Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: coerce pollutes argv #2161

Merged
merged 5 commits into from Apr 9, 2022
Merged

fix: coerce pollutes argv #2161

merged 5 commits into from Apr 9, 2022

Conversation

jly36963
Copy link
Contributor

@jly36963 jly36963 commented Apr 6, 2022

Related

TLDR

  • coerce always runs, even if arg isn't provided
  • coerce sets the value on argv, resulting in keys existing on argv that weren't passed.
  • any validation around certain keys (not) existing on argv manifest unintended behavior

Description

I'm fixing two coerce bugs:

  • bug one: coerce and related argument not passed
  • bug two: coerce and strip-aliased

Bug one

Details

Coerce doesn't behave correctly when the related arg is not passed.
There are two unintentional side-effects:

  • a new arg is set on argv
  • coerce function is run

coerce > maybeAsyncResult > resultHandler sets argv, which shouldn't happen.

Reproduction

const input = 'cmd1'

yargs(input)
  .command(
    'cmd1',
    'cmd1 desc',
    yargs => yargs
      .option('foo', { alias: 'f', type: 'string' })
      .option('bar', { 
        type: 'string', 
        alias: 'b',
        coerce: val => console.log('Why was I called?') || val,
      }),
    argv => {
      console.log({ argv })
    })
  .strict()
  .parse()
Why was I called?
{
  argv: {
    _: [ 'cmd1' ],
    '$0': 'example.js',
    bar: undefined,
    b: undefined
  }
}

'b' was not provided, so:

  • its coerce function should not run
  • it should not be defined on argv

Bug two

Details

Coerce adds aliases to argv (even when strip-aliased is true)

Reproduction

const input = 'cmd1 -f hello -b world'

yargs(input)
  .parserConfiguration({ "strip-aliased": true })
  .command(
    'cmd1',
    'cmd1 desc',
    yargs => yargs
      .option('foo', { alias: 'f', type: 'string' })
      .option('bar', { 
        type: 'string', 
        alias: 'b',
        coerce: val => val,
      }),
    argv => {
      console.log({ argv })
    })
  .strict()
  .parse()
{
  argv: {
    _: [ 'cmd1' ],
    foo: 'hello',
    bar: 'world',
    '$0': 'example.js',
    b: 'world'
  }
}

b should not be defined on argv

@jly36963 jly36963 requested a review from bcoe Apr 6, 2022
@jly36963 jly36963 changed the title Prevent coerce logic when related arg is not passed fix: prevent coerce logic when related arg is not passed Apr 6, 2022
@jly36963 jly36963 changed the title fix: prevent coerce logic when related arg is not passed fix: coerce pollutes argv Apr 6, 2022
Copy link
Member

@bcoe bcoe left a comment

Small nit, but this bug fix looks good to me.

Great digging @jly36963.

@@ -387,6 +387,13 @@ export class YargsInstance {
yargs: YargsInstance
): Partial<Arguments> | Promise<Partial<Arguments>> => {
let aliases: Dictionary<string[]>;

// Skip coerce logic if related arg was not provided
const shouldCoerce = Object.prototype.hasOwnProperty.call(argv, keys);
Copy link
Member

@bcoe bcoe Apr 9, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe this can just be:

Object.hasOwnProperty.call(obj, 'a')

Copy link

@dhensby dhensby Apr 11, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm afraid this is not correct and it should be Object.prototype.hasOwnProperty.

The changes relating to this should be reverted.

Copy link
Contributor Author

@jly36963 jly36963 Apr 11, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Object.hasOwnProperty.call({a: 5}, 'a') and Object.prototype.hasOwnProperty.call({a: 5}, 'a') both return true. (I thought there might be an issue when using a null object, but both return false when Object.create(null) is used as the first argument.) I don't know of any scenarios where their behavior differs. Do you have an example where it could cause problems?

Copy link
Contributor Author

@jly36963 jly36963 Apr 11, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, Object.hasOwnProperty.call === Object.prototype.hasOwnProperty.call is true. I'm assuming they are a reference to the same object

Copy link

@dhensby dhensby Apr 11, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Notwithstanding the fact that this convention of using the prototype instead of the Object class directly is widely adopted.

It's the same reason to not use {a: 1}.hasOwnProperty('a'). The function could have been overridden via a global polyfill or patch meaning you're not using native behaviour.

I assume that {}.hasOwnProperty.call === Object.hasOwnProperty.call as well as the prototype. The point is that they can be overridden and are, thus, unreliable to use unless you use the underlying prototype.

Copy link
Member

@bcoe bcoe Apr 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I mean, Object.prototype can just as easily be overwritten:

> Object.prototype.hasOwnProperty = () => 'batman'
[Function (anonymous)]
> {}.hasOwnProperty()
'batman'

We would have to rewrite all of yargs to use primordials that are frozen at Node.js' startup to really avoid this issue.

Copy link
Member

@bcoe bcoe Apr 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We would have to rewrite all of yargs to use primordials that are frozen at Node.js' startup to really avoid this issue.

This is how Node.js itself approaches the problem:

https://github.com/nodejs/node/blob/master/lib/internal/per_context/primordials.js

But it's made easier for them by the fact that they can do so during bootstrapping.

Copy link

@dhensby dhensby Apr 21, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, this is definitely not an issue that is limited to yargs, for better or worse it's a language issue.

Whilst I think overriding the built-in methods like Object.hasOwnProperty() is pretty crazy, for those crazy enough to do it I think there is enough expectation that the prototype is left alone that it can be used reliably. Hence why it's enforced by standard linting rules in eslint and recommendations elsewhere.

Copy link
Member

@bcoe bcoe Apr 25, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dhensby makes sense to me.

bcoe
bcoe approved these changes Apr 9, 2022
@bcoe bcoe merged commit 2d1136d into yargs:main Apr 9, 2022
7 checks passed
@bcoe
Copy link
Member

@bcoe bcoe commented Apr 9, 2022

@jly36963 thank you for the great fix, we can likely close the affected PRs?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants