poku - npm Package Compare versions

Comparing version 1.5.0 to 1.5.1

lib/modules/list-files.d.ts

 import type { Configs } from '../@types/list-files.js';
+export declare const sanitizePath: (input: string, ensureTarget?: boolean) => string;
 export declare const escapeRegExp: (string: string) => string;
 export declare const listFiles: (dirPath: string, files?: string[], configs?: Configs) => string[];
 export declare const publicListFiles: (targetDir: string, configs?: Configs) => string[];

lib/modules/list-files.js

@@ -7,6 +7,15 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.publicListFiles = exports.listFiles = exports.escapeRegExp = void 0;
+exports.publicListFiles = exports.listFiles = exports.escapeRegExp = exports.sanitizePath = void 0;
 const node_process_1 = __importDefault(require("process"));
 const node_fs_1 = __importDefault(require("fs"));
 const node_path_1 = __importDefault(require("path"));
+const sanitizePath = (input, ensureTarget) => {
+    const sanitizedPath = input
+        .replace(/[/\\]+/g, node_path_1.default.sep) // adapting slashes according to OS
+        .replace(/(\.\.(\/|\\|$))+/g, '') // ensure the current path level
+        .replace(/[<>:|^?*]+/g, ''); // removing unusual path characters
+    // Preventing absolute path access
+    return ensureTarget ? sanitizedPath.replace(/^[/\\]/, './') : sanitizedPath;
+};
+exports.sanitizePath = sanitizePath;
 const escapeRegExp = (string) => string.replace(/[.*{}[\]\\]/g, '\\$&');
@@ -18,3 +27,3 @@ exports.escapeRegExp = escapeRegExp;
 const listFiles = (dirPath, files = [], configs) => {
-    const currentFiles = node_fs_1.default.readdirSync(dirPath);
+    const currentFiles = node_fs_1.default.readdirSync((0, exports.sanitizePath)(dirPath));
     const defaultRegExp = /\.(test|spec)\./i;
@@ -32,3 +41,3 @@ const filter = (envFilter
     for (const file of currentFiles) {
-        const fullPath = node_path_1.default.join(dirPath, file);
+        const fullPath = (0, exports.sanitizePath)(node_path_1.default.join(dirPath, file));
         if (/node_modules/.test(fullPath))
@@ -46,3 +55,3 @@ continue;
 exports.listFiles = listFiles;
-const publicListFiles = (targetDir, configs) => (0, exports.listFiles)(targetDir, [], configs);
+const publicListFiles = (targetDir, configs) => (0, exports.listFiles)((0, exports.sanitizePath)(targetDir), [], configs);
 exports.publicListFiles = publicListFiles;

lib/services/run-test-file.js

@@ -65,2 +65,3 @@ "use strict";
         stdio: ['inherit', 'pipe', 'pipe'],
+        shell: false,
         env: Object.assign(Object.assign({}, node_process_1.default.env), { FILE: (configs === null || configs === void 0 ? void 0 : configs.parallel) ? fileRelative : '' }),
@@ -67,0 +68,0 @@ });

lib/services/run-tests.js

@@ -32,3 +32,3 @@ "use strict";
     const cwd = node_process_1.default.cwd();
-    const testDir = node_path_1.default.join(cwd, dir);
+    const testDir = node_path_1.default.join(cwd, (0, list_files_js_1.sanitizePath)(dir));
     const currentDir = node_path_1.default.relative(cwd, testDir);
@@ -35,0 +35,0 @@ const files = (0, list_files_js_1.listFiles)(testDir, undefined, configs);

package.json

 {
   "name": "poku",
-  "version": "1.5.0",
-  "description": "🐷 Poku is your test runner pet for Node.js, Bun and Deno, combining flexibility, parallel and sequential runs, human-friendly assertion errors and high isolation level",
+  "version": "1.5.1",
+  "description": "🐷 Poku brings human-friendly testing and assertion to Node.js, Bun & Deno at the same time.",
   "main": "./lib/index.js",
@@ -91,6 +91,6 @@ "scripts": {
   "devDependencies": {
-    "@types/node": "^20.11.20",
-    "@typescript-eslint/eslint-plugin": "^7.0.2",
-    "@typescript-eslint/parser": "^7.0.2",
-    "eslint": "^8.56.0",
+    "@types/node": "^20.11.21",
+    "@typescript-eslint/eslint-plugin": "^7.1.0",
+    "@typescript-eslint/parser": "^7.1.0",
+    "eslint": "^8.57.0",
     "eslint-config-prettier": "^9.1.0",
@@ -97,0 +97,0 @@ "eslint-import-resolver-typescript": "^3.6.1",

README.md

@@ -13,2 +13,4 @@ [node-version-url]: https://github.com/nodejs/node
 [ql-image]: https://img.shields.io/github/actions/workflow/status/wellwelwel/poku/codeql.yml?event=push&style=flat&label=Code%20QL&branch=main
+[license-url]: https://github.com/wellwelwel/poku/blob/main/LICENSE
+[license-image]: https://img.shields.io/npm/l/poku.svg?maxAge=2592000&color=9c88ff&label=License
 
