uvm - npm Package Compare versions

Comparing version 1.7.0 to 1.7.1

CHANGELOG.md

 # Postman UVM Changelog
 
+#### v1.7.1 (April 6, 2018)
+* :bug: Use `srcdoc` attribute in `iframe`, when available, for loading sandbox code browser environments
+
 #### 1.7.0 (May 31, 3017)
@@ -4,0 +7,0 @@ * removed dispatch of `disconnect` event when .disconnect() is called

lib/uvm/bridge-client.js

@@ -12,5 +12,8 @@ /**
 /**
- * Generate code to be executed inside a VM for bootstrap
+ * Generate code to be executed inside a VM for bootstrap.
+ *
+ * @param {String|Buffer} bootCode
  * @return {String}
  */
+/* eslint-disable max-len */
 module.exports = function (bootCode) {
@@ -17,0 +20,0 @@ return `;

lib/uvm/bridge.browser.js

@@ -29,4 +29,7 @@ /*
     /**
-     * Returns the HTML to be executed inside iFrame
-     * @param  {String} code
+     * Returns the HTML to be executed inside iFrame.
+     *
+     * @param {String} code
+     * @param {String} id
+     * @param {Boolean} firmwareOnly
      * @return {String}
@@ -58,2 +61,6 @@ */
         code = bridgeClientCode(options.bootCode),
+
+        // make sure we escape the code only once
+        serializedFirmware = unescape(encodeURIComponent(sandboxCode(code, id))),
+
         iframe = options._sandbox || document.createElement(SANDBOX_ELEMENT_TAG),
@@ -68,3 +75,3 @@
             catch (err) { return bridge.emit(ERROR, err); }
-            bridge.emit.apply(bridge, args);
+            bridge.emit.apply(bridge, args); // eslint-disable-line prefer-spread
         },
@@ -125,6 +132,15 @@
     // add HTML and bootstrap code to the iframe
-    iframe.setAttribute('src', 'data:text/html;base64, ' + btoa(unescape(encodeURIComponent(sandboxCode(code, id)))));
+    iframe.setAttribute('src', 'data:text/html;base64, ' + btoa(serializedFirmware));
 
+    // data uri has size limits depending on the browsers
+    // in browsers that don't support srcdoc attribute the src attribute is accepted
+    // https://www.w3.org/TR/html5/semantics-embedded-content.html#an-iframe-srcdoc-document
+    iframe.setAttribute('srcdoc', serializedFirmware);
+
     // now append the iframe to start processing stuff
     document.body.appendChild(iframe);
+
+    // help GC collect large variables
+    code = null;
+    serializedFirmware = null;
 };

lib/uvm/bridge.js

@@ -14,3 +14,4 @@ var vm = require('vm'),
     /**
-     * Generate a random number
+     * Generate a random number.
+     *
      * @return {Number}
@@ -76,3 +77,3 @@ */
 
-            emitter.emit.apply(emitter, args);
+            emitter.emit.apply(emitter, args); // eslint-disable-line prefer-spread
         };
@@ -79,0 +80,0 @@

lib/uvm/index.js

@@ -41,3 +41,4 @@ var _ = require('lodash'),
      * Wrap the callback for unified result and reduce chance of bug.
-     * We also abandon all dispatch replay
+     * We also abandon all dispatch replay.
+     *
      * @param  {Error=} [err]
@@ -84,3 +85,3 @@ */
             while ((args = this._pending.shift())) {
-                this.dispatch.apply(this, args);
+                this.dispatch.apply(this, args); // eslint-disable-line prefer-spread
             }
@@ -105,3 +106,3 @@ }
     dispatch: function () {
-        try { this._dispatch.apply(this, arguments); }
+        try { this._dispatch.apply(this, arguments); } // eslint-disable-line prefer-spread
         catch (e) { this.emit(ERROR_EVENT, e); }
@@ -114,3 +115,3 @@ },
     disconnect: function () {
-        try { this._disconnect.apply(this, arguments); }
+        try { this._disconnect.apply(this, arguments); } // eslint-disable-line prefer-spread
         catch (e) { this.emit(ERROR_EVENT, e); }
@@ -121,2 +122,3 @@ },
      * Stub dispatch handler to queue dispatched messages until bridge is ready.
+     *
      * @param {String} name
@@ -148,3 +150,3 @@ */
      * @param {Function} callback
-     * @returns UVM
+     * @returns {Object} UVM
      *
@@ -151,0 +153,0 @@ * @see UVM

