Backport from v4

.github/codeql/codeql-config.yml

@@ -0,0 +1,2 @@
+paths-ignore:
+  - '**/bundle.js'

.github/stale.yml

@@ -5,7 +5,7 @@ daysUntilClose: 7
 # Issues with these labels will never be considered stale
 exemptLabels:
   - pinned
-  - security
+  - area:security
 # Label to use when marking an issue as stale
 staleLabel: wontfix
 # Comment to post when marking an issue as stale. Set to `false` to disable

.github/workflows/build.yml

@@ -11,14 +11,14 @@ jobs:
         os: [ubuntu-latest, macos-latest]
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Setup .NET Core
-      uses: actions/setup-dotnet@v1
+      uses: actions/setup-dotnet@v2
       with:
-        dotnet-version: 5.0
+        dotnet-version: 6.0
     - name: Test with dotnet
       run: dotnet test /p:CollectCoverage=true /p:CoverletOutputFormat=lcov /p:Exclude=[NUnit3.TestAdapter]* ./test/EmbedIO.Tests/EmbedIO.Tests.csproj -c Release
-    - uses: codecov/codecov-action@v1
+    - uses: codecov/codecov-action@v3
       with:
         file: test/EmbedIO.Tests/coverage.info
         token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,67 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [master, "v[1-9].X"]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master, "v[1-9].X"]
+  schedule:
+    - cron: '0 6 * * 6'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['csharp', 'javascript']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        config-file: ./.github/codeql/codeql-config.yml
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file. 
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

Directory.Build.props

@@ -5,22 +5,22 @@
   </PropertyGroup>
 
   <PropertyGroup>
-    <Copyright>Copyright (C) Unosquare 2013-2021</Copyright>
+    <Copyright>Copyright (C) Unosquare 2013-2022</Copyright>
     <Version>3.5.0</Version>
   </PropertyGroup>
 
   <PropertyGroup>
+    <Deterministic>true</Deterministic>
     <LangVersion>latest</LangVersion>
     <Nullable>enable</Nullable>
     <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
     <CodeAnalysisRuleSet>$(MSBuildThisFileDirectory)StyleCop.Analyzers.ruleset</CodeAnalysisRuleSet>
+    <AnalysisLevel>latest</AnalysisLevel>
+    <AnalysisMode>All</AnalysisMode>
+    <EnableNETAnalyzers>true</EnableNETAnalyzers>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.CodeAnalysis.FxCopAnalyzers">
-      <PrivateAssets>all</PrivateAssets>
-      <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
-    </PackageReference>
     <PackageReference Include="StyleCop.Analyzers">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>

Directory.Packages.props

@@ -1,14 +1,13 @@
 <Project>
 
   <ItemGroup>
-    <PackageVersion Include="coverlet.msbuild" Version="3.0.2" />
-    <PackageVersion Include="Microsoft.CodeAnalysis.FxCopAnalyzers" Version="3.3.2" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="16.8.3" />
+    <PackageVersion Include="coverlet.msbuild" Version="3.1.2" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.2.0" />
     <PackageVersion Include="Nullable" Version="1.3.0" />
-    <PackageVersion Include="NUnit" Version="3.13.1" />
-    <PackageVersion Include="NUnit3TestAdapter" Version="3.17.0" />
-    <PackageVersion Include="StyleCop.Analyzers" Version="1.1.118" />
-    <PackageVersion Include="Tubular.ServerSide" Version="4.0.0" />
+    <PackageVersion Include="NUnit" Version="3.13.3" />
+    <PackageVersion Include="NUnit3TestAdapter" Version="4.2.1" />
+    <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.435" />
+    <PackageVersion Include="Tubular.ServerSide" Version="4.0.1" />
     <PackageVersion Include="Unosquare.Swan.Lite" Version="3.1.0" />
   </ItemGroup>
 

EmbedIO.sln

@@ -1,7 +1,7 @@
 
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 16
-VisualStudioVersion = 16.0.29609.76
+# Visual Studio Version 17
+VisualStudioVersion = 17.2.32526.322
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{97BC259A-4E78-4BA8-8F4D-2656BC78BB34}"
 EndProject

