Simplify implementation

* Combine values without overwriting duplicates
* Use Node.js to parse the argv string

Also add a bit more context in the documentation.

Author: novemberborn

docs/05-command-line.md

@@ -29,9 +29,9 @@ Options:
   --fail-fast             Stop after first test failure                [boolean]
   --match, -m             Only run tests with matching title (Can be repeated)
                                                                         [string]
-  --node-arguments        Configure Node.js arguments used to launch worker
-                          processes (be sure to surround the value by double
-                          quotes)                                       [string]
+  --node-arguments        Additional Node.js arguments for launching worker
+                          processes (specify as a single string; only use
+                          trusted values)                               [string]
   --serial, -s            Run tests serially                           [boolean]
   --tap, -t               Generate TAP output                          [boolean]
   --timeout, -T           Set global timeout (milliseconds or human-readable,
@@ -181,3 +181,17 @@ $ npx ava --tap | npx tap-nyan
 <img src="../media/tap-reporter.png" width="420">
 
 Please note that the TAP reporter is unavailable when using [watch mode](./recipes/watch-mode.md).
+
+## Node arguments
+
+The `--node-arguments` argument may be used to specify additional arguments for launching worker processes. These are combined with the `nodeArguments` configuration and any arguments passed to the `node` binary when starting AVA.
+
+**Only pass trusted values.**
+
+Specify the arguments as a single string:
+
+```console
+npx ava --node-arguments="--throw-deprecation --zero-fill-buffers"
+```
+
+**Only pass trusted values.**

