@usebruno/js 0.44.0 → 0.45.1

package/src/sandbox/node-vm/utils.js

@@ -0,0 +1,42 @@
+const path = require('node:path');
+const nodeModule = require('node:module');
+
+/**
+ * Check if a module is a Node.js builtin
+ * @param {string} moduleName - Module name to check
+ * @returns {boolean} True if module is a builtin
+ */
+function isBuiltinModule(moduleName) {
+  const normalized = moduleName.startsWith('node:') ? moduleName.slice(5) : moduleName;
+  return nodeModule.builtinModules.includes(normalized);
+}
+
+/**
+ * Validate that a path is within allowed context roots
+ * @param {string} normalizedPath - Normalized file path
+ * @param {Array<string>} additionalContextRootsAbsolute - Allowed roots
+ * @returns {boolean} True if path is within allowed roots
+ */
+function isPathWithinAllowedRoots(normalizedPath, additionalContextRootsAbsolute) {
+  return additionalContextRootsAbsolute.some((allowedRoot) => {
+    const normalizedAllowedRoot = path.normalize(allowedRoot);
+    const relativePath = path.relative(normalizedAllowedRoot, normalizedPath);
+    return !relativePath.startsWith('..') && !path.isAbsolute(relativePath);
+  });
+}
+
+class ScriptError extends Error {
+  constructor(error, script) {
+    super(error.message);
+    this.name = 'ScriptError';
+    this.originalError = error;
+    this.script = script;
+    this.stack = error.stack;
+  }
+}
+
+module.exports = {
+  isBuiltinModule,
+  isPathWithinAllowedRoots,
+  ScriptError
+};

package/src/sandbox/quickjs/shims/bru.js

@@ -24,6 +24,12 @@ const addBruShimToContext = (vm, bru) => {
   vm.setProp(bruObject, 'getCollectionName', getCollectionName);
   getCollectionName.dispose();
 
+  let isSafeMode = vm.newFunction('isSafeMode', function () {
+    return marshallToVm(bru.isSafeMode(), vm);
+  });
+  vm.setProp(bruObject, 'isSafeMode', isSafeMode);
+  isSafeMode.dispose();
+
   let getProcessEnv = vm.newFunction('getProcessEnv', function (key) {
     return marshallToVm(bru.getProcessEnv(vm.dump(key)), vm);
   });

package/src/sandbox/quickjs/shims/bruno-request.js

@@ -9,6 +9,7 @@ const addBrunoRequestShimToContext = (vm, req) => {
   const body = marshallToVm(req.getBody(), vm);
   const timeout = marshallToVm(req.getTimeout(), vm);
   const name = marshallToVm(req.getName(), vm);
+  const pathParams = marshallToVm(req.getPathParams(), vm);
   const tags = marshallToVm(req.getTags(), vm);
 
   vm.setProp(reqObject, 'url', url);
@@ -17,6 +18,7 @@ const addBrunoRequestShimToContext = (vm, req) => {
   vm.setProp(reqObject, 'body', body);
   vm.setProp(reqObject, 'timeout', timeout);
   vm.setProp(reqObject, 'name', name);
+  vm.setProp(reqObject, 'pathParams', pathParams);
   vm.setProp(reqObject, 'tags', tags);
 
   url.dispose();
@@ -25,6 +27,7 @@ const addBrunoRequestShimToContext = (vm, req) => {
   body.dispose();
   timeout.dispose();
   name.dispose();
+  pathParams.dispose();
   tags.dispose();
 
   let getUrl = vm.newFunction('getUrl', function () {
@@ -39,6 +42,24 @@ const addBrunoRequestShimToContext = (vm, req) => {
   vm.setProp(reqObject, 'setUrl', setUrl);
   setUrl.dispose();
 
+  let getHost = vm.newFunction('getHost', function () {
+    return marshallToVm(req.getHost(), vm);
+  });
+  vm.setProp(reqObject, 'getHost', getHost);
+  getHost.dispose();
+
+  let getPath = vm.newFunction('getPath', function () {
+    return marshallToVm(req.getPath(), vm);
+  });
+  vm.setProp(reqObject, 'getPath', getPath);
+  getPath.dispose();
+
+  let getQueryString = vm.newFunction('getQueryString', function () {
+    return marshallToVm(req.getQueryString(), vm);
+  });
+  vm.setProp(reqObject, 'getQueryString', getQueryString);
+  getQueryString.dispose();
+
   let getMethod = vm.newFunction('getMethod', function () {
     return marshallToVm(req.getMethod(), vm);
   });
@@ -57,6 +78,12 @@ const addBrunoRequestShimToContext = (vm, req) => {
   vm.setProp(reqObject, 'getName', getName);
   getName.dispose();
 
+  let getPathParams = vm.newFunction('getPathParams', function () {
+    return marshallToVm(req.getPathParams(), vm);
+  });
+  vm.setProp(reqObject, 'getPathParams', getPathParams);
+  getPathParams.dispose();
+
   let setMethod = vm.newFunction('setMethod', function (method) {
     req.setMethod(vm.dump(method));
   });

package/src/sandbox/quickjs/shims/test.js

@@ -58,6 +58,27 @@ const addBruShimToContext = (vm, __brunoTestResults) => {
       globalThis.test = Test(__brunoTestResults);
     `
   );
+
+  // Register custom chai assertion for isJson (expect(...).to.be.json)
+  // The bundled chai only exposes { expect, assert } — no Assertion class.
+  // Access the prototype through an expect() instance instead.
+  vm.evalCode(
+    `
+      (function() {
+        var proto = Object.getPrototypeOf(expect(null));
+        Object.defineProperty(proto, 'json', {
+          get: function () {
+            var obj = this._obj;
+            var isJson = typeof obj === 'object' && obj !== null && !Array.isArray(obj) &&
+              Object.prototype.toString.call(obj) === '[object Object]';
+            this.assert(isJson, 'expected #{this} to be JSON', 'expected #{this} not to be JSON');
+            return this;
+          },
+          configurable: true
+        });
+      })();
+    `
+  );
 };
 
 module.exports = addBruShimToContext;