-
Notifications
You must be signed in to change notification settings - Fork 4
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix tests and large number of security vulnerabilities #18
Closed
hut8
wants to merge
51
commits into
supervillain-software-group:master
from
supervillain-software-group:master
Closed
Changes from all commits
Commits
Show all changes
51 commits
Select commit
Hold shift + click to select a range
ab30801
Bump axios from 0.21.1 to 0.21.2
dependabot[bot] a9f5e08
Bump lodash from 4.17.19 to 4.17.21
dependabot[bot] 943b3a8
Merge pull request #1 from hut8/dependabot/npm_and_yarn/axios-0.21.2
hut8 883a939
Merge pull request #2 from hut8/dependabot/npm_and_yarn/lodash-4.17.21
hut8 215b416
Bump ini from 1.3.5 to 1.3.8
dependabot[bot] 55b0101
Bump y18n from 4.0.0 to 4.0.3
dependabot[bot] 9a24bdb
Merge pull request #3 from hut8/dependabot/npm_and_yarn/ini-1.3.8
hut8 dd7f779
Merge pull request #4 from hut8/dependabot/npm_and_yarn/y18n-4.0.3
hut8 01a0cd2
Bump ws from 5.2.2 to 5.2.3
dependabot[bot] 9342a25
Bump hosted-git-info from 2.7.1 to 2.8.9
dependabot[bot] e357397
Merge pull request #6 from hut8/dependabot/npm_and_yarn/hosted-git-in…
hut8 3433def
Merge pull request #5 from hut8/dependabot/npm_and_yarn/ws-5.2.3
hut8 153b1b1
Bump path-parse from 1.0.6 to 1.0.7
dependabot[bot] 0748c77
Bump tar from 4.4.8 to 4.4.19
dependabot[bot] c67cb04
Merge pull request #8 from hut8/dependabot/npm_and_yarn/tar-4.4.19
hut8 5c31075
Merge pull request #7 from hut8/dependabot/npm_and_yarn/path-parse-1.0.7
hut8 f5d8e85
Bump tmpl from 1.0.4 to 1.0.5
dependabot[bot] 29dff67
Merge pull request #9 from hut8/dependabot/npm_and_yarn/tmpl-1.0.5
hut8 a230410
Bump ajv from 6.7.0 to 6.12.6
dependabot[bot] a3c6397
Merge pull request #10 from hut8/dependabot/npm_and_yarn/ajv-6.12.6
hut8 66f2c30
Update lockfile to new version
hut8 eab7ba4
Fix test typing issue
hut8 5d85bec
Update jest,ts-jest. Tests pass.
hut8 6af9117
Update axios. Tests pass.
hut8 bfa453d
Update doctoc; resolves critical vuln; tests pass.
hut8 ab07372
Update lint-staged; tests pass
hut8 1dfd56e
Update Jest and Jest-ts to non-vuln versions
hut8 d5c5e23
Create security audit CI
hut8 af5052d
Version bump to 0.5.0
hut8 570b9c2
Fix incompatible versions of TS and Prettier
hut8 68df12d
Check in dist/ to deal with prepack not being run for git
hut8 08f08f2
No need for prepack step with dist checked in
joshjordan 1917749
Bump decode-uri-component from 0.2.0 to 0.2.2
dependabot[bot] 8217d50
Bump @babel/traverse from 7.18.9 to 7.23.7
dependabot[bot] ea40c9e
Bump json5 from 2.2.1 to 2.2.3
dependabot[bot] cf72dc2
Bump tough-cookie from 4.0.0 to 4.1.3
dependabot[bot] dfbc5dc
Bump axios from 0.22.0 to 0.28.0
dependabot[bot] f9d6afb
Bump follow-redirects from 1.15.1 to 1.15.6
dependabot[bot] 458c86a
Merge pull request #8 from supervillain-software-group/dependabot/npm…
joshjordan 6713131
Merge pull request #7 from supervillain-software-group/dependabot/npm…
joshjordan 172bab8
Merge pull request #5 from supervillain-software-group/dependabot/npm…
joshjordan 359763a
Merge pull request #3 from supervillain-software-group/dependabot/npm…
joshjordan c903cbe
Merge pull request #2 from supervillain-software-group/dependabot/npm…
joshjordan 0756a24
Merge pull request #1 from supervillain-software-group/dependabot/npm…
joshjordan d566ea0
Bump braces, jest and ts-jest
dependabot[bot] 3b38d2c
Merge pull request #10 from supervillain-software-group/dependabot/np…
joshjordan b7d9d61
Fix critical dependencies
joshjordan 367e4f4
Update references in package.json
joshjordan 31093c6
Bump axios version dep to 1.1.1
joshjordan 25ea450
Bump axios to compatible version; previous versions are bunk
joshjordan b54c526
Break out resouce schema to separate file, as well as types. Add rail…
joshjordan File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,6 +1,5 @@ | ||
*.idea | ||
node_modules | ||
*.log* | ||
/dist | ||
*.tgz | ||
/coverage | ||
/coverage |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
# You can override the included template(s) by including variable overrides | ||
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings | ||
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings | ||
