sinonjs / samsam Goto Github PK

Please upgrade the package to use the latest npm lodash package as the previous version have a vulnerability issue.

In referee, we have assert.json(actual, expected) which attempts to parse actual with JSON.parse and compares the result to expected. It would be nice to have a matcher that does the same and can be used like this:

assert.equals(actual, {
  some: 'thing',
  json: match.json({
    parsed: true
  })
});

Or with sinon assertions:

sinon.assert.calledWith(fake, match.json({
  my: 'json'
}));

I'm unsure about a naming ambiguity though: We also have assert.matchJson(actual, expectation) which parses actual with JSON.parse and compares the result to expected using the same semantics of assert.match.

How would match.json behave? And what would be the counterpart?

@tbiesemann opened in sinon sinonjs/sinon#1882

it("passes instance and object", function() {
    var obj = {};
    var ins = new (class MyClass {});
    assert.isFalse(samsam.deepEqual(obj, ins));
});

• library version : 2.0.0
• Environment : nodejs

What did you expect to happen?

It should return false.

What actually happens

It fails the test and returns true

Solution

As suggested by @tbiesemann, compare the names of the constructors:

if (
    type1 !== type2 ||
    class1 !== class2 ||
    obj1.constructor.name !== obj2.constructor.name ||
    keys1.length !== keys2.length
) {
    return false;
}

https://github.com/sinonjs/samsam/blob/master/lib/deep-equal.js#L105

Note: This modification lets the mentioned test pass but lets tests crash that pass objects that have no prototype.
I will provide a PR for this

It'd be much easier from a config/publishing point of view to move lib/samsa.test.js into it's own folder under ./test.

We'd be able to remove the following:

• https://github.com/sinonjs/samsam/blob/master/package.json#L29
• https://github.com/sinonjs/samsam/blob/master/.npmignore#L3

It'd also more closely follow other packages conventions. If not, we need to tidy up the following:

• https://github.com/sinonjs/samsam/blob/master/.eslintignore#L3
  https://github.com/sinonjs/samsam/blob/master/.npmignore#L5

We understand you have a problem and are in a hurry, but please provide us with some info to make it much more likely for your issue to be understood, worked on and resolved quickly.

• library version : sinon v 6.3.4
• Environment : docker with yarn as the Package Manager

What did you expect to happen?
I was trying to deploy my backend normally with docker then i get a dependency failure
What actually happens

How to reproduce
Simply use the version 6.3.4 of sinon then run yarn install. then you should see log

Trace: 
  Error: https://registry.yarnpkg.com/@sinonjs/samsam/-/samsam-2.1.0.tgz: Request failed "404 Not Found"
      at ResponseError.ExtendableBuiltin (/Users/memo/.yarn/lib/cli.js:696:66)
      at new ResponseError (/Users/memo/.yarn/lib/cli.js:802:124)
      at Request.<anonymous> (/Users/memo/.yarn/lib/cli.js:66996:16)
      at Request.emit (events.js:200:13)
      at Request.module.exports.Request.onRequestResponse (/Users/memo/.yarn/lib/cli.js:141441:10)
      at ClientRequest.emit (events.js:205:15)
      at HTTPParser.parserOnIncomingClient [as onIncoming] (_http_client.js:565:23)
      at HTTPParser.parserOnHeadersComplete (_http_common.js:116:17)
      at TLSSocket.socketOnData (_http_client.js:452:22)
      at TLSSocket.emit (events.js:200:13)

As detailed in #41 (comment) - and several other issues, the test suite currently has 7 failing tests in IE11. These are not all new - we had 4 failing prior to #38.

Since IE11 is among our supported ES5 browsers in Sinon we should aim to fix these.

Samsam 3 introduces createMatcher, which was moved from sinon.match. Also, samsam.match.* not exposes as sinon.match.* APIs. These new APIs are not documented yet.

samsam.isDate returns true for "date-like" objects.

I don't think the following should return true:

it("returns true if date", function () {
    var checkDate = samsam.isDate({
        getTime: () => "hello",
        valueOf: () => "hello"
    });
    assert.isTrue(checkDate);
});

To be honest, i'm not overly sure the usefulness of isDate being exposed when people can simply do (new Date) instanceof Date

Due to previous troubles in some of my big projects, I'm nearly always using circular-dependency-plugin for webpack to detect them when performing tests.

