@usebruno/js 0.46.1 → 0.48.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usebruno/js",
-  "version": "0.46.1",
+  "version": "0.48.0",
   "license": "MIT",
   "main": "src/index.js",
   "files": [
@@ -13,8 +13,8 @@
     "prepack": "npm run test"
   },
   "dependencies": {
-    "@usebruno/common": "0.20.0",
-    "@usebruno/query": "0.2.0",
+    "@usebruno/common": "0.22.0",
+    "@usebruno/query": "0.2.2",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "atob": "^2.1.2",
@@ -24,6 +24,7 @@
     "chai-string": "^1.5.0",
     "cheerio": "^1.0.0",
     "crypto-js": "^4.2.0",
+    "handlebars": "^4.7.9",
     "json-query": "^2.2.2",
     "jsonwebtoken": "^9.0.3",
     "lodash": "^4.17.21",
@@ -31,17 +32,18 @@
     "nanoid": "3.3.8",
     "node-fetch": "^2.7.0",
     "path": "^0.12.7",
-    "quickjs-emscripten": "^0.29.2",
+    "quickjs-emscripten": "^0.32.0",
     "tv4": "^1.3.0",
-    "uuid": "^9.0.0",
+    "uuid": "^10.0.0",
     "xml-formatter": "^3.5.0",
     "xml2js": "^0.6.2",
     "yaml": "^2.3.4"
   },
   "devDependencies": {
     "@rollup/plugin-commonjs": "^23.0.2",
+    "@rollup/plugin-json": "^6.0.0",
     "@rollup/plugin-node-resolve": "^15.0.1",
-    "rollup": "3.29.5",
-    "rollup-plugin-terser": "^7.0.2"
+    "@rollup/plugin-terser": "^1.0.0",
+    "rollup": "3.30.0"
   }
 }

package/src/bru.js

@@ -3,31 +3,90 @@ const { uuid } = require('./utils');
 const xmlFormat = require('xml-formatter');
 const { interpolate: _interpolate } = require('@usebruno/common');
 const { sendRequest, createSendRequest } = require('@usebruno/requests').scripting;
-const { jar: createCookieJar } = require('@usebruno/requests').cookies;
-
+const { jar: createCookieJar, getCookiesForUrl } = require('@usebruno/requests').cookies;
+const CookieList = require('./cookie-list');
+const Handlebars = require('handlebars');
+
+const VISUALIZATION_CLEAR = '__clear__';
+const MAX_TEMPLATE_LENGTH = 1_000_000; // 1 million characters
+/*
+ * All Handlebars.compile() options (v4.x):
+ *   data                    - set false to disable @data tracking
+ *   compat                  - enable recursive field lookup
+ *   knownHelpers            - hash of helpers known at compile time (optimization)
+ *   knownHelpersOnly        - only allow known helpers (optimization)       [SAFE]
+ *   noEscape                - skip HTML escaping of content                 [SAFE]
+ *   strict                  - throw on missing fields instead of ignoring   [SAFE]
+ *   assumeObjects           - skip object existence checks on paths         [SAFE]
+ *   preventIndent           - disable auto-indent for partials              [SAFE]
+ *   ignoreStandalone        - disable standalone tag removal                [SAFE]
+ *   explicitPartialContext  - disable implicit context for partials         [SAFE]
+ *
+ * Excluded from allowlist:
+ *   data, compat, knownHelpers - can alter template resolution in unexpected ways
+ *   allowProtoPropertiesByDefault, allowProtoMethodsByDefault - defense-in-depth against
+ *     prototype traversal. Handlebars >=4.3.0 fixed the original CVE-2019-19919 and >=4.7.0
+ *     hardcodes blocks on __proto__, constructor, etc. even when these flags are true, but
+ *     we still exclude them to avoid relaxing the security posture.
+ *     https://nvd.nist.gov/vuln/detail/CVE-2019-19919
+ *
+ * Use `dangerouslyAllowAllOptions: true` in data.options to bypass the allowlist.
+ */
+const SAFE_HBS_OPTIONS = new Set([
+  'noEscape', 'strict', 'assumeObjects', 'preventIndent',
+  'ignoreStandalone', 'explicitPartialContext', 'knownHelpersOnly'
+]);
 const variableNameRegex = /^[\w-.]*$/;
 
