Merge branch 'master' into fix-file-change-performance

.github/workflows/test.yml

@@ -1,9 +1,6 @@
 name: Test
 
 on:
-  push:
-    branches-ignore:
-      - master
   pull_request:
     branches:
       - master
@@ -38,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        node: [ 10, 12 ]
+        node: [10, 12]
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-node@v2

CHANGELOG.md

@@ -1,3 +1,54 @@
+## [6.3.15](https://github.com/karma-runner/karma/compare/v6.3.14...v6.3.15) (2022-02-05)
+
+
+### Bug Fixes
+
+* **helper:** make mkdirIfNotExists helper resilient to concurrent calls ([d9dade2](https://github.com/karma-runner/karma/commit/d9dade2f004a340e49c9a633177576200c286404)), closes [/github.com/karma-runner/karma-coverage/issues/434#issuecomment-1017939333](https://github.com//github.com/karma-runner/karma-coverage/issues/434/issues/issuecomment-1017939333)
+
+## [6.3.14](https://github.com/karma-runner/karma/compare/v6.3.13...v6.3.14) (2022-02-05)
+
+
+### Bug Fixes
+
+* remove string template from client code ([91d5acd](https://github.com/karma-runner/karma/commit/91d5acda6325caf91685da465d688527bd412b47))
+* warn when `singleRun` and `autoWatch` are `false` ([69cfc76](https://github.com/karma-runner/karma/commit/69cfc763c8f83e8e7e64d34e17829d0d3dcc0449))
+* **security:** remove XSS vulnerability in `returnUrl` query param ([839578c](https://github.com/karma-runner/karma/commit/839578c45a8ac42fbc1d72105f97eab77dd3eb8a))
+
+## [6.3.13](https://github.com/karma-runner/karma/compare/v6.3.12...v6.3.13) (2022-01-31)
+
+
+### Bug Fixes
+
+* **deps:** bump log4js to resolve security issue ([5bf2df3](https://github.com/karma-runner/karma/commit/5bf2df304453c8f71ebc725653fd174ddb1dd28b)), closes [#3751](https://github.com/karma-runner/karma/issues/3751)
+
+## [6.3.12](https://github.com/karma-runner/karma/compare/v6.3.11...v6.3.12) (2022-01-24)
+
+
+### Bug Fixes
+
+* remove depreciation warning from log4js ([41bed33](https://github.com/karma-runner/karma/commit/41bed33bf4b88c7e0787ca3a5ec15f2913b936fd))
+
+## [6.3.11](https://github.com/karma-runner/karma/compare/v6.3.10...v6.3.11) (2022-01-13)
+
+
+### Bug Fixes
+
+* **deps:** pin colors package to 1.4.0 due to security vulnerability ([a5219c5](https://github.com/karma-runner/karma/commit/a5219c52e2515248eefae4fe1863ac8ad3fdd43b))
+
+## [6.3.10](https://github.com/karma-runner/karma/compare/v6.3.9...v6.3.10) (2022-01-08)
+
+
+### Bug Fixes
+
+* **logger:** create parent folders if they are missing ([0d24bd9](https://github.com/karma-runner/karma/commit/0d24bd937f7089d1456e2ecf04419d2c268c3144)), closes [#3734](https://github.com/karma-runner/karma/issues/3734)
+
+## [6.3.9](https://github.com/karma-runner/karma/compare/v6.3.8...v6.3.9) (2021-11-16)
+
+
+### Bug Fixes
+
+* restartOnFileChange option not restarting the test run ([92ffe60](https://github.com/karma-runner/karma/commit/92ffe6018451f6144e8bc7726d304057b5ac9d0a)), closes [#27](https://github.com/karma-runner/karma/issues/27) [#3724](https://github.com/karma-runner/karma/issues/3724)
+
 ## [6.3.8](https://github.com/karma-runner/karma/compare/v6.3.7...v6.3.8) (2021-11-07)
 
 

