Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

convert relative filepath for security reason #20

Closed
Jxck opened this issue May 25, 2015 · 8 comments
Closed

convert relative filepath for security reason #20

Jxck opened this issue May 25, 2015 · 8 comments

Comments

@Jxck
Copy link

Jxck commented May 25, 2015

power-asserted test result includes filepath with 'full path' like this.

assert.strictEqual(assert._expr(assert._capt(typeof res, 'arguments/0'), {
  content: 'assert.strictEqual(typeof name, \'string\')',
  filepath: '/home/username/path/to/project/and/file.js',
  line: 22
}), 'string');

file path with full path is kind of sensitive information in server or developer machine.
if user doesn't know this behavior, it may cause some security issue.
(for example, some could forgot adding build result to gitignore and push to public repository.)

I think this information is only a project specific.
so it seems better for me to use relative path of test file or project or configurable base bath.

any comments ?

@twada
Copy link
Member

twada commented May 25, 2015

@Jxck Thank you for your comment. You are absolutely right.

Using relative paths is already planned in next release, but now I'm reminded I have to hurry.

I'm so sorry for my insensitiveness. Next version will be released soon.
Thank you so much.

@Jxck
Copy link
Author

Jxck commented May 25, 2015

LGTM

thanks, close this when resolved.

@Jxck
Copy link
Author

Jxck commented Aug 25, 2015

it seems some commits but not fixed yet in current version
any updates or not ?

@twada
Copy link
Member

twada commented Aug 25, 2015

@Jxck Sorry for slow progress. power-assert is now in 1.0.0 release process. To be released today or tomorrow.

@Jxck
Copy link
Author

Jxck commented Aug 25, 2015

🙏🍻🍻🍻🙏

@twada
Copy link
Member

twada commented Aug 25, 2015

@Jxck, instrumentors below are using ^1.0.0 of espower (or espower-source) module so they have fixed. You don't need to update power-assert, but need to upgrade one of them you are using now.

More to come (PRs are already proposed):

@twada
Copy link
Member

twada commented Aug 26, 2015

This issue is fixed by the 1.0.0 release of power-assert family.
Feel free to reopen this if it is not fixed.

@twada twada closed this as completed Aug 26, 2015
@Jxck
Copy link
Author

Jxck commented Aug 27, 2015

great work thanks :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants