Bug 42772: Cypress.env => cy.env

Warning: The allowCypressEnv configuration option is enabled. This allows any browser code to read values from Cypress.env(). This is insecure and will be removed in a future major version.

1. Replace Cypress.env() calls with cy.env() (for sensitive values) or Cypress.expose() (for public configuration)
2. Set allowCypressEnv: false in your Cypress configuration to disable Cypress.env()

Learn more: https://on.cypress.io/cypress-env-migration

Signed-off-by: Paul Derscheid <paul.derscheid@lmscloud.de>
Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Martin Renvoize <martin.renvoize@openfifth.co.uk>
Signed-off-by: Pedro Amorim <pedro.amorim@openfifth.co.uk>

cypress.config.ts

@@ -12,11 +12,14 @@ export default defineConfig({
         setupNodeEvents(on, config) {
             return require("./t/cypress/plugins/index.js")(on, config);
         },
+        allowCypressEnv: false,
         baseUrl: process.env.KOHA_INTRANET_URL || "http://localhost:8081",
         specPattern: "t/cypress/integration/**/*.*",
         supportFile: "t/cypress/support/e2e.js",
         env: {
             opacBaseUrl: process.env.KOHA_OPAC_URL || "http://localhost:8080",
+            kohaUsername: process.env.KOHA_USER || "koha",
+            kohaPassword: process.env.KOHA_PASS || "koha",
             apiUsername: process.env.KOHA_USER || "koha",
             apiPassword: process.env.KOHA_PASS || "koha",
         },

t/cypress/integration/Islands/SelfRenewal.ts

@@ -55,9 +55,10 @@ describe("Patron self-renewal", () => {
     });
     it("should verify that the patron wants to renew their account", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "GET",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl +
                     "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
                 {
                     self_renewal_settings: {
@@ -67,6 +68,7 @@ describe("Patron self-renewal", () => {
                     },
                 }
             ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
@@ -76,9 +78,10 @@ describe("Patron self-renewal", () => {
     });
     it("should renew a patron's account", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "GET",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl +
                     "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
                 {
                     self_renewal_settings: {
@@ -88,13 +91,14 @@ describe("Patron self-renewal", () => {
                     },
                 }
             ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "POST",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl + "/api/v1/public/patrons/*/self_renewal",
-                "/api/v1/public/patrons/*/self_renewal",
                 {
                     statusCode: 201,
                     body: {
@@ -103,6 +107,7 @@ describe("Patron self-renewal", () => {
                     },
                 }
             ).as("submitRenewal");
+        });
         cy.get("#patronSelfRenewal .verification_actions")
             .contains("Yes")
             .click();
@@ -113,26 +118,30 @@ describe("Patron self-renewal", () => {
     });
     it("should display an information message step", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "GET",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl +
                     "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
                 {
                     self_renewal_settings: {
                         opac_patron_details: "0",
                         self_renewal_failure_message:
                             "Your self-renewal can't be processed at this time. Please visit your local branch to complete your renewal.",
-                    self_renewal_information_messages: ["This should be shown"],
+                        self_renewal_information_messages: [
+                            "This should be shown",
+                        ],
                     },
                 }
             ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "POST",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl + "/api/v1/public/patrons/*/self_renewal",
-                "/api/v1/public/patrons/*/self_renewal",
                 {
                     statusCode: 201,
                     body: {
@@ -141,6 +150,7 @@ describe("Patron self-renewal", () => {
                     },
                 }
             ).as("submitRenewal");
+        });
         cy.get("#patronSelfRenewal .verification_question").contains(
             "This should be shown"
         );
@@ -158,9 +168,10 @@ describe("Patron self-renewal", () => {
     });
     it("should confirm patron details if required", function () {
         cy.visitOpac("/cgi-bin/koha/opac-user.pl");
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "GET",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl +
                     "/api/v1/public/patrons/*/self_renewal?_per_page=-1",
                 {
                     self_renewal_settings: {
@@ -170,6 +181,7 @@ describe("Patron self-renewal", () => {
                     },
                 }
             ).as("renewalConfig");
+        });
         cy.get("#patronSelfRenewal", { timeout: 10000 });
         cy.get("#self_renewal_available a").click();
         cy.wait("@renewalConfig");
@@ -183,10 +195,10 @@ describe("Patron self-renewal", () => {
         cy.get("#update-account div.alert.alert-info").contains(
             "Please verify your details to proceed with your self-renewal"
         );
+        cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) => {
             cy.intercept(
                 "POST",
-            Cypress.env("opacBaseUrl") +
+                opacBaseUrl + "/api/v1/public/patrons/*/self_renewal",
-                "/api/v1/public/patrons/*/self_renewal",
                 {
                     statusCode: 201,
                     body: {
@@ -195,6 +207,7 @@ describe("Patron self-renewal", () => {
                     },
                 }
             ).as("submitRenewal");
+        });
         cy.get("#update-account fieldset.action input[type='submit']")
             .contains("Submit renewal request")
             .click();

