Node.js Developer Interview Questions & Answers

Answer: They are set using the ENV instruction in the Dockerfile or the -e flag with the docker run command.

Answer: Use process.cwd(); its value depends on the directory from which the Node.js process was launched.

Answer: This version is a pre-release and is considered less stable and has lower precedence than 2.3.1.

Answer: Piping through a Transform stream that modifies the Buffer in-place.

Answer: By setting the SameSite=Strict or SameSite=Lax attribute on the cookie containing the JWT.

Answer: The console.log statement in the parent executes before the asynchronous 'message' event from the child is received.

Answer: The code is vulnerable to Command Injection because it directly concatenates an unsanitized environment variable into a shell command string.

Answer: process.exit() forcefully terminates the process, preventing any subsequent code, including inspector.close(), from executing.

Answer: The heavyComputation function is synchronous and will block the event loop, causing the application to become unresponsive.

Answer: The SIGINT handler will never execute because the while(true) loop blocks the event loop.

Answer: The query is vulnerable to SQL Injection because user input is directly concatenated into the query string.

Answer: A scenario where asynchooks could lead to severe performance issues is within a high-throughput logging system. If the hook's callback performs synchronous I/O, such as writing to the console for every async operation, it will block the event loop. Example: javascript const fs = require('fs'); const asynchooks = require('asynchooks'); const hook = asynchooks.createHook({ init(asyncId, type) { // Bug: This blocks the event loop for every single async operation! fs.writeSync(1, INIT: ${type} ${asyncId}\n); } }); hook.enable(); In a server handling thousands of requests per second, this synchronous write operation would be catastrophic for performance, as each request would be delayed by the logging of every internal async operation. Mitigation Strategies: 1. Asynchronous I/O Offloading: Do not perform I/O directly in the hook. Instead, push the log message into an in-memory buffer. Have a separate, single asynchronous worker (e.g., using setInterval) that periodically flushes this buffer to the destination (file, network socket, etc.). 2. Sampling: Do not log every event. For performance monitoring, logging a sample (e.g., 1 in 1000 requests) can provide enough data without a significant performance hit.

Answer: A scenario where asynchooks is highly beneficial is debugging a memory leak caused by un-destroyed asynchronous resources. For example, a custom connection pool that is creating database connections but failing to release them under certain error conditions. Implementation: 1. Create a global Map to track all active async resources. 2. Create an asynchooks instance. 3. In the init(asyncId, type) callback, if the type corresponds to your database connection resource (e.g., 'TCPWRAP'), add the asyncId to your global Map. 4. In the destroy(asyncId) callback, remove the asyncId from the Map. 5. Periodically (e.g., with setInterval or on a signal), you can inspect the size of the Map. If the size grows indefinitely, you have a leak. The contents of the map will show you exactly which resources were created but never destroyed.

Answer: A scenario where asynchooks could create a bottleneck is a high-throughput application that relies heavily on short-lived promises, such as a data streaming service or a real-time analytics pipeline. In such a system, millions of promises might be created and resolved per second. If the init and promiseResolve hooks perform even a small amount of work (like writing to the console or adding to a Map), the cumulative overhead can become massive. This synchronous work in the hooks blocks the event loop, directly adding latency to all operations and reducing the overall throughput of the application. Mitigation Strategies: 1. Buffering and Batching: Instead of logging or processing data on every hook event, push the event data into an in-memory buffer. Use a separate timer (setInterval) to process the buffer in batches. This amortizes the cost of I/O or processing. 2. Sampling: Do not track every operation. Implement a sampling mechanism to only enable tracking for a fraction of operations (e.g., 1 in 1000). This provides a statistical overview of performance without incurring the full overhead. 3. Use AsyncLocalStorage: For context propagation, AsyncLocalStorage is a more performant and purpose-built API than trying to manually stitch contexts together using the raw asynchooks events.

Answer: Beyond basic logging, AsyncLocalStorage is a foundational tool for building sophisticated Application Performance Monitoring (APM) and distributed tracing systems. Application: Distributed Tracing Context Propagation In a microservices architecture, a single user request might travel through multiple services. To trace this request, a unique trace-id must be passed from one service to the next. The challenge is propagating this trace-id through all the asynchronous operations within a single service. This is a perfect use case for AsyncLocalStorage. When a request with a trace-id (e.g., from an HTTP header) arrives: 1. The server creates a new async context using asyncLocalStorage.run(). 2. It stores the trace-id and a newly generated span-id (for the current service's work) in this context. 3. Now, any subsequent async operation (database query, outbound API call) will have access to this context via asyncLocalStorage.getStore(). 4. When making an outbound API call to another service, the application can retrieve the trace-id and current span-id from the store and inject them into the outgoing request's headers. This allows a distributed tracing system (like Jaeger or OpenTelemetry) to reconstruct the entire end-to-end journey of the request across all microservices.

