@usebruno/js 0.43.0 → 0.44.0

package/package.json

@@ -1,23 +1,20 @@
 {
   "name": "@usebruno/js",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "license": "MIT",
   "main": "src/index.js",
   "files": [
     "src",
     "package.json"
   ],
-  "peerDependencies": {
-    "@usebruno/vm2": "^3.9.13"
-  },
   "scripts": {
     "test": "node --experimental-vm-modules $(npx which jest) --testPathIgnorePatterns test.js",
     "sandbox:bundle-libraries": "node ./src/sandbox/bundle-libraries.js",
     "prepack": "npm run test"
   },
   "dependencies": {
-    "@usebruno/common": "0.16.0",
-    "@usebruno/query": "0.1.0",
+    "@usebruno/common": "0.17.0",
+    "@usebruno/query": "0.2.0",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "atob": "^2.1.2",
@@ -28,7 +25,7 @@
     "cheerio": "^1.0.0",
     "crypto-js": "^4.2.0",
     "json-query": "^2.2.2",
-    "jsonwebtoken": "^9.0.2",
+    "jsonwebtoken": "^9.0.3",
     "lodash": "^4.17.21",
     "moment": "^2.29.4",
     "nanoid": "3.3.8",

package/src/bru.js

@@ -27,7 +27,7 @@ class Bru {
     this.cookies = {
       jar: () => {
         const cookieJar = createCookieJar();
-                
+
         return {
           getCookie: (url, cookieName, callback) => {
             const interpolatedUrl = this.interpolate(url);
@@ -82,7 +82,7 @@ class Bru {
       iterationData: new IterationDataManager(iterationDetails?.iterationData),
       iterationIndex: iterationDetails?.iterationIndex,
       totalIterations: iterationDetails?.totalIterations
-    }; 
+    };
 
     this.utils = {
       minifyJson: (json) => {
@@ -128,7 +128,6 @@ class Bru {
       }
     };
   }
- 
 
   interpolate = (strOrObj) => {
     if (!strOrObj) return strOrObj;
@@ -179,7 +178,7 @@ class Bru {
     if (!key) {
       throw new Error('Creating a env variable without specifying a name is not allowed.');
     }
-    
+
     if (variableNameRegex.test(key) === false) {
       throw new Error(
         `Variable name: "${key}" contains invalid characters! Names must only contain alpha-numeric characters, "-", "_", "."`
@@ -242,8 +241,8 @@ class Bru {
 
     if (variableNameRegex.test(key) === false) {
       throw new Error(
-        `Variable name: "${key}" contains invalid characters!` +
-          ' Names must only contain alpha-numeric characters, "-", "_", "."'
+        `Variable name: "${key}" contains invalid characters!`
+        + ' Names must only contain alpha-numeric characters, "-", "_", "."'
       );
     }
 
@@ -262,8 +261,8 @@ class Bru {
   getVar(key) {
     if (variableNameRegex.test(key) === false) {
       throw new Error(
-        `Variable name: "${key}" contains invalid characters!` +
-          ' Names must only contain alpha-numeric characters, "-", "_", "."'
+        `Variable name: "${key}" contains invalid characters!`
+        + ' Names must only contain alpha-numeric characters, "-", "_", "."'
       );
     }
 
@@ -298,12 +297,10 @@ class Bru {
     this.nextRequest = nextRequest;
   }
 
-
   getSecretVar(key) {
     return this.secretVariables?.[`$secrets.${key}`];
   }
 
-
   visualize(type, data) {
     if (type == 'table') {
       if (data?.provider == 'ag-grid') {

package/src/bruno-request.js

@@ -8,7 +8,7 @@ class BrunoRequest {
    * - req.headers
    * - req.timeout
    * - req.body
-   * 
+   *
    * Above shorthands are useful for accessing the request properties directly in the scripts
    * It must be noted that the user cannot set these properties directly.
    * They should use the respective setter methods to set these properties.
@@ -26,9 +26,9 @@ class BrunoRequest {
     /**
      * We automatically parse the JSON body if the content type is JSON
      * This is to make it easier for the user to access the body directly
-     * 
+     *
      * It must be noted that the request data is always a string and is what gets sent over the network
-     * If the user wants to access the raw data, they can use getBody({raw: true}) method 
+     * If the user wants to access the raw data, they can use getBody({raw: true}) method
      */
     const isJson = this.hasJSONContentType(this.req.headers);
     if (isJson) {
@@ -48,6 +48,7 @@ class BrunoRequest {
   getMethod() {
     return this.req.method;
   }
+
   getAuthMode() {
     if (this.req?.oauth2) {
       return 'oauth2';
@@ -104,7 +105,7 @@ class BrunoRequest {
 
   /**
    * Get the body of the request
-   * 
+   *
    * We automatically parse and return the JSON body if the content type is JSON
    * If the user wants the raw body, they can pass the raw option as true
    */
@@ -128,7 +129,7 @@ class BrunoRequest {
    * Otherwise
    *  - We set the request data as the data itself
    *  - We set the body property as the data itself
-   * 
+   *
    * If the user wants to override this behavior, they can pass the raw option as true
    */
   setBody(data, options = {}) {
@@ -140,7 +141,7 @@ class BrunoRequest {
         createdAt: new Date().toISOString()
       });
     }
-    
+
     if (options.raw) {
       this.req.data = data;
       this.body = data;
@@ -170,7 +171,7 @@ class BrunoRequest {
     this.timeout = timeout;
     this.req.timeout = timeout;
   }
-  
+
   onFail(callback) {
     if (typeof callback === 'function') {
       this.req.onFailHandler = callback;
@@ -198,7 +199,6 @@ class BrunoRequest {
   __isObject(obj) {
     return obj !== null && typeof obj === 'object';
   }
-  
 
