@usebruno/js 0.37.0 → 0.39.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usebruno/js",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "license": "MIT",
   "main": "src/index.js",
   "files": [
@@ -16,8 +16,7 @@
     "prepack": "npm run test"
   },
   "dependencies": {
-    "@usebruno/common": "0.11.0",
-    "@usebruno/crypto-js": "^3.1.9",
+    "@usebruno/common": "0.12.1",
     "@usebruno/query": "0.1.0",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
@@ -27,7 +26,7 @@
     "chai": "^4.3.7",
     "chai-string": "^1.5.0",
     "cheerio": "^1.0.0",
-    "crypto-js": "^4.1.1",
+    "crypto-js": "^4.2.0",
     "json-query": "^2.2.2",
     "lodash": "^4.17.21",
     "moment": "^2.29.4",
@@ -46,4 +45,4 @@
     "rollup": "3.29.5",
     "rollup-plugin-terser": "^7.0.2"
   }
-}
+}

package/src/index.js

@@ -2,10 +2,12 @@ const ScriptRuntime = require('./runtime/script-runtime');
 const TestRuntime = require('./runtime/test-runtime');
 const VarsRuntime = require('./runtime/vars-runtime');
 const AssertRuntime = require('./runtime/assert-runtime');
+const { runScriptInNodeVm } = require('./sandbox/node-vm');
 
 module.exports = {
   ScriptRuntime,
   TestRuntime,
   VarsRuntime,
-  AssertRuntime
+  AssertRuntime,
+  runScriptInNodeVm
 };

package/src/runtime/script-runtime.js

@@ -14,6 +14,7 @@ const BrunoRequest = require('../bruno-request');
 const BrunoResponse = require('../bruno-response');
 const { cleanJson } = require('../utils');
 const { createBruTestResultMethods } = require('../utils/results');
+const { runScriptInNodeVm } = require('../sandbox/node-vm');
 
 // Inbuilt Library Support
 const ajv = require('ajv');
@@ -119,6 +120,28 @@ class ScriptRuntime {
       context.bru.runRequest = runRequestByItemPathname;
     }
 
+    if (this.runtime === 'nodevm') {
+      await runScriptInNodeVm({
+        script,
+        context,
+        collectionPath,
+        scriptingConfig
+      });
+
+      return {
+        request,
+        envVariables: cleanJson(envVariables),
+        runtimeVariables: cleanJson(runtimeVariables),
+        visualizations,
+        persistentEnvVariables: bru.persistentEnvVariables,
+        globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
+        results: cleanJson(__brunoTestResults.getResults()),
+        nextRequestName: bru.nextRequest,
+        skipRequest: bru.skipRequest,
+        stopExecution: bru.stopExecution
+      };
+    }
+
     if (this.runtime === 'quickjs') {
       await executeQuickJsVmAsync({
         script: script,
@@ -277,6 +300,28 @@ class ScriptRuntime {
       context.bru.runRequest = runRequestByItemPathname;
     }
 
+    if (this.runtime === 'nodevm') {
+      await runScriptInNodeVm({
+        script,
+        context,
+        collectionPath,
+        scriptingConfig
+      });
+
+      return {
+        response,
+        envVariables: cleanJson(envVariables),
+        persistentEnvVariables: cleanJson(bru.persistentEnvVariables),
+        runtimeVariables: cleanJson(runtimeVariables),
+        visualizations,
+        globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
+        results: cleanJson(__brunoTestResults.getResults()),
+        nextRequestName: bru.nextRequest,
+        skipRequest: bru.skipRequest,
+        stopExecution: bru.stopExecution
+      };
+    }
+
     if (this.runtime === 'quickjs') {
       await executeQuickJsVmAsync({
         script: script,

package/src/runtime/test-runtime.js

@@ -1,4 +1,5 @@
 const { NodeVM } = require('@usebruno/vm2');
+const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const chai = require('chai');
 const path = require('path');
 const http = require('http');
@@ -134,7 +135,15 @@ class TestRuntime {
       if (this.runtime === 'quickjs') {
         await executeQuickJsVmAsync({
           script: testsFile,
-          context: context
+          context: context,
+          collectionPath
+        });
+      } else if (this.runtime === 'nodevm') {
+        await runScriptInNodeVm({
+          script: testsFile,
+          context,
+          collectionPath,
+          scriptingConfig
         });
       } else {
         // default runtime is vm2
@@ -143,6 +152,7 @@ class TestRuntime {
           require: {
             context: 'sandbox',
             external: true,
+            builtin: ['*'],
             root: [collectionPath, ...additionalContextRootsAbsolute],
             mock: {
               // node libs