Answer: The likely cause is that the server is buffering the entire file upload into memory before writing it to disk. If a file is larger than the available memory for the Node.js process, the server will crash. The correct approach is to use streams to process the file in chunks. The incoming request is a readable stream, and you can create a writable stream to a file. By 'piping' the request stream directly to the file stream, the data flows from the client to the disk in small chunks without ever being fully stored in memory. Example of incorrect, memory-intensive code: javascript // This will crash with large files req.on('data', chunk = { body += chunk; }); req.on('end', () = { fs.writeFileSync('upload.tmp', body); }); Corrected code using streams: javascript const http = require('http'); const fs = require('fs'); const server = http.createServer((req, res) = { if (req.method === 'POST') { const destination = fs.createWriteStream('./upload.tmp'); req.pipe(destination); destination.on('finish', () = { res.writeHead(200, {'Content-Type': 'text/plain'}); res.end('File uploaded successfully!'); }); req.on('error', err = { console.error('Request stream error:', err); res.writeHead(500, {'Content-Type': 'text/plain'}); res.end('Upload failed.'); }); } else { res.end('Send a POST request to upload a file.'); } }); server.listen(3000);

Answer: A key architectural difference lies in their foundational components and design philosophy. Node.js is architecturally a combination of Google's V8 JavaScript engine and the libuv C++ library, which provides the event loop and asynchronous I/O capabilities. Its core is built in C++. Bun, on the other hand, takes a more vertically integrated approach. While it uses the JavaScriptCore engine, much of its core functionality, including its event loop, I/O handling, and built-in tools (bundler, package manager), are written from scratch in the Zig programming language. This choice allows for fine-grained, low-level control over memory and execution, which is a primary contributor to its speed. This monolithic, Zig-based design contrasts with Node.js's more modular composition of V8 and libuv.

Answer: Mocking external services in E2E tests is counterproductive when the goal is to test the interaction between the application and those external services. If we only mock the external services, the tests don't truly reflect the real-world behavior of the application. For example, mocking a payment gateway to always return a successful response would not reveal potential integration issues with the actual payment gateway. An alternative approach is to use a dedicated testing environment with real (but possibly stubbed) external services. This ensures that the tests are as close to a real-world scenario as possible, allowing for the detection of real integration issues. Using a testing environment with a test database and a non-production version of the external services would be a good approach.

Answer: Yes, an event listener can absolutely be an async function. The EventEmitter will await the promise returned by the listener if it was registered with emitter.on in a special way using an async iterator, but in the common case, it simply invokes the function and does not wait for the promise to resolve. This creates a critical error handling challenge: if the promise returned by the async listener rejects, and there is no .catch() handler attached to it, it will cause an UnhandledPromiseRejectionWarning and may terminate the Node.js process in future versions. Error Handling: Errors must be handled inside the async listener function itself. The best way is with a try...catch block. javascript const EventEmitter = require('events'); const emitter = new EventEmitter(); emitter.on('error', (err) = { console.error('Caught an error centrally:', err.message); }); // CORRECT way to handle errors in an async listener emitter.on('doWork', async (task) = { try { console.log(Starting work on: ${task}); const result = await someAsyncOperationThatMightFail(task); console.log(Finished work with result: ${result}); } catch (err) { // Handle the error, e.g., by emitting a central 'error' event emitter.emit('error', err); } }); async function someAsyncOperationThatMightFail(task) { if (task === 'bad') { throw new Error('This task failed!'); } return 'Success'; } emitter.emit('doWork', 'good'); emitter.emit('doWork', 'bad'); // The error will be caught and handled. Simply letting the async function throw is not enough, as the standard EventEmitter will not catch the promise rejection.

Answer: Both EventEmitter and EventTarget implement the observer pattern, allowing for event-driven programming, but they have key differences tailored to their environments. Similarities: Core Functionality: Both allow you to add listeners for named events (on/addEventListener) and dispatch/emit those events (emit/dispatchEvent). Listener Removal: Both provide a way to remove listeners (off/removeEventListener). Decoupling: Both are used to decouple components of an application. Differences: Method Naming: The method names are different: on, off, emit in Node.js vs. addEventListener, removeEventListener, dispatchEvent in browsers. Event Object: The browser's EventTarget passes a single Event object to the listener, which contains details about the event (like event.target). Node.js's EventEmitter passes the raw arguments from emit() directly to the listener, which can be zero or more arguments. Event Propagation: EventTarget supports a complex event propagation model with capturing and bubbling phases, allowing parent elements in the DOM to intercept events from their children. EventEmitter has no concept of hierarchy or propagation; events are only delivered to listeners on the specific object where emit() was called.