   disableParsingResponseJson() {
     this.req.__brunoDisableParsingResponseJson = true;

package/src/bruno-response.js

@@ -65,7 +65,7 @@ class BrunoResponse {
 
     const { data, dataBuffer, headers } = this.res;
     let bodySize = 0;
-    
+
     // Use raw received bytes
     if (Buffer.isBuffer(dataBuffer)) {
       bodySize = dataBuffer.length;
@@ -94,7 +94,6 @@ class BrunoResponse {
     const headerSize = Buffer.byteLength(headerLines.join('\r\n'));
 
     return { header: headerSize, body: bodySize, total: headerSize + bodySize };
-    
   }
 
   getDataBuffer() {

package/src/runtime/assert-runtime.js

@@ -241,7 +241,7 @@ const evaluateRhsOperand = (rhsOperand, operator, context, runtime) => {
 
 class AssertRuntime {
   constructor(props) {
-    this.runtime = props?.runtime || 'vm2';
+    this.runtime = props?.runtime || 'quickjs';
   }
 
   runAssertions(assertions, request, response, envVariables, runtimeVariables, processEnvVars, historyLogger, secretVariables) {

package/src/runtime/script-runtime.js

@@ -1,45 +1,15 @@
-const { NodeVM } = require('@usebruno/vm2');
-const path = require('path');
-const http = require('http');
-const https = require('https');
-const stream = require('stream');
-const util = require('util');
-const zlib = require('zlib');
-const url = require('url');
-const punycode = require('punycode');
-const fs = require('fs');
-const { get } = require('lodash');
+const chai = require('chai');
 const Bru = require('../bru');
 const BrunoRequest = require('../bruno-request');
 const BrunoResponse = require('../bruno-response');
 const { cleanJson } = require('../utils');
 const { createBruTestResultMethods } = require('../utils/results');
 const { runScriptInNodeVm } = require('../sandbox/node-vm');
-
-// Inbuilt Library Support
-const ajv = require('ajv');
-const addFormats = require('ajv-formats');
-const atob = require('atob');
-const btoa = require('btoa');
-const lodash = require('lodash');
-const moment = require('moment');
-const uuid = require('uuid');
-const nanoid = require('nanoid');
-const axios = require('axios');
-const fetch = require('node-fetch');
-const chai = require('chai');
-const CryptoJS = require('crypto-js');
-const NodeVault = require('node-vault');
-const xml2js = require('xml2js');
-const cheerio = require('cheerio');
-const tv4 = require('tv4');
-const jsonwebtoken = require('jsonwebtoken');
 const { executeQuickJsVmAsync } = require('../sandbox/quickjs');
-const { mixinTypedArrays } = require('../sandbox/mixins/typed-arrays');
 
 class ScriptRuntime {
   constructor(props) {
-    this.runtime = props?.runtime || 'vm2';
+    this.runtime = props?.runtime || 'quickjs';
   }
 
   // This approach is getting out of hand
@@ -61,7 +31,7 @@ class ScriptRuntime {
     let visualizations = [];
     let setVisualizations = (data) => {
       visualizations.push(data);
-    }
+    };
     const globalEnvironmentVariables = request?.globalEnvironmentVariables || {};
     const oauth2CredentialVariables = request?.oauth2CredentialVariables || {};
     const collectionVariables = request?.collectionVariables || {};
@@ -73,24 +43,6 @@ class ScriptRuntime {
     // TODO please clean this up
     const bru = new Bru(envVariables, runtimeVariables, processEnvVars, collectionPath, historyLogger, setVisualizations, secretVariables, collectionVariables, folderVariables, requestVariables, globalEnvironmentVariables, oauth2CredentialVariables, iterationDetails, collectionName, promptVariables);
     const req = new BrunoRequest(request);
-    const allowScriptFilesystemAccess = get(scriptingConfig, 'filesystemAccess.allow', false);
-    const moduleWhitelist = get(scriptingConfig, 'moduleWhitelist', []);
-    const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
-    const additionalContextRootsAbsolute = lodash
-      .chain(additionalContextRoots)
-      .map((acr) => (acr.startsWith('/') ? acr : path.join(collectionPath, acr)))
-      .value();
-
-    const whitelistedModules = {};
-
-    for (let module of moduleWhitelist) {
-      try {
-        whitelistedModules[module] = require(module);
-      } catch (e) {
-        // Ignore
-        console.warn(e);
-      }
-    }
 
     // extend bru with result getter methods
     const { __brunoTestResults, test } = createBruTestResultMethods(bru, assertionResults, chai);
@@ -104,10 +56,6 @@ class ScriptRuntime {
       __brunoTestResults: __brunoTestResults
     };
 
-    if (this.runtime === 'vm2') {
-      mixinTypedArrays(context);
-    }
-
     if (onConsoleLog && typeof onConsoleLog === 'function') {
       const customLogger = (type) => {
         return (...args) => {
@@ -149,70 +97,12 @@ class ScriptRuntime {
       };
     }
 
