Merge branch 'release/4.7.1'

postmanlabs · Apr 3, 2024 · feaa39b · feaa39b
2 parents e93a99a + 921e418
commit feaa39b
Show file tree

Hide file tree

Showing 6 changed files with 73 additions and 26 deletions.
diff --git a/CHANGELOG.yaml b/CHANGELOG.yaml
@@ -1,3 +1,10 @@
+4.7.1:
+  date: 2024-04-03
+  fixed bugs:
+    - GH-994 Modified process.mainModule to prevent access to the Module object
+  chores:
+    - GH-993 Moved deprecation warnings to be on the first usage of API
+
 4.7.0:
   date: 2024-04-01
   new features:

diff --git a/lib/postman-sandbox.js b/lib/postman-sandbox.js
@@ -9,12 +9,15 @@ const _ = require('lodash'),
     EXECUTION_TIMEOUT_ERROR_MESSAGE = 'sandbox not responding',
     BRIDGE_DISCONNECTING_ERROR_MESSAGE = 'sandbox: execution interrupted, bridge disconnecting.';
 
+let MAIN_MODULE = null,
+    ACTIVE_INSTANCES = 0;
 
 class PostmanSandbox extends UniversalVM {
     constructor () {
         super();
 
         this._executing = {};
+        this._initialized = false;
     }
 
     initialize (initOptions, connectOptions, callback) {
@@ -24,6 +27,17 @@ class PostmanSandbox extends UniversalVM {
 
         this.debug = Boolean(connectOptions.debug);
 
+        // Modify mainModule to prevent access to the Module object
+        if (!MAIN_MODULE && typeof process === 'object' && process.mainModule) {
+            MAIN_MODULE = process.mainModule;
+            process.mainModule = {
+                ..._.pick(process.mainModule, ['id', 'path', 'paths', 'filename', 'loaded']),
+                exports: {},
+                children: [],
+                parent: null
+            };
+        }
+
         // set the dispatch timeout of UVM based on what is set in options unless original options sends the same
         _.isFinite(connectOptions.timeout) &&
             (connectOptions.dispatchTimeout = this.executionTimeout = connectOptions.timeout);
@@ -32,6 +46,9 @@ class PostmanSandbox extends UniversalVM {
             if (err) { return callback(err); }
 
             this.once('initialize', (err) => {
+                this._initialized = !err;
+                ACTIVE_INSTANCES++;
+
                 this.on(CONSOLE_EVENT_NAME, (cursor, level, args) => {
                     if (connectOptions.serializeLogs) {
                         return this.emit('console', cursor, level, args);
@@ -133,6 +150,10 @@ class PostmanSandbox extends UniversalVM {
     }
 
     dispose () {
+        if (!this._initialized) {
+            return;
+        }
+
         _.forEach(this._executing, (irq, id) => {
             irq && clearTimeout(irq);
 
@@ -146,6 +167,15 @@ class PostmanSandbox extends UniversalVM {
 
         this.removeAllListeners(CONSOLE_EVENT_NAME);
         this.disconnect();
+
+        this._initialized = false;
+        ACTIVE_INSTANCES--;
+
+        // reset the mainModule to its original value
+        if (ACTIVE_INSTANCES === 0 && MAIN_MODULE) {
+            process.mainModule = MAIN_MODULE;
+            MAIN_MODULE = null;
+        }
     }
 }
 

diff --git a/lib/sandbox/execute-context.js b/lib/sandbox/execute-context.js
@@ -23,7 +23,7 @@ module.exports = function (scope, code, execution, console, timers, pmapi, onAss
     }
     else {
         // prepare legacy environment, which adds a tonne of global variables
-        legacy.setup(scope, execution);
+        legacy.setup(scope, execution, console);
     }
 
     // prepare the scope's environment variables
@@ -54,7 +54,7 @@ module.exports = function (scope, code, execution, console, timers, pmapi, onAss
         execution.return.async = (timers.queueLength() > 0);
 
         // call this hook to perform any post script execution tasks
-        legacy.finish(scope, pmapi, console, onAssertion);
+        legacy.finish(scope, pmapi, onAssertion);
 
         function complete () {
             // if timers are running, we do not need to proceed with any logic of completing execution. instead we wait

diff --git a/lib/sandbox/postman-legacy-interface.js b/lib/sandbox/postman-legacy-interface.js
@@ -175,6 +175,22 @@ function raiseAssertionEvent (scope, pmapi, onAssertion) {
     onAssertion(assertions);
 }
 