After upgrading to Sinon 9.0.2, my tests began to fail with this error :

ERROR in Circular dependency detected:
../../node_modules/@sinonjs/samsam/lib/create-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/assert-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher.js
ERROR in Circular dependency detected:
../../node_modules/@sinonjs/samsam/lib/create-matcher/assert-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/assert-matcher.js
ERROR in Circular dependency detected:
../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/assert-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js
ERROR in Circular dependency detected:
../../node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/type-map.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js
ERROR in Circular dependency detected:
../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/assert-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js
ERROR in Circular dependency detected:
../../node_modules/@sinonjs/samsam/lib/create-matcher/type-map.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/is-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/matcher-prototype.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher.js -> ../../node_modules/@sinonjs/samsam/lib/create-matcher/type-map.js`

I've solved my own issue by disabling check for node_modules but I think it might be of interest for you to know about this even if everything seems fine.

• library version : 5.0.3 (shipped with Sinon 9.0.2)
• Environment : Node12/webpack
• Example URL : -
• Other libraries you are using: plenty but no matter

What did you expect to happen?
No circular dependency error

What actually happens
Circular dependency error

How to reproduce
A basic webpack setup with circular-dependency-plugin enabled

Like Sinon and Lolex we should have a Sauce Labs runner using mochify. Sometimes updates to this library fails Sinon builds, which is unfortunate.

Builds are fialling for #44.

• Environment : Travis CI Node:8, Node:10
• Build : https://travis-ci.org/sinonjs/samsam/builds/438125493

What did you expect to happen?

The builds should pass

What actually happens

They fail

$ npm ci 
npm WARN prepare removing existing node_modules/ before installation
npm ERR! cipm can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! 
npm ERR! Missing: @sinonjs/commons@^1.0.2
npm ERR! 
npm ERR! A complete log of this run can be found in:
npm ERR!     /home/travis/.npm/_logs/2018-10-06T22_20_56_102Z-debug.log
The command "eval npm ci  " failed. Retrying, 2 of 3.
npm ERR! cipm can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! 
npm ERR! Missing: @sinonjs/commons@^1.0.2
npm ERR! 
npm ERR! A complete log of this run can be found in:
npm ERR!     /home/travis/.npm/_logs/2018-10-06T22_20_59_444Z-debug.log
The command "eval npm ci  " failed. Retrying, 3 of 3.
npm ERR! cipm can only install packages when your package.json and package-lock.json or npm-shrinkwrap.json are in sync. Please update your lock file with `npm install` before continuing.
npm ERR! 
npm ERR! 
npm ERR! Missing: @sinonjs/commons@^1.0.2
npm ERR! 
npm ERR! A complete log of this run can be found in:
npm ERR!     /home/travis/.npm/_logs/2018-10-06T22_21_00_896Z-debug.log
The command "eval npm ci  " failed 3 times.
The command "npm ci " failed and exited with 1 during .
Your build has been stopped.

When nested properties are missing match throws a type error.

The following example:

samsam.match({a: 1}, {b: {c: 2}});

throws

TypeError: Cannot read property 'c' of undefined

The expected result would be false.

• library version : latest
• Environment : Test
• File : https://github.com/sinonjs/samsam/blob/master/lib/is-arguments.test.js and https://github.com/sinonjs/samsam/blob/master/lib/is-arguments.js

What happened?
While trying to increase the test coverage to 100%. I ran into this bit of code...

    if (typeof object.callee === "function") {
        return true;
    }
    try {
        object[object.length] = 6;
        delete object[object.length];
    } catch (e) {
        return true;
    }

• Tests will never reach to object.callee === "function" as isArgument function will return true here
• Same thing for try.. catch.. isArgument will return either true or false before it reaches this point.

Recommended Solution
Remove the above code blocks as it is redundant.

How to produce?

• Run test coverage locally npm run test:coverage and notice the coverage result

• library version : 3.3.2
• Environment : IE-11
• Other libraries you are using: jQuery 3.4.1

What did you expect to happen?
deepEqual returns true as on any other browser.

What actually happens
"TypeError: Unable to get property 'length' of undefined or null reference" is thrown by getClassName.

