postman-runtime 7.28.0 → 7.28.4

package/lib/authorizer/auth-interface.js

@@ -7,15 +7,22 @@ var _ = require('lodash'),
  *
  * @constructs AuthInterface
  * @param {RequestAuth} auth
+ * @param {Object} protocolProfileBehavior - Protocol profile behaviors
  * @return {AuthInterface}
  * @throws {Error}
  */
-createAuthInterface = function (auth) {
+createAuthInterface = function (auth, protocolProfileBehavior) {
     if (!(auth && auth.parameters && auth.parameters())) {
         throw new Error('runtime~createAuthInterface: invalid auth');
     }
 
     return /** @lends AuthInterface.prototype **/{
+        /**
+         * @private
+         * @property {protocolProfileBehavior} - Protocol profile behaviors
+         */
+        _protocolProfileBehavior: protocolProfileBehavior || {},
+
         /**
          * @param {String|Array<String>} keys
          * @return {*} Returns a value for a key or an object having all keys & values depending on the input

package/lib/authorizer/ntlm.js

@@ -36,6 +36,7 @@ var ntlmUtil = require('httpntlm').ntlm,
  *   - Down-Level Logon name format `DOMAIN\USERNAME`
  *   - User Principal Name format `USERNAME@DOMAIN`
  *
+ * @private
  * @param {String} username - Username string to parse from
  * @return {Object} - An object with `username` and `domain` fields, which are `strings`.
  */
@@ -83,6 +84,26 @@ function parseParametersFromUsername (username) {
     };
 }
 
+/**
+ * Check if `WWW-Authenticate` header has NTLM challenge.
+ *
+ * @private
+ * @param {*} headers - Postman headers instance
+ * @returns {Boolean}
+ */
+function hasNTLMChallenge (headers) {
+    // Case 1: multiple headers
+    // - WWW-Authenticate: NTLM
+    // - WWW-Authenticate: Negotiate
+    if (headers.has(WWW_AUTHENTICATE, NTLM) || headers.has(WWW_AUTHENTICATE, NEGOTIATE)) {
+        return true;
+    }
+
+    // Case 2: single header
+    // - WWW-Authenticate: Negotiate, NTLM
+    return String(headers.get(WWW_AUTHENTICATE)).includes(NTLM);
+}
+
 /**
  * NTLM auth while authenticating requires negotiateMessage (type 1) and authenticateMessage (type 3) to be stored.
  * Also it needs to know which stage is it in (INITIALIZED, T1_MSG_CREATED and T3_MSG_CREATED).
@@ -170,8 +191,7 @@ module.exports = {
 
         if (state === STATES.INITIALIZED) {
             // Nothing to do if the server does not ask us for auth in the first place.
-            if (!(response.headers.has(WWW_AUTHENTICATE, NTLM) ||
-                  response.headers.has(WWW_AUTHENTICATE, NEGOTIATE))) {
+            if (!hasNTLMChallenge(response.headers)) {
                 return done(null, true);
             }
 

package/lib/authorizer/oauth1.js

@@ -42,7 +42,7 @@ function getOAuth1BaseUrl (url) {
         host = ((port === HTTP_PORT ||
             port === HTTPS_PORT ||
             port === undefined) && url.hostname) || url.host,
-        path = url.pathname,
+        path = url.path,
 
         // trim to convert 'http:' from Node's URL object to 'http'
         protocol = _.trimEnd(url.protocol || PROTOCOL_HTTP, PROTOCOL_SEPARATOR);
@@ -52,6 +52,34 @@ function getOAuth1BaseUrl (url) {
     return protocol.toLowerCase() + host.toLowerCase() + path;
 }
 
+/**
+ * Query parameters are encoded with WHATWG encoding in the request. OAuth1.0
+ * requires the query params to be encoded with the RFC-3986 standard. This
+ * function decodes the query parameters and encodes them to the required RFC-3986
+ * standard. For details: https://oauth.net/core/1.0a/#encoding_parameters
+ *
+ * @param {Request} request - request to update query parameters
+ * @param {Object} url - Node.js like url object
+ */
+function updateQueryParamEncoding (request, url) {
+    // early bailout if no query is set.
+    if (!url.query) {
+        return;
+    }
+
+    const queryParams = oAuth1.decodeForm(url.query);
+
+    // clear all query parameters
+    request.url.query.clear();
+
+    _.forEach(queryParams, function (param) {
+        request.url.query.add({
+            key: param[0] && oAuth1.percentEncode(param[0]),
+            value: param[1] && oAuth1.percentEncode(param[1])
+        });
+    });
+}
+
 /**
  * Calculates body hash with given algorithm and digestEncoding.
  *
@@ -252,13 +280,13 @@ module.exports = {
      *
      * @param {Request} request - request to add oauth1 parameters
      * @param {Object} params - oauth data to generate signature
+     * @param {Object} protocolProfileBehavior - Protocol profile behaviors
      * @param {Function} done - callback function
      */
-    addAuthDataToRequest: function (request, params, done) {
+    addAuthDataToRequest: function (request, params, protocolProfileBehavior, done) {
         var url = urlEncoder.toNodeUrl(request.url),
             signatureParams,
             urlencodedBody,
-            queryParams,
             bodyParams,
             allParams,
             signature,
@@ -268,7 +296,8 @@ module.exports = {
                 consumerSecret: params.consumerSecret || EMPTY,
                 tokenSecret: params.tokenSecret || EMPTY,
                 privateKey: params.privateKey || EMPTY
-            };
+            },
+            disableUrlEncoding = protocolProfileBehavior && protocolProfileBehavior.disableUrlEncoding;
 