Answer: Both schema stitching and Apollo Federation solve the same problem: creating a unified GraphQL API gateway from multiple underlying GraphQL services. However, they approach it differently. Schema Stitching: This is an imperative approach. You create a separate gateway server that is explicitly aware of the downstream services. The gateway is responsible for fetching the schemas, merging them, and adding explicit 'stitching resolvers' to define relationships between types from different services. The gateway owns the logic for how services connect. Pros: More flexible; you have full control in the gateway to transform and manipulate schemas. Cons: Can become complex and fragile. The gateway becomes a central point of logic that must be updated whenever downstream services change how they relate to each other. Apollo Federation: This is a declarative approach. Each underlying service (called a 'subgraph') annotates its schema with special directives (@key, @extends, etc.) to declare how its types relate to types in other services. A gateway (like the Apollo Router) ingests these schemas and automatically composes the unified graph and a query plan. The services themselves own their relationships. Pros: More scalable and robust. It decentralizes the schema definition, removing the gateway as a logic bottleneck. Better developer experience as teams can define their service's connections independently. Cons: Less flexible than stitching; you are constrained by the federation specification. Requires using Apollo's tooling. Conclusion: For new projects, Apollo Federation is almost always the recommended approach due to its scalability and better separation of concerns.

Answer: Yes, you can create an unencrypted HTTP/2 server using the http2.createServer() method. This creates a server that operates using the h2c protocol. Implementation: javascript const http2 = require('http2'); const server = http2.createServer(); server.on('stream', (stream, headers) = { stream.respond({ ':status': 200 }); stream.end('Hello h2c'); }); server.listen(3000); Practical Limitations: The most significant limitation is lack of browser support. Virtually all modern web browsers (Chrome, Firefox, Safari, Edge) have chosen not to implement h2c. They will only speak HTTP/2 over an encrypted TLS connection (h2). Therefore, an h2c server is not useful for public-facing websites. Its use is primarily limited to controlled environments, such as service-to-service communication within a trusted backend network, where the overhead of TLS might be considered unnecessary.

Answer: Service virtualization is the practice of creating a 'virtual' or simulated test environment that mimics the behavior of a real external dependency, such as a third-party API. Unlike simple library mocks that replace a module within your application's code, a virtualized service is a separate, running server that your application communicates with over the network, just as it would with the real service. How it works: You would use a tool like Mountebank to create a standalone server. In your tests, you configure this server to listen for specific requests (e.g., GET /api/v1/products/123) and respond with predefined data, status codes, and headers. Your Node.js application is then configured (e.g., via an environment variable) to point to the virtual service's URL instead of the real API's URL. Advantages over simple mocking: Higher Fidelity: It tests the entire network stack of your application (HTTP requests, serialization/deserialization, error handling over the network), which simple mocks bypass. Realism: It can simulate real-world conditions that mocks cannot, such as network latency, rate limiting, and specific error codes (like 502 Bad Gateway). Reusability: The virtualized service can be shared by multiple teams and used for different types of testing, not just integration tests.

Answer: require.resolve.paths(request) is a lesser-known but powerful debugging tool that returns an array of the paths that Node.js will search when attempting to resolve the given request string. This differs from require.resolve() which only returns the final resolved path or throws an error. Practical Application for Debugging: In a complex project with a nested directory structure or a monorepo, you might be surprised where Node.js is looking for a module. If a require('my-shared-lib') call is failing, you can add console.log(require.resolve.paths('my-shared-lib')); to your code right before the failing require. This will output an array of all the nodemodules directories Node will check, starting from the current file's directory and moving up to the root. This allows you to see the exact search paths and instantly diagnose why your module isn't being found (e.g., it's not in any of the searched locations, or a typo exists in a directory name).

Answer: Synthetic Monitoring and Real User Monitoring (RUM) are two complementary approaches to monitoring application performance. Synthetic Monitoring involves using scripts to simulate user journeys and test application availability and performance from various geographic locations. It is proactive, running at regular intervals to detect issues before real users are affected. Pros: Catches outages and slowdowns before users do, provides consistent performance baselines, effective for testing critical user flows. Cons: Doesn't capture the full range of real user experiences, devices, or network conditions. Real User Monitoring (RUM) collects performance data directly from the browsers of actual users interacting with the application. It is reactive, providing insights into how the application is performing for real people in real-world scenarios. Pros: Captures the true user experience across diverse browsers, devices, and networks. Helps identify frontend performance issues and JavaScript errors. Cons: Only reports problems after users have already experienced them. Prioritization: Prioritize Synthetic Monitoring for critical business endpoints and user paths (e.g., login, checkout process). This ensures you are the first to know if these core functionalities break or become slow. Prioritize RUM for understanding and optimizing the overall user experience of a content-heavy or interactive single-page application (SPA). It is invaluable for seeing how different user segments are affected by performance and for catching client-side errors.

