ylqjgm
/
canvas-lms
mirror of https://github.com/instructure/canvas-lms.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix xsslint performance, fixes SD-1725 

symlink into node_modules makes globby sad, so give it an explicit list
of files and directories

this is the workaround suggested in https://github.com/jenseng/globby-js/issues/2

Change-Id: Ic9fc04b1bedb4e28e38c5eea0a2f1b127e3b5e2f
Reviewed-on: https://gerrit.instructure.com/94371
Reviewed-by: Landon Wilkins <lwilkins@instructure.com>
Tested-by: Jenkins
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
This commit is contained in:
Jon Jensen 2016-11-03 13:46:27 -06:00
parent b7eddf9085
commit fad7b8450d
1 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
script/xsslint.js
View File

@ -32,9 +32,33 @@ Linter.prototype.isSafeString = function(node) {
return (wrapperOption.length > 0)
}
function getFilesAndDirs(root, files, dirs) {
root = root === "." ? "" : root + "/";
files = files || [];
dirs = dirs || [];
var entries = fs.readdirSync(root || ".");
var entry;
var i;
var len;
for (i = 0, len = entries.length; i < len; i++) {
entry = entries[i];
var stats = fs.lstatSync(root + entry);
if (stats.isSymbolicLink()) {
} else if (stats.isDirectory()) {
dirs.push(root + entry + "/");
getFilesAndDirs(root + entry, files, dirs);
} else {
files.push(root + entry);
}
}
return [files, dirs];
}
process.chdir("public/javascripts");
var ignores = fs.readFileSync(".xssignore").toString().trim().split(/\r?\n|\r/);
var files = globby.select(["*.js"]).reject(ignores).files;
var candidates = getFilesAndDirs(".");
candidates = {files: candidates[0], dirs: candidates[1]};
var files = globby.select(["*.js"], candidates).reject(ignores).files;
var warningCount = 0;
console.log("Checking for potential XSS vulnerabilities...");