         signatureParams = [
             {system: true, key: OAUTH1_PARAMS.oauthConsumerKey, value: params.consumerKey},
@@ -300,11 +329,6 @@ module.exports = {
             return params.addEmptyParamsToSign || param.value;
         });
 
-        // filter disabled query parameters
-        queryParams = request.url.query.filter(function (param) {
-            return !param.disabled;
-        });
-
         urlencodedBody = request.body &&
             request.body.mode === RequestBody.MODES.urlencoded &&
             request.body.urlencoded;
@@ -315,7 +339,7 @@ module.exports = {
             return !param.disabled;
         }) : [];
 
-        allParams = [].concat(signatureParams, queryParams, bodyParams);
+        allParams = [].concat(signatureParams, bodyParams);
 
         message = {
             action: getOAuth1BaseUrl(url),
@@ -333,6 +357,13 @@ module.exports = {
             return done(err);
         }
 
+        // Update the encoding for query parameters to RFC-3986 in accordance with the
+        // OAuth1.0a specification: https://oauth.net/core/1.0a/#encoding_parameters
+        // disableUrlEncoding option should be respected in authorization flow as well
+        if (disableUrlEncoding !== true) {
+            updateQueryParamEncoding(request, url);
+        }
+
         signatureParams.push({system: true, key: OAUTH1_PARAMS.oauthSignature, value: signature});
 
         // Add signature params to the request. The OAuth specification says
@@ -358,9 +389,19 @@ module.exports = {
                 urlencodedBody.add(param);
             });
         }
-        else {
+        else if (disableUrlEncoding === true) {
+            // disableUrlEncoding option should be respected in authorization flow as well
             request.addQueryParams(signatureParams);
         }
+        else {
+            _.forEach(signatureParams, function (param) {
+                request.url.query.add({
+                    key: param.key && oAuth1.percentEncode(param.key),
+                    value: param.value && oAuth1.percentEncode(param.value),
+                    system: true
+                });
+            });
+        }
 
         done();
     },
@@ -394,7 +435,8 @@ module.exports = {
             ]),
             urlencodedBody = request.body,
             signatureAlgo,
-            hashAlgo;
+            hashAlgo,
+            protocolProfileBehavior = auth._protocolProfileBehavior;
 
         // extract hash and signature algorithm form signatureMethod
         // signature methods are in this format: '<signatureAlgo>-<hashAlgo>' e.g. RSA-SHA1
@@ -440,13 +482,13 @@ module.exports = {
         // Don't include body hash as defined in specification
         // @see: https://tools.ietf.org/id/draft-eaton-oauth-bodyhash-00.html#when_to_include
         if (urlencodedBody || !(params.includeBodyHash && hashAlgo)) {
-            return self.addAuthDataToRequest(request, params, done);
+            return self.addAuthDataToRequest(request, params, protocolProfileBehavior, done);
         }
 
         computeBodyHash(request.body, hashAlgo, 'base64', function (bodyHash) {
             params.bodyHash = bodyHash;
 
-            return self.addAuthDataToRequest(request, params, done);
+            return self.addAuthDataToRequest(request, params, protocolProfileBehavior, done);
         });
     }
 };

package/lib/requester/requester.js

@@ -315,6 +315,9 @@ _.assign(Requester.prototype, /** @lends Requester.prototype */ {
              */
             onStart = function (response) {
                 var responseStartEventName = RESPONSE_START_EVENT_BASE + id,
+                    executionData,
+                    initialRequest,
+                    finalRequest,
                     sdkResponse,
                     history,
                     done = function () {
@@ -342,12 +345,22 @@ _.assign(Requester.prototype, /** @lends Requester.prototype */ {
                 // prepare history from request debug data
                 history = getExecutionHistory(_.get(response, 'request._debug'));
 
