Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
spec-detective
Advanced tools
A cool way to find out if your spec's in feature files and the like have met expectations.
This is a BDD tool for checking and specking tests against beautiful looking feature files written in MarkDown.
Rather than this tool driving your tests it is a test output parser which means you can test natively in various programming languages freely. This tool will watch for the test output files or feature file to be saved at which point shows you what specs have and haven't been implemented.
You can write feature files in markdown. You can add any information you want in any way to describe your features. However adding the following style of syntax.
# My Feature
This can contain explanations and other details about your feature
## My Context
+ IT should have a test that passes
- IT may not have a test that is skipped
## My Other Context
+ IT should also have other tests passing in other contexts
- You can add other ignored meta-data
This tool particularly likes Javascript testing frameworks (Jasmine or Mocha).
The above specks you can write in a JS test as follows:
describe("My Feature", function () {
describe("My Context", function () {
it("should have a test that passes", function () {
...
});
});
describe("My Other Context", function () {
it("should also have other tests passing in other contexts", function () {
...
});
});
});
You can get the test output in a format that spec-detective
understands by using a custom Karma reporter called karma-spec-json-reporter
. This is an NPM package that can be found here.
Please follow the instructions there to install it.
Similarly to Karma there is a mocha-spec-json-reporter
. This is also an NPM package that can be found here.
Take the following test written in Java
package com.example.foo;
import org.junit.Test;
import org.junit.Ignore;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;
import org.junit.Assert.assertTrue;
/**
* Tests for {@link Foo}.
*/
public class ContextSubcontextTest {
@Test
public void shouldAlwaysPass() {
assertTrue("failure - should be true", true);
}
}
This will then output JUnitXML similar to the below:
<?xml version="1.0" encoding="UTF-8"?>
<testsuite name="com.example.foo.ContextSubcontextTest" time="0.005" tests="1" errors="0" skipped="0" failures="0">
<properties>
<property name="java.runtime.name" value="Java(TM) SE Runtime Environment"/>
</properties>
<testcase name="shouldAlwaysPass" classname="com.example.foo.ContextSubcontextTest" time="0"/>
</testsuite>
This we can then line up to a feature file that looks like the following.
# Context
## Subscontext
+ IT should always pass
So you can also use anything that also outputs similar JUnitXML including PHPUnit and the likes.
When you have output files available you can do a comparison run using the following command
./node_modules/spec-detective/bin/spec-detective "path-to-features/*.md" "path-to-json/*.json,path-to-junit/*.xml"
You will then see some pretty output and a junit-output.xml
file that will give you a coverage summary.
If it is easier to a working example please have a look at this sample app.
FAQs
A cool way to find out if your spec's in feature files and the like have met expectations.
We found that spec-detective demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.