lib/uvm/vm-delegate-timers.js

@@ -21,3 +21,3 @@ var vm = require('vm'),
     // deleting the original function from global scope
-    timerSetDelegates.forEach(function(setFn) {
+    timerSetDelegates.forEach(function (setFn) {
         context[`${setFn}_`] = timers[setFn];
@@ -24,0 +24,0 @@ vm.runInContext(`

npm/test-browser.js

@@ -9,3 +9,3 @@ #!/usr/bin/env node
 
-var colors = require('colors/safe'),
+var chalk = require('chalk'),
     path = require('path'),
@@ -16,3 +16,3 @@
 module.exports = function (exit) {
-    console.log(colors.yellow.bold('Running unit tests within browser...'));
+    console.log(chalk.yellow.bold('Running unit tests within browser...'));
 
@@ -19,0 +19,0 @@ var KarmaServer = require('karma').Server;

npm/test-integration.js

@@ -8,6 +8,6 @@ #!/usr/bin/env node
 require('shelljs/global');
-require('colors');
 
 // set directories and files for test and coverage report
 var path = require('path'),
+    chalk = require('chalk'),
     recursive = require('recursive-readdir'),
@@ -19,3 +19,3 @@
     // banner line
-    console.log('Running integration tests using mocha on node...'.yellow.bold);
+    console.log(chalk.yellow.bold('Running integration tests using mocha on node...'));
 
@@ -28,3 +28,3 @@ var Mocha = require('mocha');
 
-        var mocha = new Mocha({timeout: 1000 * 60});
+        var mocha = new Mocha({ timeout: 1000 * 60 });
 
@@ -31,0 +31,0 @@ // specially load bootstrap file

npm/test-lint.js

@@ -9,5 +9,5 @@ #!/usr/bin/env node
 require('shelljs/global');
-require('colors');
 
-var async = require('async'),
+var chalk = require('chalk'),
+    async = require('async'),
     LINT_SOURCE_DIRS = [
@@ -24,3 +24,3 @@ './test/**/*.js',
     // banner line
-    console.log('\nLinting files using eslint...'.yellow.bold);
+    console.log(chalk.yellow.bold('\nLinting files using eslint...'));
 
@@ -39,3 +39,3 @@ async.waterfall([
             // log the success of the parser if it has no errors
-            (errorReport && !errorReport.length) && console.log('eslint ok!'.green);
+            (errorReport && !errorReport.length) && console.log(chalk.green('eslint ok!'));
             // ensure that the exit code is non zero in case there was an error
@@ -42,0 +42,0 @@ next(Number(errorReport && errorReport.length) || 0);

npm/test-system.js

@@ -5,3 +5,2 @@ #!/usr/bin/env node
 require('shelljs/global');
-require('colors');
 
@@ -12,2 +11,3 @@ var fs = require('fs'),
 
+    chalk = require('chalk'),
     async = require('async'),
@@ -31,3 +31,3 @@ _ = require('lodash'),
     // banner line
-    console.log('\nRunning system tests using mocha and nsp...'.yellow.bold);
+    console.log(chalk.yellow.bold('\nRunning system tests using mocha and nsp...'));
 
@@ -38,3 +38,6 @@ async.series([
             recursive(SPEC_SOURCE_DIR, function (err, files) {
-                if (err) { console.error(err.stack || err); return next(1); }
+                if (err) {
+                    console.error(err.stack || err);
+                    return next(1);
+                }
 
@@ -54,3 +57,3 @@ var mocha = new Mocha();
 
-         // packity
+        // packity
         function (next) {
@@ -69,3 +72,3 @@ var packity = require('packity'),
         // execute nsp
-        // programatically executing nsp is a bit tricky as we have to emulate the cli script's usage of internal
+        // programmatically executing nsp is a bit tricky as we have to emulate the cli script's usage of internal
         // nsp functions.
@@ -77,3 +80,3 @@ function (next) {
 
