process - npm Package Compare versions

Comparing version 0.11.4 to 0.11.5

browser.js

@@ -5,6 +5,26 @@ // shim for using process in browser
 
-// cached from whatever global is present so that test runners that stub it don't break things.
-var cachedSetTimeout = setTimeout;
-var cachedClearTimeout = clearTimeout;
+// cached from whatever global is present so that test runners that stub it
+// don't break things.  But we need to wrap it in a try catch in case it is
+// wrapped in strict mode code which doesn't define any globals.  It's inside a
+// function because try/catches deoptimize in certain engines.
 
+var cachedSetTimeout;
+var cachedClearTimeout;
+
+(function () {
+  try {
+    cachedSetTimeout = setTimeout;
+  } catch (e) {
+    cachedSetTimeout = function () {
+      throw new Error('setTimeout is not defined');
+    }
+  }
+  try {
+    cachedClearTimeout = clearTimeout;
+  } catch (e) {
+    cachedClearTimeout = function () {
+      throw new Error('clearTimeout is not defined');
+    }
+  }
+} ())
 var queue = [];
@@ -11,0 +31,0 @@ var draining = false;

package.json

@@ -11,3 +11,3 @@ {
   },
-  "version": "0.11.4",
+  "version": "0.11.5",
   "repository": {
@@ -14,0 +14,0 @@ "type": "git",

test.js

@@ -10,2 +10,3 @@ var assert = require('assert');
   });
+  vmtest();
 }
@@ -69,23 +70,39 @@ function test (ourProcess) {
     describe('rename globals', function (t) {
-      it('throws an error', function (done){
-        var oldTimeout = setTimeout;
-        var oldClear = clearTimeout;
-        function cleanUp() {
-          setTimeout = oldTimeout;
-          clearTimeout = oldClear;
+      var oldTimeout = setTimeout;
+      var oldClear = clearTimeout;
+
+      it('clearTimeout', function (done){
+
+        var ok = true;
+        clearTimeout = function () {
+          ok = false;
         }
+        ourProcess.nextTick(function () {
+          setTimeout(function () {
+            clearTimeout = oldClear;
+            var err;
+            try {
+              assert.ok(ok, 'fake clearTimeout ran');
+            } catch (e) {
+              err = e;
+            }
+            done(err);
+          }, 50);
+        });
+      });
+      it('just setTimeout', function (done){
+
+
         setTimeout = function () {
-          cleanUp();
-          assert.ok(false);
-          done();
+          setTimeout = oldTimeout;
+          try {
+            assert.ok(false, 'fake setTimeout called')
+          } catch (e) {
+            done(e);
+          }
+
         }
 
-        clearTimeout = function () {
-          cleanUp();
-          assert.ok(false);
-          done();
-        }
         ourProcess.nextTick(function () {
-          cleanUp();
-          assert.ok(true);
+          setTimeout = oldTimeout;
           done();
@@ -96,1 +113,34 @@ });
 }
+function vmtest() {
+  var vm = require('vm');
+  var fs = require('fs');
+  var process =  fs.readFileSync('./browser.js', {encoding: 'utf8'});
+
+
+  describe('should work in vm in strict mode with no globals', function () {
+    it('should parse', function (done) {
+      var str = '"use strict";var module = {exports:{}};';
+      str += process;
+      str += 'this.works = process.browser;';
+      var script = new vm.Script(str);
+      var context = {
+        works: false
+      };
+      script.runInNewContext(context);
+      assert.ok(context.works);
+      done();
+    });
+    it('setTimeout throws error', function (done) {
+      var str = '"use strict";var module = {exports:{}};';
+      str += process;
+      str += 'try {process.nextTick(function () {})} catch (e){this.works = e;}';
+      var script = new vm.Script(str);
+      var context = {
+        works: false
+      };
+      script.runInNewContext(context);
+      assert.ok(context.works);
+      done();
+    });
+  });
+}

New alerts

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

10095

increased by22.25%

Lines of code

238

increased by35.23%

Worsened metrics

Number of low supply chain risk alerts

2

increased byInfinity%

No dependency changes