machinepack-process - npm Package Compare versions

Comparing version 3.0.0-1 to 3.0.0-2

machines/escape-as-command-line-opt.js

@@ -64,4 +64,4 @@ module.exports = {
 
-    // Import `isString` Lodash function.
-    var isString = require('lodash.isstring');
+    // Import `lodash`.
+    var _ = require('lodash');
 
@@ -75,3 +75,3 @@ // Import `machinepack-json`.
     // If this is a string, we'll use it verbatim.
-    if (isString(inputs.value)) {
+    if (_.isString(inputs.value)) {
       stringToEscape = inputs.value;
@@ -78,0 +78,0 @@ }

machines/execute-command.js

@@ -94,5 +94,4 @@ module.exports = {
 
-    // Import `isObject` and `isUndefined` Lodash functions.
-    var isObject = require('lodash.isobject');
-    var isUndefined = require('lodash.isundefined');
+    // Import `lodash`.
+    var _ = require('lodash');
 
@@ -103,3 +102,3 @@ // First, build up the options to pass in to `child_process.exec()`.
     // Determine the appropriate `cwd` for `child_process.exec()`.
-    if (isUndefined(inputs.dir)) {
+    if (_.isUndefined(inputs.dir)) {
       // Default directory to current working directory
@@ -118,3 +117,3 @@ childProcOpts.cwd = process.cwd();
     // If `timeout` was provided...
-    if (!isUndefined(inputs.timeout)) {
+    if (!_.isUndefined(inputs.timeout)) {
 
@@ -131,5 +130,10 @@ // If the timeout < 1 millisecond, return a validation error through our `error` exit.
 
+
     // If `environmentVars` were provided, pass them in to `child_process.exec()`.
-    if (!isUndefined(inputs.environmentVars)) {
-      childProcOpts.env = inputs.environmentVars;
+    // (Otherwise, by default, the child process receives the parent process's `process.env`)
+    if (!_.isUndefined(inputs.environmentVars)) {
+      // Notice that we carefully expose parent process's env variables to the
+      // child process's environment, while still letting the deliberately passed-in
+      // `evironmentVars` take precedence.
+      childProcOpts.env = _.extend({}, process.env, inputs.environmentVars);
     }
@@ -155,3 +159,3 @@
         // Node v0.12 changed this a bit and we want to future-proof ourselves if possible.
-        if (!isObject(err)) {
+        if (!_.isObject(err)) {
           return exits.error(err);
@@ -158,0 +162,0 @@ }

machines/kill-child-process.js

@@ -70,7 +70,8 @@ module.exports = {
   fn: function (inputs,exits) {
-    var isObject = require('lodash.isobject');
-    var isFunction = require('lodash.isfunction');
 
+    // Import `lodash`.
+    var _ = require('lodash');
+
     // Validate that the provided child process instance is at least close to the real deal.
-    if (!isObject(inputs.childProcess) || !isFunction(inputs.childProcess.kill) || !isFunction(inputs.childProcess.on) || !isFunction(inputs.childProcess.removeListener)) {
+    if (!_.isObject(inputs.childProcess) || !_.isFunction(inputs.childProcess.kill) || !_.isFunction(inputs.childProcess.on) || !_.isFunction(inputs.childProcess.removeListener)) {
       // If not, leave through the `invalidChildProcess` exit.
@@ -77,0 +78,0 @@ return exits.invalidChildProcess();

machines/spawn-child-process.js

@@ -34,4 +34,4 @@ module.exports = {
     cliArgs: {
-      friendlyName: 'CLI args',
-      description: 'An array of command-line arguments (e.g. `commit` or `install`) and/or options (e.g. `-al` or `-f 7` or `--foo=\'bar\'`) to pass in.',
+      friendlyName: 'CLI args/opts',
+      description: 'An array of serial command-line arguments (e.g. `commit` or `install`) and/or options (e.g. `-al` or `-f 7` or `--foo=\'bar\'`) to pass in.',
       example: ['-la'],
@@ -79,4 +79,4 @@ defaultsTo: []
 
-    // Import the `isUndefined` Lodash function.
-    var isUndefined = require('lodash.isundefined');
+    // Import `lodash`.
+    var _ = require('lodash');
 
