static-module - npm Package Compare versions

Comparing version 0.0.0 to 0.0.1

test/fs/html.js

+var html = require('fs').readFileSync(__dirname + '/robot.html', 'utf8');
+console.log(html);

test/fs/robot.html

+EXTERMINATE

test/inline.js

+var test = require('tape');
+var concat = require('concat-stream');
+var staticModule = require('../');
+var fs = require('fs');
+var path = require('path');
+
+test('inline object', function (t) {
+    t.plan(1);
+    var sm = staticModule({
+        beep: { f: function (n) { return n * 111 } }
+    });
+    readStream('obj.js').pipe(sm).pipe(concat(function (body) {
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 555) }
+    }));
+});
+
+test('inline object call', function (t) {
+    t.plan(1);
+    var sm = staticModule({
+        beep: { f: function (n) { return n * 111 } }
+    });
+    readStream('obj_call.js').pipe(sm).pipe(concat(function (body) {
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 555) }
+    }));
+});
+
+test('inline object expression', function (t) {
+    t.plan(1);
+    var sm = staticModule({
+        beep: { f: function (n) { return n * 111 } }
+    });
+    readStream('obj_expr.js').pipe(sm).pipe(concat(function (body) {
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 1110) }
+    }));
+});
+
+test('inline function', function (t) {
+    t.plan(1);
+    var sm = staticModule({
+        beep: function (n) { return n * 111 }
+    });
+    readStream('fn.js').pipe(sm).pipe(concat(function (body) {
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 555) }
+    }));
+});
+
+test('inline function call', function (t) {
+    t.plan(1);
+    var sm = staticModule({
+        beep: function (n) { return n * 111 }
+    });
+    readStream('fn_call.js').pipe(sm).pipe(concat(function (body) {
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 555) }
+    }));
+});
+
+test('inline function expression', function (t) {
+    t.plan(1);
+    var sm = staticModule({
+        beep: function (n) { return n * 111 }
+    });
+    readStream('fn_expr.js').pipe(sm).pipe(concat(function (body) {
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 1665) }
+    }));
+});
+
+function readStream (file) {
+    return fs.createReadStream(path.join(__dirname, 'inline', file));
+}

test/inline/fn_call.js

+console.log(require('beep')(5));

test/inline/fn_expr.js

+console.log(require('beep')(5) * 3);

test/inline/fn.js

+var x = require('beep')(5);
+console.log(x);

test/inline/obj_call.js

+console.log(require('beep').f(5));

test/inline/obj_expr.js

+console.log(require('beep').f(5) * 2);

test/inline/obj.js

+var x = require('beep').f(5);
+console.log(x);

.travis.yml

 language: node_js
 node_js:
-  - "0.8"
   - "0.10"

index.js

@@ -31,4 +31,5 @@ var fs = require('fs');
     return duplexer(concat(function (body) {
-        try { var src = parse(body.toString('utf8')) }
-        catch (err) { return error(err) }
+        var src = falafel(body.toString('utf8'), walk);
+        //try { var src = falafel(body.toString('utf8'), walk) }
+        //catch (err) { return error(err) }
         if (pending === 0) finish(src);
@@ -68,78 +69,92 @@ }), output);
     
