Commit Graph

17 Commits

Author SHA1 Message Date
Jon Jensen 7420e67f71 return non-zero exit code on xss linting failure, refs CNVS-17663
this will allow us to enforce linting in the build

also ignore plugins' vendored javascript

Change-Id: Ibf6e9b73e0051a0b581ee52b641f9ff00dd6b2f2
Reviewed-on: https://gerrit.instructure.com/46351
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
2014-12-29 20:48:00 +00:00
Jon Jensen 70cdc92bdb XSS linting, fixes CNVS-17663
no significant issues/vulnerabilities fixed in this commit, rather this is
a catch-all so we can enforce linting in the build.

to better understand what's going on here, see the following:

* public/javascripts/.xssignore
* script/xsslint.js
* https://github.com/jenseng/xsslint

high level summary of what's going on in this commit:

1. .html/.append/etc. now know what to do with a SafeString ... in many
   cases we now put a $.raw around an .html argument to tell the linter
   it's ok
2. although translation is an unlikely attack vector, we now htmlEscape
   I18n.t calls used in html snippets, etc. this is a good thing, as it
   ensures we don't create a vulnerability later (e.g. by interpolating
   user content into a translation)
3. many vars were renamed (Html suffix, $ prefix) to let the linter know
   it's something that was manually vetted
4. in some cases, rather than renaming or creating a superfluous var,
   we add special xsslint comment overrides

test plan:
specs should all pass

Change-Id: Ide1df825b798d1b0c468a5308802543bf716c0d7
Reviewed-on: https://gerrit.instructure.com/46097
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Derek Hansen <dhansen@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2014-12-29 17:45:43 +00:00
Addison Higham d01e60377f Make Guard coffeescript compilation include line numbers when the build fails
Change-Id: If06afc8db7d13c9ecd7737e452dfef7eba32e4e2
Reviewed-on: https://gerrit.instructure.com/45581
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jon Jensen <jon@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>
2014-12-11 18:32:58 +00:00
Ryan Florence 9c7b6e0320 make react-tools a dependency for deploy
Change-Id: Ia3b5854e4bfeacaaf2a42548f164ffc0db28c19f
Reviewed-on: https://gerrit.instructure.com/45014
Reviewed-by: Tyler Pickett <tpickett+gerrit@instructure.com>
Product-Review: Bryan Madsen <bryan@instructure.com>
QA-Review: Bryan Madsen <bryan@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
2014-12-03 00:01:48 +00:00
Ryan Florence 9d50b8f2de added jsx
Change-Id: Ia23b8f3f7b3d6300f185548ad8c7a63541e7f795
Reviewed-on: https://gerrit.instructure.com/43784
Reviewed-by: Jason Madsen <jmadsen@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Ryan Florence <ryanf@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
2014-11-03 23:20:33 +00:00
Jon Jensen 8192132c3e i18nliner-js (part I)
this swaps out our "parsing" with i18nliner-js

also remove localization abilities of I18n.beforeLabel, since it's not
worth the trouble to support. it can still be called to format a string.

notable changes/fixes in generated yml:
1. client_apps are picked up by i18n:rake so they'll get translated...
   due to the old short-circuiting logic (`rc = rc && ...`), it would
   stop processing scripts within a particular file after the first one
   it found without an I18n.t
2. we no longer incorrectly double-escape special chars in our js strings
   (e.g. newlines are actually newlines, not a literal "\n")

test plan:
1. verify string extraction:
   1. `rake js:generate i18n:generate` before and after this commit
   2. confirm `config/locales/generated/en.yml` is identical, except the
      notable changes/fixes listed above
2. verify js translation file generation:
   1. `rake i18n:generate_js` before and after this commit
   2. confirm the files in public/javascripts/translations are identical
3. verify client_app checker still works:
   1. `cd client_apps/canvas_quiz_statistics/`
   2. `grunt check_i18n`

Change-Id: Ic8ad058bee1c9476f42916f10b612c1c08863fe3
Reviewed-on: https://gerrit.instructure.com/42809
Reviewed-by: Michael Ziwisky <mziwisky@instructure.com>
Product-Review: Michael Ziwisky <mziwisky@instructure.com>
QA-Review: Michael Ziwisky <mziwisky@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
2014-10-30 06:25:36 +00:00
Jeremy Stanley 582ae52586 pin node-sass at 0.9.3
the newer version we were using (0.9.5-rc1) seems to have a bug
that causes it to drop 'left' and 'right' styles

test plan:
 - the 'HTML Editor' and 'Rich Content Editor' links on the wiki
   page editor should appear on the right side and should not
   overlap the page title

fixes CNVS-15760

Change-Id: Icab9be6b25114485f0f5d9990b1eb3c1d600b35f
Reviewed-on: https://gerrit.instructure.com/41720
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Shaw <ryan@instructure.com>
Product-Review: Ryan Shaw <ryan@instructure.com>
QA-Review: Ryan Shaw <ryan@instructure.com>
2014-09-24 19:45:19 +00:00
Ryan Shaw 485b90a6f7 replace compass with node-sass
after many steps towards this moment, we're finally here