How to reproduce

import samsam from '@sinonjs/samsam';
import jQuery from 'jQuery';

console.log(
    samsam.deepEqual(
        jQuery('#test'),
        jQuery('#test')
    )
);

TypeError: Unable to get property 'length' of undefined or null reference
   at getClassName (http://localhost:1234/ie-11-bug.e31bb0bc.js:1004:9)
   at deepEqual (http://localhost:1234/ie-11-bug.e31bb0bc.js:1131:9)
   at deepEqualCyclic (http://localhost:1234/ie-11-bug.e31bb0bc.js:1068:5)
   at Anonymous function (http://localhost:1234/ie-11-bug.e31bb0bc.js:1257:9)
   at Anonymous function (http://localhost:1234/ie-11-bug.e31bb0bc.js:31912:1)
   at newRequire (http://localhost:1234/ie-11-bug.e31bb0bc.js:47:7)
   at Anonymous function (http://localhost:1234/ie-11-bug.e31bb0bc.js:81:7)
   at Global code (http://localhost:1234/ie-11-bug.e31bb0bc.js:8:1)

The match function is missing a case for the primitive symbol

What did you expect to happen?
A user can check if two values are both symbols, the match() should return true

What actually happens

it("returns true if two values are both symbols", () => {
        var symbol1 = Symbol("hello");
        var symbol2 = Symbol("hello2");

        var checkMatch = samsam.match(symbol1, symbol2);
        assert.isTrue(checkMatch);
});

Currently get the error message Error: Matcher was not a string, a number, a function, a boolean or an object

When running the headless tests in Chromium there is an error.

npm run test-headless

> @sinonjs/[email protected] test-headless
> mochify --no-detect-globals --recursive -R dot --plugin [ proxyquire-universal ] "./lib/*.test.js"

# chromium:


  ....................................................................................................................................................................................................................
  .....................................................................................................................................................................................................!..............
  .....................................................................................................................................,...................................

  591 passing (64ms)
  1 pending
  1 failing

  1) issues
       issue #71
         when comparing different jQuery objects
           should return false:
     AssertionError: [assert.isFalse] Expected true to be false
      at Object.fail (node_modules/@sinonjs/referee/lib/create-fail.js:5)
      at Object.fail (node_modules/@sinonjs/referee/lib/define-assertion/index.js:47)
      at assertion (node_modules/@sinonjs/referee/lib/define-assertion/index.js:65)
      at Function.referee.<computed>.<computed> [as isFalse] (node_modules/@sinonjs/referee/lib/define-assertion/index.js:92)
      at Context.<anonymous> (lib/issues.test.js:27)



Error: Exit 1

The lodash library has a known vulnerability in versions <= 4.17.5 (https://nvd.nist.gov/vuln/detail/CVE-2018-3721) . Currently samsam is using lodash.get v4.4.2, which I don't believe is technically vulnerable, but is out of date. Since individual lodash functions are also no longer being published I think the best course of action is to switch to the full lodash library and update the version. Pull request to follow.

Code

• Configure mocha and referee
• Port tests to mocha
• Use nyc for test coverage
• Add .editorconfig
• ESLint
  • Use eslint-config-sinon
  • Use eslint-plugin-ie11
  • Use eslint-plugin-mocha
  • Use lint-staged and husky for pre-commit hook
• Remove UMD wrapper from source files
• Create UMD wrapped dist version (re-use solution from sinonjs/referee)

Third party services

• Run tests in node LTS versions (4, 6, 8) on Travis
• Push coverage report to coveralls
• Configure bithound.io for repository

Repository

• Port documentation to MkDocs and publish to GitHub Pages
• Add CONTRIBUTING.md
• Add pull request template
• Add new issue template
• Add .github/stale.yml and create pinned and stale labels
• Protect master branch from force pushes, including for administrators

NPM

• Add .npmignore / files section and filter out files that package consumers would not want
• Publish module under @sinonjs scope with a new version
• Deprecate old package on npm (@mroderick can do this)

• library version : 3.0.2
• Example URL :
• Other libraries you are using: None

What did you expect to happen?
Returns true

What actually happens
Returns false

How to reproduce

var samsam = require('@sinonjs/samsam');
samsam.match(
  [[""]], 
  samsam.match.array.deepEquals(
    [[""]]
  )
);

The current version of lodash (4.17.11) that @sinonjs/samsam depends on has a high severity vulnerability. Lodash applied a fix for 4.17.13.

The vunerablity only affects the following lodash functions, merge, mergeWith and defaultsDeep, which aren't actually used in this library. But it would be nice to upgrade it anyway as it would mean that consumers of @sinonjs/samsam can trust the library implicitly. At the moment GitHub alerts users of this vulnerability when installing @sinonjs/samsam and you have to manually check that the library doesn't use the above lodash functions.

• library version : 3.3.2

What did you expect to happen?
Not to receive a high severity vulnerability alert when installing @sinonjs/samsam.