package/src/sandbox/bundle-libraries.js

@@ -11,7 +11,7 @@ const bundleLibraries = async () => {
     import moment from "moment";
     import btoa from "btoa";
     import atob from "atob";
-    import * as CryptoJS from "@usebruno/crypto-js";
+    import * as cryptoJs from 'crypto-js';
     import tv4 from "tv4";
     globalThis.expect = expect;
     globalThis.assert = assert;
@@ -19,7 +19,6 @@ const bundleLibraries = async () => {
     globalThis.btoa = btoa;
     globalThis.atob = atob;
     globalThis.Buffer = Buffer;
-    globalThis.CryptoJS = CryptoJS;
     globalThis.tv4 = tv4;
     globalThis.requireObject = {
       ...(globalThis.requireObject || {}),
@@ -28,7 +27,7 @@ const bundleLibraries = async () => {
       'buffer': { Buffer },
       'btoa': btoa,
       'atob': atob,
-      'crypto-js': CryptoJS,
+      'crypto-js': cryptoJs,
       'tv4': tv4
     };
 `;

package/src/sandbox/node-vm/index.js

@@ -0,0 +1,223 @@
+const vm = require('node:vm');
+const fs = require('node:fs');
+const path = require('node:path');
+const { get } = require('lodash');
+const lodash = require('lodash');
+const { cleanJson } = require('../../utils');
+
+class ScriptError extends Error {
+  constructor(error, script) {
+    super(error.message);
+    this.name = 'ScriptError';
+    this.originalError = error;
+    this.script = script;
+    this.stack = error.stack;
+  }
+}
+
+/**
+ * Executes a script in a Node.js VM context with enhanced security and module loading
+ * @param {Object} options - Configuration options
+ * @param {string} options.script - The script code to execute
+ * @param {Object} options.context - The execution context with Bruno objects
+ * @param {string} options.collectionPath - Path to the collection directory
+ * @param {Object} options.scriptingConfig - Scripting configuration options
+ * @returns {Promise<Object>} Execution results including variables and test results
+ * @throws {ScriptError} When script execution fails
+ */
+async function runScriptInNodeVm({
+  script,
+  context,
+  collectionPath,
+  scriptingConfig
+}) {
+  if (script.trim().length === 0) {
+    return;
+  }
+
+  try {
+    // Create script context with all necessary variables
+    const scriptContext = {
+      // Bruno context
+      console: context.console,
+      req: context.req,
+      res: context.res,
+      bru: context.bru,
+      expect: context.expect,
+      assert: context.assert,
+      __brunoTestResults: context.__brunoTestResults,
+      test: context.test,
+      // Configuration for nested module loading
+      scriptingConfig: scriptingConfig,
+      // Global objects
+      Buffer: global.Buffer,
+      process: global.process,
+      setTimeout: global.setTimeout,
+      setInterval: global.setInterval,
+      clearTimeout: global.clearTimeout,
+      clearInterval: global.clearInterval,
+      setImmediate: global.setImmediate,
+      clearImmediate: global.clearImmediate
+    };
+
+    // Create shared cache for local modules
+    const localModuleCache = new Map();
+
+    // Create a custom require function and add it to the context
+    scriptContext.require = createCustomRequire({
+      scriptingConfig,
+      collectionPath,
+      scriptContext,
+      currentModuleDir: collectionPath,
+      localModuleCache
+    });
+
+    // Execute the script in an isolated VM context
+    await vm.runInNewContext(`
+        (async function(){
+          ${script}
+        })();
+      `, scriptContext, {
+      filename: path.join(collectionPath, 'script.js'),
+      displayErrors: true
+    });
+  } catch (error) {
+    throw new ScriptError(error, script);
+  }
+
+  return;
+}
+
+
+/**
+ * Creates a custom require function with enhanced security and local module support
+ * @param {Object} options - Configuration options
+ * @param {Object} options.scriptingConfig - Scripting configuration with additional context roots
+ * @param {string} options.collectionPath - Base collection path for security checks
+ * @param {Object} options.scriptContext - Script execution context
+ * @param {string} options.currentModuleDir - Current module directory for relative imports
+ * @param {Map} options.localModuleCache - Cache for loaded local modules
+ * @returns {Function} Custom require function
+ */
+function createCustomRequire({
+  scriptingConfig,
+  collectionPath,
+  scriptContext,
+  currentModuleDir = collectionPath,
+  localModuleCache = new Map()
+}) {
+  const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
