>
+
+      </item>
+   </channel>
+</rss>

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/01-simple.json

@@ -0,0 +1,44 @@
+{
+  "name": "simple",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<h1 class=test>adsf</h1>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "h1"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "test"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "h1",
+        {
+          "class": "test"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "adsf"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "h1"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/02-template.json

@@ -0,0 +1,63 @@
+{
+  "name": "Template script tags",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<p><script type=\"text/template\"><h1>Heading1</h1></script></p>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "p"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "p",
+        {}
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "type",
+        "text/template"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "script",
+        {
+          "type": "text/template"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "<h1>Heading1</h1>"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "p"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/03-lowercase_tags.json

@@ -0,0 +1,46 @@
+{
+  "name": "Lowercase tags",
+  "options": {
+    "handler": {},
+    "parser": {
+      "lowerCaseTags": true
+    }
+  },
+  "html": "<H1 class=test>adsf</H1>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "h1"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "test"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "h1",
+        {
+          "class": "test"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "adsf"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "h1"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/04-cdata.json

@@ -0,0 +1,50 @@
+{
+  "name": "CDATA",
+  "options": {
+    "handler": {},
+    "parser": {"xmlMode": true}
+  },
+  "html": "<tag><![CDATA[ asdf ><asdf></adsf><> fo]]></tag><![CD>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "tag"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "tag",
+        {}
+      ]
+    },
+    {
+      "event": "cdatastart",
+      "data": []
+    },
+    {
+      "event": "text",
+      "data": [
+        " asdf ><asdf></adsf><> fo"
+      ]
+    },
+    {
+      "event": "cdataend",
+      "data": []
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "tag"
+      ]
+    },
+    {
+      "event": "processinginstruction",
+      "data": [
+        "![CD",
+        "![CD"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/05-cdata-special.json

@@ -0,0 +1,35 @@
+{
+  "name": "CDATA (inside special)",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<script>/*<![CDATA[*/ asdf ><asdf></adsf><> fo/*]]>*/</script>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "script",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "/*<![CDATA[*/ asdf ><asdf></adsf><> fo/*]]>*/"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "script"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/06-leading-lt.json

@@ -0,0 +1,16 @@
+{
+  "name": "leading lt",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": ">a>",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        ">a>"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/07-self-closing.json

@@ -0,0 +1,67 @@
+{
+    "name": "Self-closing tags",
+    "options": {
+        "handler": {
+
+            },
+        "parser": {
+
+            }
+    },
+    "html": "<a href=http://test.com/>Foo</a><hr / >",
+    "expected": [
+		{
+			"event": "opentagname",
+			"data": [
+				"a"
+			]
+		},
+		{
+			"event": "attribute",
+			"data": [
+				"href",
+				"http://test.com/"
+			]
+		},
+		{
+			"event": "opentag",
+			"data": [
+				"a",
+				{
+					"href": "http://test.com/"
+				}
+			]
+		},
+		{
+			"event": "text",
+			"data": [
+				"Foo"
+			]
+		},
+		{
+			"event": "closetag",
+			"data": [
+				"a"
+			]
+		},
+		{
+			"event": "opentagname",
+			"data": [
+				"hr"
+			]
+		},
+		{
+			"event": "opentag",
+			"data": [
+				"hr",
+				{}
+			]
+		},
+		{
+			"event": "closetag",
+			"data": [
+				"hr"
+			]
+		}
+	]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/08-implicit-close-tags.json