-            console.log('processing nsp for security vulnerabilities...\n'.yellow);
+            console.log(chalk.yellow('processing nsp for security vulnerabilities...\n'));
 
@@ -91,8 +94,8 @@ // we do not pass full package for privacy concerns and also to add the ability to ignore exclude packages,
                 if (err) {
-                    console.error('There was an error processing NSP!\n'.red + (err.message || err).gray + '\n\n' +
-                        'Since NSP server failure is not a blocker for tests, tests are not marked as failure!');
+                    console.error(chalk.red('There was an error processing NSP!\n') + chalk.gray(err.message || err) +
+                        '\n\nSince NSP server failure is not a blocker for tests, tests are not marked as failure!');
                     return next();
                 }
 
-                // in case an nsp vialation is found, we raise an error
+                // in case an nsp violation is found, we raise an error
                 if (result.length) {
@@ -103,3 +106,3 @@ console.error(nsp.formatters.default(err, result));
 
-                console.log('nsp ok!\n'.green);
+                console.log(chalk.green('nsp ok!\n'));
                 return next();
@@ -106,0 +109,0 @@ });

npm/test-unit.js

@@ -8,3 +8,2 @@ #!/usr/bin/env node
 require('shelljs/global');
-require('colors');
 
@@ -14,39 +13,43 @@ // set directories and files for test and coverage report
 
-    IS_WINDOWS = (/^win/).test(process.platform),
+    NYC = require('nyc'),
+    chalk = require('chalk'),
+    recursive = require('recursive-readdir'),
+
     COV_REPORT_PATH = '.coverage',
-    REPORT_PATH = path.join('.tmp', 'report.xml'),
-    SPEC_SOURCES = path.join('test', 'unit');
+    SPEC_SOURCE_DIR = path.join('test', 'unit');
 
 module.exports = function (exit) {
-    var specPattern = (process.argv[2] || '.*'),
-        mochaReporter = 'spec',
-        istanbulReport = '';
+    // banner line
+    console.log(chalk.yellow.bold('Running unit tests using mocha on node...'));
 
-    // for CI, we use simple xunit reporter (not on Travis since it does not parse results)
-    // if (process.env.CI) {
-    //     mochaReporter = 'xunit';
-    //     istanbulReport = '--report cobertura';
-    // }
+    test('-d', COV_REPORT_PATH) && rm('-rf', COV_REPORT_PATH);
+    mkdir('-p', COV_REPORT_PATH);
 
-    // banner line
-    console.log('Running unit tests using mocha on node...'.yellow.bold);
+    var Mocha = require('mocha'),
+        nyc = new NYC({
+            reporter: ['text', 'lcov'],
+            reportDir: COV_REPORT_PATH,
+            tempDirectory: COV_REPORT_PATH
+        });
 
-    mkdir('-p', '.tmp');
-    test('-d', COV_REPORT_PATH) && rm('-rf', COV_REPORT_PATH) && mkdir('-p', COV_REPORT_PATH);
+    nyc.wrap();
+    // add all spec files to mocha
+    recursive(SPEC_SOURCE_DIR, function (err, files) {
+        if (err) { console.error(err); return exit(1); }
 
-    // windows istanbul and mocha commands need some special attention.
-    if (IS_WINDOWS) {
-        // sample command in case you're confused
-        // node_modules\.bin\istanbul.cmd cover  --dir .coverage --color --print both
-        //      node_modules\mocha\bin\_mocha -- --reporter spec --reporter-options output=
-        //      .tmp\report.xml test\unit --recursive --prof --colors --grep=.*
-        exec(`node_modules\\.bin\\istanbul.cmd cover ${istanbulReport} --dir ${COV_REPORT_PATH} --colors ` +
-            `--print both node_modules\\mocha\\bin\\_mocha -- ${SPEC_SOURCES} --reporter ${mochaReporter} ` +
-            `--reporter-options output=${REPORT_PATH} --recursive --prof --colors --grep=${specPattern}`, exit);
-    }
-    else {
-        exec(`./node_modules/.bin/istanbul cover ${istanbulReport} --dir ${COV_REPORT_PATH} --colors ` +
-            `--print both node_modules/mocha/bin/_mocha -- ${SPEC_SOURCES} --reporter ${mochaReporter} ` +
-            `--reporter-options output=${REPORT_PATH} --recursive --prof --colors --grep=${specPattern}`, exit);
-    }
+        var mocha = new Mocha({ timeout: 1000 * 60 });
+
+        files.filter(function (file) { // extract all test files
+            return (file.substr(-8) === '.test.js');
+        }).forEach(mocha.addFile.bind(mocha));
+
+        mocha.run(function (runError) {
+            runError && console.error(runError.stack || runError);
+
+            nyc.reset();
+            nyc.writeCoverageFile();
+            nyc.report();
+            exit(runError ? 1 : 0);
+        });
+    });
 };
@@ -53,0 +56,0 @@