-    if (this.runtime === 'quickjs') {
-      await executeQuickJsVmAsync({
-        script: script,
-        context: context,
-        collectionPath
-      });
-
-      return {
-        request,
-        envVariables: cleanJson(envVariables),
-        runtimeVariables: cleanJson(runtimeVariables),
-        visualizations,
-        persistentEnvVariables: bru.persistentEnvVariables,
-        globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
-        results: cleanJson(__brunoTestResults.getResults()),
-        nextRequestName: bru.nextRequest,
-        skipRequest: bru.skipRequest,
-        stopExecution: bru.stopExecution
-      };
-    }
-
-    // default runtime is vm2
-    const vm = new NodeVM({
-      sandbox: context,
-      require: {
-        context: 'sandbox',
-        builtin: [ "*" ],
-        external: true,
-        root: [collectionPath, ...additionalContextRootsAbsolute],
-        mock: {
-          // node libs
-          path,
-          stream,
-          util,
-          url,
-          http,
-          https,
-          punycode,
-          zlib,
-          // 3rd party libs
-          ajv,
-          'ajv-formats': addFormats,
-          atob,
-          btoa,
-          lodash,
-          moment,
-          uuid,
-          nanoid,
-          axios,
-          chai,
-          'node-fetch': fetch,
-          'crypto-js': CryptoJS,
-          xml2js: xml2js,
-          jsonwebtoken,
-          cheerio,
-          tv4,
-          ...whitelistedModules,
-          fs: allowScriptFilesystemAccess ? fs : undefined,
-          'node-vault': NodeVault
-        }
-      }
+    // default runtime is `quickjs`
+    await executeQuickJsVmAsync({
+      script: script,
+      context: context,
+      collectionPath
     });
-    const asyncVM = vm.run(`module.exports = async () => { ${script} }`, path.join(collectionPath, 'vm.js'));
-    await asyncVM();
 
     return {
       request,
@@ -246,7 +136,7 @@ class ScriptRuntime {
     let visualizations = [];
     let setVisualizations = (data) => {
       visualizations.push(data);
-    }
+    };
     const globalEnvironmentVariables = request?.globalEnvironmentVariables || {};
     const oauth2CredentialVariables = request?.oauth2CredentialVariables || {};
     const collectionVariables = request?.collectionVariables || {};
@@ -258,24 +148,6 @@ class ScriptRuntime {
     const bru = new Bru(envVariables, runtimeVariables, processEnvVars, collectionPath, historyLogger, setVisualizations, secretVariables, collectionVariables, folderVariables, requestVariables, globalEnvironmentVariables, oauth2CredentialVariables, iterationDetails, collectionName, promptVariables);
     const req = new BrunoRequest(request);
     const res = new BrunoResponse(response);
-    const allowScriptFilesystemAccess = get(scriptingConfig, 'filesystemAccess.allow', false);
-    const moduleWhitelist = get(scriptingConfig, 'moduleWhitelist', []);
-    const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
-    const additionalContextRootsAbsolute = lodash
-      .chain(additionalContextRoots)
-      .map((acr) => (acr.startsWith('/') ? acr : path.join(collectionPath, acr)))
-      .value();
-
-    const whitelistedModules = {};
-
-    for (let module of moduleWhitelist) {
-      try {
-        whitelistedModules[module] = require(module);
-      } catch (e) {
-        // Ignore
-        console.warn(e);
-      }
-    }
 
     // extend bru with result getter methods
     const { __brunoTestResults, test } = createBruTestResultMethods(bru, assertionResults, chai);
@@ -290,10 +162,6 @@ class ScriptRuntime {
       __brunoTestResults: __brunoTestResults
     };
 
-    if (this.runtime === 'vm2') {
-      mixinTypedArrays(context);
-    }
-
     if (onConsoleLog && typeof onConsoleLog === 'function') {
       const customLogger = (type) => {
         return (...args) => {
@@ -335,71 +203,13 @@ class ScriptRuntime {
       };
     }
 
-    if (this.runtime === 'quickjs') {
-      await executeQuickJsVmAsync({
-        script: script,
-        context: context,
-        collectionPath
-      });
-
-      return {
-        response,
-        envVariables: cleanJson(envVariables),
-        persistentEnvVariables: cleanJson(bru.persistentEnvVariables),
-        runtimeVariables: cleanJson(runtimeVariables),
-        visualizations,
-        globalEnvironmentVariables: cleanJson(globalEnvironmentVariables),
-        results: cleanJson(__brunoTestResults.getResults()),
-        nextRequestName: bru.nextRequest,
-        skipRequest: bru.skipRequest,
-        stopExecution: bru.stopExecution
-      };
-    }
-
-    // default runtime is vm2
-    const vm = new NodeVM({
-      sandbox: context,
-      require: {
-        context: 'sandbox',
-        builtin: [ "*" ],
-        external: true,
-        root: [collectionPath, ...additionalContextRootsAbsolute],
-        mock: {
-          // node libs
-          path,
-          stream,
-          util,
-          url,
-          http,
-          https,
-          punycode,
-          zlib,
-          // 3rd party libs
-          ajv,
-          'ajv-formats': addFormats,
-          atob,
-          btoa,
-          lodash,
-          moment,
-          uuid,
-          nanoid,
-          axios,
-          'node-fetch': fetch,
-          'crypto-js': CryptoJS,
-          'xml2js': xml2js,
-          jsonwebtoken,
-          cheerio,
-          tv4,
-          ...whitelistedModules,
-          fs: allowScriptFilesystemAccess ? fs : undefined,
-          'node-vault': NodeVault
-        }
-      }
+    // default runtime is `quickjs`
+    await executeQuickJsVmAsync({
+      script: script,
+      context: context,
+      collectionPath
     });
 