Answer: CommonJS (CJS) and ES Modules (ESM) handle circular dependencies differently due to their fundamentally different designs. CommonJS Handling: - Mechanism: When a circular dependency is detected (e.g., A requires B, which requires A), CommonJS returns an unfinished copy of the second module's exports object. This object is a snapshot at that point in time. Any properties added to exports later in the original module will not be available. - Result: This often leads to undefined values when properties are accessed, causing runtime errors. The system is based on returning a copy of the exports value. ES Modules Handling: - Mechanism: ESM uses a concept called 'live bindings'. Instead of exporting a copy of a value, ESM exports a binding to the original value in the module's memory. The module's exports are determined during a static parsing phase before any code is executed. - Result: When a circular dependency occurs, ESM can provide access to the bindings of the other module's exports, even before that module's code has executed. If the code then tries to access a value that hasn't been initialized yet, it will get an undefined value. However, if it accesses the value later (e.g., inside a function call after all modules have loaded), it will get the correct, initialized value. This can make some circular dependencies work in ESM that would fail in CJS, but it is still considered a bad practice.

Answer: Scenario: A Node.js application uses a session cookie to store user information. To save space, it serializes a JavaScript object into the cookie. An older, vulnerable library is used for this serialization. An attacker intercepts their own cookie and modifies the serialized string. Vulnerable Payload: The attacker crafts a payload that, when deserialized, creates an Immediately Invoked Function Expression (IIFE). Some older or unsafe deserialization libraries can be tricked into executing functions found within the data. Example malicious serialized string (conceptual): '{"user":"guest","proto":{"isAdmin":true,"exec":"require(\"childprocess\").execSync(\"touch /tmp/pwned\")"}}' When the server deserializes this cookie on the next request, the malicious function is executed, creating a file on the server and demonstrating Remote Code Execution (RCE). Prevention: 1. Never Deserialize Untrusted Data: The most important rule. If you must accept serialized objects from a client, treat the data as tainted and validate it rigorously. 2. Use Safe Serialization Formats: Use simple, data-only formats like JSON (JSON.parse and JSON.stringify) which do not support functions or complex object types that could be abused. 3. Signature Verification: If using cookies for session data, always sign them with a strong secret key (e.g., using cookie-session or express-session). This prevents tampering, as any modification to the cookie will invalidate the signature.

Answer: Yes, most ORMs can interact with database views. From the ORM's perspective, a view can often be treated just like a read-only table. The implementation typically involves defining a model that maps directly to the columns of the view, just as you would for a regular table. Accomplishment: In an ORM like Sequelize or TypeORM, you would create a model/entity definition and specify the view's name as the table name. You would then define the fields on the model to match the columns exposed by the view. javascript // Sequelize example for a 'UserWithPostCount' view const UserWithPostCount = sequelize.define('UserWithPostCount', { id: { type: DataTypes.INTEGER, primaryKey: true }, name: DataTypes.STRING, postCount: DataTypes.INTEGER }, { tableName: 'UserWithPostCountView', timestamps: false }); Limitations: 1. Read-Only: Most views are not updatable, especially if they involve joins, aggregations, or unions. Therefore, the ORM model mapped to a view is typically used only for read (SELECT) operations. create, update, and delete operations will usually fail unless the view is specifically designed to be updatable. 2. Primary Keys: Views may not have a natural primary key, but ORMs often require one to uniquely identify and manage instances. You may need to specify one of the view's unique columns as the primary key in the model definition for the ORM to function correctly.

