Merge branch 'develop' into feature/fix-ci

.github/workflows/ci.yml

@@ -64,7 +64,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        node-version: [16, 18]
+        node-version: [18, 20]
         os: [ubuntu-latest, windows-latest]
         include:
           - coverage: true

CHANGELOG.yaml

@@ -1,4 +1,9 @@
 unreleased:
+  breaking changes:
+    - GH-1052 Dropped support for Node < v18
+  fixed bugs:
+    - GH-1036 Fixed `uncaughtException` event listener not being removed
+    - GH-1034 Fixed an issue where sandbox crashes for large response body
   chores:
     - GH-1033 Update ci.yml to run coverage on latest node version
 

lib/sandbox/execute.js

@@ -189,32 +189,28 @@ module.exports = function (bridge, glob) {
                 timers.clearAll();
             }
 
-            // remove listener of disconnection event
-            vault.dispose();
-            bridge.off(abortEventName);
-            bridge.off(responseEventName);
-            bridge.off(cookiesEventName);
-            bridge.off('uncaughtException', onError);
-
             // fire extra execution error event
             if (err) { onError(err); }
 
-            // @note delete response from the execution object to avoid dispatching
-            // the large response payload back due to performance reasons.
-            execution.response && (delete execution.response);
+            function complete () {
+                vault.dispose();
+                bridge.off(abortEventName);
+                bridge.off(responseEventName);
+                bridge.off(cookiesEventName);
+                bridge.off('uncaughtException', onError);
+
+                // @note delete response from the execution object to avoid dispatching
+                // the large response payload back due to performance reasons.
+                execution.response && (delete execution.response);
+                bridge.dispatch(executionEventName, err || null, execution);
+            }
 
             if (dnd !== true) {
-                const dispatchExecutionResult = () => {
-                    bridge.dispatch(executionEventName, err || null, execution);
-                };
-
                 // if execution is skipped, we dispatch execution completion
                 // event immediately to avoid  any further processing else we
                 // dispatch it in next tick to allow any other pending events
                 // to be dispatched.
-                skippedExecution ?
-                    dispatchExecutionResult() :
-                    timers.wrapped.setImmediate(dispatchExecutionResult);
+                skippedExecution ? complete() : timers.wrapped.setImmediate(complete);
             }
         });
 
@@ -249,9 +245,7 @@ module.exports = function (bridge, glob) {
         // and one of them throws an error, this handler will be triggered
         // for all of them. This is a limitation of uvm as there is no way
         // to isolate the uncaught exception handling for each execution.
-        bridge.on('uncaughtException', (err) => {
-            onError(err);
-        });
+        bridge.on('uncaughtException', onError);
 
         if (!options.resolvedPackages) {
             disabledAPIs.push('require');

lib/sandbox/postman-legacy-interface.js

@@ -71,7 +71,9 @@ const _ = require('lodash'),
         URLENCODED: 'urlencoded',
         FORMDATA: 'formdata',
         FILE: 'file'
-    };
+    },
+
+    MAX_RESPONSE_SIZE = 50 * 1024 * 1024; // 50MB
 
 function getRequestBody (request) {
     var mode = _.get(request, 'body.mode'),
@@ -416,7 +418,15 @@ module.exports = {
              * @memberOf SandboxGlobals
              * @type {String}
              */
-            globalvars.responseBody = execution.response ? execution.response.text() : undefined;
+            globalvars.responseBody = (() => {
+                // Truncating response body if it is too large to avoid negatively affecting
+                //  the performance since this get calculated for every execution by default
+                if (!execution.response || execution.response.responseSize > MAX_RESPONSE_SIZE) {
+                    return;
+                }
+
+                return execution.response.text();
+            })();
         }
 
         // 5. add the iteration information

package.json

@@ -45,15 +45,15 @@
     "lodash": "4.17.21",
     "postman-collection": "4.5.0",
     "teleport-javascript": "1.0.0",
-    "uvm": "3.0.0"
+    "uvm": "4.0.0"
   },
   "devDependencies": {
     "@postman/shipit": "^0.4.0",
     "@postman/tough-cookie": "4.1.3-postman.1",
     "@stylistic/eslint-plugin-js": "^1.8.0",
     "ajv": "6.12.5",
     "assert": "2.0.0",
-    "async": "^3.2.5",
+    "async": "^3.2.6",
     "atob": "2.1.2",
     "backbone": "1.6.0",
     "browserify": "^16.5.2",
@@ -82,7 +82,7 @@
     "karma-mocha-reporter": "^2.2.5",
     "liquid-json": "0.3.1",
     "lodash3": "3.10.2",
-    "mocha": "^10.7.0",
+    "mocha": "^10.7.3",
     "moment": "2.30.1",
     "nyc": "^15.1.0",
     "packity": "^0.3.5",
@@ -91,14 +91,14 @@
     "shelljs": "^0.8.5",
     "sinon": "^18.0.0",
     "sinon-chai": "^3.7.0",
-    "terser": "^5.31.3",
+    "terser": "^5.33.0",
     "tsd-jsdoc": "^2.5.0",
     "tv4": "1.3.0",
-    "uniscope": "2.2.0",
+    "uniscope": "3.0.0",
     "watchify": "^4.0.0",
     "xml2js": "0.6.2"
   },
   "engines": {
-    "node": ">=16"
+    "node": ">=18"
   }
 }

test/unit/sandbox-libraries/legacy.test.js

@@ -116,4 +116,46 @@ describe('sandbox library - legacy', function () {
             done();
         });
     });
+
+    it('should support "responseBody" with size upto 50MB', function (done) {
+        context.execute({
+            listen: 'test',
+            script: `
+                const assert = require('assert');
+                assert.strictEqual(
+                    responseBody,
+                    Buffer.alloc(50 * 1024 * 1024, 'a').toString(),
+                    'responseBody <= 50MB should be available'
+                );
+            `
+        }, {
+            context: {
+                response: {
+                    stream: {
+                        type: 'Base64',
+                        data: Buffer.alloc(50 * 1024 * 1024, 'a').toString('base64')
+                    }
+                }
+            }
+        }, done);
+    });
+
+    it('should truncate "responseBody" with size > 50MB', function (done) {
+        context.execute({
+            listen: 'test',
+            script: `
+                const assert = require('assert');
+                assert.strictEqual(typeof responseBody, 'undefined', 'responseBody > 50MB should not be available');
+            `
+        }, {
+            context: {
+                response: {
+                    stream: {
+                        type: 'Base64',
+                        data: Buffer.alloc(51 * 1024 * 1024, 'a').toString('base64')
+                    }
+                }
+            }
+        }, done);
+    });
 });

test/unit/sandbox-sanity.test.js

@@ -175,6 +175,16 @@ describe('sandbox', function () {
                 // Temporarily added to fix browser tests
                 !propNames.includes('SharedArrayBuffer') && propNames.push('SharedArrayBuffer');
 
+                // Make sure all allowed globals exists
+                const context = Function('return this;')();
+                for (const prop of allowedGlobals) {
+                    if (prop === 'undefined' || prop === 'SharedArrayBuffer') {
+                        continue;
+                    }
+
+                    assert.equal(context[prop] !== undefined, true, 'prop ' + prop + ' does not exist');
+                }
+
                 // make sure both propNames and allowedGlobals are same
                 assert.equal(JSON.stringify(propNames.sort()), JSON.stringify(allowedGlobals.sort()));