-
-
Notifications
You must be signed in to change notification settings - Fork 853
Add @trigger.dev/test package #2072
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Co-Authored-By: Eric Allam <[email protected]>
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Join our Discord community for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
||
const hookCallInfo = this.hookCalls[taskId]; | ||
|
||
hookCallInfo[hookType] = true; |
Check warning
Code scanning / CodeQL
Prototype-polluting assignment Medium test
library input
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
To fix the issue, we need to ensure that taskId
cannot be a value like __proto__
, constructor
, or prototype
that could lead to prototype pollution. This can be achieved by validating taskId
before using it as a key in the hookCalls
object. If taskId
contains any of these reserved values, the method should throw an error or handle the case appropriately.
The best approach is to add a validation step at the beginning of the recordHookCall
method to check if taskId
is one of the reserved keys. If it is, the method should throw an error or return early without making any changes.
-
Copy modified lines R20-R24
@@ -19,2 +19,7 @@ | ||
) { | ||
// Validate taskId to prevent prototype pollution | ||
if (["__proto__", "constructor", "prototype"].includes(taskId)) { | ||
throw new Error(`Invalid taskId: "${taskId}" is a reserved key.`); | ||
} | ||
|
||
if (!this.hookCalls[taskId]) { |
Co-Authored-By: Eric Allam <[email protected]>
|
Add @trigger.dev/test package
This PR adds a new public package called
@trigger.dev/test
that allows users to easily test their trigger.dev tasks and works well with testing frameworks.Features
Implementation
The package provides utilities for:
Build Notes
There are some build issues related to missing dependencies in the core package (
@trigger.dev/database
). These issues are not directly related to the test package implementation but affect the build process. The package structure and implementation are complete and follow the patterns of other trigger.dev packages.Link to Devin run: https://app.devin.ai/sessions/858a1bf6d356405c995149189721f73b
Requested by: Eric Allam ([email protected])