@@ -0,0 +1,71 @@
+{
+  "name": "Implicit close tags",
+  "options": {},
+  "html": "<ol><li class=test><div><table style=width:100%><tr><th>TH<td colspan=2><h3>Heading</h3><tr><td><div>Div</div><td><div>Div2</div></table></div><li><div><h3>Heading 2</h3></div></li></ol><p>Para<h4>Heading 4</h4>",
+  "expected": [
+    { "event": "opentagname", "data": [ "ol" ] },
+    { "event": "opentag", "data": [ "ol", {} ] },
+    { "event": "opentagname", "data": [ "li" ] },
+    { "event": "attribute", "data": [ "class", "test" ] },
+    { "event": "opentag", "data": [ "li", { "class": "test" } ] },
+    { "event": "opentagname", "data": [ "div" ] },
+    { "event": "opentag", "data": [ "div", {} ] },
+    { "event": "opentagname", "data": [ "table" ] },
+    { "event": "attribute", "data": [ "style", "width:100%" ] },
+    { "event": "opentag", "data": [ "table", { "style": "width:100%" } ] },
+    { "event": "opentagname", "data": [ "tr" ] },
+    { "event": "opentag", "data": [ "tr", {} ] },
+    { "event": "opentagname", "data": [ "th" ] },
+    { "event": "opentag", "data": [ "th", {} ] },
+    { "event": "text", "data": [ "TH" ] },
+    { "event": "closetag", "data": [ "th" ] },
+    { "event": "opentagname", "data": [ "td" ] },
+    { "event": "attribute", "data": [ "colspan", "2" ] },
+    { "event": "opentag", "data": [ "td", { "colspan": "2" } ] },
+    { "event": "opentagname", "data": [ "h3" ] },
+    { "event": "opentag", "data": [ "h3", {} ] },
+    { "event": "text", "data": [ "Heading" ] },
+    { "event": "closetag", "data": [ "h3" ] },
+    { "event": "closetag", "data": [ "td" ] },
+    { "event": "closetag", "data": [ "tr" ] },
+    { "event": "opentagname", "data": [ "tr" ] },
+    { "event": "opentag", "data": [ "tr", {} ] },
+    { "event": "opentagname", "data": [ "td" ] },
+    { "event": "opentag", "data": [ "td", {} ] },
+    { "event": "opentagname", "data": [ "div" ] },
+    { "event": "opentag", "data": [ "div", {} ] },
+    { "event": "text", "data": [ "Div" ] },
+    { "event": "closetag", "data": [ "div" ] },
+    { "event": "closetag", "data": [ "td" ] },
+    { "event": "opentagname", "data": [ "td" ] },
+    { "event": "opentag", "data": [ "td", {} ] },
+    { "event": "opentagname", "data": [ "div" ] },
+    { "event": "opentag", "data": [ "div", {} ] },
+    { "event": "text", "data": [ "Div2" ] },
+    { "event": "closetag", "data": [ "div" ] },
+    { "event": "closetag", "data": [ "td" ] },
+    { "event": "closetag", "data": [ "tr" ] },
+    { "event": "closetag", "data": [ "table" ] },
+    { "event": "closetag", "data": [ "div" ] },
+    { "event": "closetag", "data": [ "li" ] },
+    { "event": "opentagname", "data": [ "li" ] },
+    { "event": "opentag", "data": [ "li", {} ] },
+    { "event": "opentagname", "data": [ "div" ] },
+    { "event": "opentag", "data": [ "div", {} ] },
+    { "event": "opentagname", "data": [ "h3" ] },
+    { "event": "opentag", "data": [ "h3", {} ] },
+    { "event": "text", "data": [ "Heading 2" ] },
+    { "event": "closetag", "data": [ "h3" ] },
+    { "event": "closetag", "data": [ "div" ] },
+    { "event": "closetag", "data": [ "li" ] },
+    { "event": "closetag", "data": [ "ol" ] },
+    { "event": "opentagname", "data": [ "p" ] },
+    { "event": "opentag", "data": [ "p", {} ] },
+    { "event": "text", "data": [ "Para" ] },
+    { "event": "closetag", "data": [ "p" ] },
+    { "event": "opentagname", "data": [ "h4" ] },
+    { "event": "opentag", "data": [ "h4", {} ] },
+    { "event": "text", "data": [ "Heading 4" ] },
+    { "event": "closetag", "data": [ "h4" ] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/09-attributes.json

@@ -0,0 +1,68 @@
+{
+  "name": "attributes (no white space, no value, no quotes)",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<button class=\"test0\"title=\"test1\" disabled value=test2>adsf</button>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "test0"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "title",
+        "test1"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "disabled",
+        ""
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "value",
+        "test2"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "button",
+        {
+          "class": "test0",
+          "title": "test1",
+          "disabled": "",
+          "value": "test2"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "adsf"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "button"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/10-crazy-attrib.json

