Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix tests and large number of security vulnerabilities #18

Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
51 commits
Select commit Hold shift + click to select a range
ab30801
Bump axios from 0.21.1 to 0.21.2
dependabot[bot] Jul 23, 2022
a9f5e08
Bump lodash from 4.17.19 to 4.17.21
dependabot[bot] Jul 23, 2022
943b3a8
Merge pull request #1 from hut8/dependabot/npm_and_yarn/axios-0.21.2
hut8 Jul 23, 2022
883a939
Merge pull request #2 from hut8/dependabot/npm_and_yarn/lodash-4.17.21
hut8 Jul 23, 2022
215b416
Bump ini from 1.3.5 to 1.3.8
dependabot[bot] Jul 23, 2022
55b0101
Bump y18n from 4.0.0 to 4.0.3
dependabot[bot] Jul 23, 2022
9a24bdb
Merge pull request #3 from hut8/dependabot/npm_and_yarn/ini-1.3.8
hut8 Jul 23, 2022
dd7f779
Merge pull request #4 from hut8/dependabot/npm_and_yarn/y18n-4.0.3
hut8 Jul 23, 2022
01a0cd2
Bump ws from 5.2.2 to 5.2.3
dependabot[bot] Jul 23, 2022
9342a25
Bump hosted-git-info from 2.7.1 to 2.8.9
dependabot[bot] Jul 23, 2022
e357397
Merge pull request #6 from hut8/dependabot/npm_and_yarn/hosted-git-in…
hut8 Jul 23, 2022
3433def
Merge pull request #5 from hut8/dependabot/npm_and_yarn/ws-5.2.3
hut8 Jul 23, 2022
153b1b1
Bump path-parse from 1.0.6 to 1.0.7
dependabot[bot] Jul 23, 2022
0748c77
Bump tar from 4.4.8 to 4.4.19
dependabot[bot] Jul 23, 2022
c67cb04
Merge pull request #8 from hut8/dependabot/npm_and_yarn/tar-4.4.19
hut8 Jul 23, 2022
5c31075
Merge pull request #7 from hut8/dependabot/npm_and_yarn/path-parse-1.0.7
hut8 Jul 23, 2022
f5d8e85
Bump tmpl from 1.0.4 to 1.0.5
dependabot[bot] Jul 23, 2022
29dff67
Merge pull request #9 from hut8/dependabot/npm_and_yarn/tmpl-1.0.5
hut8 Jul 23, 2022
a230410
Bump ajv from 6.7.0 to 6.12.6
dependabot[bot] Jul 23, 2022
a3c6397
Merge pull request #10 from hut8/dependabot/npm_and_yarn/ajv-6.12.6
hut8 Jul 23, 2022
66f2c30
Update lockfile to new version
hut8 Jul 23, 2022
eab7ba4
Fix test typing issue
hut8 Jul 23, 2022
5d85bec
Update jest,ts-jest. Tests pass.
hut8 Jul 23, 2022
6af9117
Update axios. Tests pass.
hut8 Jul 23, 2022
bfa453d
Update doctoc; resolves critical vuln; tests pass.
hut8 Jul 23, 2022
ab07372
Update lint-staged; tests pass
hut8 Jul 23, 2022
1dfd56e
Update Jest and Jest-ts to non-vuln versions
hut8 Jul 23, 2022
d5c5e23
Create security audit CI
hut8 Jul 23, 2022
af5052d
Version bump to 0.5.0
hut8 Jul 23, 2022
570b9c2
Fix incompatible versions of TS and Prettier
hut8 Jul 29, 2022
68df12d
Check in dist/ to deal with prepack not being run for git
hut8 Jul 29, 2022
08f08f2
No need for prepack step with dist checked in
joshjordan Jun 2, 2023
1917749
Bump decode-uri-component from 0.2.0 to 0.2.2
dependabot[bot] Jan 2, 2024
8217d50
Bump @babel/traverse from 7.18.9 to 7.23.7
dependabot[bot] Jan 2, 2024
ea40c9e
Bump json5 from 2.2.1 to 2.2.3
dependabot[bot] Jan 2, 2024
cf72dc2
Bump tough-cookie from 4.0.0 to 4.1.3
dependabot[bot] Jan 2, 2024
dfbc5dc
Bump axios from 0.22.0 to 0.28.0
dependabot[bot] Feb 21, 2024
f9d6afb
Bump follow-redirects from 1.15.1 to 1.15.6
dependabot[bot] Mar 16, 2024
458c86a
Merge pull request #8 from supervillain-software-group/dependabot/npm…
joshjordan Oct 15, 2024
6713131
Merge pull request #7 from supervillain-software-group/dependabot/npm…
joshjordan Oct 15, 2024
172bab8
Merge pull request #5 from supervillain-software-group/dependabot/npm…
joshjordan Oct 15, 2024
359763a
Merge pull request #3 from supervillain-software-group/dependabot/npm…
joshjordan Oct 15, 2024
c903cbe
Merge pull request #2 from supervillain-software-group/dependabot/npm…
joshjordan Oct 15, 2024
0756a24
Merge pull request #1 from supervillain-software-group/dependabot/npm…
joshjordan Oct 15, 2024
d566ea0
Bump braces, jest and ts-jest
dependabot[bot] Oct 15, 2024
3b38d2c
Merge pull request #10 from supervillain-software-group/dependabot/np…
joshjordan Oct 15, 2024
b7d9d61
Fix critical dependencies
joshjordan Oct 16, 2024
367e4f4
Update references in package.json
joshjordan Oct 16, 2024
31093c6
Bump axios version dep to 1.1.1
joshjordan Oct 16, 2024
25ea450
Bump axios to compatible version; previous versions are bunk
joshjordan Oct 16, 2024
b54c526
Break out resouce schema to separate file, as well as types. Add rail…
joshjordan Oct 16, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
*.idea
node_modules
*.log*
/dist
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why include dist?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whoa! This one's more than two years old.