 class Bru {
   /**
-   * @param {string} runtime - The runtime environment ('quickjs' or 'nodevm')
-   * @param {object} envVariables - Environment variables
-   * @param {object} runtimeVariables - Runtime variables
-   * @param {object} processEnvVars - Process environment variables
-   * @param {string} collectionPath - Path to the collection
-   * @param {function} historyLogger - History logger function
-   * @param {function} setVisualizations - Visualizations setter function
-   * @param {object} secretVariables - Secret variables
-   * @param {object} collectionVariables - Collection-level variables
-   * @param {object} folderVariables - Folder-level variables
-   * @param {object} requestVariables - Request-level variables
-   * @param {object} globalEnvironmentVariables - Global environment variables
-   * @param {object} oauth2CredentialVariables - OAuth2 credential variables
-   * @param {object} iterationDetails - Iteration details for runner
-   * @param {string} collectionName - Name of the collection
-   * @param {object} promptVariables - Prompt variables
-   * @param {object} certsAndProxyConfig - Configuration for bru.sendRequest (proxy, certs, TLS)
+   * @param {object} options - Single options object (destructured)
+   * @property {string} options.runtime - The runtime environment ('quickjs' or 'nodevm')
+   * @property {object} [options.envVariables={}] - Environment variables
+   * @property {object} [options.runtimeVariables={}] - Runtime variables
+   * @property {object} [options.processEnvVars={}] - Process environment variables (deep cloned)
+   * @property {string} [options.collectionPath] - Path to the collection
+   * @property {function} [options.historyLogger] - History logger function
+   * @property {function} [options.setVisualizations] - Visualizations setter function
+   * @property {object} [options.secretVariables={}] - Secret variables (deep cloned)
+   * @property {object} [options.collectionVariables={}] - Collection-level variables
+   * @property {object} [options.folderVariables={}] - Folder-level variables
+   * @property {object} [options.requestVariables={}] - Request-level variables
+   * @property {object} [options.globalEnvironmentVariables={}] - Global environment variables
+   * @property {object} [options.oauth2CredentialVariables={}] - OAuth2 credential variables
+   * @property {object} [options.iterationDetails] - Iteration details for runner
+   * @property {string} [options.collectionName] - Name of the collection
+   * @property {object} [options.promptVariables={}] - Prompt variables
+   * @property {object} [options.certsAndProxyConfig] - Configuration for bru.sendRequest (proxy, certs, TLS)
+   * @property {string} [options.certsAndProxyConfig.collectionPath] - Path to the collection
+   * @property {object} [options.certsAndProxyConfig.options] - TLS and proxy options
+   * @property {object} [options.certsAndProxyConfig.clientCertificates] - Client certificate configuration
+   * @property {object} [options.certsAndProxyConfig.collectionLevelProxy] - Collection-level proxy settings
+   * @property {object} [options.certsAndProxyConfig.systemProxyConfig] - System proxy configuration
+   * @property {string} [options.requestUrl] - The URL of the current request (used for cookie access)
+   * @property {function} [options.onConsoleLog] - Console callback `(type, args) => void` to route warnings to the UI
    */
-  constructor(runtime, envVariables, runtimeVariables, processEnvVars, collectionPath, historyLogger, setVisualizations, secretVariables, collectionVariables, folderVariables, requestVariables, globalEnvironmentVariables, oauth2CredentialVariables, iterationDetails, collectionName, promptVariables, certsAndProxyConfig) {
+  constructor({
+    runtime,
+    envVariables,
+    runtimeVariables,
+    processEnvVars,
+    collectionPath,
+    historyLogger,
+    setVisualizations,
+    secretVariables,
+    collectionVariables,
+    folderVariables,
+    requestVariables,
+    globalEnvironmentVariables,
+    oauth2CredentialVariables,
+    iterationDetails,
+    collectionName,
+    promptVariables,
+    certsAndProxyConfig,
+    requestUrl,
+    onConsoleLog
+  }) {
     this.envVariables = envVariables || {};
     this.runtimeVariables = runtimeVariables || {};
     this.promptVariables = promptVariables || {};
@@ -41,58 +100,18 @@ class Bru {
     this.collectionPath = collectionPath;
     this.historyLogger = historyLogger;
     this.setVisualizations = setVisualizations;
+    this.onConsoleLog = onConsoleLog || null;
     this.collectionName = collectionName;
     // Use createSendRequest with config if provided, otherwise use default sendRequest
     this.sendRequest = certsAndProxyConfig ? createSendRequest(certsAndProxyConfig) : sendRequest;
     this.runtime = runtime;
-    this.cookies = {
-      jar: () => {
-        const cookieJar = createCookieJar();
-
-        return {
-          getCookie: (url, cookieName, callback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.getCookie(interpolatedUrl, cookieName, callback);
-          },
-
-          getCookies: (url, callback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.getCookies(interpolatedUrl, callback);
-          },
-
-          setCookie: (url, nameOrCookieObj, valueOrCallback, maybeCallback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.setCookie(interpolatedUrl, nameOrCookieObj, valueOrCallback, maybeCallback);
-          },
-
-          setCookies: (url, cookiesArray, callback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.setCookies(interpolatedUrl, cookiesArray, callback);
-          },
-
-          // Clear entire cookie jar
-          clear: (callback) => {
-            return cookieJar.clear(callback);
-          },
-
-          // Delete cookies for a specific URL/domain
-          deleteCookies: (url, callback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.deleteCookies(interpolatedUrl, callback);
-          },
-
-          deleteCookie: (url, cookieName, callback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.deleteCookie(interpolatedUrl, cookieName, callback);
-          },
-
-          hasCookie: (url, cookieName, callback) => {
-            const interpolatedUrl = this.interpolate(url);
-            return cookieJar.hasCookie(interpolatedUrl, cookieName, callback);
-          }
-        };
-      }
-    };
+    this.requestUrl = requestUrl;
+    this.cookies = new CookieList({
+      getUrl: () => this.interpolate(this.requestUrl),
+      interpolate: (str) => this.interpolate(str),
+      createCookieJar,
+      getCookiesForUrl
+    });
     // Holds variables that are marked as persistent by scripts
     this.persistentEnvVariables = {};
     // Holds credential IDs to be reset after script execution
@@ -414,9 +433,41 @@ class Bru {
     return this.secretVariables?.[`$secrets.${key}`];
   }
 