Answer: Monolithic Architecture: A monolith is a traditional approach where the entire application is built as a single, unified unit. All components (e.g., user authentication, product catalog, payment processing) are tightly coupled and run as a single process. Pros: Simpler to develop, test, and deploy initially. End-to-end testing is more straightforward. No network latency between components. Cons: Becomes complex and hard to maintain as it grows. A bug in one module can bring down the entire application. Scaling requires scaling the entire application, not just the parts under heavy load. Technology stack is locked in. Microservices Architecture: An architectural style that structures an application as a collection of loosely coupled, independently deployable services. Each service is self-contained, runs its own process, and communicates with others over a network (typically via APIs). Pros: Services can be developed, deployed, and scaled independently. Teams can work autonomously. Each service can use the technology stack best suited for its task. Improved fault isolation. Cons: Increased operational complexity (deployment, monitoring). Challenges with data consistency across services. Network latency and reliability become concerns. Requires robust DevOps culture. Implications for REST API Design in Microservices: 1. API Gateway: A single entry point is needed to route client requests to the appropriate downstream microservice. The API Gateway can handle cross-cutting concerns like authentication, rate limiting, and request/response transformation. This simplifies the client's interaction with the system. 2. Service Discovery: Services need a way to find each other on the network. A service discovery mechanism (like Consul or Eureka) is essential for services to communicate via their REST APIs. 3. Data Consistency: Since each service often owns its own database, maintaining consistency across services is a challenge. Patterns like the Saga pattern are used to manage distributed transactions. APIs must be designed to handle eventual consistency. 4. Resiliency: Inter-service communication can fail. API clients (other services) must be designed to be resilient using patterns like retries, timeouts, and circuit breakers to prevent cascading failures.

Answer: While INNER and OUTER joins are most common, CROSS JOIN and SELF JOIN serve specific, important purposes. CROSS JOIN: Produces the Cartesian product of two tables, meaning it pairs every row from the first table with every row from the second table. It's used when you need to generate all possible combinations of records. Use Case: Generating a master list of all possible combinations. For example, if you have a Sizes table (S, M, L) and a Colors table (Red, Green), a CROSS JOIN will produce all 6 possible product variants (S-Red, S-Green, M-Red, M-Green, L-Red, L-Green). sql SELECT s.sizename, c.colorname FROM Sizes s CROSS JOIN Colors c; SELF JOIN: This isn't a special type of join, but rather a regular join where a table is joined with itself. It's used to query hierarchical data or compare rows within the same table. Use Case: Finding employees who report to a specific manager from an Employees table that has employeeid and managerid columns. You join the table to itself, aliasing it to treat it as two separate tables: one for the employee and one for the manager. sql SELECT e.employeename, m.employeename AS managername FROM Employees e INNER JOIN Employees m ON e.managerid = m.employeeid;

Answer: Here are three advanced security measures to harden a session management system: 1. Session Binding to User Agent and IP Address: To make session hijacking more difficult, you can bind a session to certain client characteristics. When a session is created, store the user's IP address and their User-Agent string in the session data. On each subsequent request, verify that the incoming request's IP address and User-Agent match the values stored in the session. If they don't match, it could be a sign of a hijacked session, and you should invalidate it immediately and force the user to re-authenticate. (Note: This can have usability issues with mobile users whose IP addresses can change frequently, so it should be implemented carefully, perhaps with a tolerance for minor changes). 2. Activity-Based Timeout and Re-authentication: For highly sensitive applications, implement stricter session controls based on user activity. While a global inactivity timeout is standard, you can require re-authentication for critical actions (e.g., changing a password, making a payment) regardless of recent activity. This is known as 'privilege escalation confirmation'. For example, even if a user has been active, trying to access an 'admin settings' page could trigger a password confirmation prompt. 3. Logout Everywhere (Session Invalidation): Provide a mechanism for users to see all their active sessions (e.g., 'Logged in on Chrome on Windows', 'Logged in on Safari on iOS') and to remotely invalidate them. When a user changes their password or suspects an account breach, they should have an option to 'log out of all other devices'. This involves iterating through all active sessions associated with their user ID in the session store and destroying them, leaving only the current one active.

Answer: A PassThrough stream is beneficial when you need to inspect, monitor, or tap into a stream without altering the data flow between the original source and destination. Scenario: A common use case is monitoring the progress of a large file upload or download. You can pipe the source stream through a PassThrough stream and attach a 'data' listener to it to count the bytes passing through, all while the data continues to flow unimpeded to its final destination. Code Example: Here, we use a PassThrough stream to report the progress of copying a large file. javascript const { PassThrough, pipeline } = require('stream'); const fs = require('fs'); const progressMonitor = new PassThrough(); let bytesWritten = 0; progressMonitor.on('data', (chunk) = { bytesWritten += chunk.length; console.log(Progress: ${bytesWritten} bytes written...); }); pipeline( fs.createReadStream('largefile.txt'), progressMonitor, // Intercepts data to monitor progress fs.createWriteStream('output.txt'), (err) = { if (err) { console.error('Copy failed:', err); } else { console.log(Copy succeeded! Total bytes: ${bytesWritten}); } } ); In this example, the progressMonitor doesn't change the data. It just observes the chunks as they pass from the read stream to the write stream and updates a counter.