That's really why -- we use dist as a simple mechanism to publish so we don't have to put a competing module up in npm. We hadn't seen activity in this repo and so that's where we stuck the compiled code.

I do not think it needs to be included for the main repo if the main repo is starting to get updates again.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And to be clear, I think this is because the PR is continuing to pull in our latest commits. When we included dist, it was after we'd given up that we'd get this PR merged.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hahaha, I missed the ping before, and for some reason GH pinged me again just yesterday, hence the question :)
As I am not using the lib anymore myself, would you like to be added as a contributor to keep maintaining it?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

However, it is probably easier to just redirect people to your fork

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure! I am open to doing it either way. I'd like to maintain this -- we have security patches as well as some new features to add. Its a great library, thank you for it.

Would you like to do the Transfer Ownership function so GH does an automatic redirect? I can drop the supervillain-software-group repo if so so we can keep all the repo history in the main one.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Happy to do so! Could you rename your fork to anything else?
изображение

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@aigoncharov done! Sorry for that. I deleted it and will bring my local commits in after transfer.

*.tgz
/coverage
/coverage
13 changes: 13 additions & 0 deletions .gitlab-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# You can override the included template(s) by including variable overrides
# SAST customization: https://docs.gitlab.com/ee/user/application_security/sast/#customizing-the-sast-settings
# Secret Detection customization: https://docs.gitlab.com/ee/user/application_security/secret_detection/#customizing-settings
# Dependency Scanning customization: https://docs.gitlab.com/ee/user/application_security/dependency_scanning/#customizing-the-dependency-scanning-settings
# Container Scanning customization: https://docs.gitlab.com/ee/user/application_security/container_scanning/#customizing-the-container-scanning-settings
# Note that environment variables can be set in several places
# See https://docs.gitlab.com/ee/ci/variables/#cicd-variable-precedence
stages:
- test
sast:
stage: test
include:
- template: Security/SAST.gitlab-ci.yml
2 changes: 2 additions & 0 deletions dist/index.d.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
export * from './src/resource'
export * from './src/url-formatter'
30 changes: 30 additions & 0 deletions dist/index.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
'use strict'
var __createBinding =
(this && this.__createBinding) ||
(Object.create
? function(o, m, k, k2) {
if (k2 === undefined) k2 = k
var desc = Object.getOwnPropertyDescriptor(m, k)
if (!desc || ('get' in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = {
enumerable: true,
get: function() {
return m[k]
},
}
}
Object.defineProperty(o, k2, desc)
}
: function(o, m, k, k2) {
if (k2 === undefined) k2 = k
o[k2] = m[k]
})
var __exportStar =
(this && this.__exportStar) ||
function(m, exports) {
for (var p in m)
if (p !== 'default' && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p)
}
Object.defineProperty(exports, '__esModule', { value: true })
__exportStar(require('./src/resource'), exports)
__exportStar(require('./src/url-formatter'), exports)
27 changes: 27 additions & 0 deletions dist/src/resource.d.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
import { AxiosInstance, AxiosPromise, AxiosRequestConfig } from 'axios'
export declare type IAPIMethod = (requestConfig?: Partial<AxiosRequestConfig>) => AxiosPromise
export declare type IResource<Methods extends string> = {
[Method in Methods]: IAPIMethod
}
declare type RequestMethod = 'get' | 'delete' | 'head' | 'options' | 'post' | 'put' | 'patch'
export interface IAPIMethodSchema {
method: RequestMethod
url?: string
}
export declare type IResourceSchema<T extends string> = {