@@ -0,0 +1,52 @@
+{
+  "name": "crazy attribute",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<p < = '' FAIL>stuff</p><a",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "p"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "<",
+        ""
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "fail",
+        ""
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "p",
+        {
+          "<": "",
+          "fail": ""
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "stuff"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "p"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/11-script_in_script.json

@@ -0,0 +1,54 @@
+{
+  "name": "Scripts creating other scripts",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<p><script>var str = '<script></'+'script>';</script></p>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "p"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "p",
+        {}
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "script",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "var str = '<script></'+'script>';"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "p"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/12-long-comment-end.json

@@ -0,0 +1,20 @@
+{
+  "name": "Long comment ending",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<meta id='before'><!-- text ---><meta id='after'>",
+  "expected": [
+  { "event": "opentagname", "data": [ "meta" ] },
+  { "event": "attribute",   "data": [ "id", "before" ] },
+  { "event": "opentag",     "data": [ "meta", {"id": "before"} ] },
+  { "event": "closetag",    "data": [ "meta" ] },
+  { "event": "comment",     "data": [ " text -" ] },
+  { "event": "commentend",  "data": [] },
+  { "event": "opentagname", "data": [ "meta" ] },
+  { "event": "attribute",   "data": [ "id", "after" ] },
+  { "event": "opentag",     "data": [ "meta", {"id": "after"} ] },
+  { "event": "closetag",    "data": [ "meta" ] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/13-long-cdata-end.json

@@ -0,0 +1,22 @@
+{
+  "name": "Long CDATA ending",
+  "options": {
+    "handler": {},
+    "parser": {"xmlMode": true}
+  },
+  "html": "<before /><tag><![CDATA[ text ]]]></tag><after />",
+  "expected": [
+  { "event": "opentagname", "data": [ "before" ] },
+  { "event": "opentag",     "data": [ "before", {} ] },
+  { "event": "closetag",    "data": [ "before" ] },
+  { "event": "opentagname", "data": [ "tag" ] },
+  { "event": "opentag",     "data": [ "tag", {} ] },
+  { "event": "cdatastart",  "data": [] },
+  { "event": "text",        "data": [ " text ]" ] },
+  { "event": "cdataend",    "data": [] },
+  { "event": "closetag",    "data": [ "tag" ] },
+  { "event": "opentagname", "data": [ "after" ] },
+  { "event": "opentag",     "data": [ "after", {} ] },
+  { "event": "closetag",    "data": [ "after" ] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/14-implicit-open-tags.json

@@ -0,0 +1,27 @@
+{
+  "name": "Implicit open p and br tags",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<div>Hallo</p>World</br></ignore></div></p></br>",
+  "expected": [
+  	{ "event": "opentagname", "data": [ "div" ] },
+  	{ "event": "opentag",     "data": [ "div", {} ] },
+  	{ "event": "text",        "data": [ "Hallo" ] },
+  	{ "event": "opentagname", "data": [ "p" ] },
+  	{ "event": "opentag",     "data": [ "p", {} ] },
+  	{ "event": "closetag",    "data": [ "p" ] },
+  	{ "event": "text",        "data": [ "World" ] },
+  	{ "event": "opentagname", "data": [ "br" ] },
+  	{ "event": "opentag",     "data": [ "br", {} ] },
+  	{ "event": "closetag",    "data": [ "br" ] },
+  	{ "event": "closetag",    "data": [ "div" ] },
+  	{ "event": "opentagname", "data": [ "p" ] },
+  	{ "event": "opentag",     "data": [ "p", {} ] },
+  	{ "event": "closetag",    "data": [ "p" ] },
+    { "event": "opentagname", "data": [ "br" ] },
+    { "event": "opentag",     "data": [ "br", {} ] },
+    { "event": "closetag",    "data": [ "br" ] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/15-lt-whitespace.json

@@ -0,0 +1,16 @@
+{
+  "name": "lt followed by whitespace",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "a < b",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "a < b"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/16-double_attribs.json

@@ -0,0 +1,45 @@
+{
+  "name": "double attribute",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<h1 class=test class=boo></h1>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "h1"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "test"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "boo"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "h1",
+        {
+          "class": "test"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "h1"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/17-numeric_entities.json