Answer: stream.finished is a utility function that provides a reliable way to get a callback when a stream is no longer readable, writable, or has experienced an error or premature close event. It is important because listening for just the 'end' or 'finish' events is not sufficient to prevent resource leaks. A stream could be destroyed by an error or have its underlying resource close prematurely without ever emitting 'end' or 'finish'. stream.finished correctly handles all these terminal states. Example Use Case: Imagine you have a readable stream and you want to perform a cleanup action once it's completely done, no matter how it finished. javascript const { finished } = require('stream'); const fs = require('fs'); const readStream = fs.createReadStream('some-file.txt'); // ... do something with the stream ... finished(readStream, (err) = { if (err) { console.error('Stream failed!', err); } else { console.log('Stream is done. Performing cleanup.'); } // You can be sure the file descriptor is closed here. }); This prevents resource leaks by ensuring your cleanup code runs regardless of whether the stream completed successfully or failed.

Answer: No, the StringDecoder's internal buffer cannot grow indefinitely and does not cause a memory leak. The buffer's purpose is to store only the trailing bytes from a chunk that form an incomplete character. The size of this buffer is bounded by the maximum number of bytes a single character can occupy in the given encoding, minus one. For example: UTF-8: The longest character is 4 bytes. The internal buffer will never need to hold more than 3 bytes. UTF-16LE: The longest sequence is a 4-byte surrogate pair. The buffer will never need to hold more than 3 bytes (e.g., a high surrogate plus one byte of a low surrogate). When a new chunk is processed by decoder.write(), the old buffer content is used and then replaced by the new trailing incomplete sequence. The buffer size remains very small and does not accumulate over time, thus preventing memory leaks.

Answer: Effectively debugging asynchronous errors in production requires specialized tools beyond simple console.log statements. 1. Application Performance Monitoring (APM) Services: Tools like Datadog, New Relic, or Dynatrace are essential. They automatically instrument your code to trace asynchronous operations (like HTTP requests and database queries), capture unhandled exceptions, and provide rich context, including async stack traces, request parameters, and system metrics. This helps you see the full picture of what led to an error. 2. Error Aggregation and Reporting Services: Services like Sentry or Bugsnag specialize in capturing, aggregating, and alerting on exceptions. They can de-duplicate errors, show their frequency, and provide detailed reports, helping teams prioritize the most impactful bugs. 3. Production Debuggers/Profilers: Tools like ndb (Node Debugger) can be used, but more advanced platforms like Google Cloud Profiler or clinic.js can analyze CPU profiles and event loop delays in production environments without significant overhead. This can help pinpoint performance bottlenecks caused by faulty asynchronous code.

Answer: Comparison: Stubs provide pre-programmed, 'canned' responses to method calls made during a test. They are used when your test needs a dependency to return a specific value to continue. This is often called 'state verification'. You check if the code under test returns the correct result based on the stubbed input. Mocks are objects that have expectations about how they will be used. You program a mock with the calls it expects to receive. Mocks are used to verify that certain methods were called on the dependency. This is often called 'behavior verification'. You check if the code under test performed the correct actions. Scenario for a Stub: Imagine a function getUserGreeting(userId) that fetches a user from a service and returns a greeting. To test this, you don't care how the user service works, you just need it to return a user object. Appropriate Choice: A Stub. You would stub the userService.findById(userId) method to return a specific user object (e.g., { name: 'Alice' }). Your test would then assert that getUserGreeting returns 'Hello, Alice'. Scenario for a Mock: Imagine a function deleteUser(userId) that should call a logging service before deleting a user from a database. Appropriate Choice: A Mock. The return value of the logger doesn't matter, but it's critical that it was called. You would mock the loggingService and set an expectation that its log method is called with a specific message. Your test would then assert that the mock's expectation was met.

Answer: Comparison: Spies wrap a real object, allowing them to record how the object is used (e.g., which methods were called, how many times, with what arguments) while still executing the original implementation. They are used for observation without altering behavior. Fakes are simplified, working implementations of a dependency. They behave like the real thing but are made simpler for testing purposes (e.g., an in-memory database instead of a real one). They don't have the overhead of the real dependency but provide functional behavior. Scenario for a Spy: Imagine you have a cacheService with a getOrSet method that should call a logger.info method only when there is a cache miss. You want to verify this logging behavior without replacing the actual caching logic. Appropriate Choice: A Spy. You would spy on the logger.info method. Your test would then call getOrSet twice—once to populate the cache and a second time to get a cache hit—and assert that the logger.info spy was called only once. Scenario for a Fake: Imagine you have a complex data repository that interacts with a real database like PostgreSQL. For your unit tests of a business logic service that uses this repository, you don't want the overhead or complexity of connecting to a real database. Appropriate Choice: A Fake. You could create an in-memory FakeRepository class that implements the same interface as the real repository but uses a simple JavaScript array or Map to store data. This provides the functional behavior needed for the test (saving and retrieving data) without the external dependency, making tests fast and self-contained.

