From de0df2f5ab1f9829c76df23c335c37169867d777 Mon Sep 17 00:00:00 2001 From: Yaroslav Admin Date: Mon, 10 Jan 2022 10:50:54 +0100 Subject: [PATCH 01/48] test: fix version regex in the CLI test case \d no longer matches since 6.3.10 because of two-digit number. --- test/e2e/cli.feature | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/e2e/cli.feature b/test/e2e/cli.feature index e4f235985..16af67fa3 100644 --- a/test/e2e/cli.feature +++ b/test/e2e/cli.feature @@ -30,7 +30,7 @@ Feature: CLI When I execute Karma with arguments: "--version" Then the stdout matches RegExp: """ - ^\d\.\d\.\d$ + ^\d+\.\d+\.\d+$ """ Scenario: Error when command is unknown From a5219c52e2515248eefae4fe1863ac8ad3fdd43b Mon Sep 17 00:00:00 2001 From: Sergei Startsev Date: Mon, 10 Jan 2022 02:07:11 +0100 Subject: [PATCH 02/48] fix(deps): pin colors package to 1.4.0 due to security vulnerability --- package-lock.json | 2 +- package.json | 5 ++++- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8929131c1..2691033eb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5211,7 +5211,7 @@ "body-parser": "^1.19.0", "braces": "^3.0.2", "chokidar": "^3.5.1", - "colors": "^1.4.0", + "colors": "1.4.0", "connect": "^3.7.0", "di": "^0.0.1", "dom-serialize": "^2.2.1", diff --git a/package.json b/package.json index a6a67fe29..7b20277a6 100644 --- a/package.json +++ b/package.json @@ -420,11 +420,14 @@ "chalkerx@gmail.com>", "weiran.zsd@outlook.com>" ], + "overrides": { + "colors": "1.4.0" + }, "dependencies": { "body-parser": "^1.19.0", "braces": "^3.0.2", "chokidar": "^3.5.1", - "colors": "^1.4.0", + "colors": "1.4.0", "connect": "^3.7.0", "di": "^0.0.1", "dom-serialize": "^2.2.1", From c96f0c55297293222b4a91aeec12dae32e2bf4f9 Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Thu, 13 Jan 2022 06:27:37 +0000 Subject: [PATCH 03/48] chore(release): 6.3.11 [skip ci] ## [6.3.11](https://github.com/karma-runner/karma/compare/v6.3.10...v6.3.11) (2022-01-13) ### Bug Fixes * **deps:** pin colors package to 1.4.0 due to security vulnerability ([a5219c5](https://github.com/karma-runner/karma/commit/a5219c52e2515248eefae4fe1863ac8ad3fdd43b)) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 075c126f8..2c96b6e94 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.11](https://github.com/karma-runner/karma/compare/v6.3.10...v6.3.11) (2022-01-13) + + +### Bug Fixes + +* **deps:** pin colors package to 1.4.0 due to security vulnerability ([a5219c5](https://github.com/karma-runner/karma/commit/a5219c52e2515248eefae4fe1863ac8ad3fdd43b)) + ## [6.3.10](https://github.com/karma-runner/karma/compare/v6.3.9...v6.3.10) (2022-01-08) diff --git a/package-lock.json b/package-lock.json index 2691033eb..00bdfc8af 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.10", + "version": "6.3.11", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 7b20277a6..9c7907417 100644 --- a/package.json +++ b/package.json @@ -72,6 +72,7 @@ "Jérémy Judéaux ", "Marcello Nuccio ", "Pieter Mees ", + "Sergei Startsev ", "pavelgj ", "sylvain-hamel ", "ywong ", @@ -119,7 +120,6 @@ "Ruben Bridgewater ", "Réda Housni Alaoui ", "Sammy Jelin ", - "Sergei Startsev ", "Sergey Simonchik ", "Sergey Simonchik ", "Shane Russell ", @@ -497,7 +497,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.10", + "version": "6.3.11", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From c985155a4eac95c525e1217e98d4013ac5f53305 Mon Sep 17 00:00:00 2001 From: katrina95 <34797724+katrina95@users.noreply.github.com> Date: Tue, 18 Jan 2022 20:10:42 -0800 Subject: [PATCH 04/48] docs: create security.md Add security.md file. --- SECURITY.md | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 000000000..77a972928 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,11 @@ +# Security Policy + +## Supported Versions + +Only the latest version of the project are currently being supported with security updates. + +## Reporting a Vulnerability + +To report a security issue, please email karma-runner-eng+security@google.com +with a description of the issue, the steps you took to create the issue, +affected versions, and if known, mitigations for the issue. From 41bed33bf4b88c7e0787ca3a5ec15f2913b936fd Mon Sep 17 00:00:00 2001 From: Max Rose Date: Sun, 23 Jan 2022 19:49:44 +0000 Subject: [PATCH 05/48] fix: remove depreciation warning from log4js --- lib/constants.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/constants.js b/lib/constants.js index c19442e89..5d609c4b7 100644 --- a/lib/constants.js +++ b/lib/constants.js @@ -28,8 +28,8 @@ exports.LOG_PRIORITIES = [ ] // Default patterns for the pattern layout. -exports.COLOR_PATTERN = '%[%d{DATE}:%p [%c]: %]%m' -exports.NO_COLOR_PATTERN = '%d{DATE}:%p [%c]: %m' +exports.COLOR_PATTERN = '%[%d{DATETIME}:%p [%c]: %]%m' +exports.NO_COLOR_PATTERN = '%d{DATETIME}:%p [%c]: %m' // Default console appender exports.CONSOLE_APPENDER = { From 36ad678320a8eb43cd65128a7c084955424d0fde Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Mon, 24 Jan 2022 17:08:45 +0000 Subject: [PATCH 06/48] chore(release): 6.3.12 [skip ci] ## [6.3.12](https://github.com/karma-runner/karma/compare/v6.3.11...v6.3.12) (2022-01-24) ### Bug Fixes * remove depreciation warning from log4js ([41bed33](https://github.com/karma-runner/karma/commit/41bed33bf4b88c7e0787ca3a5ec15f2913b936fd)) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 4 +++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2c96b6e94..7643f8d79 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.12](https://github.com/karma-runner/karma/compare/v6.3.11...v6.3.12) (2022-01-24) + + +### Bug Fixes + +* remove depreciation warning from log4js ([41bed33](https://github.com/karma-runner/karma/commit/41bed33bf4b88c7e0787ca3a5ec15f2913b936fd)) + ## [6.3.11](https://github.com/karma-runner/karma/compare/v6.3.10...v6.3.11) (2022-01-13) diff --git a/package-lock.json b/package-lock.json index 00bdfc8af..62acbc7e5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.11", + "version": "6.3.12", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 9c7907417..acadbd575 100644 --- a/package.json +++ b/package.json @@ -283,6 +283,7 @@ "Matthias Oßwald ", "Matti Paksula ", "Mattijs Kneppers ", + "Max Rose ", "Max Waterman ", "Merott Movahedi ", "Merrick Christensen ", @@ -406,6 +407,7 @@ "is-already-taken <1771602+is-already-taken@users.noreply.github.com>", "jjoos ", "jvalkeejarvi ", + "katrina95 <34797724+katrina95@users.noreply.github.com>", "kyo_ago ", "lanshunfang ", "lusarz ", @@ -497,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.11", + "version": "6.3.12", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From 5bf2df304453c8f71ebc725653fd174ddb1dd28b Mon Sep 17 00:00:00 2001 From: Yaroslav Admin Date: Mon, 24 Jan 2022 18:41:00 +0100 Subject: [PATCH 07/48] fix(deps): bump log4js to resolve security issue Fixes #3751 --- package-lock.json | 84 ++++++++++++++++++++++------------------------- package.json | 2 +- 2 files changed, 41 insertions(+), 45 deletions(-) diff --git a/package-lock.json b/package-lock.json index 62acbc7e5..16041e4a3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2834,9 +2834,9 @@ "dev": true }, "date-format": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/date-format/-/date-format-3.0.0.tgz", - "integrity": "sha512-eyTcpKOcamdhWJXj56DpQMo1ylSQpcGtGKXcU0Tb97+K56/CF5amAqqqNj0+KvA0iw2ynxtHWFsPDSClCxe48w==" + "version": "4.0.3", + "resolved": "https://registry.npmjs.org/date-format/-/date-format-4.0.3.tgz", + "integrity": "sha512-7P3FyqDcfeznLZp2b+OMitV9Sz2lUnsT87WaTat9nVwqsBkTzPG3lPLNwW3en6F4pHUiWzr6vb8CLhjdK9bcxQ==" }, "date-now": { "version": "0.1.4", @@ -4138,9 +4138,9 @@ } }, "flatted": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/flatted/-/flatted-2.0.2.tgz", - "integrity": "sha512-r5wGx7YeOwNWNlCA0wQ86zKyDLMQr+/RB8xy74M4hTphfmjlijTSSXGuH8rnvKZnfT9i+75zmd8jcKdMR4O6jA==" + "version": "3.2.4", + "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.4.tgz", + "integrity": "sha512-8/sOawo8tJ4QOBX8YlQBMxL8+RLZfxMQOif9o0KUKTNTjMYElWPE0r/m5VNFxTRd0NSw8qSy8dajrwX4RYI1Hw==" }, "follow-redirects": { "version": "1.11.0", @@ -4229,13 +4229,13 @@ } }, "fs-extra": { - "version": "8.1.0", - "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-8.1.0.tgz", - "integrity": "sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==", + "version": "10.0.0", + "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.0.0.tgz", + "integrity": "sha512-C5owb14u9eJwizKGdchcDUQeFtlSHHthBk8pbX9Vc1PFZrLombudjDnNns88aYslCyF6IY5SUw3Roz6xShcEIQ==", "requires": { "graceful-fs": "^4.2.0", - "jsonfile": "^4.0.0", - "universalify": "^0.1.0" + "jsonfile": "^6.0.1", + "universalify": "^2.0.0" } }, "fs.realpath": { @@ -5179,11 +5179,12 @@ } }, "jsonfile": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-4.0.0.tgz", - "integrity": "sha1-h3Gq4HmbZAdrdmQPygWPnBDjPss=", + "version": "6.1.0", + "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz", + "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==", "requires": { - "graceful-fs": "^4.1.6" + "graceful-fs": "^4.1.6", + "universalify": "^2.0.0" } }, "jsonify": { @@ -5220,7 +5221,7 @@ "http-proxy": "^1.18.1", "isbinaryfile": "^4.0.8", "lodash": "^4.17.21", - "log4js": "^6.3.0", + "log4js": "^6.4.1", "mime": "^2.5.2", "minimatch": "^3.0.4", "qjobs": "^1.2.0", @@ -5462,21 +5463,21 @@ } }, "log4js": { - "version": "6.3.0", - "resolved": "https://registry.npmjs.org/log4js/-/log4js-6.3.0.tgz", - "integrity": "sha512-Mc8jNuSFImQUIateBFwdOQcmC6Q5maU0VVvdC2R6XMb66/VnT+7WS4D/0EeNMZu1YODmJe5NIn2XftCzEocUgw==", - "requires": { - "date-format": "^3.0.0", - "debug": "^4.1.1", - "flatted": "^2.0.1", - "rfdc": "^1.1.4", - "streamroller": "^2.2.4" + "version": "6.4.1", + "resolved": "https://registry.npmjs.org/log4js/-/log4js-6.4.1.tgz", + "integrity": "sha512-iUiYnXqAmNKiIZ1XSAitQ4TmNs8CdZYTAWINARF3LjnsLN8tY5m0vRwd6uuWj/yNY0YHxeZodnbmxKFUOM2rMg==", + "requires": { + "date-format": "^4.0.3", + "debug": "^4.3.3", + "flatted": "^3.2.4", + "rfdc": "^1.3.0", + "streamroller": "^3.0.2" }, "dependencies": { "debug": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz", - "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==", + "version": "4.3.