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version of the project are currently being supported with security updates.
+
+## Reporting a Vulnerability
+
+To report a security issue, please email karma-runner-eng+security@google.com
+with a description of the issue, the steps you took to create the issue,
+affected versions, and if known, mitigations for the issue.

client/karma.js

@@ -232,20 +232,23 @@ function Karma (updater, socket, iframe, opener, navigator, location, document)
       resultsBuffer = []
     }
 
-    // A test could have incorrectly issued a navigate. Wait one turn
-    // to ensure the error from an incorrect navigate is processed.
-    var config = this.config
-    setTimeout(function () {
-      socket.emit('complete', result || {})
-      if (config.clearContext) {
-        navigateContextTo('about:blank')
-      } else {
-        self.updater.updateTestStatus('complete')
-      }
-      if (returnUrl) {
-        location.href = returnUrl
+    socket.emit('complete', result || {})
+    if (this.config.clearContext) {
+      navigateContextTo('about:blank')
+    } else {
+      self.updater.updateTestStatus('complete')
+    }
+    if (returnUrl) {
+      if (!/^https?:\/\//.test(returnUrl)) {
+        throw new Error(
+          'Security: Navigation to '.concat(
+            returnUrl,
+            ' was blocked to prevent malicious exploits.'
+          )
+        )
       }
-    })
+      location.href = returnUrl
+    }
   }
 
   this.info = function (info) {

lib/constants.js

@@ -28,8 +28,8 @@ exports.LOG_PRIORITIES = [
 ]
 
 // Default patterns for the pattern layout.
-exports.COLOR_PATTERN = '%[%d{DATE}:%p [%c]: %]%m'
-exports.NO_COLOR_PATTERN = '%d{DATE}:%p [%c]: %m'
+exports.COLOR_PATTERN = '%[%d{DATETIME}:%p [%c]: %]%m'
+exports.NO_COLOR_PATTERN = '%d{DATETIME}:%p [%c]: %m'
 
 // Default console appender
 exports.CONSOLE_APPENDER = {

lib/helper.js

@@ -1,8 +1,7 @@
 'use strict'
 
-const fs = require('graceful-fs')
-const path = require('path')
 const _ = require('lodash')
+const mkdirp = require('mkdirp')
 const useragent = require('ua-parser-js')
 const mm = require('minimatch')
 
@@ -141,18 +140,7 @@ const replaceWinPath = (path) => {
 exports.normalizeWinPath = process.platform === 'win32' ? replaceWinPath : _.identity
 
 exports.mkdirIfNotExists = (directory, done) => {
-  // TODO(vojta): handle if it's a file
-  /* eslint-disable handle-callback-err */
-  fs.stat(directory, (err, stat) => {
-    if (stat && stat.isDirectory()) {
-      done()
-    } else {
-      exports.mkdirIfNotExists(path.dirname(directory), () => {
-        fs.mkdir(directory, done)
-      })
-    }
-  })
-  /* eslint-enable handle-callback-err */
+  mkdirp(directory, done)
 }
 
 exports.defer = () => {

lib/server.js

@@ -96,6 +96,10 @@ class Server extends KarmaEventEmitter {
 
     this.log.debug('Final config', util.inspect(config, false, /** depth **/ null))
 
+    if (!config.autoWatch && !config.singleRun) {
+      this.log.warn('`autowatch` and `singleRun` are both `false`. In order to execute tests use `karma run`.')
+    }
+
     let modules = [{
       helper: ['value', helper],
       logger: ['value', logger],
@@ -265,6 +269,8 @@ class Server extends KarmaEventEmitter {
       const configLevel = config.browserConsoleLogOptions.level || 'debug'
       const configFormat = config.browserConsoleLogOptions.format || '%b %T: %m'
       const configPath = config.browserConsoleLogOptions.path
+      const configPathDir = path.dirname(configPath)
+      if (!fs.existsSync(configPathDir)) fs.mkdirSync(configPathDir, { recursive: true })
       this.log.info(`Writing browser console to file: ${configPath}`)
       const browserLogFile = fs.openSync(configPath, 'w+')
       const levels = ['log', 'error', 'warn', 'info', 'debug']