docs/06-configuration.md

@@ -224,4 +224,8 @@ export default {
 };
 ```
 
+## Node arguments
+
+The `nodeArguments` configuration may be used to specify additional arguments for launching worker processes. These are combined with `--node-arguments` passed on the CLI and any arguments passed to the `node` binary when starting AVA.
+
 [CLI]: ./05-command-line.md

lib/api.js

@@ -10,9 +10,6 @@ const arrify = require('arrify');
 const ms = require('ms');
 const chunkd = require('chunkd');
 const Emittery = require('emittery');
-const yargs = require('yargs-parser');
-const dargs = require('dargs');
-const memoize = require('lodash/memoize');
 const pMap = require('p-map');
 const tempDir = require('temp-dir');
 const globs = require('./globs');
@@ -41,16 +38,6 @@ function getFilePathPrefix(files) {
 	return commonPathPrefix(files);
 }
 
-const _parseProcessArgs = memoize(() => {
-	// Do not reference this, function is called as static
-	return yargs(process.execArgv, {
-		configuration: {
-			'camel-case-expansion': false,
-			'dot-notation': false
-		}
-	});
-});
-
 class Api extends Emittery {
 	constructor(options) {
 		super();
@@ -232,7 +219,7 @@ class Api extends Emittery {
 					options.updateSnapshots = true;
 				}
 
-				const worker = fork(file, options, dargs({..._parseProcessArgs(), ...apiOptions.nodeArguments}));
+				const worker = fork(file, options, apiOptions.nodeArguments);
 				runStatus.observeWorker(worker, file);
 
 				pendingWorkers.add(worker);

lib/cli.js

@@ -37,7 +37,7 @@ const FLAGS = {
 	},
 	'node-arguments': {
 		coerce: coerceLastValue,
-		description: 'Configure Node.js arguments used to launch worker processes (be sure to surround the value by double quotes)',
+		description: 'Additional Node.js arguments for launching worker processes (specify as a single string; only use trusted values)',
 		type: 'string'
 	},
 	serial: {
@@ -311,7 +311,7 @@ exports.run = async () => { // eslint-disable-line complexity
 
 	let nodeArguments;
 	try {
-		nodeArguments = normalizeNodeArguments(conf.nodeArguments, argv['node-arguments']);
+		nodeArguments = await normalizeNodeArguments(conf.nodeArguments, argv['node-arguments']);
 	} catch (error) {
 		exit(error.message);
 	}

lib/fork.js

@@ -14,7 +14,7 @@ const AVA_PATH = path.resolve(__dirname, '..');
 
 const workerPath = require.resolve('./worker/subprocess');
 
-module.exports = (file, opts, execArgv) => {
+module.exports = (file, opts, execArgv = process.execArgv) => {
 	let finished = false;
 
 	const emitter = new Emittery();
@@ -34,7 +34,7 @@ module.exports = (file, opts, execArgv) => {
 		cwd: opts.projectDir,
 		silent: true,
 		env: {NODE_ENV: 'test', ...process.env, ...opts.environmentVariables, AVA_PATH},
-		execArgv: execArgv || process.execArgv
+		execArgv
 	});
 
 	subprocess.stdout.on('data', chunk => {

lib/node-arguments.js

@@ -1,29 +1,16 @@
 'use strict';
+const execa = require('execa');
 
-const yargs = require('yargs-parser');
-
-const configuration = {
-	'camel-case-expansion': false,
-	'dot-notation': false
-};
-
-// See https://github.com/sindresorhus/meow/issues/128
-function fixCliParams(cliStr) {
-	// Slice surrounding ' and "
-	if (cliStr[0] === cliStr[cliStr.length - 1] && '"\''.includes(cliStr[0])) {
-		return cliStr.slice(1, -1);
+async function normalizeNodeArguments(fromConf = [], fromArgv = '') {
+	let parsedArgv = [];
+	if (fromArgv !== '') {
+		// Use Node.js itself to parse the arguments. This may lead to arbitrary code execution, but since this is only
+		// applied to arguments passed when invoking AVA on the command line this is not considered a vulnerability.
+		const {stdout} = await execa.command(`${process.execPath} -pe\\ 'JSON.stringify(process.execArgv)'\\ ${fromArgv.replace(/ /g, '\\ ')}`, {shell: true});
+		parsedArgv = JSON.parse(stdout).slice(2);
 	}
 
-	return cliStr;
-}
-
-function normalizeNodeArguments(confParams = [], cliParams = '') {
-	const {_, '--': __, ...params} = {
-		...yargs(confParams, {configuration}),
-		...yargs(fixCliParams(cliParams), {configuration})
-	};
-
-	return params;
+	return [...process.execArgv, ...fromConf, ...parsedArgv];
 }
 
 module.exports = normalizeNodeArguments;

package-lock.json

@@ -73,7 +73,6 @@
 		"concordance": "^4.0.0",
 		"convert-source-map": "^1.7.0",
 		"currently-unhandled": "^0.4.1",
-		"dargs": "^7.0.0",
 		"debug": "^4.1.1",
 		"del": "^5.1.0",
 		"emittery": "^0.5.1",
@@ -108,8 +107,7 @@
 		"trim-off-newlines": "^1.0.1",
 		"update-notifier": "^4.0.0",
 		"write-file-atomic": "^3.0.1",
-		"yargs": "^15.1.0",
-		"yargs-parser": "^16.1.0"
+		"yargs": "^15.1.0"
 	},
 	"devDependencies": {
 		"@ava/babel": "^0.7.0",

package.json

@@ -8,7 +8,6 @@ const {test} = require('tap');
 const Api = require('../lib/api');
 const babelManager = require('../lib/babel-manager');
 const {normalizeGlobs} = require('../lib/globs');
-const nodeArguments = require('../lib/node-arguments');
 
 const ROOT_DIR = path.join(__dirname, '..');
 
@@ -23,7 +22,6 @@ function apiCreator(options = {}) {
 	options.extensions = options.extensions || ['js'];
 	options.experiments = {};
 	options.globs = normalizeGlobs({files: options.files, ignoredByWatcher: options.ignoredByWatcher, extensions: options.extensions});
-	options.nodeArguments = options.nodeArguments || {};
 	const instance = new Api(options);
 
 	return instance;

test/api.js

@@ -89,8 +89,7 @@ const run = (type, reporter, match = []) => {
 		concurrency: 1,
 		updateSnapshots: false,
 		snapshotDir: false,
-		chalkOptions: {level: 1},
-		nodeArguments: {}
+		chalkOptions: {level: 1}
 	};
 	let pattern = '*.js';
 

test/helper/report.js

@@ -3,26 +3,10 @@
 const {test} = require('tap');
 const normalizeNodeArguments = require('../lib/node-arguments');
 
-test('normalizes multiple node arguments from cli', t => {
-	t.deepEqual(normalizeNodeArguments([], '--a --b --c'), {a: true, b: true, c: true});
-	t.end();
-});
-
-test('normalizes multiple node arguments from config', t => {
-	t.deepEqual(normalizeNodeArguments(['--arg1', '--b'], ''), {arg1: true, b: true});
-	t.end();
-});
-
-test('normalizes node arguments from config and cli', t => {
+test('combines arguments', async t => {
 	t.deepEqual(
-		normalizeNodeArguments(['--arg1', '--b=2'], '--arg2 --b=12'),
-		{arg1: true, arg2: true, b: 12}
+		await normalizeNodeArguments(['--require setup.js'], '--throw-deprecation --zero-fill-buffers'),
+		[...process.execArgv, '--require setup.js', '--throw-deprecation', '--zero-fill-buffers']
 	);
 	t.end();
 });
-
-test('normalizes single node arguments from cli', t => {
-	t.deepEqual(normalizeNodeArguments([], '--test-flag'), {'test-flag': true});
-	t.deepEqual(normalizeNodeArguments([], '--test-flag="a & b"'), {'test-flag': 'a & b'});
-	t.end();
-});