+  const additionalContextRootsAbsolute = lodash
+    .chain(additionalContextRoots)
+    .map((acr) => (acr.startsWith('/') ? acr : path.join(collectionPath, acr)))
+    .value();
+  additionalContextRootsAbsolute.push(collectionPath);
+
+  return (moduleName) => {
+    // Check if it's a local module (starts with ./ or ../)
+    if (moduleName.startsWith('./') || moduleName.startsWith('../')) {
+      return loadLocalModule({ moduleName, collectionPath, scriptContext, localModuleCache, currentModuleDir });
+    }
+
+    // First try to require as a native/npm module
+    try {
+      return require(moduleName);
+    } catch {
+      // If that fails, try to resolve from additionalContextRoots
+      try {
+        const modulePath = require.resolve(moduleName, { paths: additionalContextRootsAbsolute });
+        return require(modulePath);
+      } catch (error) {
+        throw new Error(`Could not resolve module "${moduleName}": ${error.message}\n\nThis most likely means you did not install the module under "additionalContextRoots" using a package manager like npm.\n\nThese are your current "additionalContextRoots":\n${additionalContextRootsAbsolute.map(root => `  - ${root}`).join('\n') || '  - No "additionalContextRoots" defined'}`);
+      }
+    }
+  };
+}
+
+/**
+ * Loads a local module from the filesystem with security checks and caching
+ * @param {Object} options - Configuration options
+ * @param {string} options.moduleName - Name/path of the module to load
+ * @param {string} options.collectionPath - Base collection path for security validation
+ * @param {Object} options.scriptContext - Script execution context to inherit
+ * @param {Map} options.localModuleCache - Cache for loaded modules
+ * @param {string} options.currentModuleDir - Directory of the current module for relative resolution
+ * @returns {*} The exported content of the loaded module
+ * @throws {Error} When module is outside collection path or cannot be loaded
+ */
+function loadLocalModule({
+  moduleName,
+  collectionPath,
+  scriptContext,
+  localModuleCache,
+  currentModuleDir
+}) {
+  // Check if the filename has an extension
+  const hasExtension = path.extname(moduleName) !== '';
+  const resolvedFilename = hasExtension ? moduleName : `${moduleName}.js`;
+
+  // Resolve the file path relative to the current module's directory
+  const filePath = path.resolve(currentModuleDir, resolvedFilename);
+  const normalizedFilePath = path.normalize(filePath);
+  const normalizedCollectionPath = path.normalize(collectionPath);
+
+  // Cross-platform security check: ensure the resolved file is within collectionPath
+  const relativePath = path.relative(normalizedCollectionPath, normalizedFilePath);
+  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+    throw new Error(`Access to files outside of the collectionPath is not allowed: ${moduleName}`);
+  }
+
+  // Check cache first (use normalized path as key)
+  if (localModuleCache.has(normalizedFilePath)) {
+    return localModuleCache.get(normalizedFilePath);
+  }
+
+  if (!fs.existsSync(normalizedFilePath)) {
+    throw new Error(`Cannot find module ${moduleName}`);
+  }
+
+  // Read and execute the local module
+  const moduleCode = fs.readFileSync(normalizedFilePath, 'utf8');
+
+  // Create module object
+  const moduleObj = { exports: {} };
+
+  // Get the directory of this module for nested imports
+  const moduleDir = path.dirname(normalizedFilePath);
+
+  // Create a new context that inherits from the script context
+  const moduleContext = {
+    ...scriptContext,
+    module: moduleObj,
+    exports: moduleObj.exports,
+    __filename: normalizedFilePath,
+    __dirname: moduleDir,
+    // Create a custom require function for this module that resolves relative to its directory
+    require: createCustomRequire({
+      scriptingConfig: scriptContext.scriptingConfig || {}, 
+      collectionPath, 
+      scriptContext, 
+      currentModuleDir: moduleDir, 
+      localModuleCache
+    })
+  };
+
+  try {
+    // Execute the module code in the shared context
+    vm.runInNewContext(moduleCode, moduleContext, {
+      filename: normalizedFilePath,
+      displayErrors: true
+    });
+
+    // Cache the result using normalized path
+    localModuleCache.set(normalizedFilePath, moduleObj.exports);
+
+    return moduleObj.exports;
+  } catch (error) {
+    throw new Error(`Error loading local module ${moduleName}: ${error.message}`);
+  }
+}
+
+module.exports = {
+  runScriptInNodeVm
+};