EmbedIO.sln.DotSettings

@@ -467,6 +467,7 @@
 	<s:Int64 x:Key="/Default/CodeStyle/Naming/CSharpAutoNaming/AutoNamingCompletedVersion/@EntryValue">2</s:Int64>
 	<s:Boolean x:Key="/Default/CodeStyle/Naming/CSharpAutoNaming/IsNotificationDisabled/@EntryValue">True</s:Boolean>
 	<s:String x:Key="/Default/Connection/XmlConnectionList/@EntryValue">&lt;Configurator&gt;&lt;ConnectList /&gt;&lt;/Configurator&gt;</s:String>
+	<s:Boolean x:Key="/Default/Environment/SettingsMigration/IsMigratorApplied/=JetBrains_002EdotCover_002EInteractive_002ECore_002EFilterManagement_002EMigration_002EGlobalFilterSettingsManagerMigrateSettings/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/Environment/SettingsMigration/IsMigratorApplied/=JetBrains_002EReSharper_002EPsi_002ECSharp_002ECodeStyle_002ECSharpKeepExistingMigration/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/Environment/SettingsMigration/IsMigratorApplied/=JetBrains_002EReSharper_002EPsi_002ECSharp_002ECodeStyle_002ECSharpPlaceEmbeddedOnSameLineMigration/@EntryIndexedValue">True</s:Boolean>
 	<s:Boolean x:Key="/Default/Environment/SettingsMigration/IsMigratorApplied/=JetBrains_002EReSharper_002EPsi_002ECSharp_002ECodeStyle_002ECSharpUseContinuousIndentInsideBracesMigration/@EntryIndexedValue">True</s:Boolean>

NuGet.config

@@ -0,0 +1,12 @@
+<!-- See https://docs.microsoft.com/en-us/nuget/consume-packages/package-source-mapping -->
+<configuration>
+  <packageSources>
+    <clear />
+    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="nuget.org">
+      <package pattern="*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

README.md

@@ -223,9 +223,9 @@ namespace Unosquare
     /// <summary>
     /// Defines a very simple chat server.
     /// </summary>
-    public class WebSocketsChatServer : WebSocketModule
+    public class WebSocketsChatModule : WebSocketModule
     {
-        public WebSocketsChatServer(string urlPath)
+        public WebSocketsChatModule(string urlPath)
             : base(urlPath, true)
         {
             // placeholder

appveyor.yml

@@ -1,7 +1,5 @@
 version: '3.0.{build}'
-image: 
-- Visual Studio 2019
-- Ubuntu
+image: ["Visual Studio 2022"] # TODO: change back to ["Visual Studio 2022", "Ubuntu"] when Ubuntu image gets .NET SDK updated to 6.0.300
 environment:
   APPVEYOR_YML_DISABLE_PS_LINUX: true
   COVERALLS_REPO_TOKEN:  

global.json

@@ -0,0 +1,7 @@
+{
+  "sdk": {
+    "version": "6.0.300",
+    "rollForward": "latestMinor",
+    "allowPrerelease": false
+  }
+}

src/EmbedIO.Samples/EmbedIO.Samples.csproj

@@ -1,7 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net5.0</TargetFramework>
+    <TargetFramework>net6.0</TargetFramework>
     <AssemblyName>EmbedIO.Samples</AssemblyName>
     <OutputType>Exe</OutputType>
     <IsPackable>false</IsPackable>

src/EmbedIO/Files/Internal/HtmlDirectoryLister.cs

@@ -4,7 +4,6 @@
 using System.IO;
 using System.Linq;
 using System.Net;
-using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
 using EmbedIO.Utilities;
@@ -52,7 +51,7 @@ public async Task ListDirectoryAsync(
 