[Key in T]: IAPIMethodSchema
}
export declare type IResourceMethodsDefault = 'create' | 'read' | 'readOne' | 'remove' | 'update'
export declare const resourceSchemaDefault: IResourceSchema<IResourceMethodsDefault>
interface IAxiosConfig extends AxiosRequestConfig {
baseURL: string
}
export declare class ResourceBuilder {
readonly axiosInstance: AxiosInstance
protected readonly _schemaDefault: IResourceSchema<IResourceMethodsDefault>
constructor(axiosConfig: IAxiosConfig)
build(resourceUrl: string): IResource<IResourceMethodsDefault>
build<Methods extends string>(resourceUrl: string, schema: IResourceSchema<Methods>): IResource<Methods>
protected _build<Methods extends string>(resourceUrl: string, schema: IResourceSchema<Methods>): IResource<Methods>
}
export {}
80 changes: 80 additions & 0 deletions dist/src/resource.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
'use strict'
var __assign =
(this && this.__assign) ||
function() {
__assign =
Object.assign ||
function(t) {
for (var s, i = 1, n = arguments.length; i < n; i++) {
s = arguments[i]
for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p]
}
return t
}
return __assign.apply(this, arguments)
}
Object.defineProperty(exports, '__esModule', { value: true })
exports.ResourceBuilder = exports.resourceSchemaDefault = void 0
var axios_1 = require('axios')
var url_formatter_1 = require('./url-formatter')
exports.resourceSchemaDefault = {
create: {
method: 'post',
},
read: {
method: 'get',
},
readOne: {
method: 'get',
url: '/{id}',
},
remove: {
method: 'delete',
url: '/{id}',
},
update: {
method: 'put',
url: '/{id}',
},
}
var ResourceBuilder = (function() {
function ResourceBuilder(axiosConfig) {
this._schemaDefault = exports.resourceSchemaDefault
if (!axiosConfig.headers) {
axiosConfig.headers = {}
}
if (axiosConfig.headers.Accept === undefined) {
axiosConfig.headers.Accept = 'application/json'
}
this.axiosInstance = axios_1.default.create(axiosConfig)
this.axiosInstance.interceptors.request.use(url_formatter_1.interceptorUrlFormatter)
}
ResourceBuilder.prototype.build = function(resourceUrl, schema) {
if (!schema) {
return this._build(resourceUrl, this._schemaDefault)
}
return this._build(resourceUrl, schema)
}
ResourceBuilder.prototype._build = function(resourceUrl, schema) {
var _this = this
var resource = {}
var _loop_1 = function(methodName) {
var methodSchema = schema[methodName]
var url = methodSchema.url || ''
url = ''.concat(resourceUrl).concat(url)
resource[methodName] = function(requestConfig) {
if (requestConfig === void 0) {
requestConfig = {}
}
return _this.axiosInstance.request(__assign(__assign(__assign({}, requestConfig), methodSchema), { url: url }))
}
}
for (var _i = 0, _a = Object.keys(schema); _i < _a.length; _i++) {
var methodName = _a[_i]
_loop_1(methodName)
}
return resource
}
return ResourceBuilder
})()
exports.ResourceBuilder = ResourceBuilder
2 changes: 2 additions & 0 deletions dist/src/url-formatter.d.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
import { AxiosRequestConfig } from 'axios'
export declare const interceptorUrlFormatter: (config: AxiosRequestConfig) => AxiosRequestConfig
23 changes: 23 additions & 0 deletions dist/src/url-formatter.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
'use strict'
Object.defineProperty(exports, '__esModule', { value: true })
exports.interceptorUrlFormatter = void 0
var interceptorUrlFormatter = function(config) {
if (!config.params) {
return config
}
var _loop_1 = function(paramName) {
var param = config.params[paramName]
if (config.url && config.url.indexOf('{'.concat(paramName, '}')) > -1) {
config.url = config.url.replace('{'.concat(paramName, '}'), function() {
return param
})
delete config.params[paramName]
}
}
for (var _i = 0, _a = Object.keys(config.params); _i < _a.length; _i++) {
var paramName = _a[_i]
_loop_1(paramName)
}
return config
}
exports.interceptorUrlFormatter = interceptorUrlFormatter
2 changes: 2 additions & 0 deletions index.ts
Original file line number Diff line number Diff line change
@@ -1,2 +1,4 @@
export * from './src/resource'
export { railsResourceSchema, default as resourceSchemaDefault } from './src/resourceSchemaDefault'
export * from './src/types'
export * from './src/url-formatter'
Loading