t/cypress/integration/OPAC/SCO_spec.ts

@@ -3,12 +3,17 @@ describe("SCO", () => {
     // cy.request() — no browser navigation, so no cross-origin issues.
     function setSyspref(variable: string, value: string) {
         // Step 1: GET the login page to get an anonymous session + its CSRF token
-        cy.request("/cgi-bin/koha/mainpage.pl?logout.x=1").then(loginPage => {
+        cy.env(["apiUsername", "apiPassword"]).then(
+            ({ apiUsername, apiPassword }) => {
+                cy.request("/cgi-bin/koha/mainpage.pl?logout.x=1").then(
+                    loginPage => {
                         const csrfForLogin = (loginPage.body as string).match(
                             /<meta name="csrf-token" content="([^"]+)"/
                         )?.[1];
                         if (!csrfForLogin)
-                throw new Error("CSRF token not found on login page");
+                            throw new Error(
+                                "CSRF token not found on login page"
+                            );
 
                         // Step 2: POST credentials — Koha authenticates and redirects to the
                         // logged-in mainpage whose body contains the new session's CSRF token
@@ -16,11 +21,12 @@ describe("SCO", () => {
                             method: "POST",
                             url: "/cgi-bin/koha/mainpage.pl",
                             headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
+                                "Content-Type":
+                                    "application/x-www-form-urlencoded",
                             },
                             body: [
-                    `login_userid=${encodeURIComponent(Cypress.env("apiUsername"))}`,
+                                `login_userid=${encodeURIComponent(apiUsername)}`,
-                    `login_password=${encodeURIComponent(Cypress.env("apiPassword"))}`,
+                                `login_password=${encodeURIComponent(apiPassword)}`,
                                 `csrf_token=${encodeURIComponent(csrfForLogin)}`,
                                 `login_op=cud-login`,
                             ].join("&"),
@@ -29,20 +35,26 @@ describe("SCO", () => {
                                 /<meta name="csrf-token" content="([^"]+)"/
                             )?.[1];
                             if (!csrfForSvc)
-                    throw new Error("CSRF token not found on main page");
+                                throw new Error(
+                                    "CSRF token not found on main page"
+                                );
 
                             // Step 3: POST to svc endpoint — session cookie sent automatically
                             cy.request({
                                 method: "POST",
                                 url: "/cgi-bin/koha/svc/config/systempreferences",
                                 headers: {
-                        "Content-Type": "application/x-www-form-urlencoded",
+                                    "Content-Type":
+                                        "application/x-www-form-urlencoded",
                                     "CSRF-TOKEN": csrfForSvc,
                                 },
                                 body: `pref_${encodeURIComponent(variable)}=${encodeURIComponent(value)}`,
                             });
                         });
-        });
+                    }
+                );
+            }
+        );
     }
 
     beforeEach(() => {

t/cypress/support/e2e.js

@@ -75,46 +75,40 @@ Cypress.on("uncaught:exception", err => {
     }
 });
 
-function get_fallback_login_value(param) {
-    var env_var = param == "username" ? "KOHA_USER" : "KOHA_PASS";
-
-    return typeof Cypress.env(env_var) === "undefined"
-        ? "koha"
-        : Cypress.env(env_var);
-}
-
 Cypress.Commands.add("visitOpac", path => {
-    cy.visit(Cypress.env("opacBaseUrl") + path);
+    cy.env(["opacBaseUrl"]).then(({ opacBaseUrl }) =>
+        cy.visit(opacBaseUrl + path)
+    );
 });
 
 Cypress.Commands.add("login", (username, password) => {
+    cy.env(["kohaUsername", "kohaPassword"]).then(
+        ({ kohaUsername, kohaPassword }) => {
             var user =
-        typeof username === "undefined"
+                typeof username === "undefined" ? kohaUsername : username;
-            ? get_fallback_login_value("username")
-            : username;
             var pass =
-        typeof password === "undefined"
+                typeof password === "undefined" ? kohaPassword : password;
-            ? get_fallback_login_value("password")
-            : password;
             cy.visit("/cgi-bin/koha/mainpage.pl?logout.x=1");
             cy.get("#userid").type(user);
             cy.get("#password").type(pass);
             cy.get("#submit-button").click();
+        }
+    );
 });
 
 Cypress.Commands.add("loginOpac", (username, password) => {
+    cy.env(["kohaUsername", "kohaPassword"]).then(
+        ({ kohaUsername, kohaPassword }) => {
             var user =
-        typeof username === "undefined"
+                typeof username === "undefined" ? kohaUsername : username;
-            ? get_fallback_login_value("username")
-            : username;
             var pass =
-        typeof password === "undefined"
+                typeof password === "undefined" ? kohaPassword : password;
-            ? get_fallback_login_value("password")
-            : password;
             cy.visitOpac("/cgi-bin/koha/opac-main.pl?logout.x=1");
             cy.get("#userid").type(user);
             cy.get("#password").type(pass);
             cy.get("#auth .action").contains("Log in").click();
+        }
+    );
 });
 
 Cypress.Commands.add("left_menu_active_item_is", label => {