package/src/sandbox/quickjs/index.js

@@ -11,6 +11,7 @@ const { newQuickJSWASMModule, memoizePromiseFactory } = require('quickjs-emscrip
 const getBundledCode = require('../bundle-browser-rollup');
 const addPathShimToContext = require('./shims/lib/path');
 const { marshallToVm } = require('./utils');
+const addCryptoUtilsShimToContext = require('./shims/lib/crypto-utils');
 
 let QuickJSSyncContext;
 const loader = memoizePromiseFactory(() => newQuickJSWASMModule());
@@ -98,6 +99,9 @@ const executeQuickJsVmAsync = async ({ script: externalScript, context: external
     const module = await newQuickJSWASMModule();
     const vm = module.newContext();
 
+    // add crypto utilities required by the crypto-js library in bundledCode
+    await addCryptoUtilsShimToContext(vm);
+
     const bundledCode = getBundledCode?.toString() || '';
     const moduleLoaderCode = function () {
       return `

package/src/sandbox/quickjs/shims/lib/crypto-utils.js

@@ -0,0 +1,104 @@
+const crypto = require('node:crypto');
+const { marshallToVm } = require('../../utils');
+const { serializeTypedArray, deserializeTypedArray } = require('./utils');
+
+/**
+ * Node.js crypto module shim for QuickJS sandbox
+ * Implements crypto.randomBytes and crypto.getRandomValues functions
+ */
+const addCryptoUtilsShimToContext = async (vm) => {
+  let randomBytesHandle = vm.newFunction('randomBytes', function (sizeHandle) {
+    try {
+      let size = vm.dump(sizeHandle);
+      
+      if (typeof size !== 'number') {
+        throw new TypeError('The "size" argument must be of type number');
+      }
+
+      size = Math.trunc(size);
+
+      if (size < 0) {
+        throw new RangeError('The "size" argument must be >= 0');
+      }
+
+      if (size > 65536) { // 2^31 - 1 (max safe integer for practical use)
+        throw new RangeError('The "size" argument is too large');
+      }
+
+      if (size === 0) {
+        return marshallToVm([], vm);
+      }
+
+      const buffer = crypto.randomBytes(size);
+      
+      const byteArray = Array.from(buffer);
+      
+      return marshallToVm(byteArray, vm);
+      
+    } catch (error) {
+      const vmError = vm.newError(error.message);
+      vm.setProp(vmError, 'name', vm.newString(error.name));
+      
+      throw vmError;
+    }
+  });
+
+  let getRandomValuesHandle = vm.newFunction('getRandomValues', function (arrayHandle) {
+    try {
+      // Receive the serialized array data directly
+      const serializedArray = vm.dump(arrayHandle);
+      const typedArray = deserializeTypedArray(serializedArray);
+      
+      if (typedArray.length === 0) {
+        return marshallToVm([], vm);
+      }
+
+      if (typedArray.length > 65536) {
+        throw new Error('getRandomValues: ArrayBufferView byte length exceeds 65536');
+      }
+
+      crypto.getRandomValues(typedArray);
+
+      const byteArray = Array.from(typedArray);
+
+      return marshallToVm(byteArray, vm);
+      
+    } catch (error) {
+      const vmError = vm.newError(error.message);
+      vm.setProp(vmError, 'name', vm.newString(error.name));
+      
+      throw vmError;
+    }
+  });
+
+  // Set the functions in global context
+  vm.setProp(vm.global, '__bruno__crypto__randomBytes', randomBytesHandle);
+  vm.setProp(vm.global, '__bruno__crypto__getRandomValues', getRandomValuesHandle);
+  randomBytesHandle.dispose();
+  getRandomValuesHandle.dispose();
+
+  vm.evalCode(`
+    // Helper function for typed array serialization
+    ${serializeTypedArray.toString()}
+    
+    // Create crypto module object following Node.js specifications
+    const cryptoModule = {
+      // node.js crypto.randomBytes API
+      randomBytes: function(size) {
+        const byteArray = globalThis.__bruno__crypto__randomBytes(size);
+        return Buffer.from(Array.from(byteArray));
+      },
+      // node.js crypto.getRandomValues API
+      getRandomValues: function(typedArray) {
+        const serializedTypedArray = serializeTypedArray(typedArray);
+        typedArray.set(globalThis.__bruno__crypto__getRandomValues(serializedTypedArray));
+        return typedArray;
+      },
+    };
+    
+    // Make crypto available globally
+    globalThis.crypto = cryptoModule;
+  `);
+};
+
+module.exports = addCryptoUtilsShimToContext;