@@ -21,2 +23,4 @@ # Poku
 
+> By creating **Poku**, my aim is to show that testing can be simpler.
+
 [![Node.js Version][node-version-image]][node-version-url]
@@ -28,2 +32,3 @@ [![Bun Version][bun-version-image]][bun-version-url]
 [![GitHub Workflow Status (with event)][ql-image]][ql-url]
+[![License][license-image]][license-url]
 
@@ -40,14 +45,13 @@ Enjoying **Poku**? Consider giving him a star ⭐️
 
-Don't worry about `describe`, `it`, `beforeEach` and everything else 🚀
+Don't worry about `describe`, `it`, `beforeEach` and everything else 🚀 <br/>
+After all, you don't need to learn what you already know ([**see why**](https://poku.dev/docs/examples/beforeEach)) ✨
 
-> You don't need to learn what you already know ✨
-
 - Supports **ESM** and **CJS**
 - Designed to be highly intuitive
-- No need to compile [**TypeScript**][typescript-url] \*
 - Compatible with **Coverage** tools
-- Allows both **in-code** and **CLI** usage
 - [**Node.js**][node-version-url], [**Bun**][bun-version-url] and [**Deno**][deno-version-url] compatibility
 - Zero configurations, except you want
+- Allows both **API (_in-code_)** and **CLI** usage
 - Poku adapts to your test, not the other way around
+- You can use **Poku**'s `assert` with every test runner you want
 - [**And much more!**](https://poku.dev)
@@ -57,3 +61,3 @@
 
-- <img src="https://img.shields.io/bundlephobia/min/poku">
+- [![Install Size](https://packagephobia.com/badge?p=poku)](https://packagephobia.com/result?p=poku)
 - **Zero** external dependencies 🌱
@@ -71,2 +75,4 @@
 
+### `poku`
+
 | Sequential                                         | Concurrent                                       |
@@ -76,25 +82,8 @@ | -------------------------------------------------- | ------------------------------------------------ |
 
-- By default, **Poku**:
-  - Searches for all _`.test.`_ and `.spec.` files, but you can customize it using the option [**`filter`**](https://poku.dev/docs/documentation/poku/configs/filter).
-  - Uses `sequential` mode.
-- You can use concurrecy by use the flag `--parallel` for **CLI** or the option `parallel` to `true` in **API** (_in-code_) usage.
+> [**See the complete `poku` documentation**](https://poku.dev/docs/category/poku).
 
-> Follow the same idea for [**Bun**][bun-version-url] and [**Deno**][deno-version-url].
-
 ---
 
-**Poku** also includes the `assert` method, keeping everything as it is, but providing human readability and automatic `describe` and `it`:
+### `assert`
 
-> Compatible with **Node.js**, **Bun** and **Deno**.
-
-```ts
-import { assert } from 'poku'; // Node and Bun
-import { assert } from 'npm:poku'; // Deno
-
-const actual = '1';
-
-assert(actual, 'My first assert');
-assert.deepStrictEqual(actual, 1, 'My first assert error');
-```
-
 | Using `poku`                                        | Using `node`                                        |
@@ -104,7 +93,2 @@ | --------------------------------------------------- | --------------------------------------------------- |
 
-- ❌ Both cases finish with `code 1`, as expected
-- 🧑🏻‍🎓 The `message` param is optional, as it's in **Node.js**
-- 💚 Yes, you can use **Poku**'s `assert` running `node ./my-file.js`
-- 🐷 Unlike most, **Poku** adapts to your test, not the other way around
-
 > [**See the complete assert's documentation**](https://poku.dev/docs/documentation/assert).
@@ -144,20 +128,2 @@
 
-### In-code
-
-#### Node.js and Bun
-
-```ts
-import { poku } from 'poku';
-
-await poku(['targetDir']);
-```
-
-#### Deno
-
-```ts
-import { poku } from 'npm:poku';
-
-await poku(['targetDir']);
-```
-
 ### CLI
@@ -183,2 +149,20 @@
 
+### API (_In-code_)
+
+#### Node.js, TypeScript (Node.js) and Bun
+
+```ts
+import { poku } from 'poku';
+
+await poku(['targetDir']);
+```
+
+#### Deno
+
+```ts
+import { poku } from 'npm:poku';
+
+await poku(['targetDir']);
+```
+
 ---
@@ -198,2 +182,20 @@
 
-- [**Contributors**](https://github.com/wellwelwel/poku/graphs/contributors)
+- [**Contributors**](https://github.com/wellwelwel/poku/graphs/contributors).
+
+---
+
+## Contributing
+
+Please check the [**CONTRIBUTING.md**](./CONTRIBUTING.md) for instructions 🚀
+
+---
+
+## License
+
+Poku is under the [**MIT** License](./LICENSE).
+
+---
+
+## Security Policy
+
+Please check the [**SECURITY.md**](./SECURITY.md) and the section [**Is Poku Safe?**](https://poku.dev/docs/security) from Documentation.

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

56311

increased by0.73%

Lines of code

1042

increased by1.07%

Number of lines in readme file

191

increased by1.06%

No dependency changes