-    const asyncVM = vm.run(`module.exports = async () => { ${script} }`, path.join(collectionPath, 'vm.js'));
-    await asyncVM();
-
     return {
       response,
       envVariables: cleanJson(envVariables),

package/src/runtime/test-runtime.js

@@ -1,47 +1,17 @@
-const { NodeVM } = require('@usebruno/vm2');
-const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const chai = require('chai');
-const path = require('path');
-const http = require('http');
-const https = require('https');
-const stream = require('stream');
-const util = require('util');
-const zlib = require('zlib');
-const url = require('url');
-const punycode = require('punycode');
-const fs = require('fs');
-const { get } = require('lodash');
+const uuid = require('uuid');
 const Bru = require('../bru');
 const BrunoRequest = require('../bruno-request');
 const BrunoResponse = require('../bruno-response');
-const Test = require('../test');
-const TestResults = require('../test-results');
 const { cleanJson } = require('../utils');
 const { createBruTestResultMethods } = require('../utils/results');
-
-// Inbuilt Library Support
-const ajv = require('ajv');
-const addFormats = require('ajv-formats');
-const atob = require('atob');
-const btoa = require('btoa');
-const lodash = require('lodash');
-const moment = require('moment');
-const uuid = require('uuid');
-const nanoid = require('nanoid');
-const axios = require('axios');
-const fetch = require('node-fetch');
-const CryptoJS = require('crypto-js');
-const NodeVault = require('node-vault');
-const xml2js = require('xml2js');
-const cheerio = require('cheerio');
-const tv4 = require('tv4');
+const { runScriptInNodeVm } = require('../sandbox/node-vm');
 const jsonwebtoken = require('jsonwebtoken');
 const { executeQuickJsVmAsync } = require('../sandbox/quickjs');
-const { mixinTypedArrays } = require('../sandbox/mixins/typed-arrays');
 
 class TestRuntime {
   constructor(props) {
-    this.runtime = props?.runtime || 'vm2';
+    this.runtime = props?.runtime || 'quickjs';
   }
 
   async runTests(
@@ -70,24 +40,6 @@ class TestRuntime {
     const bru = new Bru(envVariables, runtimeVariables, processEnvVars, collectionPath, historyLogger, undefined, secretVariables, collectionVariables, folderVariables, requestVariables, globalEnvironmentVariables, oauth2CredentialVariables, iterationDetails, collectionName, promptVariables);
     const req = new BrunoRequest(request, historyLogger);
     const res = new BrunoResponse(response);
-    const allowScriptFilesystemAccess = get(scriptingConfig, 'filesystemAccess.allow', false);
-    const moduleWhitelist = get(scriptingConfig, 'moduleWhitelist', []);
-    const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
-    const additionalContextRootsAbsolute = lodash
-      .chain(additionalContextRoots)
-      .map((acr) => (acr.startsWith('/') ? acr : path.join(collectionPath, acr)))
-      .value();
-
-    const whitelistedModules = {};
-
-    for (let module of moduleWhitelist) {
-      try {
-        whitelistedModules[module] = require(module);
-      } catch (e) {
-        // Ignore
-        console.warn(e);
-      }
-    }
 
     // extend bru with result getter methods
     const { __brunoTestResults, test } = createBruTestResultMethods(bru, assertionResults, chai);
@@ -114,10 +66,6 @@ class TestRuntime {
       jwt: jsonwebtoken
     };
 
-    if (this.runtime === 'vm2') {
-      mixinTypedArrays(context);
-    }
-
     if (onConsoleLog && typeof onConsoleLog === 'function') {
       const customLogger = (type) => {
         return (...args) => {
@@ -133,20 +81,14 @@ class TestRuntime {
       };
     }
 
-    if(runRequestByItemPathname) {
+    if (runRequestByItemPathname) {
       context.bru.runRequest = runRequestByItemPathname;
     }
 
     let scriptError = null;
 
     try {
-      if (this.runtime === 'quickjs') {
-        await executeQuickJsVmAsync({
-          script: testsFile,
-          context: context,
-          collectionPath
-        });
-      } else if (this.runtime === 'nodevm') {
+      if (this.runtime === 'nodevm') {
         await runScriptInNodeVm({
           script: testsFile,
           context,
@@ -154,49 +96,12 @@ class TestRuntime {
           scriptingConfig
         });
       } else {
-        // default runtime is vm2
-        const vm = new NodeVM({
-          sandbox: context,
-          require: {
-            context: 'sandbox',
-            external: true,
-            builtin: ['*'],
-            root: [collectionPath, ...additionalContextRootsAbsolute],
-            mock: {
-              // node libs
-              path,
-              stream,
-              util,
-              url,
-              http,
-              https,
-              punycode,
-              zlib,
-              // 3rd party libs
-              ajv,
-              'ajv-formats': addFormats,
-              btoa,
-              atob,
-              lodash,
-              moment,
-              uuid,
-              nanoid,
-              axios,
-              chai,
-              'node-fetch': fetch,
-              'crypto-js': CryptoJS,
-              'xml2js': xml2js,
-              cheerio,
-              tv4,
-              'jsonwebtoken': jsonwebtoken,
-              ...whitelistedModules,
-              fs: allowScriptFilesystemAccess ? fs : undefined,
-              'node-vault': NodeVault
-            }
-          }
+        // default runtime is `quickjs`
+        await executeQuickJsVmAsync({
+          script: testsFile,
+          context: context,
+          collectionPath
         });
-        const asyncVM = vm.run(`module.exports = async () => { ${testsFile}}`, path.join(collectionPath, 'vm.js'));
-        await asyncVM();
       }
     } catch (error) {
       scriptError = error;

package/src/runtime/vars-runtime.js

@@ -20,7 +20,7 @@ const evaluateJsExpressionBasedOnRuntime = (expr, context, runtime, mode) => {
 
 class VarsRuntime {
   constructor(props) {
-    this.runtime = props?.runtime || 'vm2';
+    this.runtime = props?.runtime || 'quickjs';
     this.mode = props?.mode || 'developer';
   }
 