@@ -0,0 +1,16 @@
+{
+  "name": "numeric entities",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true}
+  },
+  "html": "a&#x62c&#100&#x66g&#x;&#x68",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "abcdfg&#x;h"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/18-legacy_entities.json

@@ -0,0 +1,16 @@
+{
+  "name": "legacy entities",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true}
+  },
+  "html": "&AMPel&iacutee&ampeer;s&lter",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "&el\u00EDe&eer;s<er"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/19-named_entities.json

@@ -0,0 +1,16 @@
+{
+  "name": "named entities",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true}
+  },
+  "html": "&el<er&CounterClockwiseContourIntegral;foo&bar",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "&el<er\u2233foo&bar"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/20-xml_entities.json

@@ -0,0 +1,16 @@
+{
+  "name": "xml entities",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true, "xmlMode": true}
+  },
+  "html": "&>&amp<üa&#x62c&#100&#101",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "&>&amp<&uuml;a&#x62c&#100&#101"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/21-entity_in_attribute.json

@@ -0,0 +1,38 @@
+{
+  "name": "entity in attribute",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true}
+  },
+  "html": "<a href='http://example.com/p&#x61;ge?param=value&param2&param3=&lt;val&; & &'>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "a"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "href",
+        "http://example.com/page?param=value&param2&param3=<val&; & &"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "a",
+        {
+          "href": "http://example.com/page?param=value&param2&param3=<val&; & &"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "a"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/22-double_brackets.json

@@ -0,0 +1,41 @@
+{
+  "name": "double brackets",
+  "options": {
+    "handler": {},
+    "parser": {}
+  },
+  "html": "<<princess-purpose>>testing</princess-purpose>",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "<"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "princess-purpose"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "princess-purpose",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        ">testing"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "princess-purpose"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/23-legacy_entity_fail.json

@@ -0,0 +1,16 @@
+{
+  "name": "legacy entities",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true}
+  },
+  "html": "M&M",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "M&M"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/24-special_special.json

@@ -0,0 +1,133 @@
+{
+  "name": "Special special tags",
+  "options": {},
+  "html": "<sCriPT></scripter</soo</sCript><STyLE></styler</STylE><sCiPt><stylee><scriptee><soo>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "script",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "</scripter</soo"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "script"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "style"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "style",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "</styler"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "style"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "scipt"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "scipt",
+        {}
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "stylee"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "stylee",
+        {}
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "scriptee"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "scriptee",
+        {}
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "soo"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "soo",
+        {}
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "soo"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "scriptee"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "stylee"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "scipt"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/25-empty_tag_name.json

@@ -0,0 +1,13 @@
+{
+  "name": "Empty tag name",
+  "options": {},
+  "html": "< ></ >",
+  "expected": [
+    {
+      "event": "text",
+      "data": [
+        "< ></ >"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/26-not-quite-closed.json

@@ -0,0 +1,35 @@
+{
+  "name": "Not quite closed",
+  "options": {},
+  "html": "<foo /bar></foo bar>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "foo"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "bar",
+        ""
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "foo",
+        {
+          "bar": ""
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "foo"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/27-entities_in_attributes.json

@@ -0,0 +1,62 @@
+{
+  "name": "Entities in attributes",
+  "options": {
+    "handler": {},
+    "parser": {"decodeEntities": true}
+  },
+  "html": "<foo bar=&amp; baz=\"&amp;\" boo='&amp;' noo=>",
+  "expected": [
+    {
+      "event": "opentagname",
+      "data": [
+        "foo"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "bar",
+        "&"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "baz",
+        "&"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "boo",
+        "&"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "noo",
+        ""
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "foo",
+        {
+          "bar": "&",
+          "baz": "&",
+          "boo": "&",
+          "noo": ""
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "foo"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/28-cdata_in_html.json

@@ -0,0 +1,9 @@
+{
+  "name": "CDATA in HTML",
+  "options": {},
+  "html": "<![CDATA[ foo ]]>",
+  "expected": [
+    { "event": "comment",     "data": [ "[CDATA[ foo ]]" ] },
+    { "event": "commentend",  "data": [] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/29-comment_edge-cases.json