npm/test.js

@@ -6,3 +6,3 @@ #!/usr/bin/env node
 var async = require('async'),
-    colors = require('colors/safe');
+    chalk = require('chalk');
 
@@ -16,4 +16,4 @@ async.series([
 ], function (code) {
-    !code && console.log(colors.green('\n' + require('../package.json').name + ' tests: all ok!'));
+    !code && console.log(chalk.green('\n' + require('../package.json').name + ' tests: all ok!'));
     exit(code);
 });

package.json

 {
   "name": "uvm",
-  "version": "1.7.0",
+  "version": "1.7.1",
   "description": "Universal Virtual Machine for Node and Browser",
@@ -30,30 +30,32 @@ "main": "index.js",
     "inherits": "2.0.3",
-    "lodash": "4.17.4",
-    "uuid": "3.0.1"
+    "lodash": "4.17.5",
+    "uuid": "3.2.1"
   },
   "devDependencies": {
-    "async": "2.4.1",
-    "browserify": "^14.3.0",
-    "colors": "1.1.2",
-    "editorconfig": "0.13.2",
-    "eslint": "3.19.0",
-    "eslint-plugin-jsdoc": "3.0.1",
-    "eslint-plugin-mocha": "4.9.0",
-    "eslint-plugin-security": "1.3.0",
+    "async": "2.6.0",
+    "browserify": "16.1.1",
+    "chalk": "2.3.2",
+    "editorconfig": "0.15.0",
+    "eslint": "4.19.1",
+    "eslint-plugin-jsdoc": "3.5.0",
+    "eslint-plugin-lodash": "2.7.0",
+    "eslint-plugin-mocha": "4.12.0",
+    "eslint-plugin-security": "1.4.0",
     "expect.js": "0.3.1",
-    "istanbul": "0.4.5",
-    "js-yaml": "3.8.4",
-    "jsdoc": "3.4.3",
-    "jsdoc-to-markdown": "3.0.0",
-    "karma": "1.6.0",
-    "karma-browserify": "5.1.1",
-    "karma-chrome-launcher": "2.0.0",
+    "js-yaml": "3.11.0",
+    "jsdoc": "3.5.5",
+    "jsdoc-to-markdown": "4.0.1",
+    "karma": "2.0.0",
+    "karma-browserify": "5.2.0",
+    "karma-chrome-launcher": "2.2.0",
     "karma-mocha": "1.3.0",
-    "karma-mocha-reporter": "2.2.3",
-    "mocha": "3.3.0",
-    "nsp": "2.6.3",
+    "karma-mocha-reporter": "2.2.5",
+    "mocha": "5.0.5",
+    "nsp": "2.8.1",
+    "nyc": "11.6.0",
     "packity": "0.3.2",
     "parse-gitignore": "0.4.0",
-    "recursive-readdir": "^2.1.0",
-    "shelljs": "0.7.7"
+    "recursive-readdir": "2.2.2",
+    "shelljs": "0.8.1",
+    "watchify": "3.11.0"
   },
@@ -60,0 +62,0 @@ "repository": {

test/karma.conf.js

@@ -38,3 +38,3 @@ // Karma configuration
         // level of logging
-        // possible values: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
+        // one of: config.LOG_DISABLE || config.LOG_ERROR || config.LOG_WARN || config.LOG_INFO || config.LOG_DEBUG
         logLevel: config.LOG_WARN,
@@ -74,3 +74,3 @@
 