package/src/sandbox/quickjs/shims/lib/crypto-utils.spec.js

@@ -0,0 +1,73 @@
+const { describe, it, expect } = require('@jest/globals');
+const { newQuickJSWASMModule } = require('quickjs-emscripten');
+const addCryptoUtilsShimToContext = require('./crypto-utils');
+const getBundledCode = require('../../../bundle-browser-rollup');
+
+describe('crypto-utils shims tests', () => {
+  let vm, module;
+
+  beforeAll(async () => {
+    module = await newQuickJSWASMModule();
+  });
+
+  beforeEach(async () => {
+    vm = module.newContext();
+    await addCryptoUtilsShimToContext(vm);
+    // required for `Buffer` library usage
+    const bundledCode = getBundledCode?.toString() || '';
+    vm.evalCode(
+      `
+        (${bundledCode})()
+      `
+    );
+  });
+
+  it('should provide crypto.randomBytes function', async () => {
+    const result = vm.evalCode('typeof crypto.randomBytes');
+    const handle = vm.unwrapResult(result);
+    const type = vm.dump(handle);
+    handle.dispose();
+  
+    expect(type).toBe('function');
+  });
+
+  it('should provide crypto.getRandomValues function', async () => {
+    const result = vm.evalCode('typeof crypto.getRandomValues');
+    const handle = vm.unwrapResult(result);
+    const type = vm.dump(handle);
+    handle.dispose();
+    
+    expect(type).toBe('function');
+  });
+
+  it('should generate random bytes with correct length', async () => {
+    const result = vm.evalCode('crypto.randomBytes(8).length');
+    const handle = vm.unwrapResult(result);
+    const length = vm.dump(handle);
+    handle.dispose();
+    
+    expect(length).toBe(8);
+  });
+
+  it('should convert random bytes to hex string', async () => {
+    const result = vm.evalCode('crypto.randomBytes(4).toString("hex").length');
+    const handle = vm.unwrapResult(result);
+    const hexLength = vm.dump(handle);
+    handle.dispose();
+    
+    expect(hexLength).toBe(8); // 4 bytes = 8 hex chars
+  });
+
+  it('should fill Uint8Array with getRandomValues', async () => {
+    const result = vm.evalCode(`
+      const arr = new Uint8Array(5);
+      crypto.getRandomValues(arr);
+      arr.length;
+    `);
+    const handle = vm.unwrapResult(result);
+    const length = vm.dump(handle);
+    handle.dispose();
+    
+    expect(length).toBe(5);
+  });
+});

package/src/sandbox/quickjs/shims/lib/utils.js

@@ -0,0 +1,48 @@
+function serializeTypedArray(ta) {
+  return {
+    type: ta.constructor.name,
+    array: Array.from(ta),
+    length: ta.length
+  };
+}
+
+function deserializeTypedArray(obj) {
+  // Allowed typed array constructors for crypto operations
+  const allowedConstructors = new Set([
+    'Int8Array',
+    'Uint8Array',
+    'Uint8ClampedArray',
+    'Int16Array',
+    'Uint16Array',
+    'Int32Array',
+    'Uint32Array',
+    'Float32Array',
+    'Float64Array',
+    'BigInt64Array',
+    'BigUint64Array'
+  ]);
+
+  if (!obj || typeof obj !== 'object') {
+    throw new TypeError('getRandomValues: Invalid typed array object');
+  }
+
+  if (typeof obj.type !== 'string' || !allowedConstructors.has(obj.type)) {
+    throw new TypeError(`getRandomValues: Invalid or unsupported typed array type: ${obj.type}`);
+  }
+
+  if (!obj.array || typeof obj.length !== 'number') {
+    throw new TypeError('getRandomValues: Invalid typed array properties');
+  }
+
+  const ctor = globalThis[obj.type];
+  if (typeof ctor !== 'function') {
+    throw new TypeError(`getRandomValues: Constructor ${obj.type} is not available`);
+  }
+
+  return new ctor(obj.array, 0, obj.length);
+}
+
+module.exports = {
+  serializeTypedArray,
+  deserializeTypedArray
+}