@existdb/node-exist - npm Package Compare versions

Comparing version 4.1.0 to 4.1.1

spec/tests/readenv.js

+const test = require('tape')
+
+const { readOptionsFromEnv } = require('../../index')
+
+test('connection options from environment', function (t) {
+  const optionsFromEnv = readOptionsFromEnv()
+  const userIsSet = process.env.EXISTDB_USER && process.env.EXISTDB_PASS
+  const serverIsSet = 'EXISTDB_SERVER' in process.env
+
+  if (serverIsSet) {
+    const { hostname, port, protocol } = new URL(process.env.EXISTDB_SERVER)
+    t.equal(optionsFromEnv.port, port)
+    t.equal(optionsFromEnv.secure, protocol === 'https:')
+    t.equal(optionsFromEnv.host, hostname)
+  } else {
+    t.false('port' in optionsFromEnv)
+    t.false('secure' in optionsFromEnv)
+    t.false('host' in optionsFromEnv)
+  }
+
+  if (userIsSet) {
+    t.ok(optionsFromEnv.basic_auth)
+    t.equal(optionsFromEnv.basic_auth.user, process.env.EXISTDB_USER)
+    t.equal(optionsFromEnv.basic_auth.pass, process.env.EXISTDB_PASS)
+  } else {
+    t.false('basic_auth' in optionsFromEnv)
+  }
+
+  t.end()
+})
+
+test('test user set in env', function (t) {
+  process.env.EXISTDB_USER = 'test'
+  process.env.EXISTDB_PASS = 'test'
+  const optionsFromEnv = readOptionsFromEnv()
+  t.ok(optionsFromEnv.basic_auth)
+  t.equal(optionsFromEnv.basic_auth.user, 'test')
+  t.equal(optionsFromEnv.basic_auth.pass, 'test')
+  t.end()
+})
+
+test('test user set in env with empty password', function (t) {
+  process.env.EXISTDB_USER = 'test'
+  process.env.EXISTDB_PASS = ''
+  const optionsFromEnv = readOptionsFromEnv()
+  t.ok(optionsFromEnv.basic_auth)
+  t.equal(optionsFromEnv.basic_auth.user, 'test')
+  t.equal(optionsFromEnv.basic_auth.pass, '')
+  t.end()
+})
+
+test('empty user set in env', function (t) {
+  process.env.EXISTDB_USER = ''
+  process.env.EXISTDB_PASS = 'test1234'
+  const optionsFromEnv = readOptionsFromEnv()
+  t.false('basic_auth' in optionsFromEnv)
+  t.end()
+})
+
+test('only user set in env', function (t) {
+  process.env.EXISTDB_USER = 'test'
+  delete process.env.EXISTDB_PASS
+  const optionsFromEnv = readOptionsFromEnv()
+  t.notOk(optionsFromEnv.basic_auth)
+  t.end()
+})

components/connection.js

@@ -85,3 +85,3 @@ const xmlrpc = require('xmlrpc')
 
-  if (process.env.EXISTDB_USER && process.env.EXISTDB_PASS) {
+  if (process.env.EXISTDB_USER && 'EXISTDB_PASS' in process.env) {
     environmentOptions.basic_auth = {
@@ -88,0 +88,0 @@ user: process.env.EXISTDB_USER,

package.json

@@ -6,3 +6,3 @@ {
   "scripts": {
-    "test": "node_modules/.bin/standard && node_modules/.bin/tape spec/tests/*.js",
+    "test": "standard && tape spec/tests/*.js",
     "semantic-release": "semantic-release",
@@ -47,3 +47,3 @@ "travis-deploy-once": "travis-deploy-once"
     "@semantic-release/github": "^7.2.3",
-    "semantic-release": "^17.4.4",
+    "semantic-release": "^18.0.0",
     "standard": "^16.0.0",
@@ -57,3 +57,3 @@ "tape": "^5.0.1"
   },
-  "version": "4.1.0"
+  "version": "4.1.1"
 }

readme.md

 # node-exist
 
-![example branch parameter](https://github.com/exist-db/node-exist/actions/workflows/semantic-release.yml/badge.svg)
+![semantic release status](https://github.com/exist-db/node-exist/actions/workflows/semantic-release.yml/badge.svg)
 [![js-standard-style](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](http://standardjs.com/)
@@ -69,3 +69,3 @@
 You can also have a look at the 
-[examples](https://github.com/eXist-db/node-exist/tree/master/spec/examples) for more use-cases.
+[examples](spec/examples) for more use-cases.
 
@@ -72,0 +72,0 @@ ## Configuration

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 4 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

56364

3.56%

Number of package files

38

2.7%

Lines of code

1055

5.71%

Number of medium supply chain risk alerts

0

-100%

Worsened metrics

Number of low supply chain risk alerts

24

140%

No dependency changes