@@ -0,0 +1,18 @@
+{
+  "name": "Comment edge-cases",
+  "options": {},
+  "html": "<!-foo><!-- --- --><!--foo",
+  "expected": [
+    {
+      "event": "processinginstruction",
+      "data": [
+        "!-foo",
+        "!-foo"
+      ]
+    },
+    { "event": "comment",     "data": [ " --- " ] },
+    { "event": "commentend",  "data": [] },
+    { "event": "comment",     "data": [ "foo" ] },
+    { "event": "commentend",  "data": [] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/30-cdata_edge-cases.json

@@ -0,0 +1,22 @@
+{
+  "name": "CDATA edge-cases",
+  "options": {
+    "parser": {"recognizeCDATA": true}
+  },
+  "html": "<![CDATA><![CDATA[[]]sdaf]]><![CDATA[foo",
+  "expected": [
+    {
+      "event": "processinginstruction",
+      "data": [
+        "![cdata",
+        "![CDATA"
+      ]
+    },
+    { "event": "cdatastart", "data": [] },
+    { "event": "text",     "data": [ "[]]sdaf" ] },
+    { "event": "cdataend",  "data": [] },
+    { "event": "cdatastart", "data": [] },
+    { "event": "text",     "data": [ "foo" ] },
+    { "event": "cdataend",  "data": [] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Events/31-comment_false-ending.json

@@ -0,0 +1,9 @@
+{
+  "name": "Comment false ending",
+  "options": {},
+  "html": "<!-- a-b-> -->",
+  "expected": [
+    { "event": "comment",     "data": [ " a-b-> " ] },
+    { "event": "commentend",  "data": [] }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Feeds/01-rss.js

@@ -0,0 +1,34 @@
+exports.name = "RSS (2.0)";
+exports.file = "/RSS_Example.xml";
+exports.expected = {
+	type: "rss",
+	id: "",
+	title: "Liftoff News",
+	link: "http://liftoff.msfc.nasa.gov/",
+	description: "Liftoff to Space Exploration.",
+	updated: new Date("Tue, 10 Jun 2003 09:41:01 GMT"),
+	author: "editor@example.com",
+	items: [{
+		id: "http://liftoff.msfc.nasa.gov/2003/06/03.html#item573",
+		title: "Star City",
+		link: "http://liftoff.msfc.nasa.gov/news/2003/news-starcity.asp",
+		description: "How do Americans get ready to work with Russians aboard the International Space Station? They take a crash course in culture, language and protocol at Russia's <a href=\"http://howe.iki.rssi.ru/GCTC/gctc_e.htm\">Star City</a>.",
+		pubDate: new Date("Tue, 03 Jun 2003 09:39:21 GMT")
+	}, {
+		id: "http://liftoff.msfc.nasa.gov/2003/05/30.html#item572",
+		description: "Sky watchers in Europe, Asia, and parts of Alaska and Canada will experience a <a href=\"http://science.nasa.gov/headlines/y2003/30may_solareclipse.htm\">partial eclipse of the Sun</a> on Saturday, May 31st.",
+		pubDate: new Date("Fri, 30 May 2003 11:06:42 GMT")
+	}, {
+		id: "http://liftoff.msfc.nasa.gov/2003/05/27.html#item571",
+		title: "The Engine That Does More",
+		link: "http://liftoff.msfc.nasa.gov/news/2003/news-VASIMR.asp",
+		description: "Before man travels to Mars, NASA hopes to design new engines that will let us fly through the Solar System more quickly.  The proposed VASIMR engine would do that.",
+		pubDate: new Date("Tue, 27 May 2003 08:37:32 GMT")
+	}, {
+		id: "http://liftoff.msfc.nasa.gov/2003/05/20.html#item570",
+		title: "Astronauts' Dirty Laundry",
+		link: "http://liftoff.msfc.nasa.gov/news/2003/news-laundry.asp",
+		description: "Compared to earlier spacecraft, the International Space Station has many luxuries, but laundry facilities are not one of them.  Instead, astronauts have other options.",
+		pubDate: new Date("Tue, 20 May 2003 08:56:02 GMT")
+	}]
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Feeds/02-atom.js