package/src/sandbox/node-vm/index.js

@@ -3,7 +3,6 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { get } = require('lodash');
 const lodash = require('lodash');
-const { cleanJson } = require('../../utils');
 const { mixinTypedArrays } = require('../mixins/typed-arrays');
 
 class ScriptError extends Error {
@@ -37,6 +36,17 @@ async function runScriptInNodeVm({
   }
 
   try {
+    const allowScriptFilesystemAccess = get(scriptingConfig, 'filesystemAccess.allow', false);
+
+    // Compute additional context roots
+    const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
+    const additionalContextRootsAbsolute = lodash
+      .chain(additionalContextRoots)
+      .map((acr) => (path.isAbsolute(acr) ? acr : path.join(collectionPath, acr)))
+      .map((acr) => path.normalize(acr))
+      .value();
+    additionalContextRootsAbsolute.push(path.normalize(collectionPath));
+
     // Create script context with all necessary variables
     const scriptContext = {
       // Bruno context
@@ -77,7 +87,9 @@ async function runScriptInNodeVm({
       collectionPath,
       scriptContext,
       currentModuleDir: collectionPath,
-      localModuleCache
+      localModuleCache,
+      allowScriptFilesystemAccess,
+      additionalContextRootsAbsolute
     });
 
     // Execute the script in an isolated VM context
@@ -96,7 +108,6 @@ async function runScriptInNodeVm({
   return;
 }
 
-
 /**
  * Creates a custom require function with enhanced security and local module support
  * @param {Object} options - Configuration options
@@ -105,6 +116,8 @@ async function runScriptInNodeVm({
  * @param {Object} options.scriptContext - Script execution context
  * @param {string} options.currentModuleDir - Current module directory for relative imports
  * @param {Map} options.localModuleCache - Cache for loaded local modules
+ * @param {boolean} options.allowScriptFilesystemAccess - Whether to allow fs module access
+ * @param {Array<string>} options.additionalContextRootsAbsolute - Pre-computed absolute context roots
  * @returns {Function} Custom require function
  */
 function createCustomRequire({
@@ -112,32 +125,54 @@ function createCustomRequire({
   collectionPath,
   scriptContext,
   currentModuleDir = collectionPath,
-  localModuleCache = new Map()
+  localModuleCache = new Map(),
+  allowScriptFilesystemAccess = false,
+  additionalContextRootsAbsolute = []
 }) {
-  const additionalContextRoots = get(scriptingConfig, 'additionalContextRoots', []);
-  const additionalContextRootsAbsolute = lodash
-    .chain(additionalContextRoots)
-    .map((acr) => (acr.startsWith('/') ? acr : path.join(collectionPath, acr)))
-    .value();
-  additionalContextRootsAbsolute.push(collectionPath);
-
   return (moduleName) => {
-    // Check if it's a local module (starts with ./ or ../)
-    if (moduleName.startsWith('./') || moduleName.startsWith('../')) {
-      return loadLocalModule({ moduleName, collectionPath, scriptContext, localModuleCache, currentModuleDir });
+    // Check if it's a local module (starts with ./ or ../ or .\ or ..\)
+    // Normalize backslashes to forward slashes for cross-platform compatibility
+    const normalizedModuleName = moduleName.replace(/\\/g, '/');
+    if (normalizedModuleName.startsWith('./') || normalizedModuleName.startsWith('../')) {
+      return loadLocalModule({ moduleName: normalizedModuleName, collectionPath, scriptContext, localModuleCache, currentModuleDir, additionalContextRootsAbsolute });
     }
 
+    // Helper function to check if a module is the fs module or a submodule
+    const isFsModule = (module) => {
+      if (!module) return false;
+      const fsModule = require('fs');
+      // Check if it's the fs module itself
+      if (module === fsModule) return true;
+      // Check if it's fs/promises submodule
+      if (module === fsModule.promises) return true;
+      // Check if it's fs/promises by comparing with require('fs/promises')
+      try {
+        if (module === require('fs/promises')) return true;
+      } catch {
+        // fs/promises might not be available in all Node versions
+      }
+      return false;
+    };
+
     // First try to require as a native/npm module
     try {
-      return require(moduleName);
-    } catch {
-      // If that fails, try to resolve from additionalContextRoots
-      try {
-        const modulePath = require.resolve(moduleName, { paths: additionalContextRootsAbsolute });
-        return require(modulePath);
-      } catch (error) {
-        throw new Error(`Could not resolve module "${moduleName}": ${error.message}\n\nThis most likely means you did not install the module under "additionalContextRoots" using a package manager like npm.\n\nThese are your current "additionalContextRoots":\n${additionalContextRootsAbsolute.map(root => `  - ${root}`).join('\n') || '  - No "additionalContextRoots" defined'}`);
+      const requiredModulePath = require.resolve(moduleName, { paths: [...additionalContextRootsAbsolute, ...module.paths] });
+      const requiredModule = require(requiredModulePath);
+
+      // Block filesystem module access if filesystem access is not allowed
+      if (!allowScriptFilesystemAccess && isFsModule(requiredModule)) {
+        throw new Error('Filesystem access is not allowed. Enable "filesystemAccess.allow" in scripting config to use the fs module.');
       }
+
+      return requiredModule;
+    } catch (requireError) {
+      // Re-throw if it's our filesystem access error
+      if (requireError.message && requireError.message.includes('Enable "filesystemAccess.allow"')) {
+        throw requireError;
+      }
+
+      // If that fails, try to resolve from additionalContextRoots
+      throw new Error(`Could not resolve module "${moduleName}": ${requireError.message}\n\nThis most likely means you did not install the module under the collection or the "additionalContextRoots" using a package manager like npm.\n\nThese are your current "additionalContextRoots":\n${additionalContextRootsAbsolute.map((root) => `  - ${root}`).join('\n') || '  - No "additionalContextRoots" defined'}`);
     }
   };
 }
@@ -150,6 +185,7 @@ function createCustomRequire({
  * @param {Object} options.scriptContext - Script execution context to inherit
  * @param {Map} options.localModuleCache - Cache for loaded modules
  * @param {string} options.currentModuleDir - Directory of the current module for relative resolution
+ * @param {Array<string>} options.additionalContextRootsAbsolute - Additional allowed context root paths
  * @returns {*} The exported content of the loaded module
  * @throws {Error} When module is outside collection path or cannot be loaded
  */
@@ -158,7 +194,8 @@ function loadLocalModule({
   collectionPath,
   scriptContext,
   localModuleCache,
-  currentModuleDir
+  currentModuleDir,
+  additionalContextRootsAbsolute = []
 }) {
   // Check if the filename has an extension
   const hasExtension = path.extname(moduleName) !== '';
@@ -167,12 +204,19 @@ function loadLocalModule({
   // Resolve the file path relative to the current module's directory
   const filePath = path.resolve(currentModuleDir, resolvedFilename);
   const normalizedFilePath = path.normalize(filePath);
-  const normalizedCollectionPath = path.normalize(collectionPath);
 