-    function parse (body) {
-        var output = falafel(body, function (node) {
-            if (isRequire(node) && has(modules, node.arguments[0].value)
-            && node.parent.type === 'VariableDeclarator'
-            && node.parent.id.type === 'Identifier') {
-                varNames[node.parent.id.name] = node.arguments[0].value;
-                var decs = node.parent.parent.declarations;
-                var ix = decs.indexOf(node.parent);
-                if (ix >= 0) decs.splice(ix, 1);
-                
-                if (decs.length === 0) {
-                    pushUpdate(node.parent.parent, '');
-                }
-                else {
-                    pushUpdate(
-                        node.parent.parent,
-                        unparse(node.parent.parent)
-                    );
-                }
+    function walk (node) {
+        var isreq = false, reqid;
+        if (isRequire(node)) {
+            reqid = node.arguments[0].value;
+            isreq = has(modules, reqid);
+        }
+        
+        if (isreq && node.parent.type === 'VariableDeclarator'
+        && node.parent.id.type === 'Identifier') {
+            varNames[node.parent.id.name] = reqid;
+            var decs = node.parent.parent.declarations;
+            var ix = decs.indexOf(node.parent);
+            if (ix >= 0) decs.splice(ix, 1);
+            
+            if (decs.length === 0) {
+                pushUpdate(node.parent.parent, '');
             }
-            else if (isRequire(node) && has(modules, node.arguments[0].value)
-            && node.parent.type === 'AssignmentExpression'
-            && node.parent.left.type === 'Identifier') {
-                varNames[node.parent.left.name] = node.arguments[0].value;
-                var cur = node.parent.parent;
-                if (cur.type === 'SequenceExpression') {
-                    var ex = cur.expressions;
-                    var ix = ex.indexOf(node.parent);
-                    if (ix >= 0) ex.splice(ix, 1);
-                    pushUpdate(
-                        node.parent.parent,
-                        unparse(node.parent.parent)
-                    );
-                }
-                else pushUpdate(cur, '');
+            else {
+                pushUpdate(
+                    node.parent.parent,
+                    unparse(node.parent.parent)
+                );
             }
-            else if (isRequire(node) && has(modules, node.arguments[0].value)
-            && node.parent.type === 'MemberExpression'
-            && node.parent.property.type === 'Identifier'
-            && node.parent.parent.type === 'VariableDeclarator'
-            && node.parent.parent.id.type === 'Identifier') {
-                varNames[node.parent.parent.id.name] = [
-                    node.arguments[0].value, node.parent.property.name
-                ];
-                var decs = node.parent.parent.parent.declarations;
-                var ix = decs.indexOf(node.parent.parent);
-                if (ix >= 0) decs.splice(ix, 1);
-                
-                if (decs.length === 0) {
-                    pushUpdate(node.parent.parent.parent, '');
-                }
-                else {
-                    pushUpdate(
-                        node.parent.parent.parent,
-                        unparse(node.parent.parent.parent)
-                    );
-                }
+        }
+        else if (isreq && node.parent.type === 'AssignmentExpression'
+        && node.parent.left.type === 'Identifier') {
+            varNames[node.parent.left.name] = reqid;
+            var cur = node.parent.parent;
+            if (cur.type === 'SequenceExpression') {
+                var ex = cur.expressions;
+                var ix = ex.indexOf(node.parent);
+                if (ix >= 0) ex.splice(ix, 1);
+                pushUpdate(
+                    node.parent.parent,
+                    unparse(node.parent.parent)
+                );
             }
+            else pushUpdate(cur, '');
+        }
+        else if (isreq && node.parent.type === 'MemberExpression'
+        && node.parent.property.type === 'Identifier'
+        && node.parent.parent.type === 'VariableDeclarator'
+        && node.parent.parent.id.type === 'Identifier') {
+            varNames[node.parent.parent.id.name] = [
+                reqid, node.parent.property.name
+            ];
+            var decs = node.parent.parent.parent.declarations;
+            var ix = decs.indexOf(node.parent.parent);
+            if (ix >= 0) decs.splice(ix, 1);
             