This yanks sass and compass out of canvas-lms
completely and instead uses the libsass based
node-sass to compile our SASS files.

wins:

It is WAYYY faster!
as in, < 10 seconds to recompile all css in canvas
(compared to the 5+ minutes it used to take)

It is all in JS, helping use move to a completely
nodeJS based fronted tooling workflow.

next steps:

remove jammit: we don't need an assets.yml file
since node-sass can output compressed css for us
and we use sass to do all of our @import'ing of other
files (@colleen calls those "compiler" sheets), this
would simplify and speed up fronted asset building
even more

use gulp/broccoli/whatev to do cached, incremental builds

test plan:

all outputted css should look exactly the
same as it used to.

run `npm run compile-sass`, make sure it works
and is way faster than `rake css:generate` used to be

Change-Id: I7d865ea6b3e374cdc27a883d2019a4c15746c0e2
Reviewed-on: https://gerrit.instructure.com/38416
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Trevor deHaan <tdehaan@instructure.com>
Product-Review: Ryan Shaw <ryan@instructure.com>
2014-08-04 15:28:29 +00:00
Stanley Stuart 9be9ca6c7f package.json should include compute-cluster in dependencies
Include compute-cluster in "dependencies" so `npm install --production`
works for building assets.

Test plan:
  - run rm -rf node_modules && npm install --production
  - run bundle exec rake canvas:compile_assets

Change-Id: Ie5b1d387608f24b59a736dbeb974cb1ec710cfbd
Reviewed-on: https://gerrit.instructure.com/34302
Reviewed-by: Jason Madsen <jmadsen@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Stanley Stuart <stanley@instructure.com>
QA-Review: Stanley Stuart <stanley@instructure.com>
2014-05-05 16:46:43 +00:00
Ryan Shaw 0b4e9fe5d8 make rake canvas:compile_assets a TON faster
...by parallelizing everything I could

fixes: CNVS-12362

`time bundle exec rake canvas:compile_assets`
(on my I7 2.3GHz macbook pro)
before: "322.56s user 26.62s system 173% cpu 3:21.05 total"
after: "425.91s user 30.71s system 413% cpu 1:50.35 total"

If you ever find yourself needing to run everything all
sequentially (and not in multiple threads), you can
set the environment variable CANVAS_BUILD_CONCURRENCY=1
by default it will use all the cores your system has

You're welcome, anyone that has ever had to build canvas
or wait for jenkins to run :)

Test Plan:
* run "time bundle exec rake canvas:compile_assets"
* checkout this code
* run it again
* verify that it is faster, and everything works

Change-Id: Ib01506bc9638e86f4a329284458706279ef751ab
Reviewed-on: https://gerrit.instructure.com/33127
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
Product-Review: Bracken Mosbacker <bracken@instructure.com>
2014-04-17 19:47:17 +00:00
Stanley Stuart 86158729ce fix npm installs by pinning karma-coffee-preproccessor
Change-Id: I26809102e68d1be5951a2eb446f2f4a0aeb40e08
Reviewed-on: https://gerrit.instructure.com/31707
Reviewed-by: Aaron Shafovaloff <ashafovaloff@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Stanley Stuart <stanley@instructure.com>
QA-Review: Stanley Stuart <stanley@instructure.com>
2014-03-11 17:03:51 +00:00
Aaron Shafovaloff 20f692c884 upgraded requirejs to 2.1.10
- upgraded raphaël to 2.1.2
- upgraded FileAPI to 2.0.4
- amd-ified files
- removed unnecessary shims
- removed "use!" usage
- removed "order" requirejs plugin
- using new shim configuration format
- replace deprecated require.resourcesDone with !window.requirejs.s.contexts._.defQueue.length
- using UglifyJS separate from r.js
- added keep_trying_until in selenium specs to fix timing issue
- fix race condition in take_quiz.js with .file-upload-question-holder

