@bilt/build-with-configuration - npm Package Compare versions

Comparing version 1.0.1 to 2.0.0

package.json

 {
   "name": "@bilt/build-with-configuration",
-  "version": "1.0.1",
+  "version": "2.0.0",
   "description": "",
@@ -5,0 +5,0 @@ "main": "src/build-with-configuration.js",

src/build-with-configuration.js

@@ -9,6 +9,18 @@ 'use strict'
  * @param {{[x: string]: boolean|string}} buildOptions
+ * @param {{[x: string]: any}} javascriptOptionsParameter
  * @returns {AsyncGenerator<import('./execute-step').StepInfo, void, void>}
  */
-async function* executeJob(jobConfiguration, phase, directoryToExecuteIn, buildOptions) {
-  yield* executePhase(jobConfiguration.steps[phase], directoryToExecuteIn, buildOptions)
+async function* executeJob(
+  jobConfiguration,
+  phase,
+  directoryToExecuteIn,
+  buildOptions,
+  javascriptOptionsParameter,
+) {
+  yield* executePhase(
+    jobConfiguration.steps[phase],
+    directoryToExecuteIn,
+    buildOptions,
+    javascriptOptionsParameter,
+  )
 }
@@ -45,9 +57,15 @@
  * @param {{[x: string]: boolean|string}} buildOptions
+ * @param {{[x: string]: any}} javascriptOptionsParameter
  * @returns {AsyncGenerator<import('./execute-step').StepInfo>}
  */
-async function* executePhase(steps, directoryToExecuteIn, buildOptions) {
+async function* executePhase(
+  steps,
+  directoryToExecuteIn,
+  buildOptions,
+  javascriptOptionsParameter,
+) {
   for (const step of steps) {
     if (isStepEnabled(stepInfo(step).enableOptions, buildOptions)) {
       yield stepInfo(step)
-      await executeStep(step, directoryToExecuteIn, buildOptions)
+      await executeStep(step, directoryToExecuteIn, buildOptions, javascriptOptionsParameter)
     }
@@ -54,0 +72,0 @@ }

src/execute-step.js

 'use strict'
-const {compileFunction} = require('vm')
+const vm = require('vm')
 const {constantCase} = require('constant-case')
@@ -31,5 +31,6 @@ const {sh} = require('@bilt/scripting-commons')
  * @param {{[x: string]: boolean|string}} buildOptions
+ * @param {{[x: string]: any}} javascriptOptionsParameter
  * @returns {Promise<void>}
  */
-async function executeStep(step, cwd, buildOptions) {
+async function executeStep(step, cwd, buildOptions, javascriptOptionsParameter) {
   const name = step.name
@@ -40,4 +41,4 @@ const runCommand = step.run
 
-  if (await executeCondition(runCondition, cwd)) {
-    await executeCommand(name, runCommand, runEnv, cwd, buildOptions)
+  if (await executeCondition(runCondition, javascriptOptionsParameter)) {
+    await executeCommand(name, runCommand, runEnv, cwd, buildOptions, javascriptOptionsParameter)
   }
@@ -48,10 +49,10 @@ }
  * @param {import('./types').BooleanValueOrFunctionText} condition
- * @param {string} cwd
+ * @param {{[x: string]: any}} javascriptOptionsParameter
  * @returns {Promise<boolean>}
  */
-async function executeCondition(condition, cwd) {
+async function executeCondition(condition, javascriptOptionsParameter) {
   if (!condition) {
     return true
   }
-  return await executeFunction(condition, {directory: cwd})
+  return await executeFunction(condition, javascriptOptionsParameter)
 }
@@ -64,5 +65,6 @@
  * @param {string} cwd
+ * @param {{[x: string]: any}} javascriptOptionsParameter
  * @param {any} buildOptions
  */
-async function executeCommand(name, command, env, cwd, buildOptions) {
+async function executeCommand(name, command, env, cwd, buildOptions, javascriptOptionsParameter) {
   if (!command) throw new Error(`Step ${name} must have a command`)
@@ -76,3 +78,3 @@
     for (const [envVar, value] of Object.entries(env)) {
-      envVars[envVar] = await executeFunction(value, {directory: cwd})
+      envVars[envVar] = await executeFunction(value, javascriptOptionsParameter)
     }
@@ -84,9 +86,11 @@ }
 
+const contextWithRequire = vm.createContext({require})
+
 /**
  * @param {any|{function: string}} functionAsText
- * @param {{ directory: string; }} optionsParameter
+ * @param {{[x: string]: any}} javascriptOptionsParameter
  */
-async function executeFunction(functionAsText, optionsParameter) {
+async function executeFunction(functionAsText, javascriptOptionsParameter) {
   if (typeof functionAsText === 'object')
-    return await compileFunction(
+    return await vm.compileFunction(
       `
@@ -96,3 +100,4 @@ return (${functionAsText.function})(options)
       ['options'],
-    )(optionsParameter)
+      {parsingContext: contextWithRequire},
+    )(javascriptOptionsParameter)
 
@@ -99,0 +104,0 @@ return functionAsText

New alerts

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

12341

increased by5.9%

Lines of code

342

increased by6.88%

Worsened metrics

Number of low supply chain risk alerts

3

increased by50%

No dependency changes