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz", + "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==", "requires": { "ms": "2.1.2" } @@ -10164,24 +10165,19 @@ } }, "streamroller": { - "version": "2.2.4", - "resolved": "https://registry.npmjs.org/streamroller/-/streamroller-2.2.4.tgz", - "integrity": "sha512-OG79qm3AujAM9ImoqgWEY1xG4HX+Lw+yY6qZj9R1K2mhF5bEmQ849wvrb+4vt4jLMLzwXttJlQbOdPOQVRv7DQ==", + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/streamroller/-/streamroller-3.0.2.tgz", + "integrity": "sha512-ur6y5S5dopOaRXBuRIZ1u6GC5bcEXHRZKgfBjfCglMhmIf+roVCECjvkEYzNQOXIN2/JPnkMPW/8B3CZoKaEPA==", "requires": { - "date-format": "^2.1.0", + "date-format": "^4.0.3", "debug": "^4.1.1", - "fs-extra": "^8.1.0" + "fs-extra": "^10.0.0" }, "dependencies": { - "date-format": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/date-format/-/date-format-2.1.0.tgz", - "integrity": "sha512-bYQuGLeFxhkxNOF3rcMtiZxvCBAquGzZm6oWA1oZ0g2THUzivaRhv8uOhdr19LmoobSOLoIAxeUK2RdbM8IFTA==" - }, "debug": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz", - "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==", + "version": "4.3.3", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz", + "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==", "requires": { "ms": "2.1.2" } @@ -10755,9 +10751,9 @@ "dev": true }, "universalify": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.1.2.tgz", - "integrity": "sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==" + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz", + "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==" }, "unpipe": { "version": "1.0.0", diff --git a/package.json b/package.json index acadbd575..c75cae2e3 100644 --- a/package.json +++ b/package.json @@ -438,7 +438,7 @@ "http-proxy": "^1.18.1", "isbinaryfile": "^4.0.8", "lodash": "^4.17.21", - "log4js": "^6.3.0", + "log4js": "^6.4.1", "mime": "^2.5.2", "minimatch": "^3.0.4", "qjobs": "^1.2.0", From db53785b3e87eca8269bb2e8d0aa6f615d165adc Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Mon, 31 Jan 2022 23:05:15 +0000 Subject: [PATCH 08/48] chore(release): 6.3.13 [skip ci] ## [6.3.13](https://github.com/karma-runner/karma/compare/v6.3.12...v6.3.13) (2022-01-31) ### Bug Fixes * **deps:** bump log4js to resolve security issue ([5bf2df3](https://github.com/karma-runner/karma/commit/5bf2df304453c8f71ebc725653fd174ddb1dd28b)), closes [#3751](https://github.com/karma-runner/karma/issues/3751) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 2 +- 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7643f8d79..1f8c4fa5a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.13](https://github.com/karma-runner/karma/compare/v6.3.12...v6.3.13) (2022-01-31) + + +### Bug Fixes + +* **deps:** bump log4js to resolve security issue ([5bf2df3](https://github.com/karma-runner/karma/commit/5bf2df304453c8f71ebc725653fd174ddb1dd28b)), closes [#3751](https://github.com/karma-runner/karma/issues/3751) + ## [6.3.12](https://github.com/karma-runner/karma/compare/v6.3.11...v6.3.12) (2022-01-24) diff --git a/package-lock.json b/package-lock.json index 16041e4a3..f385637b6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.12", + "version": "6.3.13", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index c75cae2e3..dd08952f7 100644 --- a/package.json +++ b/package.json @@ -499,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.12", + "version": "6.3.13", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From 839578c45a8ac42fbc1d72105f97eab77dd3eb8a Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Mon, 31 Jan 2022 19:41:54 -0600 Subject: [PATCH 09/48] fix(security): remove XSS vulnerability in `returnUrl` query param The `returnUrl` query parameter can be used to execute malicious code. For example, visiting `http://localhost:9876/?return_url=javascript:alert(document.domain)` will display an alert. --- client/karma.js | 3 +++ static/karma.js | 3 +++ 2 files changed, 6 insertions(+) diff --git a/client/karma.js b/client/karma.js index 64264d1d0..b5a6f76b4 100644 --- a/client/karma.js +++ b/client/karma.js @@ -239,6 +239,9 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) self.updater.updateTestStatus('complete') } if (returnUrl) { + if (!/^https?:\/\//.test(returnUrl)) { + throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`) + } location.href = returnUrl } } diff --git a/static/karma.js b/static/karma.js index b88001881..7d7e49a97 100644 --- a/static/karma.js +++ b/static/karma.js @@ -249,6 +249,9 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) self.updater.updateTestStatus('complete') } if (returnUrl) { + if (!/^https?:\/\//.test(returnUrl)) { + throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`) + } location.href = returnUrl } } From 69cfc763c8f83e8e7e64d34e17829d0d3dcc0449 Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Mon, 31 Jan 2022 20:54:17 -0600 Subject: [PATCH 10/48] fix: warn when `singleRun` and `autoWatch` are `false` Setting `singleRun` and `autoWatch` to `false` will not immediately run anything. Warn the user about this. --- lib/server.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/server.js b/lib/server.js index dc2314cdf..31b5306e0 100644 --- a/lib/server.js +++ b/lib/server.js @@ -96,6 +96,10 @@ class Server extends KarmaEventEmitter { this.log.debug('Final config', util.inspect(config, false, /** depth **/ null)) + if (!config.autoWatch && !config.singleRun) { + this.log.warn('`autowatch` and `singleRun` are both `false`. In order to execute tests use `karma run`.') + } + let modules = [{ helper: ['value', helper], logger: ['value', logger], From 91d5acda6325caf91685da465d688527bd412b47 Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Fri, 4 Feb 2022 17:07:47 -0600 Subject: [PATCH 11/48] fix: remove string template from client code It is incompatible with IE. --- client/karma.js | 7 ++++++- static/karma.js | 7 ++++++- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/client/karma.js b/client/karma.js index b5a6f76b4..50651037b 100644 --- a/client/karma.js +++ b/client/karma.js @@ -240,7 +240,12 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) } if (returnUrl) { if (!/^https?:\/\//.test(returnUrl)) { - throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`) + throw new Error( + 'Security: Navigation to '.concat( + returnUrl, + ' was blocked to prevent malicious exploits.' + ) + ) } location.href = returnUrl } diff --git a/static/karma.js b/static/karma.js index 7d7e49a97..f0b2548af 100644 --- a/static/karma.js +++ b/static/karma.js @@ -250,7 +250,12 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) } if (returnUrl) { if (!/^https?:\/\//.test(returnUrl)) { - throw new Error(`Security: Navigation to ${returnUrl} was blocked to prevent malicious exploits.`) + throw new Error( + 'Security: Navigation to '.concat( + returnUrl, + ' was blocked to prevent malicious exploits.' + ) + ) } location.href = returnUrl } From c97e5623195fc043e26c4c0052835989b8b43edc Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Sat, 5 Feb 2022 00:17:18 +0000 Subject: [PATCH 12/48] chore(release): 6.3.14 [skip ci] ## [6.3.14](https://github.com/karma-runner/karma/compare/v6.3.13...v6.3.14) (2022-02-05) ### Bug Fixes * remove string template from client code ([91d5acd](https://github.com/karma-runner/karma/commit/91d5acda6325caf91685da465d688527bd412b47)) * warn when `singleRun` and `autoWatch` are `false` ([69cfc76](https://github.com/karma-runner/karma/commit/69cfc763c8f83e8e7e64d34e17829d0d3dcc0449)) * **security:** remove XSS vulnerability in `returnUrl` query param ([839578c](https://github.com/karma-runner/karma/commit/839578c45a8ac42fbc1d72105f97eab77dd3eb8a)) --- CHANGELOG.md | 9 +++++++++ package-lock.json | 2 +- package.json | 6 +++--- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1f8c4fa5a..05068e58a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,12 @@ +## [6.3.14](https://github.com/karma-runner/karma/compare/v6.3.13...v6.3.14) (2022-02-05) + + +### Bug Fixes + +* remove string template from client code ([91d5acd](https://github.com/karma-runner/karma/commit/91d5acda6325caf91685da465d688527bd412b47)) +* warn when `singleRun` and `autoWatch` are `false` ([69cfc76](https://github.com/karma-runner/karma/commit/69cfc763c8f83e8e7e64d34e17829d0d3dcc0449)) +* **security:** remove XSS vulnerability in `returnUrl` query param ([839578c](https://github.com/karma-runner/karma/commit/839578c45a8ac42fbc1d72105f97eab77dd3eb8a)) + ## [6.3.13](https://github.com/karma-runner/karma/compare/v6.3.12...v6.3.13) (2022-01-31) diff --git a/package-lock.json b/package-lock.json index f385637b6..d1c4a2e7d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.13", + "version": "6.3.14", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index dd08952f7..718ee8603 100644 --- a/package.json +++ b/package.json @@ -30,8 +30,8 @@ "greenkeeperio-bot ", "Karma Bot ", "Maksim Ryzhikov ", - "ukasz Usarz ", "semantic-release-bot ", + "ukasz Usarz ", "Christian Budde Christensen ", "Wesley Cho ", "taichi ", @@ -41,9 +41,9 @@ "Michał Gołębiowski-Owczarek ", "Todd Wolfson ", "Mark Trostler ", + "Jonathan Ginsburg ", "Ciro Nunes ", "Christian Budde Christensen ", - "Jonathan Ginsburg ", "Pawel Kozlowski ", "Robo ", "Shyam Seshadri ", @@ -499,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.13", + "version": "6.3.14", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From 653c762be4fa464fed5bfa306317b84cc5c28a17 Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Fri, 4 Feb 2022 18:07:39 -0600 Subject: [PATCH 13/48] ci: prevent duplicate CI tasks on creating a PR BrowserStack can be flaky when there are multiple concurrent jobs running on it. This commit makes sure that only 1 browser can run concurrently during the `npm run test:client` jobs and that the "Test" GitHub Action workflow is only trigerred once when creating a PR; having the `on: push` configuration made it so that GH triggers two duplicate jobs when a PR is opened. --- .github/workflows/test.yml | 5 +---- test/client/karma.conf.js | 2 +- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 47e0882ae..82d51b1b3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -1,9 +1,6 @@ name: Test on: - push: - branches-ignore: - - master pull_request: branches: - master @@ -38,7 +35,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node: [ 10, 12 ] + node: [10, 12] steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v2 diff --git a/test/client/karma.conf.js b/test/client/karma.conf.js index 454d40d9e..edf0bdb19 100644 --- a/test/client/karma.conf.js +++ b/test/client/karma.conf.js @@ -124,7 +124,7 @@ module.exports = function (config) { 'karma-browserstack-launcher' ], - concurrency: 2, + concurrency: 1, forceJSONP: true, From d9dade2f004a340e49c9a633177576200c286404 Mon Sep 17 00:00:00 2001 From: Yaroslav Admin Date: Fri, 21 Jan 2022 17:19:02 +0100 Subject: [PATCH 14/48] fix(helper): make mkdirIfNotExists helper resilient to concurrent calls The main motivation for this change is https://github.com/karma-runner/karma-coverage/issues/434#issuecomment-1017939333 where concurrent calls to the helper fail because of the race between the check and directory creation. This is a temporary solution and should be replaced with the native [`mkdir`](https://nodejs.org/api/fs.html#fsmkdirpath-options-callback) with the `recursive` option once minimum supported Node is bumped to 12. --- lib/helper.js | 16 ++-------------- package-lock.json | 5 ++--- package.json | 2 +- test/unit/helper.spec.js | 33 ++++++++++----------------------- 4 files changed, 15 insertions(+), 41 deletions(-) diff --git a/lib/helper.js b/lib/helper.js index e77418039..cd239ecc3 100644 --- a/lib/helper.js +++ b/lib/helper.js @@ -1,8 +1,7 @@ 'use strict' -const fs = require('graceful-fs') -const path = require('path') const _ = require('lodash') +const mkdirp = require('mkdirp') const useragent = require('ua-parser-js') const mm = require('minimatch') @@ -141,18 +140,7 @@ const replaceWinPath = (path) => { exports.normalizeWinPath = process.platform === 'win32' ? replaceWinPath : _.identity exports.mkdirIfNotExists = (directory, done) => { - // TODO(vojta): handle if it's a file - /* eslint-disable handle-callback-err */ - fs.stat(directory, (err, stat) => { - if (stat && stat.isDirectory()) { - done() - } else { - exports.mkdirIfNotExists(path.dirname(directory), () => { - fs.mkdir(directory, done) - }) - } - }) - /* eslint-enable handle-callback-err */ + mkdirp(directory, done) } exports.defer = () => { diff --git a/package-lock.json b/package-lock.json index d1c4a2e7d..64d119dbb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5224,6 +5224,7 @@ "log4js": "^6.4.1", "mime": "^2.5.2", "minimatch": "^3.0.4", + "mkdirp": "^0.5.5", "qjobs": "^1.2.0", "range-parser": "^1.2.1", "rimraf": "^3.0.2", @@ -6020,8 +6021,7 @@ "minimist": { "version": "1.2.5", "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz", - "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==", - "dev": true + "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==" }, "minimist-options": { "version": "4.1.0", @@ -6059,7 +6059,6 @@ "version": "0.5.5", "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.5.tgz", "integrity": "sha512-NKmAlESf6jMGym1++R0Ra7wvhV+wFW63FaSOFPwRahvea0gMUcGUhVeAg/0BC0wiv9ih5NYPB1Wn1UEI1/L+xQ==", - "dev": true, "requires": { "minimist": "^1.2.5" } diff --git a/package.json b/package.json index 718ee8603..f8a1f71fe 100644 --- a/package.json +++ b/package.json @@ -441,6 +441,7 @@ "log4js": "^6.4.1", "mime": "^2.5.2", "minimatch": "^3.0.4", + "mkdirp": "^0.5.5", "qjobs": "^1.2.0", "range-parser": "^1.2.1", "rimraf": "^3.0.2", @@ -479,7 +480,6 @@ "karma-mocha": "^1.0.1", "karma-mocha-reporter": "^2.0.0", "karma-script-launcher": "^1.0.0", - "mkdirp": "^0.5.0", "mocha": "^4.1.0", "mocks": "^0.0.15", "proxyquire": "^2.1.3", diff --git a/test/unit/helper.spec.js b/test/unit/helper.spec.js index 8c5808c50..2d4abc204 100644 --- a/test/unit/helper.spec.js +++ b/test/unit/helper.spec.js @@ -229,36 +229,23 @@ describe('helper', () => { }) describe('mkdirIfNotExists', () => { - const fsMock = require('mocks').fs const loadFile = require('mocks').loadFile - const fs = fsMock.create({ - home: { 'some.js': fsMock.file() } - }) + const spy = sinon.spy() // load file under test - const m = loadFile(path.join(__dirname, '/../../lib/helper.js'), { 'graceful-fs': fs, lodash: require('lodash') }) - - const mkdirIfNotExists = m.exports.mkdirIfNotExists - - it('should not do anything, if dir already exists', (done) => { - mkdirIfNotExists('/home', done) - }) - - it('should create directory if it does not exist', (done) => { - mkdirIfNotExists('/home/new', () => { - const stat = fs.statSync('/home/new') - expect(stat).to.exist - expect(stat.isDirectory()).to.equal(true) + const m = loadFile(path.join(__dirname, '/../../lib/helper.js'), { + mkdirp: (path, done) => { + spy(path) done() - }) + } }) - it('should create even parent directories if it does not exist', (done) => { - mkdirIfNotExists('/home/new/parent/child', () => { - const stat = fs.statSync('/home/new/parent/child') - expect(stat).to.exist - expect(stat.isDirectory()).to.equal(true) + const mkdirIfNotExists = m.exports.mkdirIfNotExists + + it('should call mkdirp', (done) => { + mkdirIfNotExists('/path/to/dir', () => { + expect(spy).to.have.been.calledOnceWith('/path/to/dir') done() }) }) From c1befa04b32b90f088fefdc0521c6f48cbc510a9 Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Sat, 5 Feb 2022 00:54:36 +0000 Subject: [PATCH 15/48] chore(release): 6.3.15 [skip ci] ## [6.3.15](https://github.com/karma-runner/karma/compare/v6.3.14...v6.3.15) (2022-02-05) ### Bug Fixes * **helper:** make mkdirIfNotExists helper resilient to concurrent calls ([d9dade2](https://github.com/karma-runner/karma/commit/d9dade2f004a340e49c9a633177576200c286404)), closes [/github.com/karma-runner/karma-coverage/issues/434#issuecomment-1017939333](https://github.com//github.com/karma-runner/karma-coverage/issues/434/issues/issuecomment-1017939333) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 05068e58a..6d9fa0799 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.15](https://github.com/karma-runner/karma/compare/v6.3.14...v6.3.15) (2022-02-05) + + +### Bug Fixes + +* **helper:** make mkdirIfNotExists helper resilient to concurrent calls ([d9dade2](https://github.com/karma-runner/karma/commit/d9dade2f004a340e49c9a633177576200c286404)), closes [/github.com/karma-runner/karma-coverage/issues/434#issuecomment-1017939333](https://github.com//github.com/karma-runner/karma-coverage/issues/434/issues/issuecomment-1017939333) + ## [6.3.14](https://github.com/karma-runner/karma/compare/v6.3.13...v6.3.14) (2022-02-05) diff --git a/package-lock.json b/package-lock.json index 64d119dbb..556087493 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.14", + "version": "6.3.15", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index f8a1f71fe..6674f5ea7 100644 --- a/package.json +++ b/package.json @@ -40,8 +40,8 @@ "Anton ", "Michał Gołębiowski-Owczarek ", "Todd Wolfson ", - "Mark Trostler ", "Jonathan Ginsburg ", + "Mark Trostler ", "Ciro Nunes ", "Christian Budde Christensen ", "Pawel Kozlowski ", @@ -499,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.14", + "version": "6.3.15", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From ff7edbb2ffbcdd69761bece86b7dc1ef0740508d Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Thu, 10 Feb 2022 12:23:41 -0600 Subject: [PATCH 16/48] fix(security): mitigate the "Open Redirect Vulnerability" --- client/karma.js | 10 +++++++++- docs/config/01-configuration-file.md | 9 +++++++++ lib/config.js | 9 +++++---- static/karma.js | 10 +++++++++- test/client/karma.spec.js | 29 +++++++++++++++++++++++++--- 5 files changed, 58 insertions(+), 9 deletions(-) diff --git a/client/karma.js b/client/karma.js index 50651037b..9e13d89df 100644 --- a/client/karma.js +++ b/client/karma.js @@ -239,7 +239,15 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) self.updater.updateTestStatus('complete') } if (returnUrl) { - if (!/^https?:\/\//.test(returnUrl)) { + var isReturnUrlAllowed = false + for (var i = 0; i < this.config.allowedReturnUrlPatterns.length; i++) { + var allowedReturnUrlPattern = new RegExp(this.config.allowedReturnUrlPatterns[i]) + if (allowedReturnUrlPattern.test(returnUrl)) { + isReturnUrlAllowed = true + break + } + } + if (!isReturnUrlAllowed) { throw new Error( 'Security: Navigation to '.concat( returnUrl, diff --git a/docs/config/01-configuration-file.md b/docs/config/01-configuration-file.md index ce83ec28c..dff4b6135 100644 --- a/docs/config/01-configuration-file.md +++ b/docs/config/01-configuration-file.md @@ -277,6 +277,15 @@ upon the completion of running the tests. Setting this to false is useful when e If true, Karma does not display the banner and browser list. Useful when using karma on component tests with screenshots. +## client.allowedReturnUrlPatterns +**Type:** Array + +**Default:** `['^https?://']` + +**Description:** Define the string representations of the regular expressions that will be allowed for the `return_url` query parameter. + +If the value of the `return_url` query parameter does not match any regular expression derived from the string representation of each of the elements of this array, navigation to it will be blocked. + ## colors **Type:** Boolean diff --git a/lib/config.js b/lib/config.js index cd9510bfd..240e1c305 100644 --- a/lib/config.js +++ b/lib/config.js @@ -17,19 +17,19 @@ let TYPE_SCRIPT_AVAILABLE = false try { require('coffeescript').register() COFFEE_SCRIPT_AVAILABLE = true -} catch (e) {} +} catch {} // LiveScript is required here to enable config files written in LiveScript. // It's not directly used in this file. try { require('LiveScript') LIVE_SCRIPT_AVAILABLE = true -} catch (e) {} +} catch {} try { require('ts-node') TYPE_SCRIPT_AVAILABLE = true -} catch (e) {} +} catch {} class Pattern { constructor (pattern, served, included, watched, nocache, type, isBinary) { @@ -324,7 +324,8 @@ class Config { useIframe: true, runInParent: false, captureConsole: true, - clearContext: true + clearContext: true, + allowedReturnUrlPatterns: ['^https?://'] } this.browserDisconnectTimeout = 2000 this.browserDisconnectTolerance = 0 diff --git a/static/karma.js b/static/karma.js index f0b2548af..23081eb7f 100644 --- a/static/karma.js +++ b/static/karma.js @@ -249,7 +249,15 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) self.updater.updateTestStatus('complete') } if (returnUrl) { - if (!/^https?:\/\//.test(returnUrl)) { + var isReturnUrlAllowed = false + for (var i = 0; i < this.config.allowedReturnUrlPatterns.length; i++) { + var allowedReturnUrlPattern = new RegExp(this.config.allowedReturnUrlPatterns[i]) + if (allowedReturnUrlPattern.test(returnUrl)) { + isReturnUrlAllowed = true + break + } + } + if (!isReturnUrlAllowed) { throw new Error( 'Security: Navigation to '.concat( returnUrl, diff --git a/test/client/karma.spec.js b/test/client/karma.spec.js index 3e7af73d8..b88ebda38 100644 --- a/test/client/karma.spec.js +++ b/test/client/karma.spec.js @@ -442,15 +442,18 @@ describe('Karma', function () { assert(spyResult.called) }) - it('should navigate the client to return_url if specified', function (done) { + it('should navigate the client to return_url if specified and allowed', function (done) { + var config = { + // The default value. + allowedReturnUrlPatterns: ['^https?://'] + } windowLocation.search = '?id=567&return_url=http://return.com' socket = new MockSocket() k = new ClientKarma(updater, socket, iframe, windowStub, windowNavigator, windowLocation) clientWindow = { karma: k } ck = new ContextKarma(ContextKarma.getDirectCallParentKarmaMethod(clientWindow)) - ck.config = {} + socket.emit('execute', config) - sinon.spy(socket, 'disconnect') clock.tick(500) ck.complete() @@ -462,6 +465,26 @@ describe('Karma', function () { clock.tick(10) }) + it('should not navigate the client to return_url if not allowed', function () { + var config = { + allowedReturnUrlPatterns: [] + } + + windowLocation.search = '?id=567&return_url=javascript:alert(document.domain)' + socket = new MockSocket() + k = new ClientKarma(updater, socket, iframe, windowStub, windowNavigator, windowLocation) + clientWindow = { karma: k } + ck = new ContextKarma(ContextKarma.getDirectCallParentKarmaMethod(clientWindow)) + socket.emit('execute', config) + + try { + ck.complete() + throw new Error('An error should have been caught.') + } catch (error) { + assert(/Error: Security: Navigation to .* was blocked to prevent malicious exploits./.test(error)) + } + }) + it('should clear context window upon complete when clearContext config is true', function () { var config = ck.config = { clearContext: true From ab4b32898bcb4e0ba3a1e99835d30c113db3eeeb Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Thu, 10 Feb 2022 18:33:48 +0000 Subject: [PATCH 17/48] chore(release): 6.3.16 [skip ci] ## [6.3.16](https://github.com/karma-runner/karma/compare/v6.3.15...v6.3.16) (2022-02-10) ### Bug Fixes * **security:** mitigate the "Open Redirect Vulnerability" ([ff7edbb](https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d)) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6d9fa0799..0b8581167 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.16](https://github.com/karma-runner/karma/compare/v6.3.15...v6.3.16) (2022-02-10) + + +### Bug Fixes + +* **security:** mitigate the "Open Redirect Vulnerability" ([ff7edbb](https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d)) + ## [6.3.15](https://github.com/karma-runner/karma/compare/v6.3.14...v6.3.15) (2022-02-05) diff --git a/package-lock.json b/package-lock.json index 556087493..7d5fa9af4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.15", + "version": "6.3.16", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 6674f5ea7..9379c9403 100644 --- a/package.json +++ b/package.json @@ -38,9 +38,9 @@ "Liam Newman ", "lukasz ", "Anton ", + "Jonathan Ginsburg ", "Michał Gołębiowski-Owczarek ", "Todd Wolfson ", - "Jonathan Ginsburg ", "Mark Trostler ", "Ciro Nunes ", "Christian Budde Christensen ", @@ -499,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.15", + "version": "6.3.16", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From fca18843e7a04eeb67b86cb3cfc3db794d66f445 Mon Sep 17 00:00:00 2001 From: David Hyde Date: Mon, 28 Feb 2022 13:20:05 -0600 Subject: [PATCH 18/48] fix(deps): update colors to maintained version (#3763) Co-authored-by: David Hyde --- lib/reporters/base_color.js | 2 +- package-lock.json | 10 ++++++++-- package.json | 5 +---- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/lib/reporters/base_color.js b/lib/reporters/base_color.js index f45c04110..9ae379dfb 100644 --- a/lib/reporters/base_color.js +++ b/lib/reporters/base_color.js @@ -1,4 +1,4 @@ -const { red, yellow, green, cyan } = require('colors/safe') +const { red, yellow, green, cyan } = require('@colors/colors/safe') function BaseColorReporter () { this.USE_COLORS = true diff --git a/package-lock.json b/package-lock.json index 7d5fa9af4..98179b1cb 100644 --- a/package-lock.json +++ b/package-lock.json @@ -42,6 +42,11 @@ } } }, + "@colors/colors": { + "version": "1.5.0", + "resolved": "https://registry.npmjs.org/@colors/colors/-/colors-1.5.0.tgz", + "integrity": "sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==" + }, "@commitlint/cli": { "version": "12.1.4", "resolved": "https://registry.npmjs.org/@commitlint/cli/-/cli-12.1.4.tgz", @@ -2315,7 +2320,8 @@ "colors": { "version": "1.4.0", "resolved": "https://registry.npmjs.org/colors/-/colors-1.4.0.tgz", - "integrity": "sha512-a+UqTh4kgZg/SlGvfbzDHpgRu7AAQOmmqRHJnxhRZICKFUT91brVhNNt58CMWU9PsBbv3PDCZUHbVxuDiH2mtA==" + "integrity": "sha512-a+UqTh4kgZg/SlGvfbzDHpgRu7AAQOmmqRHJnxhRZICKFUT91brVhNNt58CMWU9PsBbv3PDCZUHbVxuDiH2mtA==", + "dev": true }, "combine-source-map": { "version": "0.8.0", @@ -5209,10 +5215,10 @@ "version": "file:", "dev": true, "requires": { + "@colors/colors": "1.5.0", "body-parser": "^1.19.0", "braces": "^3.0.2", "chokidar": "^3.5.1", - "colors": "1.4.0", "connect": "^3.7.0", "di": "^0.0.1", "dom-serialize": "^2.2.1", diff --git a/package.json b/package.json index 9379c9403..807b09550 100644 --- a/package.json +++ b/package.json @@ -422,14 +422,11 @@ "chalkerx@gmail.com>", "weiran.zsd@outlook.com>" ], - "overrides": { - "colors": "1.4.0" - }, "dependencies": { "body-parser": "^1.19.0", "braces": "^3.0.2", "chokidar": "^3.5.1", - "colors": "1.4.0", + "@colors/colors": "1.5.0", "connect": "^3.7.0", "di": "^0.0.1", "dom-serialize": "^2.2.1", From f068854da881014803f2a790235b59d82621eb3f Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Mon, 28 Feb 2022 20:59:01 +0000 Subject: [PATCH 19/48] chore(release): 6.3.17 [skip ci] ## [6.3.17](https://github.com/karma-runner/karma/compare/v6.3.16...v6.3.17) (2022-02-28) ### Bug Fixes * **deps:** update colors to maintained version ([#3763](https://github.com/karma-runner/karma/issues/3763)) ([fca1884](https://github.com/karma-runner/karma/commit/fca18843e7a04eeb67b86cb3cfc3db794d66f445)) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 3 ++- 3 files changed, 10 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0b8581167..7fce88179 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.17](https://github.com/karma-runner/karma/compare/v6.3.16...v6.3.17) (2022-02-28) + + +### Bug Fixes + +* **deps:** update colors to maintained version ([#3763](https://github.com/karma-runner/karma/issues/3763)) ([fca1884](https://github.com/karma-runner/karma/commit/fca18843e7a04eeb67b86cb3cfc3db794d66f445)) + ## [6.3.16](https://github.com/karma-runner/karma/compare/v6.3.15...v6.3.16) (2022-02-10) diff --git a/package-lock.json b/package-lock.json index 98179b1cb..7c46baedc 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.16", + "version": "6.3.17", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 807b09550..567b85901 100644 --- a/package.json +++ b/package.json @@ -191,6 +191,7 @@ "Dan Thareja ", "Danny Croft ", "Danny Tuppeny ", + "David Hyde ", "David Jensen ", "David M. Karr ", "Derek Gould ", @@ -496,7 +497,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.16", + "version": "6.3.17", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From d6359a7160ed9a7397370a4b3c8f06af2614ceee Mon Sep 17 00:00:00 2001 From: Tobias Speicher Date: Sun, 27 Mar 2022 01:59:31 +0100 Subject: [PATCH 20/48] refactor: replace deprecated String.prototype.substr() .substr() is deprecated so we replace it with .slice() which works similarily but isn't deprecated Signed-off-by: Tobias Speicher --- client/main.js | 2 +- common/util.js | 2 +- lib/completion.js | 2 +- lib/events.js | 2 +- lib/helper.js | 2 +- lib/launcher.js | 2 +- lib/middleware/karma.js | 10 +++++----- lib/runner.js | 6 +++--- 8 files changed, 14 insertions(+), 14 deletions(-) diff --git a/client/main.js b/client/main.js index 7dfc5b738..f8546ebb5 100644 --- a/client/main.js +++ b/client/main.js @@ -15,7 +15,7 @@ var socket = io(location.host, { reconnectionDelay: 500, reconnectionDelayMax: Infinity, timeout: BROWSER_SOCKET_TIMEOUT, - path: KARMA_PROXY_PATH + KARMA_URL_ROOT.substr(1) + 'socket.io', + path: KARMA_PROXY_PATH + KARMA_URL_ROOT.slice(1) + 'socket.io', 'sync disconnect on unload': true, useNativeTimers: true }) diff --git a/common/util.js b/common/util.js index 9d406c635..6c251a901 100644 --- a/common/util.js +++ b/common/util.js @@ -20,7 +20,7 @@ exports.isDefined = function (value) { exports.parseQueryParams = function (locationSearch) { var params = {} - var pairs = locationSearch.substr(1).split('&') + var pairs = locationSearch.slice(1).split('&') var keyValue for (var i = 0; i < pairs.length; i++) { diff --git a/lib/completion.js b/lib/completion.js index 8e2d56f63..eb058527c 100644 --- a/lib/completion.js +++ b/lib/completion.js @@ -36,7 +36,7 @@ const options = { function opositeWord (word) { if (word.startsWith('-')) { - return word.startsWith('--no-') ? `--${word.substr(5)}` : `--no-${word.substr(2)}` + return word.startsWith('--no-') ? `--${word.slice(5)}` : `--no-${word.slice(2)}` } else { return null } diff --git a/lib/events.js b/lib/events.js index 6d8280bfc..7d64ce39d 100644 --- a/lib/events.js +++ b/lib/events.js @@ -35,7 +35,7 @@ class KarmaEventEmitter extends EventEmitter { bind (object) { for (const method in object) { if (method.startsWith('on') && helper.isFunction(object[method])) { - this.on(helper.camelToSnake(method.substr(2)), function () { + this.on(helper.camelToSnake(method.slice(2)), function () { // We do not use an arrow function here, to supply the caller as this. object[method].apply(object, Array.from(arguments).concat(this)) }) diff --git a/lib/helper.js b/lib/helper.js index cd239ecc3..3c58fe8dc 100644 --- a/lib/helper.js +++ b/lib/helper.js @@ -96,7 +96,7 @@ exports.camelToSnake = (camelCase) => { } exports.ucFirst = (word) => { - return word.charAt(0).toUpperCase() + word.substr(1) + return word.charAt(0).toUpperCase() + word.slice(1) } exports.dashToCamel = (dash) => { diff --git a/lib/launcher.js b/lib/launcher.js index 723390c09..e374fbbd1 100644 --- a/lib/launcher.js +++ b/lib/launcher.js @@ -60,7 +60,7 @@ class Launcher { protocol = upstreamProxy.protocol hostname = upstreamProxy.hostname port = upstreamProxy.port - urlRoot = upstreamProxy.path + urlRoot.substr(1) + urlRoot = upstreamProxy.path + urlRoot.slice(1) } return (name) => { diff --git a/lib/middleware/karma.js b/lib/middleware/karma.js index 5f701e7e7..a5c94f399 100644 --- a/lib/middleware/karma.js +++ b/lib/middleware/karma.js @@ -32,9 +32,9 @@ const FILE_TYPES = [ function filePathToUrlPath (filePath, basePath, urlRoot, proxyPath) { if (filePath.startsWith(basePath)) { - return proxyPath + urlRoot.substr(1) + 'base' + filePath.substr(basePath.length) + return proxyPath + urlRoot.slice(1) + 'base' + filePath.slice(basePath.length) } - return proxyPath + urlRoot.substr(1) + 'absolute' + filePath + return proxyPath + urlRoot.slice(1) + 'absolute' + filePath } function getQuery (urlStr) { @@ -85,8 +85,8 @@ function createKarmaMiddleware ( const requestedRangeHeader = request.headers.range // redirect /__karma__ to /__karma__ (trailing slash) - if (requestUrl === urlRoot.substr(0, urlRoot.length - 1)) { - response.setHeader('Location', proxyPath + urlRoot.substr(1)) + if (requestUrl === urlRoot.slice(0, -1)) { + response.setHeader('Location', proxyPath + urlRoot.slice(1)) response.writeHead(301) return response.end('MOVED PERMANENTLY') } @@ -97,7 +97,7 @@ function createKarmaMiddleware ( } // remove urlRoot prefix - requestUrl = requestUrl.substr(urlRoot.length - 1) + requestUrl = requestUrl.slice(urlRoot.length - 1) // serve client.html if (requestUrl === '/') { diff --git a/lib/runner.js b/lib/runner.js index 7d07bb08b..2e04065b6 100644 --- a/lib/runner.js +++ b/lib/runner.js @@ -18,9 +18,9 @@ function parseExitCode (buffer, defaultExitCode, failOnEmptyTestSuite) { const tail = buffer.slice(tailPos) const tailStr = tail.toString() - if (tailStr.substr(0, tailStr.length - 2) === constant.EXIT_CODE) { - const emptyInt = parseInt(tailStr.substr(-2, 1), 10) - let exitCode = parseInt(tailStr.substr(-1), 10) + if (tailStr.slice(0, -2) === constant.EXIT_CODE) { + const emptyInt = parseInt(tailStr.slice(-2, -1), 10) + let exitCode = parseInt(tailStr.slice(-1), 10) if (failOnEmptyTestSuite === false && emptyInt === 0) { log.warn('Test suite was empty.') exitCode = 0 From 1b6ded58021219324282b5b701ea227b2faab0e3 Mon Sep 17 00:00:00 2001 From: Tobias Speicher Date: Sun, 27 Mar 2022 03:02:39 +0200 Subject: [PATCH 21/48] refactor: replace .substring() with .slice() .slice() is shorter and generally faster Signed-off-by: Tobias Speicher --- lib/file.js | 2 +- lib/helper.js | 6 +++--- lib/launchers/process.js | 2 +- lib/url.js | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/file.js b/lib/file.js index 24e140779..2342fd3ab 100644 --- a/lib/file.js +++ b/lib/file.js @@ -36,7 +36,7 @@ class File { * @returns {string} detected file type or empty string */ detectType () { - return path.extname(this.path).substring(1) + return path.extname(this.path).slice(1) } toString () { diff --git a/lib/helper.js b/lib/helper.js index 3c58fe8dc..9be119378 100644 --- a/lib/helper.js +++ b/lib/helper.js @@ -30,15 +30,15 @@ const parser = (pattern, out) => { t = 'optional' } out[t]++ - return parser(pattern.substring(1), out) + return parser(pattern.slice(1), out) } if (matches[2] !== undefined) { out.ext_glob++ parser(matches[2], out) - return parser(pattern.substring(matches[0].length), out) + return parser(pattern.slice(matches[0].length), out) } out.range++ - return parser(pattern.substring(matches[0].length), out) + return parser(pattern.slice(matches[0].length), out) } const gsParser = (pattern, out) => { diff --git a/lib/launchers/process.js b/lib/launchers/process.js index a7aa101ce..9fa859fc3 100644 --- a/lib/launchers/process.js +++ b/lib/launchers/process.js @@ -44,7 +44,7 @@ function ProcessLauncher (spawn, tempDir, timer, processKillTimeout) { // Normalize the command, remove quotes (spawn does not like them). this._normalizeCommand = function (cmd) { if (cmd.charAt(0) === cmd.charAt(cmd.length - 1) && '\'`"'.includes(cmd.charAt(0))) { - cmd = cmd.substring(1, cmd.length - 1) + cmd = cmd.slice(1, -1) log.warn(`The path should not be quoted.\n Normalized the path to ${cmd}`) } diff --git a/lib/url.js b/lib/url.js index 0bbfcc6d3..ebe078619 100644 --- a/lib/url.js +++ b/lib/url.js @@ -19,7 +19,7 @@ class Url { * @returns {string} detected file type or empty string */ detectType () { - return path.extname(new URL(this.path).pathname).substring(1) + return path.extname(new URL(this.path).pathname).slice(1) } toString () { From 263a87025a88b040f51a825d516654ef7d8de88b Mon Sep 17 00:00:00 2001 From: Tobias Speicher Date: Sun, 27 Mar 2022 14:18:23 +0200 Subject: [PATCH 22/48] refactor: replace deprecated String.prototype.substr() .substr() is deprecated so we replace it with .slice() which works similarily but isn't deprecated Signed-off-by: Tobias Speicher --- static/context.js | 2 +- static/karma.js | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/static/context.js b/static/context.js index 8d697eff8..94e1f24ae 100644 --- a/static/context.js +++ b/static/context.js @@ -123,7 +123,7 @@ exports.isDefined = function (value) { exports.parseQueryParams = function (locationSearch) { var params = {} - var pairs = locationSearch.substr(1).split('&') + var pairs = locationSearch.slice(1).split('&') var keyValue for (var i = 0; i < pairs.length; i++) { diff --git a/static/karma.js b/static/karma.js index 23081eb7f..04c7ad322 100644 --- a/static/karma.js +++ b/static/karma.js @@ -348,7 +348,7 @@ var socket = io(location.host, { reconnectionDelay: 500, reconnectionDelayMax: Infinity, timeout: BROWSER_SOCKET_TIMEOUT, - path: KARMA_PROXY_PATH + KARMA_URL_ROOT.substr(1) + 'socket.io', + path: KARMA_PROXY_PATH + KARMA_URL_ROOT.slice(1) + 'socket.io', 'sync disconnect on unload': true, useNativeTimers: true }) @@ -565,7 +565,7 @@ exports.isDefined = function (value) { exports.parseQueryParams = function (locationSearch) { var params = {} - var pairs = locationSearch.substr(1).split('&') + var pairs = locationSearch.slice(1).split('&') var keyValue for (var i = 0; i < pairs.length; i++) { From 7aeb3f84684325f1d5e0cff276b14aa059c6f6ce Mon Sep 17 00:00:00 2001 From: Nico Jansen Date: Fri, 11 Feb 2022 08:54:59 +0100 Subject: [PATCH 23/48] docs(configuration-file): document async function See https://github.com/karma-runner/karma/pull/3660 --- docs/config/01-configuration-file.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/config/01-configuration-file.md b/docs/config/01-configuration-file.md index dff4b6135..dfa0bf1cd 100644 --- a/docs/config/01-configuration-file.md +++ b/docs/config/01-configuration-file.md @@ -53,6 +53,20 @@ module.exports = (config) => { } ``` +Alternatively, you can use an `async` function instead (since v6.3). + +```javascript +// karma.conf.js +module.exports = async (config) => { + const karmaConfig = await getKarmaConfig("dev"); + + config.set({ + ...karmaConfig + }); +}; +``` + + ### Customized TypeScript Configuration Under the hood Karma uses ts-node to transpile TypeScript to JavaScript. If the resolved `tsconfig.json` has `module` configured as `ES` formats. You might get errors like `SyntaxError: Unexpected token`. This is due that in Node `ES` module formats are not supported. To overcome this issue you need to configure ts-node to use `commonjs` module format. From 52a30bbc6e168333a8592c26c9f40678d6ab74ea Mon Sep 17 00:00:00 2001 From: Jonathan Kingston Date: Wed, 6 Apr 2022 15:02:31 +0100 Subject: [PATCH 24/48] fix(deps): upgrade socket.io to v4.4.1 Signed-off-by: Jonathan Kingston --- package-lock.json | 105 ++++++++++++++++++++++++++-------------------- package.json | 4 +- 2 files changed, 62 insertions(+), 47 deletions(-) diff --git a/package-lock.json b/package-lock.json index 7c46baedc..dcb9917ce 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1188,6 +1188,11 @@ "integrity": "sha512-+iTbntw2IZPb/anVDbypzfQa+ay64MW0Zo8aJ8gZPWMMK6/OubMVb6lUPMagqjOPnmtauXnFCACVl3O7ogjeqQ==", "dev": true }, + "@socket.io/base64-arraybuffer": { + "version": "1.0.2", + "resolved": "https://registry.npmjs.org/@socket.io/base64-arraybuffer/-/base64-arraybuffer-1.0.2.tgz", + "integrity": "sha512-dOlCBKnDw4iShaIsH/bxujKTM18+2TOAsYz+KSc11Am38H4q5Xw8Bbz97ZYdrVNM+um3p7w86Bvvmcn9q+5+eQ==" + }, "@tootallnate/once": { "version": "1.1.2", "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz", @@ -1228,9 +1233,9 @@ "dev": true }, "@types/node": { - "version": "13.11.0", - "resolved": "https://registry.npmjs.org/@types/node/-/node-13.11.0.tgz", - "integrity": "sha512-uM4mnmsIIPK/yeO+42F2RQhGUIs39K2RFmugcJANppXe6J1nvH87PvzPZYpza7Xhhs8Yn9yIAVdLZ84z61+0xQ==" + "version": "17.0.23", + "resolved": "https://registry.npmjs.org/@types/node/-/node-17.0.23.tgz", + "integrity": "sha512-UxDxWn7dl97rKVeVS61vErvw086aCYhDLyvRQZ5Rk65rZKepaFdm53GeqXaKBuOhED4e9uWq34IC3TdSdJJ2Gw==" }, "@types/normalize-package-data": { "version": "2.4.1", @@ -1261,12 +1266,27 @@ } }, "accepts": { - "version": "1.3.7", - "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.7.tgz", - "integrity": "sha512-Il80Qs2WjYlJIBNzNkK6KYqlVMTbZLXgHx2oT0pU/fjRHyEp+PEfEPY0R3WCwAGVOtauxh1hOxNgIf5bv7dQpA==", + "version": "1.3.8", + "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz", + "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==", "requires": { - "mime-types": "~2.1.24", - "negotiator": "0.6.2" + "mime-types": "~2.1.34", + "negotiator": "0.6.3" + }, + "dependencies": { + "mime-db": { + "version": "1.52.0", + "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", + "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==" + }, + "mime-types": { + "version": "2.1.35", + "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", + "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", + "requires": { + "mime-db": "1.52.0" + } + } } }, "acorn": { @@ -1662,11 +1682,6 @@ } } }, - "base64-arraybuffer": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/base64-arraybuffer/-/base64-arraybuffer-1.0.1.tgz", - "integrity": "sha512-vFIUq7FdLtjZMhATwDul5RZWv2jpXQ09Pd6jcVEOvIsqCWTRFD/ONHNfyOS8dA/Ippi5dsIgpyKWKZaAKZltbA==" - }, "base64-js": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.3.0.tgz", @@ -2548,9 +2563,9 @@ } }, "cookie": { - "version": "0.4.1", - "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz", - "integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==" + "version": "0.4.2", + "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz", + "integrity": "sha512-aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==" }, "cookiejar": { "version": "2.1.2", @@ -3179,9 +3194,9 @@ "integrity": "sha1-rT/0yG7C0CkyL1oCw6mmBslbP1k=" }, "engine.io": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.0.0.tgz", - "integrity": "sha512-Ui7yl3JajEIaACg8MOUwWvuuwU7jepZqX3BKs1ho7NQRuP4LhN4XIykXhp8bEy+x/DhA0LBZZXYSCkZDqrwMMg==", + "version": "6.1.3", + "resolved": "https://registry.npmjs.org/engine.io/-/engine.io-6.1.3.tgz", + "integrity": "sha512-rqs60YwkvWTLLnfazqgZqLa/aKo+9cueVfEi/dZ8PyGyaf8TLOxj++4QMIgeG3Gn0AhrWiFXvghsoY9L9h25GA==", "requires": { "@types/cookie": "^0.4.1", "@types/cors": "^2.8.12", @@ -3191,14 +3206,14 @@ "cookie": "~0.4.1", "cors": "~2.8.5", "debug": "~4.3.1", - "engine.io-parser": "~5.0.0", + "engine.io-parser": "~5.0.3", "ws": "~8.2.3" }, "dependencies": { "debug": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.2.tgz", - "integrity": "sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==", + "version": "4.3.4", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz", + "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==", "requires": { "ms": "2.1.2" } @@ -3211,11 +3226,11 @@ } }, "engine.io-parser": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.0.1.tgz", - "integrity": "sha512-j4p3WwJrG2k92VISM0op7wiq60vO92MlF3CRGxhKHy9ywG1/Dkc72g0dXeDQ+//hrcDn8gqQzoEkdO9FN0d9AA==", + "version": "5.0.3", + "resolved": "https://registry.npmjs.org/engine.io-parser/-/engine.io-parser-5.0.3.tgz", + "integrity": "sha512-BtQxwF27XUNnSafQLvDi0dQ8s3i6VgzSoQMJacpIcGNrlUdfHSKbgm3jmjCVvQluGzqwujQMPAoMai3oYSTurg==", "requires": { - "base64-arraybuffer": "~1.0.1" + "@socket.io/base64-arraybuffer": "~1.0.2" } }, "enquirer": { @@ -5234,7 +5249,7 @@ "qjobs": "^1.2.0", "range-parser": "^1.2.1", "rimraf": "^3.0.2", - "socket.io": "^4.2.0", + "socket.io": "^4.4.1", "source-map": "^0.6.1", "tmp": "^0.2.1", "ua-parser-js": "^0.7.30", @@ -6227,9 +6242,9 @@ "dev": true }, "negotiator": { - "version": "0.6.2", - "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.2.tgz", - "integrity": "sha512-hZXc7K2e+PgeI1eDBe/10Ard4ekbfrrqG8Ep+8Jmf4JID2bNg7NvCPOZN+kfF574pFQI7mum2AUqDidoKqcTOw==" + "version": "0.6.3", + "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz", + "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==" }, "neo-async": { "version": "2.6.2", @@ -9884,22 +9899,22 @@ } }, "socket.io": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/socket.io/-/socket.io-4.3.1.tgz", - "integrity": "sha512-HC5w5Olv2XZ0XJ4gOLGzzHEuOCfj3G0SmoW3jLHYYh34EVsIr3EkW9h6kgfW+K3TFEcmYy8JcPWe//KUkBp5jA==", + "version": "4.4.1", + "resolved": "https://registry.npmjs.org/socket.io/-/socket.io-4.4.1.tgz", + "integrity": "sha512-s04vrBswdQBUmuWJuuNTmXUVJhP0cVky8bBDhdkf8y0Ptsu7fKU2LuLbts9g+pdmAdyMMn8F/9Mf1/wbtUN0fg==", "requires": { "accepts": "~1.3.4", "base64id": "~2.0.0", "debug": "~4.3.2", - "engine.io": "~6.0.0", - "socket.io-adapter": "~2.3.2", + "engine.io": "~6.1.0", + "socket.io-adapter": "~2.3.3", "socket.io-parser": "~4.0.4" }, "dependencies": { "debug": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.2.tgz", - "integrity": "sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==", + "version": "4.3.4", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz", + "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==", "requires": { "ms": "2.1.2" } @@ -9912,9 +9927,9 @@ } }, "socket.io-adapter": { - "version": "2.3.2", - "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-2.3.2.tgz", - "integrity": "sha512-PBZpxUPYjmoogY0aoaTmo1643JelsaS1CiAwNjRVdrI0X9Seuc19Y2Wife8k88avW6haG8cznvwbubAZwH4Mtg==" + "version": "2.3.3", + "resolved": "https://registry.npmjs.org/socket.io-adapter/-/socket.io-adapter-2.3.3.tgz", + "integrity": "sha512-Qd/iwn3VskrpNO60BeRyCyr8ZWw9CPZyitW4AQwmRZ8zCiyDiL+znRnWX6tDHXnWn1sJrM1+b6Mn6wEDJJ4aYQ==" }, "socket.io-parser": { "version": "4.0.4", @@ -9932,9 +9947,9 @@ "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==" }, "debug": { - "version": "4.3.2", - "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.2.tgz", - "integrity": "sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==", + "version": "4.3.4", + "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz", + "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==", "requires": { "ms": "2.1.2" } diff --git a/package.json b/package.json index 567b85901..f1013ad97 100644 --- a/package.json +++ b/package.json @@ -424,10 +424,10 @@ "weiran.zsd@outlook.com>" ], "dependencies": { + "@colors/colors": "1.5.0", "body-parser": "^1.19.0", "braces": "^3.0.2", "chokidar": "^3.5.1", - "@colors/colors": "1.5.0", "connect": "^3.7.0", "di": "^0.0.1", "dom-serialize": "^2.2.1", @@ -443,7 +443,7 @@ "qjobs": "^1.2.0", "range-parser": "^1.2.1", "rimraf": "^3.0.2", - "socket.io": "^4.2.0", + "socket.io": "^4.4.1", "source-map": "^0.6.1", "tmp": "^0.2.1", "ua-parser-js": "^0.7.30", From 31701a251cf83e26340d9ffcc49b91d8cbad090b Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Wed, 13 Apr 2022 03:02:00 +0000 Subject: [PATCH 25/48] chore(release): 6.3.18 [skip ci] ## [6.3.18](https://github.com/karma-runner/karma/compare/v6.3.17...v6.3.18) (2022-04-13) ### Bug Fixes * **deps:** upgrade socket.io to v4.4.1 ([52a30bb](https://github.com/karma-runner/karma/commit/52a30bbc6e168333a8592c26c9f40678d6ab74ea)) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 6 ++++-- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7fce88179..72d1870c0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.18](https://github.com/karma-runner/karma/compare/v6.3.17...v6.3.18) (2022-04-13) + + +### Bug Fixes + +* **deps:** upgrade socket.io to v4.4.1 ([52a30bb](https://github.com/karma-runner/karma/commit/52a30bbc6e168333a8592c26c9f40678d6ab74ea)) + ## [6.3.17](https://github.com/karma-runner/karma/compare/v6.3.16...v6.3.17) (2022-02-28) diff --git a/package-lock.json b/package-lock.json index dcb9917ce..f230766d6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.17", + "version": "6.3.18", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index f1013ad97..e5ba090f1 100644 --- a/package.json +++ b/package.json @@ -71,8 +71,10 @@ "Jeff Jewiss ", "Jérémy Judéaux ", "Marcello Nuccio ", + "Nico Jansen ", "Pieter Mees ", "Sergei Startsev ", + "Tobias Speicher ", "pavelgj ", "sylvain-hamel ", "ywong ", @@ -108,7 +110,6 @@ "Levi Thomason ", "Luke Page ", "Matt Lewis ", - "Nico Jansen ", "Parashuram ", "Pat Tullmann ", "PatrickJS ", @@ -245,6 +246,7 @@ "Jon Bretman ", "Jonathan ES Lin ", "Jonathan Felchlin ", + "Jonathan Kingston ", "Jonathan Niles ", "Josh Lory ", "João Marcos Duarte ", @@ -497,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.17", + "version": "6.3.18", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From b659015a79432d6a9a72781c3b570cc74bb29e3e Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Tue, 12 Apr 2022 22:03:33 -0500 Subject: [PATCH 26/48] ci: lint and commitlint in its own workflow Source of inspiration: https://github.com/karma-runner/karma-jasmine/pull/313 --- .github/workflows/lint.yml | 25 +++++++++++++++++++++++++ .github/workflows/test.yml | 4 +--- 2 files changed, 26 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/lint.yml diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 000000000..070815b16 --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,25 @@ +name: Lint + +on: + pull_request: + branches: + - master + +jobs: + linux: + name: Linux - Lint + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v2 + with: + fetch-depth: 0 + - uses: actions/setup-node@v2 + with: + node-version: 14 + cache: npm + - run: npm ci + - run: | + npm run commitlint -- \ + --verbose \ + --from `git merge-base origin/master $GITHUB_SHA` + - run: npm run lint diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 82d51b1b3..13fea22eb 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -7,7 +7,7 @@ on: jobs: main: - name: Lint and Unit (Client and Server), E2E and Integration Test + name: Unit (Client and Server), E2E and Integration Test runs-on: ubuntu-latest env: BROWSERSTACK_USERNAME: ${{ secrets.BROWSERSTACK_USERNAME }} @@ -23,8 +23,6 @@ jobs: node-version: 14 cache: npm - run: npm ci - - run: npm run commitlint -- --from `git merge-base origin/master $GITHUB_SHA` - - run: npm run lint - run: npm run build:check - run: npm run test:unit - run: npm run test:e2e From 099b85ed0a46e37dd7cb14fc1596cbb1b3eabce9 Mon Sep 17 00:00:00 2001 From: Jonathan Ginsburg Date: Tue, 19 Apr 2022 01:28:44 -0500 Subject: [PATCH 27/48] fix(client): error out when opening a new tab fails --- client/karma.js | 3 +++ static/karma.js | 3 +++ 2 files changed, 6 insertions(+) diff --git a/client/karma.js b/client/karma.js index 9e13d89df..117c1239b 100644 --- a/client/karma.js +++ b/client/karma.js @@ -94,6 +94,9 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) childWindow.close() } childWindow = opener(url) + if (childWindow === null) { + self.error('Opening a new tab/window failed, probably because pop-ups are blocked.') + } // run context on parent element (client_with_context) // using window.__karma__.scriptUrls to get the html element strings and load them dynamically } else if (url !== 'about:blank') { diff --git a/static/karma.js b/static/karma.js index 04c7ad322..f72f024ed 100644 --- a/static/karma.js +++ b/static/karma.js @@ -104,6 +104,9 @@ function Karma (updater, socket, iframe, opener, navigator, location, document) childWindow.close() } childWindow = opener(url) + if (childWindow === null) { + self.error('Opening a new tab/window failed, probably because pop-ups are blocked.') + } // run context on parent element (client_with_context) // using window.__karma__.scriptUrls to get the html element strings and load them dynamically } else if (url !