Answer: By default, code inside a vm sandbox created with vm.runInNewContext() cannot access the filesystem. This is because the sandbox has its own isolated global scope and does not have access to Node.js built-in modules like fs. However, it is a common but very dangerous pattern for developers to explicitly pass the fs module into the sandbox, which would grant full filesystem access to the untrusted code. To safely provide filesystem functionality, you should not pass the entire fs module. Instead, you should create wrapper functions that expose only the specific, limited functionality that is required. These wrappers must perform strict validation on all inputs. Example of providing safe file reading: javascript const vm = require('vm'); const fs = require('fs'); const path = require('path'); const untrustedCode = readFile('userdata.txt').then(logger);; const SANDBOXDIR = '/path/to/safe/user/files'; const sandbox = { Promise, logger: console.log, readFile: (filePath) = { // 1. Sanitize and validate the file path const resolvedPath = path.join(SANDBOXDIR, filePath); // 2. Security Check: Ensure the path is still within the intended directory if (!resolvedPath.startsWith(SANDBOXDIR)) { return Promise.reject(new Error('Access denied.')); } // 3. Perform the controlled action return fs.promises.readFile(resolvedPath, 'utf-8'); } } vm.runInNewContext(untrustedCode, sandbox); This approach ensures the untrusted code can only read files from a specific, safe directory and cannot use path traversal (../) to escape it.

Answer: A valid signature can fail verification if the data being verified does not exactly match the data that was originally signed, byte for byte. This often happens due to subtle differences introduced during transmission or processing. Common Reasons & Mitigations: 1. JSON Canonicalization: A server signs a JSON object. The client re-parses and re-serializes it before verifying. The new serialization might have different key ordering or whitespace, causing the hash to be different and the verification to fail. Mitigation: Always canonicalize JSON before signing and verifying using a library (like canonical-json) that sorts keys and removes insignificant whitespace to produce a consistent string. 2. Character Encoding: The data was signed as UTF-8 but verified using a different encoding. Mitigation: Ensure a single, standard character encoding (UTF-8) is used consistently throughout. 3. Line Endings: Text data may have its line endings changed during transit (e.g., LF to CRLF). Mitigation: Normalize line endings before signing and verifying.

Answer: subtle.encrypt and subtle.wrapKey both perform encryption, but their intended targets are different. subtle.encrypt: This function is for encrypting general-purpose data (plaintext). It takes a key and an ArrayBuffer of data and returns the ciphertext. This is what you would use to encrypt a user's message, a file, or any other application data. subtle.wrapKey: This function is specifically for encrypting another CryptoKey object. It takes a 'wrapping' key and the CryptoKey to be wrapped (encrypted) and returns the encrypted key material. This is used for key management, particularly a pattern called envelope encryption, where you encrypt a high-volume data encryption key (DEK) with a lower-volume key encryption key (KEK). When to choose: Use encrypt for all general data encryption needs. Use wrapKey when you need to securely store or transmit a cryptographic key by encrypting it with another key.

Answer: An innocuous dependency could introduce a vulnerability through a logic bomb that is not detectable by static analysis security scanners. Automated scanners primarily check against databases of known vulnerabilities (CVEs) and look for common anti-patterns. Scenario: Your application uses a popular and trusted testing utility, test-helpers@2.1.0. A malicious actor compromises the package and publishes a new version, test-helpers@2.1.1. The malicious code is heavily obfuscated and designed to be a logic bomb. It checks if the current date is after a certain point in the future and if an environment variable NODEENV is set to production. If both conditions are met, it attempts to access the application's database credentials from environment variables and exfiltrate them to an external server. Why it passes automated scans: Zero-Day: This is a zero-day attack, so it won't be in any known vulnerability database. Obfuscation: The malicious code is obfuscated, making it difficult for static analysis tools to understand its intent and flag it as suspicious. Conditional Logic: The logic bomb is conditional and only activates under specific circumstances (in production, after a certain date), so it would not trigger during normal testing or in a CI environment. Mitigation: Code Review: For critical dependencies, a manual code review of updates (diffs) is the best defense against this type of sophisticated attack, though it is very resource-intensive. Sandboxing: Running application processes with the principle of least privilege (e.g., in a container with no unnecessary network access) can prevent the logic bomb from exfiltrating data even if it triggers. Behavioral Analysis: More advanced security tools can monitor application behavior at runtime and flag suspicious activities, like unexpected outbound network connections.

