Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: coerce pollutes argv #2161

Merged
merged 5 commits into from Apr 9, 2022
Merged

fix: coerce pollutes argv #2161

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
6b23e4c
Prevent coerce logic when related arg is not passed
jly36963 Apr 6, 2022
70876ea
Merge branch 'main' into fix-coerce-bug
jly36963 Apr 6, 2022
4d86088
Fix strip-aliased coerce bug
jly36963 Apr 6, 2022
adf0ccb
cleanup
jly36963 Apr 6, 2022
4b2dfc8
nit
jly36963 Apr 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 11 additions & 1 deletion lib/yargs-factory.ts
View file
Open in desktop
Expand Up @@ -387,6 +387,13 @@ export class YargsInstance {
yargs: YargsInstance
): Partial<Arguments> | Promise<Partial<Arguments>> => {
let aliases: Dictionary<string[]>;

// Skip coerce logic if related arg was not provided
const shouldCoerce = Object.prototype.hasOwnProperty.call(argv, keys);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this can just be:

Object.hasOwnProperty.call(obj, 'a')

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm afraid this is not correct and it should be Object.prototype.hasOwnProperty.

The changes relating to this should be reverted.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Object.hasOwnProperty.call({a: 5}, 'a') and Object.prototype.hasOwnProperty.call({a: 5}, 'a') both return true. (I thought there might be an issue when using a null object, but both return false when Object.create(null) is used as the first argument.) I don't know of any scenarios where their behavior differs. Do you have an example where it could cause problems?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, Object.hasOwnProperty.call === Object.prototype.hasOwnProperty.call is true. I'm assuming they are a reference to the same object

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Notwithstanding the fact that this convention of using the prototype instead of the Object class directly is widely adopted.

It's the same reason to not use {a: 1}.hasOwnProperty('a'). The function could have been overridden via a global polyfill or patch meaning you're not using native behaviour.

I assume that {}.hasOwnProperty.call === Object.hasOwnProperty.call as well as the prototype. The point is that they can be overridden and are, thus, unreliable to use unless you use the underlying prototype.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean, Object.prototype can just as easily be overwritten:

> Object.prototype.hasOwnProperty = () => 'batman'
[Function (anonymous)]
> {}.hasOwnProperty()
'batman'

We would have to rewrite all of yargs to use primordials that are frozen at Node.js' startup to really avoid this issue.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We would have to rewrite all of yargs to use primordials that are frozen at Node.js' startup to really avoid this issue.

This is how Node.js itself approaches the problem:

https://github.com/nodejs/node/blob/master/lib/internal/per_context/primordials.js

But it's made easier for them by the fact that they can do so during bootstrapping.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this is definitely not an issue that is limited to yargs, for better or worse it's a language issue.

Whilst I think overriding the built-in methods like Object.hasOwnProperty() is pretty crazy, for those crazy enough to do it I think there is enough expectation that the prototype is left alone that it can be used reliably. Hence why it's enforced by standard linting rules in eslint and recommendations elsewhere.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dhensby makes sense to me.

if (!shouldCoerce) {
return argv;
}

return maybeAsyncResult<
Partial<Arguments> | Promise<Partial<Arguments>> | any
>(
Expand All @@ -396,7 +403,10 @@ export class YargsInstance {
},
(result: any): Partial<Arguments> => {
argv[keys] = result;
if (aliases[keys]) {
const stripAliased = yargs
.getInternalMethods()
.getParserConfiguration()['strip-aliased'];
if (aliases[keys] && stripAliased !== true) {
for (const alias of aliases[keys]) {
argv[alias] = result;
}
Expand Down
53 changes: 53 additions & 0 deletions test/command.cjs
View file
Open in desktop
Expand Up @@ -1647,6 +1647,59 @@ describe('Command', () => {
argv.rest.should.equal('bar baz');
coerceExecutionCount.should.equal(1);
});

// Addresses: https://github.com/yargs/yargs/issues/2130
it('should not run or set new properties on argv when related argument is not passed', () => {
yargs('cmd1')
.command(
'cmd1',
'cmd1 desc',
yargs =>
yargs
.option('foo', {alias: 'f', type: 'string'})
.option('bar', {
alias: 'b',
type: 'string',
implies: 'f',
coerce: () => expect.fail(), // Should not be called
})
.fail(() => {
expect.fail(); // Should not fail because of implies
}),
argv => {
// eslint-disable-next-line no-prototype-builtins
if (Object.prototype.hasOwnProperty(argv, 'b')) {
expect.fail(); // 'b' was not provided, coerce should not set it
}
}
)
.strict()
.parse();
});

// Addresses: https://github.com/yargs/yargs/issues/2159
it('should not add aliases to argv if strip-aliased config is true', () => {
yargs('cmd1 -f hello -b world')
.parserConfiguration({'strip-aliased': true})
.command(
'cmd1',
'cmd1 desc',
yargs =>
yargs.option('foo', {alias: 'f', type: 'string'}).option('bar', {
type: 'string',
alias: 'b',
coerce: val => val,
}),
argv => {
// eslint-disable-next-line no-prototype-builtins
if (Object.prototype.hasOwnProperty(argv, 'b')) {
expect.fail(); // 'b' is an alias, it should not be in argv
}
}
)
.strict()
.parse();
});
});

describe('defaults', () => {
Expand Down