Gathering detailed insights and metrics for callguard
Gathering detailed insights and metrics for callguard
Gathering detailed insights and metrics for callguard
Gathering detailed insights and metrics for callguard
npm install callguard
Module System
Min. Node Version
Typescript Support
Node Version
NPM Version
20 Commits
2 Watching
1 Branches
1 Contributors
Updated on 04 Sept 2020
TypeScript (98.78%)
JavaScript (1.22%)
Cumulative downloads
Total Downloads
Last day
34.5%
23,886
Compared to previous day
Last week
18%
107,457
Compared to previous week
Last month
-5.3%
391,547
Compared to previous month
Last year
190.8%
3,201,588
Compared to previous year
When using API's with callback support, the 3rd party module will call your function. Most of Node.js' asynchronous functions work like this. If you unintentionally throw an exception there, you won't know what happens - what is that module supposed to do?
Promises are a solution to this, as they propagate the error back to you transparently through the promise chain, but arbitrary callbacks lack this defined flow.
There are other situations where callbacks are used, and where promises won't automatically solve the handling of exceptions.
To ensure you don't throw back in a callback, guard your callback function with either syncGuard
or asyncGuard
.
1import { syncGuard, asyncGuard } from 'callguard' 2// or 3const { syncGuard, asyncGuard } = require( 'callguard' );
callguard
exports two functions, syncGuard
and asyncGuard
. The former guards against synchronous exceptions (but can catch asynchronous too), while the latter guard against both.
For callbacks that either expect no particular return value, or a synchronous value, use syncGuard
(optionally enable catchAsync
), and for callbacks that are allowed (and expected) to returned synchronously or asynchronously (through promises), use asyncGuard
.
Create the guards using these functions and provide an error handler (and optionally options).
1const sGuard = syncGuard( errorHandler[, options ] ); // synchronous guard 2const aGuard = asyncGuard( errorHandler[, options ] ); // asynchronous guard
The returned values are function wrappers that takes a function as input, and returns a new one as output. The returned functions are safe in that they will not throw. Asynchronously guarded functions will not returned rejected promises either. The guards can be re-used as many times as necessary, both the wrapped functions, as well as the wrapper generators (sGuard
and aGuard
in this example). They are all stateless.
1fs.open( 'file', 'r', sGuard( myCallback ) );
2// and for asynchronous calls:
3translateThing( thing, aGuard( myAsyncTranslator ) );
By default, the value returned from guarded functions when an error was detected, is null
. This can be altered using the defaultReturn
option.
When debugging an unwanted exception (caught by these guards), it may be hard to know where it came from. To get longer stack traces from the guards construction, usage and call, enable longStackTraces
. This has a severe performance impact (even in success-flow where no exceptions are thrown!), so you probably only want this when debugging.
These are the function signatures and the default options:
1syncGuard(
2 errorHandler,
3 {
4 defaultReturn: null,
5 longStackTraces: false,
6 catchAsync: false,
7 }
8);
9
10asyncGuard(
11 errorHandler,
12 {
13 defaultReturn: null,
14 longStackTraces: false,
15 }
16);
Consider the following unsafe code. What if doSomethingWithFd
throws? Maybe this logic is within another module we don't have control over...
1fs.open( 'my-file', 'r', ( err, fd ) =>
2{
3 // We REALLY don't want to throw here
4 doSomethingWithFd( fd ); // Please don't throw!
5});
Turn it into:
1// Create a synchronous guard, forward exceptions to console.error.
2// This is just an example, you might want other logic.
3const guard = syncGuard( console.error.bind( console ) );
4
5fs.open( 'my-file', 'r', guard( ( err, fd ) =>
6{
7 // We really shouldn't throw here, it is not logically sound
8 doSomethingWithFd( fd ); // But it's guarded anyway, so we're safe
9} ) );
Now, if doSomethingWithFd
would throw, this wouldn't propagate to the fs.open
function, but instead be printed to the console.
One typical example is when using promises in a codebase, but needing to react to callbacks. In this case, it would often be a bug to throw in the callback, and if this is wrapped in a new Promise( )
function body, the promise can easily be canceled while the callback remains exception safe.
NOTE; It will probably be expected that the promise can be rejected, but only because otherLib
fails/throws, not that the logic here throws (that's a handling error). callguard
will not fix such bugs in your code, but it will ensure you can safely handle it in the promise chain.
1const p = new Promise( ( resolve, reject ) =>
2{
3 // Map mistakes in throwing back at <otherLib> to this promise rejection
4 const guard = syncGuard( reject );
5
6 otherLib.on( 'data', guard( data =>
7 {
8 // We can handle data here, and if we throw, it will reject <p>
9 doStuffWithData( data ); // This is safe
10 } ) );
11
12 otherLib.on( 'end', guard( ( ) =>
13 {
14 // Also safe callback, also guarded.
15 // If assembleData throws, the promise will be rejected.
16 resolve( assembleData( ) ); // This is safe
17 } ) );
18
19 otherLib.on( 'error', reject ); // Not everything must be guarded
20} );
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
0 existing vulnerabilities detected
Reason
license file detected
Details
Reason
Found 0/20 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
Reason
no SAST tool detected
Details
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
Reason
project is not fuzzed
Details
Reason
branch protection not enabled on development/release branches
Details
Score
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More