fix: do not clone stdout/stderr passed to pugins

Closes #882

index.js

@@ -1,4 +1,3 @@
-const process = require('process');
 const {template, pick} = require('lodash');
 const marked = require('marked');
 const TerminalRenderer = require('marked-terminal');

lib/definitions/constants.js

@@ -10,4 +10,14 @@ const RELEASE_NOTES_SEPARATOR = '\n\n';
 
 const SECRET_REPLACEMENT = '[secure]';
 
-module.exports = {RELEASE_TYPE, FIRST_RELEASE, COMMIT_NAME, COMMIT_EMAIL, RELEASE_NOTES_SEPARATOR, SECRET_REPLACEMENT};
+const SECRET_MIN_SIZE = 5;
+
+module.exports = {
+  RELEASE_TYPE,
+  FIRST_RELEASE,
+  COMMIT_NAME,
+  COMMIT_EMAIL,
+  RELEASE_NOTES_SEPARATOR,
+  SECRET_REPLACEMENT,
+  SECRET_MIN_SIZE,
+};

lib/hide-sensitive.js

@@ -1,9 +1,9 @@
-const {escapeRegExp} = require('lodash');
-const {SECRET_REPLACEMENT} = require('./definitions/constants');
+const {escapeRegExp, size} = require('lodash');
+const {SECRET_REPLACEMENT, SECRET_MIN_SIZE} = require('./definitions/constants');
 
 module.exports = env => {
   const toReplace = Object.keys(env).filter(
-    envVar => /token|password|credential|secret|private/i.test(envVar) && env[envVar].trim()
+    envVar => /token|password|credential|secret|private/i.test(envVar) && size(env[envVar].trim()) >= SECRET_MIN_SIZE
   );
 
   const regexp = new RegExp(toReplace.map(envVar => escapeRegExp(env[envVar])).join('|'), 'g');

lib/plugins/normalize.js

@@ -1,11 +1,11 @@
 const {dirname} = require('path');
-const {isString, isPlainObject, isFunction, noop, cloneDeep} = require('lodash');
+const {isString, isPlainObject, isFunction, noop, cloneDeep, omit} = require('lodash');
 const resolveFrom = require('resolve-from');
 const getError = require('../get-error');
 const {extractErrors} = require('../utils');
 const PLUGINS_DEFINITIONS = require('../definitions/plugins');
 
-module.exports = ({cwd, options, logger}, type, pluginOpt, pluginsPath) => {
+module.exports = ({cwd, stdout, stderr, options, logger}, type, pluginOpt, pluginsPath) => {
   if (!pluginOpt) {
     return noop;
   }
@@ -31,7 +31,12 @@ module.exports = ({cwd, options, logger}, type, pluginOpt, pluginsPath) => {
     const {outputValidator} = PLUGINS_DEFINITIONS[type] || {};
     try {
       logger.log(`Start step "${type}" of plugin "${pluginName}"`);
-      const result = await func({...cloneDeep(input), logger: logger.scope(logger.scopeName, pluginName)});
+      const result = await func({
+        ...cloneDeep(omit(input, ['stdout', 'stderr', 'logger'])),
+        stdout,
+        stderr,
+        logger: logger.scope(logger.scopeName, pluginName),
+      });
       if (outputValidator && !outputValidator(result)) {
         throw getError(`E${type.toUpperCase()}OUTPUT`, {result, pluginName});
       }

package.json

@@ -22,7 +22,7 @@
     "@semantic-release/commit-analyzer": "^6.0.0",
     "@semantic-release/error": "^2.2.0",
     "@semantic-release/github": "^5.0.0",
-    "@semantic-release/npm": "^4.0.1",
+    "@semantic-release/npm": "^5.0.1",
     "@semantic-release/release-notes-generator": "^7.0.0",
     "aggregate-error": "^1.0.0",
     "cosmiconfig": "^5.0.1",
@@ -57,7 +57,7 @@
     "dockerode": "^2.5.2",
     "file-url": "^2.0.2",
     "fs-extra": "^7.0.0",
-    "got": "^8.0.0",
+    "got": "^9.0.0",
     "js-yaml": "^3.10.0",
     "mockserver-client": "^5.1.1",
     "nock": "^9.0.2",