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings | ||
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings | ||
# Note that environment variables can be set in several places | ||
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence | ||
stages: | ||
- test | ||
sast: | ||
stage: test | ||
include: | ||
- template: Security/SAST.gitlab-ci.yml |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,2 @@ | ||
export * from './src/resource' | ||
export * from './src/url-formatter' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,30 @@ | ||
'use strict' | ||
var __createBinding = | ||
(this && this.__createBinding) || | ||
(Object.create | ||
? function(o, m, k, k2) { | ||
if (k2 === undefined) k2 = k | ||
var desc = Object.getOwnPropertyDescriptor(m, k) | ||
if (!desc || ('get' in desc ? !m.__esModule : desc.writable || desc.configurable)) { | ||
desc = { | ||
enumerable: true, | ||
get: function() { | ||
return m[k] | ||
}, | ||
} | ||
} | ||
Object.defineProperty(o, k2, desc) | ||
} | ||
: function(o, m, k, k2) { | ||
if (k2 === undefined) k2 = k | ||
o[k2] = m[k] | ||
}) | ||
var __exportStar = | ||
(this && this.__exportStar) || | ||
function(m, exports) { | ||
for (var p in m) | ||
if (p !== 'default' && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p) | ||
} | ||
Object.defineProperty(exports, '__esModule', { value: true }) | ||
__exportStar(require('./src/resource'), exports) | ||
__exportStar(require('./src/url-formatter'), exports) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
import { AxiosInstance, AxiosPromise, AxiosRequestConfig } from 'axios' | ||
export declare type IAPIMethod = (requestConfig?: Partial<AxiosRequestConfig>) => AxiosPromise | ||
export declare type IResource<Methods extends string> = { | ||
[Method in Methods]: IAPIMethod | ||
} | ||
declare type RequestMethod = 'get' | 'delete' | 'head' | 'options' | 'post' | 'put' | 'patch' | ||
export interface IAPIMethodSchema { | ||
method: RequestMethod | ||
url?: string | ||
} | ||
export declare type IResourceSchema<T extends string> = { | ||
[Key in T]: IAPIMethodSchema | ||
} | ||
export declare type IResourceMethodsDefault = 'create' | 'read' | 'readOne' | 'remove' | 'update' | ||
export declare const resourceSchemaDefault: IResourceSchema<IResourceMethodsDefault> | ||
interface IAxiosConfig extends AxiosRequestConfig { | ||
baseURL: string | ||
} | ||
export declare class ResourceBuilder { | ||
readonly axiosInstance: AxiosInstance | ||
protected readonly _schemaDefault: IResourceSchema<IResourceMethodsDefault> | ||
constructor(axiosConfig: IAxiosConfig) | ||
build(resourceUrl: string): IResource<IResourceMethodsDefault> | ||
build<Methods extends string>(resourceUrl: string, schema: IResourceSchema<Methods>): IResource<Methods> | ||
protected _build<Methods extends string>(resourceUrl: string, schema: IResourceSchema<Methods>): IResource<Methods> | ||
} | ||
export {} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,80 @@ | ||
'use strict' | ||
var __assign = | ||
(this && this.__assign) || | ||
function() { | ||
__assign = | ||
Object.assign || | ||
function(t) { | ||
for (var s, i = 1, n = arguments.length; i < n; i++) { | ||
s = arguments[i] | ||
for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p] | ||
} | ||
return t | ||
} | ||
return __assign.apply(this, arguments) | ||
} | ||
Object.defineProperty(exports, '__esModule', { value: true }) | ||
exports.ResourceBuilder = exports.resourceSchemaDefault = void 0 | ||
var axios_1 = require('axios') | ||
var url_formatter_1 = require('./url-formatter') | ||
exports.resourceSchemaDefault = { | ||
create: { | ||
method: 'post', | ||
}, | ||
read: { | ||
method: 'get', | ||
}, | ||
readOne: { | ||
method: 'get', | ||
url: '/{id}', | ||
}, | ||
remove: { | ||
method: 'delete', | ||
url: '/{id}', | ||
}, | ||
update: { | ||
method: 'put', | ||
url: '/{id}', | ||
}, | ||
} | ||
var ResourceBuilder = (function() { | ||
function ResourceBuilder(axiosConfig) { | ||
this._schemaDefault = exports.resourceSchemaDefault | ||
if (!axiosConfig.headers) { | ||
axiosConfig.headers = {} | ||
} | ||
if (axiosConfig.headers.Accept === undefined) { | ||
axiosConfig.headers.Accept = 'application/json' | ||
} | ||