-  // Cross-platform security check: ensure the resolved file is within collectionPath
-  const relativePath = path.relative(normalizedCollectionPath, normalizedFilePath);
-  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
-    throw new Error(`Access to files outside of the collectionPath is not allowed: ${moduleName}`);
+  const isWithinAllowedRoot = additionalContextRootsAbsolute.some((allowedRoot) => {
+    const normalizedAllowedRoot = path.normalize(allowedRoot);
+    const relativePath = path.relative(normalizedAllowedRoot, normalizedFilePath);
+    return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
+  });
+
+  if (!isWithinAllowedRoot) {
+    const allowedRootsDisplay = additionalContextRootsAbsolute.map((root) => `  - ${root}`).join('\n');
+    throw new Error(
+      `Access to files outside of the allowed context roots is not allowed: ${moduleName}\n\n`
+      + `Allowed context roots:\n${allowedRootsDisplay}`
+    );
   }
 
   // Check cache first (use normalized path as key)
@@ -202,11 +246,13 @@ function loadLocalModule({
     __dirname: moduleDir,
     // Create a custom require function for this module that resolves relative to its directory
     require: createCustomRequire({
-      scriptingConfig: scriptContext.scriptingConfig || {}, 
-      collectionPath, 
-      scriptContext, 
-      currentModuleDir: moduleDir, 
-      localModuleCache
+      scriptingConfig: scriptContext.scriptingConfig || {},
+      collectionPath,
+      scriptContext,
+      currentModuleDir: moduleDir,
+      localModuleCache,
+      allowScriptFilesystemAccess: get(scriptContext.scriptingConfig, 'filesystemAccess.allow', false),
+      additionalContextRootsAbsolute
     })
   };
 