@@ -87,3 +87,3 @@ // First, build up the options to pass in to `child_process.spawn()`.
     // Determine the appropriate `cwd` for `child_process.exec()`.
-    if (isUndefined(inputs.dir)) {
+    if (_.isUndefined(inputs.dir)) {
       // Default directory to current working directory
@@ -99,4 +99,8 @@ childProcOpts.cwd = process.cwd();
     // If `environmentVars` were provided, pass them in to `child_process.exec()`.
-    if (!isUndefined(inputs.environmentVars)) {
-      childProcOpts.env = inputs.environmentVars;
+    // (Otherwise, by default, the child process receives the parent process's `process.env`)
+    if (!_.isUndefined(inputs.environmentVars)) {
+      // Notice that we carefully expose parent process's env variables to the
+      // child process's environment, while still letting the deliberately passed-in
+      // `evironmentVars` take precedence.
+      childProcOpts.env = _.extend({}, process.env, inputs.environmentVars);
     }
@@ -103,0 +107,0 @@

package.json

 {
   "name": "machinepack-process",
-  "version": "3.0.0-1",
+  "version": "3.0.0-2",
   "description": "Work with child procs and the running process.",
@@ -16,6 +16,3 @@ "scripts": {
   "dependencies": {
-    "lodash.isfunction": "3.0.8",
-    "lodash.isobject": "3.0.2",
-    "lodash.isstring": "4.0.1",
-    "lodash.isundefined": "3.0.1",
+    "lodash": "3.10.1",
     "machine": "^13.0.0-7",
@@ -27,3 +24,2 @@ "machinepack-json": "~2.0.0",
     "async": "2.0.1",
-    "lodash": "3.10.1",
     "mocha": "3.0.2",
@@ -30,0 +26,0 @@ "test-machinepack-mocha": "^2.1.7"

tests/spawn-child-process.test.js

@@ -5,2 +5,3 @@ /**
 
+var assert = require('assert');
 var _ = require('lodash');
@@ -44,2 +45,65 @@ var async = require('async');
 
+  describe('when providing env vars', function(){
+    var childProc;
+
+    it('should still have access to env of parent process', function (done){
+
+      // Set a couple of env vars in parent process.
+      process.env.foobar = 'gee';
+      process.env.beep = 'boop';
+
+      // Used below for double-checking that we didn't inadvertentely corrupt
+      // the parent process's environment.
+      var envVarsBackup = _.cloneDeep(process.env);
+
+      // Used below for verifying that the child proc had access to
+      // the expected env vars.
+      var conglomeratedBufferedStdout = '';
+
+      // Now spawn child proc.
+      var _childProc = Pack.spawnChildProcess({
+        command: 'node',
+        cliArgs: ['-e', 'console.log(process.env.foobar + \' \' + process.env.baz + process.env.beep);'],
+        environmentVars: {
+          baz: 'williker',
+          beep: 's' // << to override the `beep` env var we set in our parent proc
+        }
+      }).execSync();
+      childProc = _childProc;
+      childProc.once('error', function whenFirstErrorIsEmitted(err){ return done(err); });
+
+      // Receive output from the child process.
+      childProc.stdout.on('data', function onStdoutData(tastyBytes){
+        conglomeratedBufferedStdout += tastyBytes.toString();
+      });
+
+      // Wait for the child process to finish.
+      childProc.on('close', function (){
+
+        // Verify that `process.env` of parent process was not damaged.
+        try { assert.deepEqual(envVarsBackup, process.env); }
+        catch (e) { return done(e); }
+
+        // If the child process logged "gee willikers\n", then that means it had access to both the env vars
+        // that were specially passed in, AS WELL AS of its parent process.  It also means that it properly
+        // overrode parent env vars with those that were explicitly passed in.
+        try { assert.strictEqual('gee willikers\n', conglomeratedBufferedStdout); }
+        catch (e) { return done(e); }
+
+        return done();
+      });
+    });
+
+    after(function (done) {
+      if (!childProc) { return done(); }
+
+      Pack.killChildProcess({
+        childProcess: childProc,
+        forceIfNecessary: true
+      }).exec(done);
+    });
+  });
+
+
+
   describe('multiple child processes at once', function(){
@@ -46,0 +110,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 3 instances in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

35934

increased by7.68%

Dependency count

4

decreased by-42.86%

Dev dependency count

3

decreased by-25%

Lines of code

662

increased by9.24%

Worsened metrics

Number of low supply chain risk alerts

6

increased byInfinity%

Dependency changes

• + Addedlodash@3.10.1

• - Removedlodash.isfunction@3.0.8

• - Removedlodash.isobject@3.0.2

• - Removedlodash.isstring@4.0.1

• - Removedlodash.isundefined@3.0.1

• - Removedlodash.isobject@3.0.2(transitive)

• - Removedlodash.isstring@4.0.1(transitive)

• - Removedlodash.isundefined@3.0.1(transitive)