this.axiosInstance = axios_1.default.create(axiosConfig) | ||
this.axiosInstance.interceptors.request.use(url_formatter_1.interceptorUrlFormatter) | ||
} | ||
ResourceBuilder.prototype.build = function(resourceUrl, schema) { | ||
if (!schema) { | ||
return this._build(resourceUrl, this._schemaDefault) | ||
} | ||
return this._build(resourceUrl, schema) | ||
} | ||
ResourceBuilder.prototype._build = function(resourceUrl, schema) { | ||
var _this = this | ||
var resource = {} | ||
var _loop_1 = function(methodName) { | ||
var methodSchema = schema[methodName] | ||
var url = methodSchema.url || '' | ||
url = ''.concat(resourceUrl).concat(url) | ||
resource[methodName] = function(requestConfig) { | ||
if (requestConfig === void 0) { | ||
requestConfig = {} | ||
} | ||
return _this.axiosInstance.request(__assign(__assign(__assign({}, requestConfig), methodSchema), { url: url })) | ||
} | ||
} | ||
for (var _i = 0, _a = Object.keys(schema); _i < _a.length; _i++) { | ||
var methodName = _a[_i] | ||
_loop_1(methodName) | ||
} | ||
return resource | ||
} | ||
return ResourceBuilder | ||
})() | ||
exports.ResourceBuilder = ResourceBuilder |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,2 @@ | ||
import { AxiosRequestConfig } from 'axios' | ||
export declare const interceptorUrlFormatter: (config: AxiosRequestConfig) => AxiosRequestConfig |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,23 @@ | ||
'use strict' | ||
Object.defineProperty(exports, '__esModule', { value: true }) | ||
exports.interceptorUrlFormatter = void 0 | ||
var interceptorUrlFormatter = function(config) { | ||
if (!config.params) { | ||
return config | ||
} | ||
var _loop_1 = function(paramName) { | ||
var param = config.params[paramName] | ||
if (config.url && config.url.indexOf('{'.concat(paramName, '}')) > -1) { | ||
config.url = config.url.replace('{'.concat(paramName, '}'), function() { | ||
return param | ||
}) | ||
delete config.params[paramName] | ||
} | ||
} | ||
for (var _i = 0, _a = Object.keys(config.params); _i < _a.length; _i++) { | ||
var paramName = _a[_i] | ||
_loop_1(paramName) | ||
} | ||
return config | ||
} | ||
exports.interceptorUrlFormatter = interceptorUrlFormatter |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,2 +1,4 @@ | ||
export * from './src/resource' | ||
export { railsResourceSchema, default as resourceSchemaDefault } from './src/resourceSchemaDefault' | ||
export * from './src/types' | ||
export * from './src/url-formatter' |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why include dist?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Whoa! This one's more than two years old.
That's really why -- we use
dist
as a simple mechanism to publish so we don't have to put a competing module up in npm. We hadn't seen activity in this repo and so that's where we stuck the compiled code.I do not think it needs to be included for the main repo if the main repo is starting to get updates again.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
And to be clear, I think this is because the PR is continuing to pull in our latest commits. When we included
dist
, it was after we'd given up that we'd get this PR merged.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hahaha, I missed the ping before, and for some reason GH pinged me again just yesterday, hence the question :)
As I am not using the lib anymore myself, would you like to be added as a contributor to keep maintaining it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
However, it is probably easier to just redirect people to your fork
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sure! I am open to doing it either way. I'd like to maintain this -- we have security patches as well as some new features to add. Its a great library, thank you for it.
Would you like to do the Transfer Ownership function so GH does an automatic redirect? I can drop the supervillain-software-group repo if so so we can keep all the repo history in the main one.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Happy to do so! Could you rename your fork to anything else?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@aigoncharov done! Sorry for that. I deleted it and will bring my local commits in after transfer.