package/src/sandbox/node-vm/index.spec.js

@@ -0,0 +1,252 @@
+const { describe, it, expect, beforeEach, afterEach } = require('@jest/globals');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { runScriptInNodeVm } = require('./index');
+
+describe('node-vm sandbox', () => {
+  let testDir;
+  let collectionPath;
+
+  beforeEach(() => {
+    // Create a temporary test directory
+    testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'bruno-test-'));
+    collectionPath = path.join(testDir, 'collection');
+    fs.mkdirSync(collectionPath);
+  });
+
+  afterEach(() => {
+    // Clean up test directory
+    fs.rmSync(testDir, { recursive: true, force: true });
+  });
+
+  describe('createCustomRequire - local modules', () => {
+    it('should load local module with ./ path', async () => {
+      // Create a local module
+      fs.writeFileSync(
+        path.join(collectionPath, 'helper.js'),
+        'module.exports = { value: 42 };'
+      );
+
+      const script = `
+        const helper = require('./helper');
+        bru.setVar('result', helper.value);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig: {} });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', 42);
+    });
+
+    it('should load local module with ../ path', async () => {
+      // Create a subdirectory and modules
+      const subDir = path.join(collectionPath, 'subdir');
+      fs.mkdirSync(subDir);
+      fs.writeFileSync(
+        path.join(collectionPath, 'parent.js'),
+        'module.exports = { name: "parent" };'
+      );
+      fs.writeFileSync(
+        path.join(subDir, 'child.js'),
+        'const parent = require("../parent"); module.exports = parent;'
+      );
+
+      const script = `
+        const child = require('./subdir/child');
+        bru.setVar('result', child.name);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig: {} });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', 'parent');
+    });
+
+    it('should handle backslashes on Windows', async () => {
+      const subDir = path.join(collectionPath, 'utils');
+      fs.mkdirSync(subDir);
+      fs.writeFileSync(
+        path.join(subDir, 'module.js'),
+        'module.exports = { platform: "cross-platform" };'
+      );
+
+      // Simulate Windows-style path with backslashes
+      const script = `
+        const mod = require('.\\\\utils\\\\module');
+        bru.setVar('result', mod.platform);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig: {} });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', 'cross-platform');
+    });
+
+    it('should block access outside collection path', async () => {
+      const script = `
+        const outside = require('../../outside');
+      `;
+
+      const context = { console: console };
+
+      await expect(
+        runScriptInNodeVm({ script, context, collectionPath, scriptingConfig: {} })
+      ).rejects.toThrow('Access to files outside of the allowed context roots is not allowed');
+    });
+  });
+
+  describe('createCustomRequire - additionalContextRoots', () => {
+    it('should allow module access from additionalContextRoots', async () => {
+      // Create an additional context root at same level as collection
+      const additionalRoot = path.join(testDir, 'shared');
+      fs.mkdirSync(additionalRoot);
+      fs.writeFileSync(
+        path.join(additionalRoot, 'shared.js'),
+        'module.exports = { shared: true };'
+      );
+
+      // From collection, traverse up to testDir, then into shared directory
+      const script = `
+        const shared = require('../shared/shared');
+        bru.setVar('result', shared.shared);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      const scriptingConfig = {
+        additionalContextRoots: [additionalRoot]
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', true);
+    });
+
+    it('should handle relative additionalContextRoots path', async () => {
+      // Create a sibling directory to collection
+      const libsDir = path.join(testDir, 'libs');
+      fs.mkdirSync(libsDir);
+      fs.writeFileSync(
+        path.join(libsDir, 'lib.js'),
+        'module.exports = { fromLib: "yes" };'
+      );
+
+      const script = `
+        const lib = require('../libs/lib');
+        bru.setVar('result', lib.fromLib);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      const scriptingConfig = {
+        additionalContextRoots: ['../libs']
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', 'yes');
+    });
+
+    it('should handle nested additional context roots modules', async () => {
+      // Create an additional context root
+      const additionalRoot = path.join(testDir, 'shared');
+      fs.mkdirSync(additionalRoot);
+      fs.writeFileSync(
+        path.join(additionalRoot, 'allowed.js'),
+        'module.exports = { allowed: true };'
+      );
+
+      // Create a nested module that tries to require from additional root
+      fs.writeFileSync(
+        path.join(collectionPath, 'parent.js'),
+        `
+          const allowed = require('../shared/allowed');
+          module.exports = { nestedAccess: allowed.allowed };
+          `
+      );
+
+      const script = `
+          const parent = require('./parent');
+          bru.setVar('result', parent.nestedAccess);
+        `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      const scriptingConfig = {
+        additionalContextRoots: [additionalRoot]
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig });
+
+      // Nested module should successfully access the additional root
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', true);
+    });
+  });
+
+  describe('createCustomRequire - npm modules', () => {
+    it('should load npm module', async () => {
+      const script = `
+        const lodash = require('lodash');
+        bru.setVar('result', typeof lodash.get);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig: {} });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('result', 'function');
+    });
+  });
+
+  describe('createCustomRequire - module caching', () => {
+    it('should cache loaded modules', async () => {
+      let callCount = 0;
+      fs.writeFileSync(
+        path.join(collectionPath, 'cached.js'),
+        `
+        module.exports = { count: ${++callCount} };
+        `
+      );
+
+      const script = `
+        const mod1 = require('./cached');
+        const mod2 = require('./cached');
+        bru.setVar('same', mod1.count === mod2.count);
+      `;
+
+      const context = {
+        bru: { setVar: jest.fn() },
+        console: console
+      };
+
+      await runScriptInNodeVm({ script, context, collectionPath, scriptingConfig: {} });
+
+      expect(context.bru.setVar).toHaveBeenCalledWith('same', true);
+    });
+  });
+});

package/src/sandbox/quickjs/index.js

@@ -24,7 +24,7 @@ const toNumber = (value) => {
 };
 
 const removeQuotes = (str) => {
-  if ((str.startsWith('"') && str.endsWith('"')) || (str.startsWith("'") && str.endsWith("'"))) {
+  if ((str.startsWith('"') && str.endsWith('"')) || (str.startsWith('\'') && str.endsWith('\''))) {
     return str.slice(1, -1);
   }
   return str;
@@ -36,7 +36,7 @@ const executeQuickJsVm = ({ script: externalScript, context: externalContext, sc
   }
   externalScript = externalScript?.trim();
 
-  if(scriptType === 'template-literal') {
+  if (scriptType === 'template-literal') {
     if (!isNaN(Number(externalScript))) {
       const number = Number(externalScript);
 

package/src/sandbox/quickjs/shims/bru.js

@@ -341,7 +341,7 @@ const addBruShimToContext = (vm, bru) => {
       const promise = vm.newPromise();
       const dumpedUrl = vm.dump(url);
       const dumpedNameOrObj = vm.dump(nameOrCookieObj);
-      
+
       // Check if the second argument is an object (cookie object case)
       if (typeof dumpedNameOrObj === 'object' && dumpedNameOrObj !== null) {
         // Cookie object case: setCookie(url, cookieObject, callback)
@@ -363,7 +363,7 @@ const addBruShimToContext = (vm, bru) => {
           }
         });
       }
-      
+
       promise.settled.then(vm.runtime.executePendingJobs);
       return promise.handle;
     });
@@ -371,7 +371,7 @@ const addBruShimToContext = (vm, bru) => {
 
     const _setCookiesFn = vm.newFunction('_setCookies', (url, cookiesArray) => {
       const promise = vm.newPromise();
-      
+
       nativeJar.setCookies(vm.dump(url), vm.dump(cookiesArray), (err) => {
         if (err) {
           promise.reject(marshallToVm(cleanJson(err), vm));

package/src/sandbox/quickjs/shims/lib/crypto-utils.js

@@ -10,7 +10,7 @@ const addCryptoUtilsShimToContext = async (vm) => {
   let randomBytesHandle = vm.newFunction('randomBytes', function (sizeHandle) {
     try {
       let size = vm.dump(sizeHandle);
-      
+
       if (typeof size !== 'number') {
         throw new TypeError('The "size" argument must be of type number');
       }
@@ -30,15 +30,14 @@ const addCryptoUtilsShimToContext = async (vm) => {
       }
 