+  /**
+   * Render a visualization in the response pane.
+   *
+   * @param {'table' | 'html'} type - The visualization type.
+   * @param {Object} data - Shape depends on `type`:
+   *
+   *   **When `type` is `'table'`:**
+   *   @param {string}  data.provider             - `'ag-grid'` or `'react-table'`.
+   *   @param {Object}  data.props                - Props forwarded to the grid component.
+   *   @param {Array}   data.props.columnDefinitions - (ag-grid) Column definitions.
+   *   @param {Array}   data.props.rowData           - (ag-grid) Row data.
+   *
+   *   **When `type` is `'html'`** (raw mode):
+   *   @param {string}  data.content              - Pre-rendered HTML string.
+   *
+   *   **When `type` is `'html'`** (Handlebars template mode):
+   *   @param {string}  data.template             - Handlebars template string (required).
+   *   @param {Object}  [data.data={}]            - Context object passed to the compiled template.
+   *   @param {Object}  [data.options]            - Handlebars compile options.
+   *   @param {boolean} [data.options.noEscape]    - Disable HTML escaping.
+   *   @param {boolean} [data.options.strict]      - Throw on missing variables.
+   *   @param {boolean} [data.options.assumeObjects] - Skip null checks on nested paths.
+   *   @param {boolean} [data.options.dangerouslyAllowAllOptions] - Bypass the safe-options
+   *     allowlist (forwards all remaining options directly to `Handlebars.compile`).
+   *
+   * @throws {Error} If `type` is falsy.
+   * @throws {Error} If `type` is `'html'` and neither `data.content` nor `data.template` is provided.
+   * @throws {Error} If template exceeds `MAX_TEMPLATE_LENGTH`.
+   */
   visualize(type, data) {
-    if (type == 'table') {
-      if (data?.provider == 'ag-grid') {
+    if (!type) {
+      throw new Error('visualization type is required');
+    }
+    if (type === 'table') {
+      if (data?.provider === 'ag-grid') {
         if (!data?.props?.columnDefinitions) {
           throw new Error(`columns definitions are required`);
         }
@@ -424,17 +475,63 @@ class Bru {
           throw new Error(`row data is required`);
         }
         this.setVisualizations({ uid: uuid(), type, data });
-      } else if (data?.provider == 'react-table') {
+      } else if (data?.provider === 'react-table') {
         this.setVisualizations({ uid: uuid(), type, data });
       }
-    } else if (type == 'html') {
-      if (!data?.content) {
-        throw new Error(`html content is required`);
+    } else if (type === 'html') {
+      if (typeof data?.template === 'string') {
+        // Handlebars template mode (translated from pm.visualizer.set)
+        if (data.template.length > MAX_TEMPLATE_LENGTH) {
+          throw new Error(`template exceeds maximum length of ${MAX_TEMPLATE_LENGTH} characters`);
+        }
+        // Isolated instance so globally-registered helpers can't be exploited (SSTI prevention)
+        const hbs = Handlebars.create();
+        // Allowlist safe compile options to prevent re-enabling prototype traversal (CVE-2019-19919)
+        let compileOptions;
+        if (data.options?.dangerouslyAllowAllOptions) {
+          const { dangerouslyAllowAllOptions, ...rest } = data.options;
+          compileOptions = rest;
+        } else {
+          compileOptions = {};
+          if (data.options) {
+            const blocked = [];
+            for (const key of Object.keys(data.options)) {
+              if (SAFE_HBS_OPTIONS.has(key)) {
+                compileOptions[key] = data.options[key];
+              } else {
+                blocked.push(key);
+              }
+            }
+            if (blocked.length > 0) {
+              const msg = `bru.visualize: the following compile options were blocked and ignored: ${blocked.map((k) => `"${k}"`).join(', ')}. `
+                + 'Use { dangerouslyAllowAllOptions: true } in options to bypass the allowlist.';
+              if (this.onConsoleLog) {
+                this.onConsoleLog('warn', [msg]);
+              } else {
+                console.warn(msg);
+              }
+            }
+          }
+        }
+        const compiled = hbs.compile(data.template, compileOptions);
+        const renderedHtml = compiled(data.data || {});
+        this.setVisualizations({
+          uid: uuid(), type,
+          data: { content: renderedHtml, rawData: data.data || {} }
+        });
+      } else if (data?.content) {
+        // Existing raw HTML mode
+        this.setVisualizations({ uid: uuid(), type, data });
+      } else {
+        throw new Error('html content or template is required');
       }
-      this.setVisualizations({ uid: uuid(), type, data });
     }
   }
 
