@aimeloic/monkey-tester 1.0.6 → 1.0.8

package/htmlTemplate.js

@@ -1,4 +1,5 @@
 export function getHtmlTemplate(endpoints) {
+  // Safe stringification for HTML attribute encoding to prevent script engine parsing breaks
   const safeJsonString = Buffer.from(JSON.stringify(endpoints)).toString('base64');
 
   return `
@@ -148,13 +149,10 @@ function buildSidebar() {
   if (keys.length > 0) renderPanel(keys[0]);
 }
 
-function makeInput(type, id, placeholder, defaultValue) {
-  var el = document.createElement('input');
-  el.type = type;
-  el.id = id;
-  if (placeholder) el.placeholder = placeholder;
-  if (defaultValue !== undefined) el.value = defaultValue;
-  return el.outerHTML;
+function makeInputString(type, id, placeholder, defaultValue) {
+  const pAttr = placeholder ? ' placeholder="' + placeholder + '"' : '';
+  const vAttr = defaultValue !== undefined ? ' value=\'' + defaultValue + '\'' : '';
+  return '<input type="' + type + '" id="' + id + '"' + pAttr + vAttr + ' />';
 }
 
 function renderPanel(epKey) {
@@ -163,39 +161,50 @@ function renderPanel(epKey) {
   const main = document.getElementById('main-panel');
   if (!ep) return;
 
-  let html = '<div class="endpoint-title">' + ep.title + '</div>' +
-    '<div class="endpoint-path">' +
-      '<span class="method-badge ' + ep.method + '">' + ep.method + '</span>' +
-      '<span>' + ep.path + '</span>' +
-    '</div>' +
-    '<div class="endpoint-desc">' + ep.desc + '</div>';
+  // Render core elements utilizing un-escaped container tokens safely
+  let html = \`
+    <div class="endpoint-title">\${ep.title}</div>
+    <div class="endpoint-path">
+      <span class="method-badge \${ep.method}">\${ep.method}</span>
+      <span>\${ep.path}</span>
+    </div>
+    <div class="endpoint-desc">\${ep.desc}</div>
+  \`;
 
   if (ep.params && ep.params.length) {
-    html += '<div class="form-section"><div class="form-section-title">Path Parameters</div>';
+    html += \`<div class="form-section"><div class="form-section-title">Path Parameters</div>\`;
     ep.params.forEach(function(p) {
-      html += '<div class="field-row">' +
-        '<label class="field-label">' + p.label + '</label>' +
-        makeInput('text', 'param-' + p.name, p.placeholder, '') +
-        '</div>';
+      const inputHtml = makeInputString('text', 'param-' + p.name, p.placeholder, '');
+      html += \`
+        <div class="field-row">
+          <label class="field-label">\${p.label}</label>
+          \${inputHtml}
+        </div>
+      \`;
     });
-    html += '</div>';
+    html += \`</div>\`;
   }
 
   if (ep.fields && ep.fields.length) {
-    html += '<div class="form-section"><div class="form-section-title">JSON Request Body Raw Payload</div>';
+    html += \`<div class="form-section"><div class="form-section-title">JSON Request Body Raw Payload</div>\`;
     ep.fields.forEach(function(f) {
-      html += '<div class="field-row">' +
-        '<label class="field-label">' + f.label + '</label>' +
-        makeInput('text', 'field-' + f.name, '', '{"key": "value"}') +
-        '</div>';
+      const inputHtml = makeInputString('text', 'field-' + f.name, '', '{"key": "value"}');
+      html += \`
+        <div class="field-row">
+          <label class="field-label">\${f.label}</label>
+          \${inputHtml}
+        </div>
+      \`;
     });
-    html += '</div>';
+    html += \`</div>\`;
   }
 
-  html += '<div class="btn-row">' +
-    '<button class="btn" onclick="sendRequest()">Execute Route</button>' +
-    '<button class="btn btn-secondary" onclick="clearResponse()">Clear Context</button>' +
-    '</div>';
+  html += \`
+    <div class="btn-row">
+      <button class="btn" onclick="sendRequest()">Execute Route</button>
+      <button class="btn btn-secondary" onclick="clearResponse()">Clear Context</button>
+    </div>
+  \`;
 
   main.innerHTML = html;
 }
@@ -212,7 +221,7 @@ async function sendRequest() {
     }
   }
 
-  const baseUrl = document.getElementById('base-url').value.replace(/\/+$/, '');
+  const baseUrl = document.getElementById('base-url').value.replace(/[/]+$/, '');
   const url = baseUrl + path;
   const headers = { 'Content-Type': 'application/json' };
 
@@ -274,7 +283,7 @@ function clearResponse() {
 
 function highlightJson(str) {
   return str
-    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replace(/&/g, '&amp;').replace(/[<]/g, '&lt;').replace(/[>]/g, '&gt;')
     .replace(/("(\\u[a-zA-Z0-9]{4}|\\[^u]|[^\\"])*"(\s*:)?|\b(true|false|null)\b|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?)/g, function(match) {
       if (/^"/.test(match)) {
         if (/:$/.test(match)) return '<span class="json-key">' + match + '</span>';

package/index.js

@@ -9,17 +9,15 @@ export function endtesterExpress() {
     const expressApp = req.app;
     const detectedEndpoints = {};
 
-    // Recursive function to dig through all layers of Express routes
     function parseStack(stack, prefix = '') {
       if (!stack) return;
 
       stack.forEach((layer) => {
         if (layer.route) {
-          // It's a direct route (e.g., app.get('/path'))
           const methods = Object.keys(layer.route.methods);
           const path = (prefix + layer.route.path).replace(/\/+/g, '/');
           
-          if (path.includes('/api/tester')) return; // Skip ourselves
+          if (path.includes('/api/tester')) return; 
 
           methods.forEach((method) => {
             const httpMethod = method.toUpperCase();
@@ -42,10 +40,8 @@ export function endtesterExpress() {
             };
           });
         } else if (layer.name === 'router' && layer.handle && layer.handle.stack) {
-          // It's a router middleware (e.g., app.use('/api', myRouter))
           let routerPath = '';
           if (layer.regexp) {
-            // Extract the base path string from the router regex safely
             const match = layer.regexp.toString().match(/^\/\^\\(.*?)\\\/\?/);
             if (match && match[1]) {
               routerPath = match[1].replace(/\\/g, '');
@@ -56,7 +52,6 @@ export function endtesterExpress() {
       });
     }
 
-    // Fire the scanner on the main app router stack
     if (expressApp._router && expressApp._router.stack) {
       parseStack(expressApp._router.stack);
     }

package/package.json

@@ -1,13 +1,10 @@
 {
   "name": "@aimeloic/monkey-tester",
-  "version": "1.0.6",
-  "description": "Embedded interactive API testing UI for Node.js backends",
+  "version": "1.0.8",
+  "description": "Auto route scanning visual runner dashboard.",
   "main": "index.js",
-  "type":"module",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
-  },
-  "keywords": [],
-  "author": "",
+  "type": "module",
+  "keywords": ["express", "tester", "autodiscover"],
+  "author": "aimeloic",
   "license": "ISC"
 }