       const buffer = crypto.randomBytes(size);
-      
+
       const byteArray = Array.from(buffer);
-      
+
       return marshallToVm(byteArray, vm);
-      
     } catch (error) {
       const vmError = vm.newError(error.message);
       vm.setProp(vmError, 'name', vm.newString(error.name));
-      
+
       throw vmError;
     }
   });
@@ -48,7 +47,7 @@ const addCryptoUtilsShimToContext = async (vm) => {
       // Receive the serialized array data directly
       const serializedArray = vm.dump(arrayHandle);
       const typedArray = deserializeTypedArray(serializedArray);
-      
+
       if (typedArray.length === 0) {
         return marshallToVm([], vm);
       }
@@ -62,11 +61,10 @@ const addCryptoUtilsShimToContext = async (vm) => {
       const byteArray = Array.from(typedArray);
 
       return marshallToVm(byteArray, vm);
-      
     } catch (error) {
       const vmError = vm.newError(error.message);
       vm.setProp(vmError, 'name', vm.newString(error.name));
-      
+
       throw vmError;
     }
   });
@@ -101,4 +99,4 @@ const addCryptoUtilsShimToContext = async (vm) => {
   `);
 };
 
-module.exports = addCryptoUtilsShimToContext;
+module.exports = addCryptoUtilsShimToContext;

package/src/sandbox/quickjs/shims/lib/crypto-utils.spec.js

@@ -27,7 +27,7 @@ describe('crypto-utils shims tests', () => {
     const handle = vm.unwrapResult(result);
     const type = vm.dump(handle);
     handle.dispose();
-  
+
     expect(type).toBe('function');
   });
 
@@ -36,7 +36,7 @@ describe('crypto-utils shims tests', () => {
     const handle = vm.unwrapResult(result);
     const type = vm.dump(handle);
     handle.dispose();
-    
+
     expect(type).toBe('function');
   });
 
@@ -45,7 +45,7 @@ describe('crypto-utils shims tests', () => {
     const handle = vm.unwrapResult(result);
     const length = vm.dump(handle);
     handle.dispose();
-    
+
     expect(length).toBe(8);
   });
 
@@ -54,7 +54,7 @@ describe('crypto-utils shims tests', () => {
     const handle = vm.unwrapResult(result);
     const hexLength = vm.dump(handle);
     handle.dispose();
-    
+
     expect(hexLength).toBe(8); // 4 bytes = 8 hex chars
   });
 
@@ -67,7 +67,7 @@ describe('crypto-utils shims tests', () => {
     const handle = vm.unwrapResult(result);
     const length = vm.dump(handle);
     handle.dispose();
-    
+
     expect(length).toBe(5);
   });
-});
+});

package/src/sandbox/quickjs/shims/lib/utils.js

@@ -45,4 +45,4 @@ function deserializeTypedArray(obj) {
 module.exports = {
   serializeTypedArray,
   deserializeTypedArray
-}
+};

package/src/utils/results.js

@@ -7,7 +7,7 @@ const getResultsSummary = (results) => {
     total: results.length,
     passed: 0,
     failed: 0,
-    skipped: 0,
+    skipped: 0
   };
 
   results.forEach((r) => {
@@ -34,7 +34,7 @@ const setupBruTestMethods = (bru, __brunoTestResults, assertionResults) => {
     const summary = getResultsSummary(results);
     return {
       summary,
-      results: results.map(r => ({
+      results: results.map((r) => ({
         status: r.status,
         description: r.description,
         expected: r.expected,
@@ -49,7 +49,7 @@ const setupBruTestMethods = (bru, __brunoTestResults, assertionResults) => {
     const summary = getResultsSummary(results);
     return {
       summary,
-      results: results.map(r => ({
+      results: results.map((r) => ({
         status: r.status,
         lhsExpr: r.lhsExpr,
         rhsExpr: r.rhsExpr,
@@ -77,4 +77,4 @@ module.exports = {
   getResultsSummary,
   createBruTestResultMethods,
   setupBruTestMethods
-};
+};

package/src/utils.js

@@ -90,7 +90,7 @@ const evaluateJsTemplateLiteral = (templateLiteral, context) => {
     return templateLiteral.slice(1, -1);
   }
 
-  if (templateLiteral.startsWith("'") && templateLiteral.endsWith("'")) {
+  if (templateLiteral.startsWith('\'') && templateLiteral.endsWith('\'')) {
     return templateLiteral.slice(1, -1);
   }
 
@@ -129,7 +129,7 @@ const createResponseParser = (response = {}) => {
 };
 
 /**
- * Objects that are created inside vm2 execution context result in an serialization error when sent to the renderer process
+ * Objects that are created inside developer mode execution context result in an serialization error when sent to the renderer process
  * Error sending from webFrameMain:  Error: Failed to serialize arguments
  *    at s.send (node:electron/js2c/browser_init:169:631)
  *    at g.send (node:electron/js2c/browser_init:165:2156)
@@ -201,7 +201,7 @@ const uuid = () => {
   const customNanoId = customAlphabet(urlAlphabet, 21);
 
   return customNanoId();
-}
+};
 
 const appendAwaitToTestFunc = (str) => {
   return str.replace(/(?<!\.\s*)(?<!await\s)(test\()/g, 'await $1');
@@ -211,18 +211,18 @@ const cleanCircularJson = (data) => {
   try {
     // Handle circular references by keeping track of seen objects
     const seen = new WeakSet();
-    
+
     const replacer = (key, value) => {
       // Skip non-objects and null
       if (typeof value !== 'object' || value === null) {
         return value;
       }
-      
+
       // Detect circular reference
       if (seen.has(value)) {
         return '[Circular Reference]';
       }
-      
+
       seen.add(value);
       return value;
     };