+  clearVisualizations() {
+    this.setVisualizations({ type: VISUALIZATION_CLEAR });
+  }
+
   sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
   }
@@ -488,3 +585,4 @@ class IterationDataManager {
 }
 
 module.exports = Bru;
+module.exports.VISUALIZATION_CLEAR = VISUALIZATION_CLEAR;

package/src/bruno-request.js

@@ -1,9 +1,12 @@
+const HeaderList = require('./header-list');
+
 class BrunoRequest {
   /**
    * The following properties are available as shorthand:
    * - req.url
    * - req.method
-   * - req.headers
+   * - req.headers (raw headers object)
+   * - req.headerList (PropertyList API for headers)
    * - req.timeout
    * - req.body
    *
@@ -22,6 +25,7 @@ class BrunoRequest {
     this.name = req.name;
     this.pathParams = req.pathParams;
     this.tags = req.tags || [];
+    this.headerList = new HeaderList(this.req);
     /**
      * We automatically parse the JSON body if the content type is JSON
      * This is to make it easier for the user to access the body directly
@@ -96,17 +100,24 @@ class BrunoRequest {
   }
 
   getAuthMode() {
+    const headers = this.req.headers;
     if (this.req?.oauth2) {
       return 'oauth2';
-    } else if (this.headers?.['Authorization']?.startsWith('Bearer')) {
+    } else if (this.req?.oauth1config) {
+      return 'oauth1';
+    } else if (headers?.['Authorization']?.startsWith('Bearer')) {
       return 'bearer';
-    } else if (this.headers?.['Authorization']?.startsWith('Basic') || this.req?.auth?.username) {
+    } else if (headers?.['Authorization']?.startsWith('Basic') || this.req?.auth?.username) {
       return 'basic';
+    } else if (this.req?.apiKeyAuthValueForQueryParams) {
+      return 'apikey';
+    } else if (this.req?.apiKeyHeaderName && this.headers?.[this.req.apiKeyHeaderName] !== undefined) {
+      return 'apikey';
     } else if (this.req?.awsv4) {
       return 'awsv4';
     } else if (this.req?.digestConfig) {
       return 'digest';
-    } else if (this.headers?.['X-WSSE'] || this.req?.auth?.username) {
+    } else if (headers?.['X-WSSE'] || this.req?.auth?.username) {
       return 'wsse';
     } else {
       return 'none';
@@ -123,7 +134,6 @@ class BrunoRequest {
   }
 
   setHeaders(headers) {
-    this.headers = headers;
     this.req.headers = headers;
   }
 
@@ -136,12 +146,10 @@ class BrunoRequest {
   }
 
   setHeader(name, value) {
-    this.headers[name] = value;
     this.req.headers[name] = value;
   }
 
   deleteHeader(name) {
-    delete this.headers[name];
     delete this.req.headers[name];
 
     /**

package/src/bruno-response.js

@@ -1,5 +1,6 @@
 const { get } = require('@usebruno/query');
 const _ = require('lodash');
+const HeaderList = require('./header-list');
 
 class BrunoResponse {
   constructor(res) {
@@ -11,6 +12,9 @@ class BrunoResponse {
     this.responseTime = res ? res.responseTime : null;
     this.url = res?.request ? res.request.protocol + '//' + res.request.host + res.request.path : null;
 
+    // HeaderList in static read-only mode — write methods throw
+    this.headerList = new HeaderList(res, { writable: false });
+
     // Make the instance callable
     const callable = (...args) => get(this.body, ...args);
     Object.setPrototypeOf(callable, this.constructor.prototype);