-    if (process.env.TRAVIS) {
+    if (process.env.TRAVIS) { // eslint-disable-line no-process-env
         configuration.customLaunchers = {
@@ -77,0 +77,0 @@ chromeTravis: {

test/system/appveyor-yml.test.js

 /* global describe, it */
 var expect = require('expect.js');
 
-describe('appveyor.yml', function () {
+describe('.appveyor.yml', function () {
     var fs = require('fs'),
@@ -12,3 +12,3 @@ yaml = require('js-yaml'),
     try {
-        appveyorYAML = yaml.safeLoad(fs.readFileSync('appveyor.yml').toString());
+        appveyorYAML = yaml.safeLoad(fs.readFileSync('.appveyor.yml').toString());
     }
@@ -20,3 +20,3 @@ catch (e) {
     it('should exist', function (done) {
-        fs.stat('appveyor.yml', done);
+        fs.stat('.appveyor.yml', done);
     });
@@ -52,3 +52,3 @@
             expect(appveyorYAML.install[0].ps).to.be('Install-Product node $env:nodejs_version');
-            expect(appveyorYAML.install[1]).to.be('npm cache clean');
+            expect(appveyorYAML.install[1]).to.be('npm cache clean --force');
             expect(appveyorYAML.install[2]).to.be('appveyor-retry npm install');
@@ -55,0 +55,0 @@ });

test/system/repository.test.js

@@ -40,2 +40,3 @@ /**
                 expect(json.version)
+                    // eslint-disable-next-line max-len
                     .to.match(/^((\d+)\.(\d+)\.(\d+))(?:-([\dA-Za-z-]+(?:\.[\dA-Za-z-]+)*))?(?:\+([\dA-Za-z-]+(?:\.[\dA-Za-z-]+)*))?$/);
@@ -42,0 +43,0 @@ });

test/system/travis-yml.test.js

@@ -32,7 +32,7 @@ /* global describe, it */
             expect(travisYAML.language).to.be('node_js');
-            expect(travisYAML.node_js).to.eql(['6', '4']);
+            expect(travisYAML.node_js).to.eql(['4', '6', '8']);
         });
 
         it('should use Google Chrome as an added package', function () {
-            expect(travisYAML.addons).to.eql({apt: {packages: ['google-chrome-stable']}});
+            expect(travisYAML.addons).to.eql({ apt: { packages: ['google-chrome-stable'] } });
         });
@@ -39,0 +39,0 @@

test/unit/uvm-errors.test.js

@@ -42,3 +42,3 @@ describe('uvm errors', function () {
         cyclic = {};
-        subcycle = {parent: cyclic};
+        subcycle = { parent: cyclic };
         cyclic.child = subcycle;
@@ -45,0 +45,0 @@

test/unit/vm-delegate-timers.test.js

@@ -162,5 +162,6 @@ (typeof window === 'undefined' ? describe : describe.skip)('node vm timer delegation', function () {
     it('should not leave the original timer function exposed in global (security)', function (done) {
-        var context = delegateTimers(vm.createContext({expect: expect}));
+        var context = delegateTimers(vm.createContext({ expect: expect }));
 
         context.done = function (err, res) {
+            expect(err).to.be(null);
             expect(res).be.an('object');
@@ -191,3 +192,3 @@ expect(res.typeOf).have.property('setTimeout_', 'undefined');
     it('should not allow access to original context from setter (security)', function (done) {
-        var context = delegateTimers(vm.createContext({expect: expect}));
+        var context = delegateTimers(vm.createContext({ expect: expect }));
 
@@ -210,3 +211,3 @@ context.done = function () {
     it('should not allow access from setter returned objects (security)', function (done) {
-        var context = delegateTimers(vm.createContext({expect: expect}));
+        var context = delegateTimers(vm.createContext({ expect: expect }));
 
@@ -213,0 +214,0 @@ context.done = function () {

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

123462

increased by5.7%

Lines of code

1997

increased by4.66%

Worsened metrics

Dev dependency count

26

increased by8.33%

Number of medium supply chain risk alerts

1

increased byInfinity%

Dependency changes

• + Addedlodash@4.17.5(transitive)

• + Addeduuid@3.2.1(transitive)

• - Removedlodash@4.17.4(transitive)

• - Removeduuid@3.0.1(transitive)

• Updatedlodash@4.17.5

• Updateduuid@3.2.1