Answer: Using assert.doesNotThrow is problematic with asynchronous functions that return Promises. The assertion will check the initial synchronous execution of the function, which only returns a promise, and will not wait for the promise to settle. If the promise later rejects, the test has already passed, leading to a false positive. Example: javascript const assert = require('assert'); function asyncFunction() { return new Promise((resolve, reject) = { setTimeout(() = reject(new Error('Async error')), 100); }); } // This test will PASS, even though the function's promise rejects. assert.doesNotThrow(() = asyncFunction(), Error); Mitigation: Do not use assert.doesNotThrow for promise-returning functions. Instead, handle the promise directly. The test should await the function and be wrapped in a try/catch block, or use a testing framework like Jest that has built-in support for testing promises. Mitigation Example (using async/await): javascript const assert = require('assert'); // (assuming asyncFunction from above) async function testAsync() { try { await asyncFunction(); // If we get here, the test should fail because an error was NOT thrown. assert.fail('Expected asyncFunction to throw an error, but it did not.'); } catch (error) { // The promise rejected as expected, so the test can pass. assert.strictEqual(error.message, 'Async error'); console.log('Test passed: Caught expected async error.'); } } testAsync();

Answer: The primary issue is using assert for runtime input validation. Assertions are designed to catch programmer errors or violations of internal invariants, not expected runtime errors like invalid user input. When calculateArea(-5, 10) is called, the assertion fails and throws an AssertionError, which crashes the Node.js application if uncaught. This is unacceptable for a production service. A better approach is to treat invalid input as a predictable runtime error and handle it gracefully by throwing a more appropriate error type. javascript // Improved Version function calculateArea(length, width) { if (typeof length !== 'number' || typeof width !== 'number') { throw new TypeError('Length and width must be numbers.'); } if (length <= 0 || width <= 0) { throw new RangeError('Length and width must be positive numbers.'); } return length width; } // Calling code can now handle this specific error try { console.log(calculateArea(-5, 10)); } catch (error) { if (error instanceof RangeError) { console.error('Invalid input:', error.message); // Gracefully handle the error, e.g., return an error response to a user. } else { // Handle other unexpected errors throw error; } } Throwing a RangeError is better because: 1. It Doesn't Crash the App: The calling code can use a try...catch block to handle the error without terminating the process. 2. Semantic Clarity: RangeError clearly communicates that a value was not in the expected set or range, which is more descriptive than a generic AssertionError.

Answer: This package.json contains multiple dependency security vulnerabilities: 1. Known Vulnerable Version: express: "4.17.1" is an old version with a known moderate severity Prototype Pollution vulnerability. It must be updated. 2. Wildcard Versioning: request: "" is extremely dangerous. It will install the latest version of the request package, which is officially deprecated and known to have vulnerabilities. This wildcard could pull in a malicious package if the name were ever compromised. 3. Unsafe Upper Bound: moment: "<2.29.0" pins the version to a range that is known to contain multiple high-severity vulnerabilities, including ReDoS and Path Traversal. The < prevents an update to a patched version. Improvements: Audit and Update: Run npm audit to get a report of these vulnerabilities. The tool will suggest updates. Replace Deprecated Packages: The request package is deprecated and should be replaced with a modern alternative like axios or node-fetch. Use Secure Versions and Semver: Update the packages to their latest secure versions and use appropriate semantic versioning ranges. For example: json "dependencies": { "express": "^4.18.2", "axios": "^1.4.0", "moment": "^2.29.4" } Use a Lockfile: After correcting the package.json, run npm install to generate a package-lock.json and commit it.

Answer: This package.json file demonstrates a common security issue: using outdated dependencies with known vulnerabilities. 1. lodash: "4.17.15": This version of Lodash is known to be vulnerable to Prototype Pollution, which is a high-severity vulnerability. Attackers could potentially modify the Object.prototype, leading to application-wide security issues including denial of service or remote code execution. 2. axios: "0.21.1": This version of Axios is vulnerable to a high-severity Server-Side Request Forgery (SSRF) vulnerability. An attacker could potentially trick the application into making requests to internal, private network resources. 3. Transitive Dependencies: Even if these direct dependencies were secure, they pull in their own dependencies. Without a lockfile and an audit, it's impossible to know if those transitive dependencies are secure. Improvements: Run a Security Audit: The first step is to run npm audit. This will immediately flag these known vulnerabilities and suggest update commands. Update Dependencies: Update the versions in package.json to the latest secure versions (e.g., "lodash": "^4.17.21", "axios": "^1.4.0"). Use a Lockfile: Run npm install after updating package.json to generate a package-lock.json. This file should be committed to version control to ensure reproducible and secure builds. Integrate Scanning into CI/CD: Add a step to the CI/CD pipeline to run npm audit --production on every build to prevent new vulnerabilities from being deployed.