             foreach (var directory in entries.Where(m => m.IsDirectory).OrderBy(e => e.Name))
             {
-                text.Write($"<a href=\"{Uri.EscapeDataString(directory.Name)}{Path.DirectorySeparatorChar}\">{WebUtility.HtmlEncode(directory.Name)}</a>");
+                text.Write($"<a href=\"{Uri.EscapeDataString(directory.Name)}\">{WebUtility.HtmlEncode(directory.Name)}</a>");
                 text.Write(new string(' ', Math.Max(1, MaxEntryLength - directory.Name.Length + 1)));
                 text.Write(HttpDate.Format(directory.LastModifiedUtc));
                 text.Write('\n');

src/EmbedIO/Net/Internal/HttpListenerRequest.cs

@@ -218,10 +218,11 @@ internal void FinishInitialization()
                 host = rawUri?.Host ?? UserHostAddress;
             }
 
-            var colon = host.LastIndexOf(':');
-            if (colon >= 0)
+            var colonPos = host.LastIndexOf(':');
+            var closedSquareBracketPos = host.LastIndexOf(']');
+            if (colonPos >= 0 && closedSquareBracketPos < colonPos)
             {
-                host = host.Substring(0, colon);
+                host = host.Substring(0, colonPos);
             }
 
             // var baseUri = $"{(IsSecureConnection ? "https" : "http")}://{host}:{LocalEndPoint.Port}";

src/EmbedIO/Net/Internal/HttpListenerResponse.cs

@@ -177,8 +177,8 @@ internal MemoryStream SendHeaders(bool closing)
         {
             if (_contentType != null)
             {
-                var contentTypeValue = _contentType.IndexOf("charset=", StringComparison.Ordinal) == -1
-                    ? $"{_contentType}; charset={WebServer.DefaultEncoding.WebName}"
+                var contentTypeValue = _contentType.IndexOf("charset=", StringComparison.Ordinal) == -1 && ContentEncoding is not null
+                    ? $"{_contentType}; charset={ContentEncoding.WebName}"
                     : _contentType;
 
                 Headers.Add(HttpHeaderNames.ContentType, contentTypeValue);
@@ -194,25 +194,37 @@ internal MemoryStream SendHeaders(bool closing)
                 Headers.Add(HttpHeaderNames.Date, HttpDate.Format(DateTime.UtcNow));
             }
 
-            if (closing)
+            // HTTP did not support chunked transfer encoding before version 1.1;
+            // besides, there's no point in setting transfer encoding at all without a request body.
+            if (closing || ProtocolVersion < HttpVersion.Version11)
             {
-                Headers[HttpHeaderNames.ContentLength] = "0";
                 _chunked = false;
             }
-            else
+
+            // Was content length set to a valid value, AND chunked encoding not set?
+            // Note that this does not mean that a response body _will_ be sent
+            // as this could be the response to a HEAD request.
+            var haveContentLength = !_chunked
+                 && Headers.ContainsKey(HttpHeaderNames.ContentLength)
+                 && long.TryParse(Headers[HttpHeaderNames.ContentLength], NumberStyles.None, CultureInfo.InvariantCulture, out var contentLength)
+                 && contentLength >= 0L;
+
+            if (!haveContentLength)
             {
-                if (ProtocolVersion < HttpVersion.Version11)
+                // Content length could have been set to an invalid value (e.g. "-1")
+                // so we must either force it to 0, or remove the header completely.
+                if (closing)
                 {
-                    _chunked = false;
+                    // Content length was not explicitly set to a valid value,
+                    // and there is no request body.
+                    Headers[HttpHeaderNames.ContentLength] = "0";
                 }
-
-                var haveContentLength = !_chunked
-                                     && Headers.ContainsKey(HttpHeaderNames.ContentLength)
-                                     && long.TryParse(Headers[HttpHeaderNames.ContentLength], out var contentLength)
-                                     && contentLength >= 0L;
-
-                if (!haveContentLength)
+                else
                 {
+                    // Content length was not explicitly set to a valid value,
+                    // and we're going to send a request body.
+                    //   - Remove possibly invalid Content-Length header
+                    //   - Enable chunked transfer encoding for HTTP 1.1
                     Headers.Remove(HttpHeaderNames.ContentLength);
                     if (ProtocolVersion >= HttpVersion.Version11)
                     {