@@ -0,0 +1,18 @@
+exports.name = "Atom (1.0)";
+exports.file = "/Atom_Example.xml";
+exports.expected = {
+	type: "atom",
+	id: "urn:uuid:60a76c80-d399-11d9-b91C-0003939e0af6",
+	title: "Example Feed",
+	link: "http://example.org/feed/",
+	description: "A subtitle.",
+	updated: new Date("2003-12-13T18:30:02Z"),
+	author: "johndoe@example.com",
+	items: [{
+		id: "urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a",
+		title: "Atom-Powered Robots Run Amok",
+		link: "http://example.org/2003/12/13/atom03",
+		description: "Some content.",
+		pubDate: new Date("2003-12-13T18:30:02Z")
+	}]
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Feeds/03-rdf.js

@@ -0,0 +1,20 @@
+exports.name = "RDF test";
+exports.file = "/RDF_Example.xml";
+exports.expected = {
+	"type": "rdf",
+	"id": "",
+	"title": "craigslist | all community in SF bay area",
+	"link": "http://sfbay.craigslist.org/ccc/",
+	"items": [
+		{
+			"title": "Music Equipment Repair and Consignment",
+			"link": "http://sfbay.craigslist.org/sby/muc/2681301534.html",
+			"description": "San Jose Rock Shop offers musical instrument repair and consignment! (408) 215-2065<br> <br> We are pleased to announce our NEW LOCATION: 1199 N 5th st. San Jose, ca 95112. Please call ahead, by appointment only.<br> <br> Recently featured by Metro Newspaper in their 2011 Best of the Silicon Valley edition see it online here:<br> <a href=\"http://www.metroactive.com/best-of-silicon-valley/2011/music-nightlife/editor-picks.html\" rel=\"nofollow\">http://www.metroactive.com/best-of-silicon-valley/2011/music-nightlife/editor-picks.html</a><br> <br> Guitar Set up (acoustic and electronic) $40!<!-- END CLTAGS -->"
+		},
+		{
+			"title": "Ride Offered - Oakland/BART to LA/SFV - TODAY 3PM 11/04 (oakland north / temescal)",
+			"link": "http://sfbay.craigslist.org/eby/rid/2685010755.html",
+			"description": "Im offering a lift for up to two people from Oakland (or near any BART station in the East Bay/580/880 Corridor, or San Jose/Morgan Hill, Gilroy) to the San Fernando Valley / Los Angeles area. Specifically, Im leaving from Oakland between 2:30 and 3:00pm (this is flexible, but if I leave too late my girlfriend will kill me), and heading to Woodland Hills via the 580, I-5, 405, and 101.<!-- END CLTAGS -->"
+		}
+	]
+};

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Stream/01-basic.json

@@ -0,0 +1,83 @@
+{
+  "name": "Basic html",
+  "options": {},
+  "file": "Basic.html",
+  "expected": [
+    {
+      "event": "processinginstruction",
+      "data": [
+        "!doctype",
+        "!DOCTYPE html"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "html"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "html",
+        {}
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "title",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "The Title"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "body"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "body",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "Hello world"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "body"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "html"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Stream/03-Atom.json

