.eslintrc.json

@@ -0,0 +1,14 @@
+{
+  "env": {
+    "node": true,
+    "mocha": true
+  },
+  "globals": {
+    "expect": true
+  },
+  "extends": ["eslint:recommended", "prettier"],
+  "rules": {
+    "no-console": "off",
+    "no-empty": ["error", { "allowEmptyCatch": true }]
+  }
+}

.gitignore

@@ -12,6 +12,7 @@ lib-cov
 
 # Coverage directory used by tools like istanbul
 coverage
+.nyc_output
 
 # Grunt intermediate storage (http://gruntjs.com/creating-plugins#storing-task-files)
 .grunt

.travis.yml

@@ -12,4 +12,4 @@ node_js:
   - "4"
 
 after_success:
-  - ./bin/codecov -e TRAVIS_NODE_VERSION -f coverage/coverage.json
+  - ./bin/codecov -e TRAVIS_NODE_VERSION -f .nyc_output/*.json

README.md

@@ -95,3 +95,4 @@ nyc report --reporter=text-lcov > coverage.lcov
 - v3.0.1 Security fixes
 - v3.0.2 Security fixes
 - v3.0.3 Support non-git/hg root dirs
+- v3.0.4 Security fixes

appveyor.yml

@@ -22,7 +22,7 @@ test_script:
   - npm run test
 
 after_test:
-  - node .\bin\codecov -f coverage\coverage.json
+  - node .\bin\codecov -f .nyc_output\*.json
 
 build: off
 

bin/codecov

@@ -20,7 +20,8 @@ var args = argv.option([
   {name: 'slug', short: 'r', type: 'string', description: "Specify repository slug for Enterprise ex. owner/repo"},
   {name: 'url', short: 'u', type: 'string', description: "Your Codecov endpoint"},
   {name: 'flags', short: 'F', type: 'string', description: "Codecov Flags"},
-  {name: 'dump', type: 'boolean', description: "Dump collected data and do not send to Codecov"}
+  {name: 'dump', type: 'boolean', description: "Dump collected data and do not send to Codecov"},
+  {name: 'yml', short: 'y', type: 'string', description: "Configuration file Used to specify the location of the .codecov.yml config file. Defaults to codecov.yml and .codecov.yml"}
 ]).run();
 
 codecov.upload(args);

circle.yml

@@ -4,10 +4,4 @@ machine:
 
 test:
   post:
-    - ./bin/codecov -f coverage/coverage.json
-
-deployment:
-  suite:
-    branch: /.*/
-    commands:
-      - make testsuite
+    - ./bin/codecov -f .nyc_output/*.json

lib/codecov.js

@@ -2,6 +2,7 @@ var fs = require('fs')
 var path = require('path')
 var request = require('request')
 var urlgrey = require('urlgrey')
+var jsYaml = require('js-yaml')
 var walk = require('ignore-walk')
 var execSync = require('child_process').execSync
 
@@ -156,7 +157,7 @@ var sendToCodecovV2 = function(
         Accept: 'text/plain',
       },
     },
-    function(err, response, result) {
+    function(err, response) {
       if (err || response.statusCode !== 200) {
         console.log('    ' + (err || response.body))
         return response
@@ -210,7 +211,7 @@ var sendToCodecovV3 = function(
               'x-amz-acl': 'public-read',
             },
           },
-          function(err, response, result) {
+          function(err) {
             if (err) {
               sendToCodecovV2(
                 codecov_endpoint,
@@ -240,6 +241,11 @@ var upload = function(args, on_success, on_failure) {
     'https://codecov.io'
   var query = {}
   var debug = []
+  var yamlFile =
+    args.options.yml ||
+    process.env.codecov_yml ||
+    process.env.CODECOV_YML ||
+    'codecov.yml'
 
   console.log(
     '' +
@@ -253,20 +259,22 @@ var upload = function(args, on_success, on_failure) {
       version
   )
 
-  query.yaml = ['codecov.yml', '.codecov.yml'].reduce(function(result, file) {
-    return (
-      result ||
-      (fs.existsSync(path.resolve(process.cwd(), file)) ? file : undefined)
-    )
-  }, undefined)
-
   if ((args.options.disable || '').split(',').indexOf('detect') === -1) {
     console.log('==> Detecting CI Provider')
     query = detectProvider()
   } else {
     debug.push('disabled detect')
   }
 
+  query.yaml = [yamlFile, '.codecov.yml'].reduce(function(result, file) {
+    return (
+      result ||
+      (fs.existsSync(path.resolve(process.cwd(), file))
+        ? path.resolve(process.cwd(), file)
+        : undefined)
+    )
+  }, undefined)
+
   if (args.options.build) {
     query.build = args.options.build
   }
@@ -289,8 +297,18 @@ var upload = function(args, on_success, on_failure) {
     query.flags = flags
   }
 
+  var yamlToken
+  try {
+    var loadedYamlFile  = jsYaml.safeLoad(fs.readFileSync(query.yaml, 'utf8'))
+    yamlToken = loadedYamlFile && loadedYamlFile.codecov && loadedYamlFile.codecov.token
+  } catch (e) {
+    // silently fail
+  }
   var token =
-    args.options.token || process.env.codecov_token || process.env.CODECOV_TOKEN
+    args.options.token ||
+    yamlToken ||
+    process.env.codecov_token ||
+    process.env.CODECOV_TOKEN
   if (token) {
     query.token = token
   }