What actually happens
You receive a high severity vulnerability alert when installing @sinonjs/samsam.

How to reproduce

npm i -D sinon

Thanks 😄

https://humanwhocodes.com/snippets/2020/10/create-typescript-declarations-from-javascript-jsdoc/

When using sinon.match with an object literal (for partial matching), samsam enters an infinite loop.

• library version : sinon@latest - 13.0.1
• Environment : node
• Example URL :
• Other libraries you are using:

What did you expect to happen?
Sinon correctly supports circular objects without sinon.match, so I expected this to work. (See workarounds below).

What actually happens
RangeError: Maximum call stack size exceeded

How to reproduce

const sinon = require("sinon");

const circular_obj = { a: null };
circular_obj.a = circular_obj;

const fake = sinon.fake();
fake({ b: circular_obj, c: "c" });

sinon.assert.calledWith(fake, sinon.match({ b: circular_obj }));

Output

/Users/arlanjaska/sandbox/sinon_testing/node_modules/type-detect/type-detect.js:45
function typeDetect(obj) {
                   ^

RangeError: Maximum call stack size exceeded
    at typeDetect (/Users/arlanjaska/sandbox/sinon_testing/node_modules/type-detect/type-detect.js:45:20)
    at typeOf (/Users/arlanjaska/sandbox/sinon_testing/node_modules/@sinonjs/commons/lib/type-of.js:12:12)
    at /Users/arlanjaska/sandbox/sinon_testing/node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js:46:20
    at Array.every (<anonymous>)
    at matchObject (/Users/arlanjaska/sandbox/sinon_testing/node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js:38:12)
    at /Users/arlanjaska/sandbox/sinon_testing/node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js:47:18
    at Array.every (<anonymous>)
    at matchObject (/Users/arlanjaska/sandbox/sinon_testing/node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js:38:12)
    at /Users/arlanjaska/sandbox/sinon_testing/node_modules/@sinonjs/samsam/lib/create-matcher/match-object.js:47:18
    at Array.every (<anonymous>)

Additional context
This could probably be solved for this case by tossing in an identical() check somewhere in here. Not sure how it's handled in general though.

Workarounds

• Use sinon.match.same

sinon.assert.calledWith(fake, sinon.match({ b: sinon.match.same(circular_obj) }));

• If you are okay with checking every property, don't use sinon.match

sinon.assert.calledWith(fake, { b: circular_obj, c: "c" });

• library version : 5.3.1 (current)
• Environment : node 14

What did you expect to happen?

samsam.deepEqual returns false for different promise objects.

What actually happens

samsam.deepEqual returns true for different promise objects.

How to reproduce

const samsam = require('@sinonjs/samsam');

const p1 = Promise.resolve('a');
const p2 = Promise.resolve('b');
console.log(samsam.deepEqual(p1, p2)); // should return false

Reported in Sinon: sinonjs/sinon#2345

As samsam is going to be released with a breaking change, it would be good to tidy up some of the instances where deepEqual can return undefined.

Having taken a look through the code, it seems there is one condition that is not handled correctly, causing it to return undefined, that's here.

For instance, this test will fail:

it("should fail when comparing an object to null", () => {
    var checkDeep = samsam.deepEqual({}, null);
    assert.equals(checkDeep, true);
});

The problem is that identical is set to return undefined. This is the same as isSet but that's handled correctly by explicitly returning false here. We could simply fix the issue by conditionally returning undefined from within deepEqual if we get undefined back from identical, or we could refactor identical to return false. My suggestion would be the latter whilst also fixing isSet.

This would then allow us to use samsam.deepEqual within the sinon project, resolving this issue: sinonjs/sinon#1709

What did you expect to happen?
The error message should be more clear to what the function has actually checked,
function, a boolean or an object is not clear

What actually happens
The error message is

throw new Error(
"Matcher was not a string, a number, a " +
"function, a boolean or an object"
);

But the function also checks for null, dates, classes and more

• library version : 3.3.1
• Environment: Node 10
• Example URL :
• Other libraries you are using: None

What did you expect to happen?
deepEqual to return false.

What actually happens
It returns true.

How to reproduce

const samsam = require('@sinonjs/samsam');

const a = new Map([[1,'a'], [2, 'b']]);
const b = new Map([[3,'c'], [4, 'd']]);

const a1 = new Map([[1,'a'], [2, 'b']]);

console.log(samsam.deepEqual(a, b)); // logs true
console.log(samsam.deepEqual(a, a1)); // logs true