== 'about:blank') { From 6ff5aafe9578a5f958adf2d565d45e4b5d204245 Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Tue, 19 Apr 2022 19:39:30 +0000 Subject: [PATCH 28/48] chore(release): 6.3.19 [skip ci] ## [6.3.19](https://github.com/karma-runner/karma/compare/v6.3.18...v6.3.19) (2022-04-19) ### Bug Fixes * **client:** error out when opening a new tab fails ([099b85e](https://github.com/karma-runner/karma/commit/099b85ed0a46e37dd7cb14fc1596cbb1b3eabce9)) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 72d1870c0..e2500bf93 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.19](https://github.com/karma-runner/karma/compare/v6.3.18...v6.3.19) (2022-04-19) + + +### Bug Fixes + +* **client:** error out when opening a new tab fails ([099b85e](https://github.com/karma-runner/karma/commit/099b85ed0a46e37dd7cb14fc1596cbb1b3eabce9)) + ## [6.3.18](https://github.com/karma-runner/karma/compare/v6.3.17...v6.3.18) (2022-04-13) diff --git a/package-lock.json b/package-lock.json index f230766d6..3e2206d31 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.18", + "version": "6.3.19", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index e5ba090f1..7487c353b 100644 --- a/package.json +++ b/package.json @@ -35,10 +35,10 @@ "Christian Budde Christensen ", "Wesley Cho ", "taichi ", + "Jonathan Ginsburg ", "Liam Newman ", "lukasz ", "Anton ", - "Jonathan Ginsburg ", "Michał Gołębiowski-Owczarek ", "Todd Wolfson ", "Mark Trostler ", @@ -499,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.18", + "version": "6.3.19", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From 60f4f794ea8472e4ace8e5c2d8744f83078a1277 Mon Sep 17 00:00:00 2001 From: Yaroslav Admin Date: Tue, 23 Nov 2021 22:09:10 +0100 Subject: [PATCH 29/48] build: add Node 16 and 18 to the CI matrix Update documentation, so that it does not become outdated whenever a new version of Node is released. Test on the current version of Node, so we can spot problems early, but don't claim to support it as current release line sometimes introduces bugs, which are later fixed by Node itself. Fixes #3728 --- .github/workflows/lint.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/test.yml | 6 +++--- docs/intro/01-installation.md | 2 +- docs/intro/04-faq.md | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 070815b16..ea040f011 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -15,7 +15,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-node@v2 with: - node-version: 14 + node-version: 16 cache: npm - run: npm ci - run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e93ffed06..53d5054a0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,7 +23,7 @@ jobs: token: ${{ env.GITHUB_TOKEN }} - uses: actions/setup-node@v2 with: - node-version: 14 + node-version: 16 cache: npm - run: npm ci - run: npm run lint diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 13fea22eb..707d3d26b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,7 +20,7 @@ jobs: fetch-depth: 0 - uses: actions/setup-node@v2 with: - node-version: 14 + node-version: 16 cache: npm - run: npm ci - run: npm run build:check @@ -33,7 +33,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - node: [10, 12] + node: [10, 12, 14, 18] steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v2 @@ -48,7 +48,7 @@ jobs: runs-on: windows-latest strategy: matrix: - node: [10, 12, 14] + node: [10, 12, 14, 16, 18] steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v2 diff --git a/docs/intro/01-installation.md b/docs/intro/01-installation.md index a9ff25145..429ac1561 100644 --- a/docs/intro/01-installation.md +++ b/docs/intro/01-installation.md @@ -5,7 +5,7 @@ Karma runs on [Node.js] and is available as an [npm] package. On Mac or Linux we recommend using [NVM](https://github.com/creationix/nvm). On Windows, download Node.js from [the official site](https://nodejs.org/) or use the [NVM PowerShell Module](https://www.powershellgallery.com/packages/nvm). -Note: Karma currently works on Node.js **6.x**, **8.x**, and **10.x**. See [FAQ] for more info. +Karma works on all [LTS releases](https://nodejs.org/en/about/releases/) of Node.js. ## Installing Karma and plugins diff --git a/docs/intro/04-faq.md b/docs/intro/04-faq.md index a70444f2c..9387d3caf 100644 --- a/docs/intro/04-faq.md +++ b/docs/intro/04-faq.md @@ -27,7 +27,7 @@ The latest stable version from npm (`npm install karma`). See [versioning] for m ### Which version of Node.js does Karma run with? -Karma works on all active LTS versions of node as specified by the [Node.js Release Working Group](https://github.com/nodejs/Release/blob/master/README.md). The nodejs version numbers are set in the package.json. Older versions of karma work with older versions of nodejs, but are not maintained or updated. +Karma works on all LTS versions of Node.js as specified by the [Node.js Release Working Group](https://github.com/nodejs/Release/blob/master/README.md). The Node.js version numbers are set in the package.json. Older versions of karma work with older versions of Node.js, but are not maintained or updated. [mailing list]: https://groups.google.com/d/forum/karma-users [karma-ng-scenario]: https://github.com/karma-runner/karma-ng-scenario From e17698f950af83bf2b3edc540d2a3e1fb73cba59 Mon Sep 17 00:00:00 2001 From: Yaroslav Admin Date: Tue, 10 May 2022 20:35:56 +0200 Subject: [PATCH 30/48] fix: prefer IPv4 addresses when resolving domains Node 17+ changed the DNS resolution (see https://github.com/nodejs/node/issues/40702), so now it resolves `localhost` according to the OS settings instead of IPv4-address first. The Karma server only listens on IPv4 address (127.0.0.1) by default, but the requests are sent to `localhost` in several places and `localhost` is resolved into IPv6 address (`::`) in Node 17+. So the run/stop/proxy request is unable to reach the Karma server and produces an error. This commit configures karma to use the IPv4-address first approach in newer Node version as well. In the future major release, we may consider changing defaults to listen on IPv6 address instead, but IPv6 is not supported in Docker on macOS and Windows, so I think we should not rush such a change to make sure karma works there out of the box. Fixes #3730 --- lib/middleware/proxy.js | 6 +++++- lib/runner.js | 4 +++- lib/stopper.js | 4 +++- lib/utils/dns-utils.js | 11 +++++++++++ test/e2e/support/proxy.js | 2 +- 5 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 lib/utils/dns-utils.js diff --git a/lib/middleware/proxy.js b/lib/middleware/proxy.js index 6b0fcf730..b2e0e7f63 100644 --- a/lib/middleware/proxy.js +++ b/lib/middleware/proxy.js @@ -3,6 +3,7 @@ const { Agent: httpAgent } = require('http') const { Agent: httpsAgent } = require('https') const httpProxy = require('http-proxy') const _ = require('lodash') +const { lookup } = require('../utils/dns-utils') const log = require('../logger').create('proxy') @@ -41,7 +42,10 @@ function parseProxyConfig (proxies, config) { const port = proxyDetails.port || defaultPorts[proxyDetails.protocol] || config.port const changeOrigin = proxyConfiguration.changeOrigin || false const Agent = protocol === 'https:' ? httpsAgent : httpAgent - const agent = new Agent({ keepAlive: true }) + const agent = new Agent({ + keepAlive: true, + lookup + }) const proxy = httpProxy.createProxyServer({ target: { host: hostname, port, protocol }, xfwd: true, diff --git a/lib/runner.js b/lib/runner.js index 2e04065b6..fb67ebe92 100644 --- a/lib/runner.js +++ b/lib/runner.js @@ -7,6 +7,7 @@ const EventEmitter = require('events').EventEmitter const helper = require('./helper') const cfg = require('./config') const logger = require('./logger') +const { lookup } = require('./utils/dns-utils') const log = logger.create('runner') function parseExitCode (buffer, defaultExitCode, failOnEmptyTestSuite) { @@ -74,7 +75,8 @@ function run (cliOptionsOrConfig, done) { method: 'POST', headers: { 'Content-Type': 'application/json' - } + }, + lookup } const request = http.request(options, function (response) { diff --git a/lib/stopper.js b/lib/stopper.js index 964eb5e37..386fa5d83 100644 --- a/lib/stopper.js +++ b/lib/stopper.js @@ -2,6 +2,7 @@ const http = require('http') const cfg = require('./config') const logger = require('./logger') const helper = require('./helper') +const { lookup } = require('./utils/dns-utils') exports.stop = function (cliOptionsOrConfig, done) { cliOptionsOrConfig = cliOptionsOrConfig || {} @@ -42,7 +43,8 @@ exports.stop = function (cliOptionsOrConfig, done) { hostname: config.hostname, path: config.urlRoot + 'stop', port: config.port, - method: 'GET' + method: 'GET', + lookup }) request.on('response', function (response) { diff --git a/lib/utils/dns-utils.js b/lib/utils/dns-utils.js new file mode 100644 index 000000000..5d281ed6f --- /dev/null +++ b/lib/utils/dns-utils.js @@ -0,0 +1,11 @@ +const dns = require('dns') + +// Node >=17 has different DNS resolution (see +// https://github.com/nodejs/node/issues/40702), it resolves domains +// according to the OS settings instead of IPv4-address first. The Karma server +// only listens on IPv4 address (127.0.0.1) by default, but the requests are +// sent to `localhost` in several places and `localhost` is resolved into IPv6 +// address (`::`). So the run/stop/proxy request is unable to reach the Karma +// server and produces an error. To mitigate this issue karma force the +// IPv4-address first approach in Node >=17 as well. +module.exports.lookup = (hostname, options, callback) => dns.lookup(hostname, { ...options, verbatim: false }, callback) diff --git a/test/e2e/support/proxy.js b/test/e2e/support/proxy.js index 5bf17c1fd..e78a4544c 100644 --- a/test/e2e/support/proxy.js +++ b/test/e2e/support/proxy.js @@ -8,7 +8,7 @@ module.exports = class Proxy { this.proxyPathRegExp = null this.proxy = httpProxy.createProxyServer({ - target: 'http://localhost:9876' + target: 'http://127.0.0.1:9876' }) this.proxy.on('error', (err) => { From 5e71cf591e9006ad2621dd88d09739bfbffd463c Mon Sep 17 00:00:00 2001 From: semantic-release-bot Date: Fri, 13 May 2022 00:27:34 +0000 Subject: [PATCH 31/48] chore(release): 6.3.20 [skip ci] ## [6.3.20](https://github.com/karma-runner/karma/compare/v6.3.19...v6.3.20) (2022-05-13) ### Bug Fixes * prefer IPv4 addresses when resolving domains ([e17698f](https://github.com/karma-runner/karma/commit/e17698f950af83bf2b3edc540d2a3e1fb73cba59)), closes [#3730](https://github.com/karma-runner/karma/issues/3730) --- CHANGELOG.md | 7 +++++++ package-lock.json | 2 +- package.json | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index e2500bf93..cb8d3c859 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [6.3.20](https://github.com/karma-runner/karma/compare/v6.3.19...v6.3.20) (2022-05-13) + + +### Bug Fixes + +* prefer IPv4 addresses when resolving domains ([e17698f](https://github.com/karma-runner/karma/commit/e17698f950af83bf2b3edc540d2a3e1fb73cba59)), closes [#3730](https://github.com/karma-runner/karma/issues/3730) + ## [6.3.19](https://github.com/karma-runner/karma/compare/v6.3.18...v6.3.19) (2022-04-19) diff --git a/package-lock.json b/package-lock.json index 3e2206d31..da0a5af3f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,6 +1,6 @@ { "name": "karma", - "version": "6.3.19", + "version": "6.3.20", "lockfileVersion": 1, "requires": true, "dependencies": { diff --git a/package.json b/package.json index 7487c353b..50789b029 100644 --- a/package.json +++ b/package.json @@ -29,8 +29,8 @@ "Yaroslav Admin ", "greenkeeperio-bot ", "Karma Bot ", - "Maksim Ryzhikov ", "semantic-release-bot ", + "Maksim Ryzhikov ", "ukasz Usarz ", "Christian Budde Christensen ", "Wesley Cho ", @@ -499,7 +499,7 @@ "engines": { "node": ">= 10" }, - "version": "6.3.19", + "version": "6.3.20", "license": "MIT", "scripts": { "lint": "eslint . --ext js --ignore-pattern *.tpl.js", From 6a54b1c2a1df8214c470b8a5cc8036912874637e Mon Sep 17 00:00:00 2001 From: falsandtru Date: Mon, 16 May 2022 12:33:52 +0900 Subject: [PATCH 32/48] feat: support SRI verification of script tags --- lib/config.js | 7 ++++--- lib/file-list.js | 4 ++-- lib/file.js | 4 +++- lib/middleware/karma.js | 7 ++++--- lib/url.js | 3 ++- test/unit/middleware/karma.spec.js | 19 +++++++++++++++++-- 6 files changed, 32 insertions(+), 12 deletions(-) diff --git a/lib/config.js b/lib/config.js index 240e1c305..0dff33c99 100644 --- a/lib/config.js +++ b/lib/config.js @@ -32,7 +32,7 @@ try { } catch {} class Pattern { - constructor (pattern, served, included, watched, nocache, type, isBinary) { + constructor (pattern, served, included, watched, nocache, type, isBinary, integrity) { this.pattern = pattern this.served = helper.isDefined(served) ? served : true this.included = helper.isDefined(included) ? included : true @@ -41,6 +41,7 @@ class Pattern { this.weight = helper.mmPatternWeight(pattern) this.type = type this.isBinary = isBinary + this.integrity = integrity } compare (other) { @@ -49,8 +50,8 @@ class Pattern { } class UrlPattern extends Pattern { - constructor (url, type) { - super(url, false, true, false, false, type) + constructor (url, type, integrity) { + super(url, false, true, false, false, type, undefined, integrity) } } diff --git a/lib/file-list.js b/lib/file-list.js index 6c9e93d16..b4ec01d29 100644 --- a/lib/file-list.js +++ b/lib/file-list.js @@ -62,9 +62,9 @@ class FileList { let lastCompletedRefresh = this._refreshing lastCompletedRefresh = Promise.all( - this._patterns.map(async ({ pattern, type, nocache, isBinary }) => { + this._patterns.map(async ({ pattern, type, nocache, isBinary, integrity }) => { if (helper.isUrlAbsolute(pattern)) { - this.buckets.set(pattern, [new Url(pattern, type)]) + this.buckets.set(pattern, [new Url(pattern, type, integrity)]) return } diff --git a/lib/file.js b/lib/file.js index 2342fd3ab..698aca7dc 100644 --- a/lib/file.js +++ b/lib/file.js @@ -6,7 +6,7 @@ const path = require('path') * File object used for tracking files in `file-list.js`. */ class File { - constructor (path, mtime, doNotCache, type, isBinary) { + constructor (path, mtime, doNotCache, type, isBinary, integrity) { // used for serving (processed path, eg some/file.coffee -> some/file.coffee.js) this.path = path @@ -29,6 +29,8 @@ class File { // Tri state: null means probe file for binary. this.isBinary = isBinary === undefined ? null : isBinary + + this.integrity = integrity } /** diff --git a/lib/middleware/karma.js b/lib/middleware/karma.js index a5c94f399..20051eec4 100644 --- a/lib/middleware/karma.js +++ b/lib/middleware/karma.js @@ -190,11 +190,12 @@ function createKarmaMiddleware ( scriptTags.push(``) } else { const scriptType = (SCRIPT_TYPE[fileType] || 'text/javascript') - const crossOriginAttribute = includeCrossOriginAttribute ? 'crossorigin="anonymous"' : '' + const crossOriginAttribute = includeCrossOriginAttribute ? ' crossorigin="anonymous"' : '' + const integrityAttribute = file.integrity ? ` integrity="${file.integrity}"` : '' if (fileType === 'module') { - scriptTags.push(``) + scriptTags.push(``) } else { - scriptTags.push(``) + scriptTags.push(``) } } } diff --git a/lib/url.js b/lib/url.js index ebe078619..fce5bd1d3 100644 --- a/lib/url.js +++ b/lib/url.js @@ -7,10 +7,11 @@ const { URL } = require('url') * Url object used for tracking files in `file-list.js`. */ class Url { - constructor (path, type) { + constructor (path, type, integrity) { this.path = path this.originalPath = path this.type = type + this.integrity = integrity this.isUrl = true } diff --git a/test/unit/middleware/karma.spec.js b/test/unit/middleware/karma.spec.js index 4f6b873c2..7479b202e 100644 --- a/test/unit/middleware/karma.spec.js +++ b/test/unit/middleware/karma.spec.js @@ -17,8 +17,8 @@ describe('middleware.karma', () => { let response class MockFile extends File { - constructor (path, sha, type, content) { - super(path, undefined, undefined, type) + constructor (path, sha, type, content, integrity) { + super(path, undefined, undefined, type, undefined, integrity) this.sha = sha || 'sha-default' this.content = content } @@ -230,6 +230,21 @@ describe('middleware.karma', () => { callHandlerWith('/__karma__/context.html') }) + it('should serve context.html with script tags with integrity checking', (done) => { + includedFiles([ + new MockFile('/first.js', 'sha123'), + new MockFile('/second.js', 'sha456', undefined, undefined, 'sha256-XXX') + ]) + + response.once('end', () => { + expect(nextSpy).not.to.have.been.called + expect(response).to.beServedAs(200, 'CONTEXT\n\n') + done() + }) + + callHandlerWith('/__karma__/context.html') + }) + it('should serve context.html with replaced link tags', (done) => { includedFiles([ new MockFile('/first.css', 'sha007'), From dc51a2e0e9b9805f7740f52fde01bcd20adc2dfc Mon Sep 17 00:00:00 2001 From: falsandtru Date: Tue, 17 May 2022 15:59:15 +0900 Subject: [PATCH 33/48] feat: support SRI verification of link tags --- lib/middleware/karma.js | 8 ++++---- test/unit/middleware/karma.spec.js | 21 ++++++++++++++++++--- 2 files changed, 22 insertions(+), 7 deletions(-) diff --git a/lib/middleware/karma.js b/lib/middleware/karma.js index 20051eec4..355a9b63b 100644 --- a/lib/middleware/karma.js +++ b/lib/middleware/karma.js @@ -182,16 +182,16 @@ function createKarmaMiddleware ( } } + const integrityAttribute = file.integrity ? ` integrity="${file.integrity}"` : '' + const crossOriginAttribute = includeCrossOriginAttribute ? ' crossorigin="anonymous"' : '' if (fileType === 'css') { - scriptTags.push(``) + scriptTags.push(``) } else if (fileType === 'dom') { scriptTags.push(file.content) } else if (fileType === 'html') { - scriptTags.push(``) + scriptTags.push(``) } else { const scriptType = (SCRIPT_TYPE[fileType] || 'text/javascript') - const crossOriginAttribute = includeCrossOriginAttribute ? ' crossorigin="anonymous"' : '' - const integrityAttribute = file.integrity ? ` integrity="${file.integrity}"` : '' if (fileType === 'module') { scriptTags.push(``) } else { diff --git a/test/unit/middleware/karma.spec.js b/test/unit/middleware/karma.spec.js index 7479b202e..db9c5819b 100644 --- a/test/unit/middleware/karma.spec.js +++ b/test/unit/middleware/karma.spec.js @@ -257,7 +257,7 @@ describe('middleware.karma', () => { response.once('end', () => { expect(nextSpy).not.to.have.been.called - expect(response).to.beServedAs(200, 'CONTEXT\n\n\n\n\n\n') + expect(response).to.beServedAs(200, 'CONTEXT\n\n\n\n\n\n') done() }) @@ -293,7 +293,22 @@ describe('middleware.karma', () => { response.once('end', () => { expect(nextSpy).not.to.have.been.called - expect(response).to.beServedAs(200, 'CONTEXT\n\n\n\n\n\n\n\n') + expect(response).to.beServedAs(200, 'CONTEXT\n\n\n\n\n\n\n\n') + done() + }) + + callHandlerWith('/__karma__/context.html') + }) + + it('should serve context.html with link tags with integrity checking', (done) => { + includedFiles([ + new MockFile('/first.css', 'sha007', undefined, undefined, 'sha256-XXX'), + new MockFile('/second.html', 'sha678', undefined, undefined, 'sha256-XXX') + ]) + + response.once('end', () => { + expect(nextSpy).not.to.have.been.called + expect(response).to.beServedAs(200, 'CONTEXT\n\n') done() }) @@ -462,7 +477,7 @@ describe('middleware.karma', () => { response.once('end', () => { expect(nextSpy).not.to.have.been.called - expect(response).to.beServedAs(200, 'DEBUG\n\n\n\n\n\n\n\n') + expect(response).to.beServedAs(200, 'DEBUG\n\n\n\n\n\n\n\n') done() }) From f2d0663105eba0b9ea7f281230546282a46015ad Mon Sep 17 00:00:00 2001 From: falsandtru Date: Fri, 20 May 2022 19:46:15 +0900 Subject: [PATCH 34/48] docs: add integrity parameter --- docs/config/02-files.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/config/02-files.md b/docs/config/02-files.md index aac9304e0..0bab8256c 100644 --- a/docs/config/02-files.md +++ b/docs/config/02-files.md @@ -54,6 +54,11 @@ The `files` array determines which files are included in the browser, watched, a * **Default.** `false` * **Description.** Should the files be served from disk on each request by Karma's webserver? +### `integrity` +* **Type.** String +* **Default.** `undefined` +* **Description.** Set the `integrity` HTML attribute value to the `` tag. * `module` - Include using `` tag. * `dom` - Inline content of the file in the page. This can be used, for example, to test components combining HTML and JS. @@ -57,7 +57,7 @@ The `files` array determines which files are included in the browser, watched, a ### `integrity` * **Type.** String * **Default.** `undefined` -* **Description.** Set the `integrity` HTML attribute value to the `