test/hide-sensitive.test.js

@@ -1,11 +1,13 @@
 import test from 'ava';
+import {repeat} from 'lodash';
 import hideSensitive from '../lib/hide-sensitive';
+import {SECRET_REPLACEMENT, SECRET_MIN_SIZE} from '../lib/definitions/constants';
 
 test('Replace multiple sensitive environment variable values', t => {
   const env = {SOME_PASSWORD: 'password', SOME_TOKEN: 'secret'};
   t.is(
     hideSensitive(env)(`https://user:${env.SOME_PASSWORD}@host.com?token=${env.SOME_TOKEN}`),
-    'https://user:[secure]@host.com?token=[secure]'
+    `https://user:${SECRET_REPLACEMENT}@host.com?token=${SECRET_REPLACEMENT}`
   );
 });
 
@@ -13,13 +15,16 @@ test('Replace multiple occurences of sensitive environment variable values', t =
   const env = {secretKey: 'secret'};
   t.is(
     hideSensitive(env)(`https://user:${env.secretKey}@host.com?token=${env.secretKey}`),
-    'https://user:[secure]@host.com?token=[secure]'
+    `https://user:${SECRET_REPLACEMENT}@host.com?token=${SECRET_REPLACEMENT}`
   );
 });
 
 test('Escape regexp special characters', t => {
   const env = {SOME_CREDENTIALS: 'p$^{.+}\\w[a-z]o.*rd'};
-  t.is(hideSensitive(env)(`https://user:${env.SOME_CREDENTIALS}@host.com`), 'https://user:[secure]@host.com');
+  t.is(
+    hideSensitive(env)(`https://user:${env.SOME_CREDENTIALS}@host.com`),
+    `https://user:${SECRET_REPLACEMENT}@host.com`
+  );
 });
 
 test('Accept "undefined" input', t => {
@@ -34,10 +39,20 @@ test('Exclude empty environment variables from the regexp', t => {
   const env = {SOME_PASSWORD: 'password', SOME_TOKEN: ''};
   t.is(
     hideSensitive(env)(`https://user:${env.SOME_PASSWORD}@host.com?token=`),
-    'https://user:[secure]@host.com?token='
+    `https://user:${SECRET_REPLACEMENT}@host.com?token=`
   );
 });
 
 test('Exclude empty environment variables from the regexp if there is only empty ones', t => {
   t.is(hideSensitive({SOME_PASSWORD: '', SOME_TOKEN: ' \n '})(`https://host.com?token=`), 'https://host.com?token=');
 });
+
+test('Exclude environment variables with value shorter than SECRET_MIN_SIZE from the regexp', t => {
+  const SHORT_TOKEN = repeat('a', SECRET_MIN_SIZE - 1);
+  const LONG_TOKEN = repeat('b', SECRET_MIN_SIZE);
+  const env = {SHORT_TOKEN, LONG_TOKEN};
+  t.is(
+    hideSensitive(env)(`https://user:${SHORT_TOKEN}@host.com?token=${LONG_TOKEN}`),
+    `https://user:${SHORT_TOKEN}@host.com?token=${SECRET_REPLACEMENT}`
+  );
+});

test/plugins/normalize.test.js

@@ -160,7 +160,10 @@ test('Plugin is called with "pluginConfig" (omitting "path", adding global confi
   await plugin({param: 'param'});
 
   t.true(
-    pluginFunction.calledWith({conf: 'confValue', global: 'globalValue'}, {param: 'param', logger: t.context.logger})
+    pluginFunction.calledWithMatch(
+      {conf: 'confValue', global: 'globalValue'},
+      {param: 'param', logger: t.context.logger}
+    )
   );
 });