+function logDeprecationWarning (key, legacyUsageSet, console) {
+    // we've already logged warning once. ignore all next usages
+    if (legacyUsageSet.has(key)) {
+        return;
+    }
+
+    legacyUsageSet.add(key);
+
+    if (LEGACY_GLOBS_ALTERNATIVES[key]) {
+        console.warn(`Using "${key}" is deprecated. Use "${LEGACY_GLOBS_ALTERNATIVES[key]}" instead.`);
+    }
+    else if (LEGACY_GLOBS.includes(key)) {
+        console.warn(`Using "${key}" is deprecated.`);
+    }
+}
+
 class PostmanLegacyInterface {
     /**
      * @param {Object} execution -
@@ -279,10 +295,11 @@ module.exports = {
      *
      * @param  {Uniscope} scope -
      * @param  {Execution} execution -
+     * @param  {Object} console -
      *
      * @note ensure that globalvars variables added here are added as part of the LEGACY_GLOBS array
      */
-    setup (scope, execution) {
+    setup (scope, execution, console) {
         /**
          * @name SandboxGlobals
          * @type {Object}
@@ -403,7 +420,9 @@ module.exports = {
         globalvars.postman = new (execution.target === TARGET_TEST ?
             PostmanLegacyTestInterface : PostmanLegacyInterface)(execution, globalvars);
 
-        scope.__postman_legacy_api_usage = new Set();
+        const legacyAPIUsage = new Set();
+
+        scope.__is_deprecation_warning_enabled = true;
 
         // wrap all globals to ensure we track their usage to show warnings
         // on access.
@@ -414,7 +433,7 @@ module.exports = {
 
             globalvars[key] = new Proxy(globalvars[key], {
                 set (target, prop, value) {
-                    scope.__postman_legacy_api_usage.add(key);
+                    scope.__is_deprecation_warning_enabled && logDeprecationWarning(key, legacyAPIUsage, console);
 
                     target[prop] = value;
                 },
@@ -423,17 +442,18 @@ module.exports = {
                     // special handling for postman because setNextRequest is
                     // used a lot.
                     if (key === 'postman') {
-                        scope.__postman_legacy_api_usage.add('postman.setNextRequest');
+                        scope.__is_deprecation_warning_enabled &&
+                            logDeprecationWarning('postman.setNextRequest', legacyAPIUsage, console);
                     }
                     else {
-                        scope.__postman_legacy_api_usage.add(key);
+                        scope.__is_deprecation_warning_enabled && logDeprecationWarning(key, legacyAPIUsage, console);
                     }
 
                     return target[prop];
                 },
 
                 apply (target, thisArg, args) {
-                    scope.__postman_legacy_api_usage.add(key);
+                    scope.__is_deprecation_warning_enabled && logDeprecationWarning(key, legacyAPIUsage, console);
 
                     return target.apply(thisArg, args);
                 }
@@ -469,24 +489,14 @@ module.exports = {
      *
      * @param  {Uniscope} scope -
      * @param  {Object} pmapi -
-     * @param  {Object} console -
      * @param  {Function} onAssertion -
      */
-    finish (scope, pmapi, console, onAssertion) {
+    finish (scope, pmapi, onAssertion) {
         if (!scope.__postman_legacy_setup) {
             return;
         }
 
-        if (scope.__postman_legacy_api_usage) {
-            scope.__postman_legacy_api_usage.forEach((key) => {
-                if (LEGACY_GLOBS_ALTERNATIVES[key]) {
-                    console.warn(`Using "${key}" is deprecated. Use "${LEGACY_GLOBS_ALTERNATIVES[key]}" instead.`);
-                }
-                else if (LEGACY_GLOBS.includes(key)) {
-                    console.warn(`Using "${key}" is deprecated.`);
-                }
-            });
-        }
+        scope.__is_deprecation_warning_enabled = false;
 
         raiseAssertionEvent(scope, pmapi, onAssertion);
     },

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "postman-sandbox",
-  "version": "4.7.0",
+  "version": "4.7.1",
   "description": "Sandbox for Postman Scripts to run in Node.js or browser",
   "author": "Postman Inc.",
   "license": "Apache-2.0",
@@ -89,7 +89,7 @@
     "shelljs": "^0.8.5",
     "sinon": "^12.0.1",
     "sinon-chai": "^3.7.0",
-    "terser": "^5.30.0",
+    "terser": "^5.30.2",
     "tsd-jsdoc": "^2.5.0",
     "tv4": "1.3.0",
     "uniscope": "2.2.0",