@@ -0,0 +1,678 @@
+{
+  "name": "Atom feed",
+  "options": {"xmlMode": true},
+  "file": "Atom_Example.xml",
+  "expected": [
+    {
+      "event": "processinginstruction",
+      "data": [
+        "?xml",
+        "?xml version=\"1.0\" encoding=\"utf-8\"?"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "comment",
+      "data": [
+        " http://en.wikipedia.org/wiki/Atom_%28standard%29 "
+      ]
+    },
+    {
+      "event": "commentend",
+      "data": []
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "feed"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "xmlns",
+        "http://www.w3.org/2005/Atom"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "feed",
+        {
+          "xmlns": "http://www.w3.org/2005/Atom"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "title",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "Example Feed"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "subtitle"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "subtitle",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "A subtitle."
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "subtitle"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "href",
+        "http://example.org/feed/"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "rel",
+        "self"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "link",
+        {
+          "href": "http://example.org/feed/",
+          "rel": "self"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "href",
+        "http://example.org/"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "link",
+        {
+          "href": "http://example.org/"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "id"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "id",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "urn:uuid:60a76c80-d399-11d9-b91C-0003939e0af6"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "id"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "updated"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "updated",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "2003-12-13T18:30:02Z"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "updated"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "author"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "author",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "name"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "name",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "John Doe"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "name"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "email"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "email",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "johndoe@example.com"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "email"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "author"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "entry"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "entry",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "title",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "Atom-Powered Robots Run Amok"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "href",
+        "http://example.org/2003/12/13/atom03"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "link",
+        {
+          "href": "http://example.org/2003/12/13/atom03"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "rel",
+        "alternate"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "type",
+        "text/html"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "href",
+        "http://example.org/2003/12/13/atom03.html"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "link",
+        {
+          "rel": "alternate",
+          "type": "text/html",
+          "href": "http://example.org/2003/12/13/atom03.html"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "rel",
+        "edit"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "href",
+        "http://example.org/2003/12/13/atom03/edit"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "link",
+        {
+          "rel": "edit",
+          "href": "http://example.org/2003/12/13/atom03/edit"
+        }
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "link"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "id"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "id",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "urn:uuid:1225c695-cfb8-4ebb-aaaa-80da344efa6a"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "id"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "updated"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "updated",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "2003-12-13T18:30:02Z"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "updated"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t\t"
+      ]
+    },
+    {
+    "event": "opentagname",
+      "data": [
+        "content"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "type",
+        "html"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "content",
+        {
+          "type": "html"
+        }
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "p"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "p",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "Some content."
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "p"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "content"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "entry"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\n"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "feed"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/Stream/05-Attributes.json

@@ -0,0 +1,354 @@
+{
+  "name": "Attributes",
+  "options": {},
+  "file": "Attributes.html",
+  "expected": [
+    {
+      "event": "processinginstruction",
+      "data": [
+        "!doctype",
+        "!doctype html"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "html"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "html",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "head"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "head",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "title",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "Attributes test"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "title"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "head"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "body"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "body",
+        {}
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "comment",
+      "data": [
+        " Normal attributes "
+      ]
+    },
+    {
+      "event": "commentend",
+      "data": []
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "id",
+        "test0"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "value0"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "title",
+        "value1"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "button",
+        {
+          "id": "test0",
+          "class": "value0",
+          "title": "value1"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "class=\"value0\" title=\"value1\""
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\n\t"
+      ]
+    },
+    {
+      "event": "comment",
+      "data": [
+        " Attributes with no quotes or value "
+      ]
+    },
+    {
+      "event": "commentend",
+      "data": []
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "id",
+        "test1"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "value2"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "disabled",
+        ""
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "button",
+        {
+          "id": "test1",
+          "class": "value2",
+          "disabled": ""
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "class=value2 disabled"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\n\t"
+      ]
+    },
+    {
+      "event": "comment",
+      "data": [
+        " Attributes with no space between them. No valid, but accepted by the browser "
+      ]
+    },
+    {
+      "event": "commentend",
+      "data": []
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n\t"
+      ]
+    },
+    {
+      "event": "opentagname",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "id",
+        "test2"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "class",
+        "value4"
+      ]
+    },
+    {
+      "event": "attribute",
+      "data": [
+        "title",
+        "value5"
+      ]
+    },
+    {
+      "event": "opentag",
+      "data": [
+        "button",
+        {
+          "id": "test2",
+          "class": "value4",
+          "title": "value5"
+        }
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "class=\"value4\"title=\"value5\""
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "button"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "body"
+      ]
+    },
+    {
+      "event": "text",
+      "data": [
+        "\n"
+      ]
+    },
+    {
+      "event": "closetag",
+      "data": [
+        "html"
+      ]
+    }
+  ]
+}