+                // get the initial and final (on redirect) request from history
+                executionData = _.get(history, 'execution.data') || [];
+                initialRequest = _.get(executionData, '[0].request') || {};
+                finalRequest = executionData.length > 1 ?
+                    // get final redirect
+                    _.get(executionData, [executionData.length - 1, 'request']) :
+                    // no redirects
+                    initialRequest;
+
                 // add missing request headers so that they get bubbled up into the UI
-                addMissingRequestHeaders(_.get(history, 'execution.data[0].request.headers'));
+                addMissingRequestHeaders(initialRequest.headers);
 
-                // Pull out cookies from the cookie jar, and make them chrome compatible.
+                // pull out cookies from the cookie jar, and make them chrome compatible.
                 if (cookieJar && _.isFunction(cookieJar.getCookies)) {
-                    cookieJar.getCookies(requestOptions.url, function (err, cookiesFromJar) {
+                    // get cookies set for the final request URL
+                    cookieJar.getCookies(finalRequest.href, function (err, cookiesFromJar) {
                         if (err) {
                             return done();
                         }
@@ -371,7 +384,7 @@ _.assign(Requester.prototype, /** @lends Requester.prototype */ {
         // we can't trust the integrity of this request
         // bail out if request url is empty
         if (!(request && request.url && request.url.toString && request.url.toString())) {
-            return onEnd(new Error('runtime:extenstions~request: request url is empty'));
+            return onEnd(new Error('runtime:extensions~request: request url is empty'));
         }
 
         cookieJar = self.options.cookieJar;

package/lib/runner/instruction.js

@@ -127,6 +127,9 @@ pool = function (processors) {
             doneAndSpread = function (err) {
                 if (sealed) {
                     console.error('__postmanruntime_fatal_debug: instruction.execute callback called twice');
+                    if (err) {
+                        console.error(err);
+                    }
 
                     return;
                 }

package/lib/runner/request-helpers-presend.js

@@ -190,7 +190,7 @@ module.exports = [
             return done();
         }
 
-        authInterface = createAuthInterface(auth);
+        authInterface = createAuthInterface(auth, context.protocolProfileBehavior);
 
         /**
          * We go through the `pre` request send validation for the auth. In this step one of the three things can happen

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "postman-runtime",
-  "version": "7.28.0",
+  "version": "7.28.4",
   "description": "Underlying library of executing Postman Collections (used by Newman)",
   "main": "index.js",
   "directories": {
@@ -8,6 +8,7 @@
     "test": "test"
   },
   "scripts": {
+    "codecov": "node npm/publish-coverage.js",
     "test": "npm run test-lint && npm run test-system && npm run test-unit && npm run test-integration && npm run test-integration-legacy",
     "test-system": "node npm/test-system.js",
     "test-lint": "node npm/test-lint.js",
@@ -39,23 +40,23 @@
     "eventemitter3": "4.0.7",
     "handlebars": "4.7.7",
     "http-reasons": "0.1.0",
-    "httpntlm": "1.7.6",
+    "httpntlm": "1.7.7",
     "inherits": "2.0.4",
     "js-sha512": "0.8.0",
     "lodash": "4.17.21",
     "node-oauth1": "1.3.0",
     "performance-now": "2.1.0",
-    "postman-collection": "3.6.11",
+    "postman-collection": "4.1.0",
     "postman-request": "2.88.1-postman.30",
-    "postman-sandbox": "4.0.2",
-    "postman-url-encoder": "3.0.1",
+    "postman-sandbox": "4.0.5",
+    "postman-url-encoder": "3.0.5",
     "resolve-from": "5.0.0",
     "serialised-error": "1.1.3",
     "tough-cookie": "3.0.1",
     "uuid": "3.4.0"
   },
   "devDependencies": {
-    "@postman/shipit": "0.2.0",
+    "@postman/shipit": "0.3.0",
     "ajv": "6.12.6",
     "browserify": "16.5.2",
     "chai": "4.3.4",
@@ -63,13 +64,13 @@
     "editorconfig": "0.15.3",
     "eslint": "5.16.0",
     "eslint-plugin-jsdoc": "8.7.0",
-    "eslint-plugin-lodash": "7.2.0",
+    "eslint-plugin-lodash": "7.3.0",
     "eslint-plugin-mocha": "6.3.0",
     "eslint-plugin-security": "1.4.0",
     "express": "4.17.1",
-    "graphql": "15.5.0",
-    "js-yaml": "4.0.0",
-    "jsdoc": "3.6.6",
+    "graphql": "15.5.1",
+    "js-yaml": "4.1.0",
+    "jsdoc": "3.6.7",
     "jsdoc-to-markdown": "7.0.1",
     "karma": "3.1.4",
     "karma-browserify": "6.1.0",
@@ -87,7 +88,7 @@
     "shelljs": "0.8.4",
     "sinon": "8.1.1",
     "teleport-javascript": "1.0.0",
-    "terser": "5.6.1",
+    "terser": "5.7.1",
     "tmp": "0.2.1",
     "yankee": "1.0.8"
   },