Change-Id: I8c205ef4c80115fa0cbd662c184490f1b9626336
Reviewed-on: https://gerrit.instructure.com/29683
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
QA-Review: Nathan Rogowski <nathan@instructure.com>
Product-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
Tested-by: Aaron Shafovaloff <ashafovaloff@instructure.com>
2014-03-10 22:27:53 +00:00
Aaron Shafovaloff d40fcb7dce move napa from "devDependencies" to "dependencies"
Change-Id: I4dde9458868cd5c1c41b921414dff4b3dc9371de
Reviewed-on: https://gerrit.instructure.com/29878
Reviewed-by: Simon Williams <simon@instructure.com>
Reviewed-by: Jason Madsen <jmadsen@instructure.com>
Product-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
QA-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
Tested-by: Aaron Shafovaloff <ashafovaloff@instructure.com>
2014-02-10 19:51:05 +00:00
Aaron Shafovaloff fa189a98cd clean up JS tests and integrate karma
- js:generate_runner now generates common files to be used by different test runners
- js spec file order now shuffled to better expose dependencies
- fakeENV now returns two methods: setup and teardown
- stock tinymce 3 files are now wrapped for AMD

test plan:

- tinymce should work the same
- js:test rake task should run tests
- js:build task should work as normal (using new location of r.js)
- test results should successfully send to firework

Change-Id: Ic09647f55dae57130fa0fe3d6a9168d2b67b89a2
Reviewed-on: https://gerrit.instructure.com/29297
QA-Review: Shawn Meredith <shawn@instructure.com>
Tested-by: Shawn Meredith <shawn@instructure.com>
Tested-by: Aaron Shafovaloff <ashafovaloff@instructure.com>
Reviewed-by: Aaron Shafovaloff <ashafovaloff@instructure.com>
Product-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
QA-Review: Aaron Shafovaloff <ashafovaloff@instructure.com>
2014-02-07 19:40:37 +00:00
Ryan Florence 70fcacad3a updated package.json
Change-Id: I768ca40a86ac36c19c89c08af31e304ec980e03f
Reviewed-on: https://gerrit.instructure.com/23480
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
Product-Review: Ryan Florence <ryanf@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
2013-08-23 18:46:20 +00:00
Ryan Florence e9c5ff2197 added ember generators
- first install new npm modules `npm install`
- add node_modules/.bin/ to your path or install
  loom globally with `npm install -g loom` or
  call the binary directly from node_modules with
  `node_modules/.bin/generate <args>`

to generate objects for your ember app run

  `generate <generator> <app>/<name> <options>`

examples:

  generate model quizzes/user name:string
  generate component inbox/modal
  generate route inbox/messages/message

test plan:
- none, we aren't set up to test node code but
  loom itself is well tested

Change-Id: Ibdf1d6307cbf5f2eb651d0f45aa0f94229b57814
Reviewed-on: https://gerrit.instructure.com/23387
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
Product-Review: Ryan Florence <ryanf@instructure.com>
QA-Review: Ryan Florence <ryanf@instructure.com>
2013-08-19 17:22:01 +00:00
Ryan Florence a1e31c8c9a AMD Conversion
"Trivial" JavaScript / CoffeeScript changes
--------------------------------------------------

For the most part, all javascript was simply
wrapped in `require` or `define`. The dependencies
were found with a script that matched regexes in
the files, it errs on the side of listing too many
dependencies, so its worth double checking each
file's dependencies (over time, anyway).

i18n API changes
--------------------------------------------------

No longer have to do I18n.scoped calls, just
list i18n as a dependency with the scope and it's
imported already scoped

  require ['i18n!some_scope'], (I18n) ->
    I18n.t 'im_scoped', 'I'm scoped!'

JS bundling now done with r.js, not Jammit
--------------------------------------------------

We don't use jammit to bundle JS anymore. Simply
list dependencies for your JS modules in the file
and RequireJS handles the rest.

To optimize the JavaScript, first make sure you
have node.js 0.4.12+ installed and then run:

  $ rake js:build

The app defaults to the optimized build in
production. You can use non-optimized in
production by putting ?debug_assets=true in the
url just like before.

You can also test the optimized JavaScript in
development with ?optimized_js=true.

Significant changes
--------------------------------------------------

These files have "real" changes to them (unlike
the JavaScript that is simply wrapped in require
and define).  Worth taking a really close look at:

- app/helpers/application_helper.rb
- app/views/layouts/application.html.erb
- config/assets.yml
- config/build.js
- lib/handlebars/handlebars.rb
- lib/i18n_extraction/js_extractor.rb
- lib/tasks/canvas.rake
- lib/tasks/i18n.rake
- lib/tasks/js.rake

Change-Id: I4bc5ecb1231f331aaded0fef2bcc1f3a9fe482a7
Reviewed-on: https://gerrit.instructure.com/6986
Tested-by: Hudson <hudson@instructure.com>
Reviewed-by: Ryan Florence <ryanf@instructure.com>
2012-02-06 16:41:40 -07:00