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/api.js

@@ -0,0 +1,75 @@
+var htmlparser2 = require(".."),
+    assert = require("assert");
+
+describe("API", function(){
+
+	it("should load all modules", function(){
+		var Stream = require("../lib/Stream.js");
+		assert.strictEqual(htmlparser2.Stream, Stream, "should load module");
+		assert.strictEqual(htmlparser2.Stream, Stream, "should load it again (cache)");
+
+		var ProxyHandler = require("../lib/ProxyHandler.js");
+		assert.strictEqual(htmlparser2.ProxyHandler, ProxyHandler, "should load module");
+		assert.strictEqual(htmlparser2.ProxyHandler, ProxyHandler, "should load it again (cache)");
+	});
+
+	it("should work without callbacks", function(){
+		var p = new htmlparser2.Parser(null, {xmlMode: true, lowerCaseAttributeNames: true});
+
+		p.end("<a foo><bar></a><!-- --><![CDATA[]]]><?foo?><!bar><boo/>boohay");
+		p.write("foo");
+
+		//check for an error
+		p.end();
+		var err = false;
+		p._cbs.onerror = function(){ err = true; };
+		p.write("foo");
+		assert(err);
+		err = false;
+		p.end();
+		assert(err);
+
+		p.reset();
+
+		//remove method
+		p._cbs.onopentag = function(){};
+		p.write("<a foo");
+		p._cbs.onopentag = null;
+		p.write(">");
+
+		//pause/resume
+		var processed = false;
+		p._cbs.ontext = function(t){
+			assert.equal(t, "foo");
+			processed = true;
+		};
+		p.pause();
+		p.write("foo");
+		assert(!processed);
+		p.resume();
+		assert(processed);
+		processed = false;
+		p.pause();
+		assert(!processed);
+		p.resume();
+		assert(!processed);
+		p.pause();
+		p.end("foo");
+		assert(!processed);
+		p.resume();
+		assert(processed);
+
+	});
+
+	it("should update the position", function(){
+		var p = new htmlparser2.Parser(null);
+
+		p.write("foo");
+
+		assert.equal(p.startIndex, 0);
+
+		p.write("<bar>");
+
+		assert.equal(p.startIndex, 3);
+	});
+});

samples/client/petstore-security-test/javascript/node_modules/htmlparser2/test/test-helper.js

@@ -0,0 +1,83 @@
+var htmlparser2 = require(".."),
+    fs = require("fs"),
+    path = require("path"),
+    assert = require("assert"),
+	Parser = htmlparser2.Parser,
+	CollectingHandler = htmlparser2.CollectingHandler;
+
+exports.writeToParser = function(handler, options, data){
+	var parser = new Parser(handler, options);
+	//first, try to run the test via chunks
+	for(var i = 0; i < data.length; i++){
+		parser.write(data.charAt(i));
+	}
+	parser.end();
+	//then parse everything
+	parser.parseComplete(data);
+};
+
+//returns a tree structure
+exports.getEventCollector = function(cb){
+	var handler = new CollectingHandler({onerror: cb, onend: onend});
+
+	return handler;
+
+	function onend(){
+		cb(null, handler.events.reduce(eventReducer, []));
+	}
+};
+
+function eventReducer(events, arr){
+	if(arr[0] === "onerror" || arr[0] === "onend");
+	else if(arr[0] === "ontext" && events.length && events[events.length - 1].event === "text"){
+		events[events.length - 1].data[0] += arr[1];
+	} else {
+		events.push({
+			event: arr[0].substr(2),
+			data: arr.slice(1)
+		});
+	}
+
+	return events;
+}
+
+function getCallback(expected, done){
+	var repeated = false;
+
+	return function(err, actual){
+		assert.ifError(err);
+		try {
+			assert.deepEqual(expected, actual, "didn't get expected output");
+		} catch(e){
+			e.expected = JSON.stringify(expected, null, 2);
+			e.actual = JSON.stringify(actual, null, 2);
+			throw e;
+		}
+
+		if(repeated) done();
+		else repeated = true;
+	};
+}
+
+exports.mochaTest = function(name, root, test){
+	describe(name, readDir);
+
+	function readDir(){
+		var dir = path.join(root, name);
+
+		fs
+		.readdirSync(dir)
+		.filter(RegExp.prototype.test, /^[^\._]/) //ignore all files with a leading dot or underscore
+		.map(function(name){
+			return path.join(dir, name);
+		})
+		.map(require)
+		.forEach(runTest);
+	}
+
+	function runTest(file){
+		it(file.name, function(done){
+			test(file, getCallback(file.expected, done));
+		});
+	}
+};