-            if (node.type === 'Identifier' && varNames[node.name]) {
-                traverse(node);
+            if (decs.length === 0) {
+                pushUpdate(node.parent.parent.parent, '');
             }
-        });
-        return output;
-    }
-    
-    function traverse (node) {
-        var vn = varNames[node.name];
-        var val;
-        if (Array.isArray(vn)) {
-            val = modules[vn[0]][vn[1]];
+            else {
+                pushUpdate(
+                    node.parent.parent.parent,
+                    unparse(node.parent.parent.parent)
+                );
+            }
         }
-        else {
-            val = modules[vn];
+        else if (isreq && node.parent.type === 'MemberExpression'
+        && node.parent.property.type === 'Identifier') {
+            var name = node.parent.property.name;
+            var cur = copy(node.parent.parent);
+            cur.callee = copy(node.parent.property);
+            cur.callee.parent = cur;
+            traverse(cur.callee, modules[reqid][name]);
         }
+        else if (isreq && node.parent.type === 'CallExpression') {
+            var cur = copy(node.parent);
+            var iname = Math.pow(16,8) * Math.random();
+            cur.callee = {
+                type: 'Identifier',
+                name: '_' + Math.floor(iname).toString(16),
+                parent: cur
+            };
+            pushUpdate(node.parent, '');
+            traverse(cur.callee, modules[reqid]);
+        }
         
+        if (node.type === 'Identifier' && varNames[node.name]) {
+            var vn = varNames[node.name];
+            if (Array.isArray(vn)) {
+                traverse(node, modules[vn[0]][vn[1]]);
+            }
+            else traverse(node, modules[vn]);
+        }
+    }
+    
+    function traverse (node, val) {
         if (node.parent.type === 'CallExpression') {
@@ -161,3 +176,3 @@ if (typeof val !== 'function') {
                 });
-                node.parent.update('');
+                pushUpdate(node.parent, '');
             }
@@ -210,3 +225,3 @@ else if (res !== undefined) pushUpdate(node.parent, res);
     }
-};
+}
 
@@ -213,0 +228,0 @@ function isRequire (node) {

package.json

 {
   "name": "static-module",
-  "version": "0.0.0",
+  "version": "0.0.1",
   "description": "convert module usage to inline expressions",
@@ -5,0 +5,0 @@ "main": "index.js",

test/fs.js

@@ -12,12 +12,3 @@ var staticModule = require('../');
     var sm = staticModule({
-        fs: {
-            readFile: function (file, cb) {
-                var stream = through(write, end);
-                stream.push('process.nextTick(function(){(' + cb + ')(null,');
-                return fs.createReadStream(file).pipe(quote()).pipe(stream);
-                
-                function write (buf, enc, next) { this.push(buf); next() }
-                function end (next) { this.push(')})'); this.push(null); next() }
-            }
-        }
+        fs: { readFile: readFile }
     }, { vars: { __dirname: __dirname + '/fs' } });
@@ -35,4 +26,32 @@ readStream('readfile.js').pipe(sm).pipe(concat(function (body) {
 
+test('fs.readFileSync', function (t) {
+    t.plan(2);
+    var sm = staticModule({
+        fs: { readFileSync: readFileSync }
+    }, { vars: { __dirname: __dirname + '/fs' } });
+    readStream('html.js').pipe(sm).pipe(concat(function (body) {
+        t.equal(body.toString('utf8'),
+            'var html = "EXTERMINATE\\n";\n'
+            + 'console.log(html);\n'
+        );
+        Function(['console'],body)({ log: log });
+        function log (msg) { t.equal(msg, 'EXTERMINATE\n') }
+    }));
+});
+
 function readStream (file) {
     return fs.createReadStream(path.join(__dirname, 'fs', file));
 }
+
+function readFile (file, cb) {
+    var stream = through(write, end);
+    stream.push('process.nextTick(function(){(' + cb + ')(null,');
+    return fs.createReadStream(file).pipe(quote()).pipe(stream);
+    
+    function write (buf, enc, next) { this.push(buf); next() }
+    function end (next) { this.push(')})'); this.push(null); next() }
+}
+
+function readFileSync (file, opts) {
+    return fs.createReadStream(file).pipe(quote());
+}

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

26861

14.94%

Number of package files

42

27.27%

Lines of code

668

19.5%

Worsened metrics

Number of low supply chain risk alerts

20

11.11%

Number of medium supply chain risk alerts

15

87.5%

No dependency changes