Thanks to Mozilla reviewer several changes has been made

build_and_release.py → .github/workflows/build_and_release.py

@@ -7,14 +7,14 @@
 
 version = os.environ.get("GITHUB_REF").split("/")[-1]
 if version == "dev":
-  version_manifest = "0.0"
+    version_manifest = "0.0"
 else:
-  version_manifest = version.replace("v","")
+    version_manifest = version.replace("v","")
 
-is_tag = os.environ.get("GITHUB_REF").split("/")[-2] == "tags"
-
-gh_user = GitHub(token=os.environ.get("TOKEN_EMAIL"))
-gh_release = GitHub(token=os.environ.get("TOKEN_RELEASE"))
+if os.environ.get("GITHUB_REF") is not None:
+    is_tag = os.environ.get("GITHUB_REF").split("/")[-2] == "tags"
+    gh_user = GitHub(token=os.environ.get("TOKEN_EMAIL"))
+    gh_release = GitHub(token=os.environ.get("TOKEN_RELEASE"))
 
 def create_manifest():
     json_manifest = json.load(open("manifest.json.tpl"))
@@ -34,13 +34,15 @@ def create_manifest():
 
 def create_zip():
     if len(sys.argv) == 2 and sys.argv[1] == "--firefox":
-        zipName = 'splunk_xml_formatter.firefox.%s.zip' % version
+        zipName = 'splunk_xml_formatter.firefox.dev.zip'
     else:
-        zipName = 'splunk_xml_formatter.chrome.%s.zip' % version
+        zipName = 'splunk_xml_formatter.chrome.dev.zip'
     zipf = zipfile.ZipFile(zipName, 'w', zipfile.ZIP_DEFLATED)
-    zipf.write("injector.js")
+    # Add mandatory files
     zipf.write("manifest.json")
     zipf.write("splunk_xml.js")
+    zipf.write("highlightjs.min.js")
+    zipf.write("jquery.min.js")
     zipf.write("splunk_xml.css")
     zipf.write("LICENSE")
     zipf.write("img/splunk-icon-01.png")
@@ -80,6 +82,7 @@ def upload_artifact(zip_file, upload_url):
 
 create_manifest()
 zip_name = create_zip()
+
 release = release_exists()
 if release is None:
     release = create_release()

.github/workflows/main.yml

@@ -15,9 +15,11 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install github3.py      
+        pip install github3.py
+    - name: Validates signature of external libs
+      run: python3 .github/workflows/validate_sha256.py
     - name: Build the manifest
-      run: python3 build_and_release.py
+      run: python3 .github/workflows/build_and_release.py
       env: # Set the secret as an input
         TOKEN_EMAIL: ${{ secrets.TOKEN_EMAIL }}
         TOKEN_RELEASE: ${{ secrets.TOKEN_RELEASE }}      
@@ -33,13 +35,10 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install github3.py
-    - name: List EnvVar used
-      run: |
-        echo "GITHUB_REF=$GITHUB_REF"
-        echo "GITHUB_ACTOR=$GITHUB_ACTOR"
-        echo "GITHUB_REPOSITORY=$GITHUB_REPOSITORY"
+    - name: Validates signature of external libs
+      run: python3 .github/workflows/validate_sha256.py
     - name: Build the manifest
-      run: python3 build_and_release.py --firefox
+      run: python3 .github/workflows/build_and_release.py --firefox
       env: # Set the secret as an input
         TOKEN_EMAIL: ${{ secrets.TOKEN_EMAIL }}
-        TOKEN_RELEASE: ${{ secrets.TOKEN_RELEASE }}     
+        TOKEN_RELEASE: ${{ secrets.TOKEN_RELEASE }}    

.github/workflows/validate_sha256.py

@@ -0,0 +1,27 @@
+import requests
+import hashlib
+import sys
+
+jquery_http_hash = hashlib.sha256()
+highlightjs_http_hash = hashlib.sha256()
+jquery_file_hash = hashlib.sha256()
+highlightjs_file_hash = hashlib.sha256()
+
+jquery = requests.get("https://code.jquery.com/jquery-3.5.1.min.js").text.encode("utf-8")
+highlightjs = requests.get("https://cdnjs.cloudflare.com/ajax/libs/highlight.js/10.0.3/highlight.min.js").text.encode("utf-8")
+
+jquery_file = open("jquery.min.js", "rb").read()
+highlightjs_file = open("highlightjs.min.js", "rb").read()
+
+jquery_http_hash.update(jquery)
+highlightjs_http_hash.update(highlightjs)
+jquery_file_hash.update(jquery_file)
+highlightjs_file_hash.update(highlightjs_file)
+
+if jquery_http_hash.hexdigest() != jquery_file_hash.hexdigest():
+    sys.stderr.writelines("jQuery hash does not match")
+    sys.exit(-1)
+
+if highlightjs_http_hash.hexdigest() != highlightjs_file_hash.hexdigest():
+    sys.stderr.writelines("highlightjs hash does not match")
+    sys.exit(-2)

README.md

@@ -4,17 +4,19 @@ This repo contains the source code of a Chrome/Firefox extension for the LogMana
 By default XML events appear as raw xml without any syntax highlight.
 This extension detect that you are in a Splunk window and perform actions
 
+## Permissions needed:
+- storage
+    - This permission is used to store the CSS style you actually used
+- Read on all tabs / page
+    - This permission is needed to check that the page is a Splunk Page and to inject both button
+
 ## First Stage done behind the scene
 In order to work the extension perform the following actions
-- Inject the `injector.js` on every page
+- Inject the `jquery.min.js` `highlightjs.min.js` `splunk_xml.js` on every page
     - This script check that the html meta tag author is set to Splunk.
 	- With this the extension will not be perform on all page
-- When a Splunk Page is discovered
-	- The scripts add those scripts to the page
-	    - `splunk_xml.js`
-		    - This is the core of the extension
-		- [highlightjs](https://highlightjs.org)
-			- This is a 3rd party script that highlight the XML
+- When a Splunk Page is NOT discovered
+	- The scripts unload highlightjs and jquery
 
 ## Second Stage behind the scene
 All this document refer to `splunk_xml.js`
@@ -32,6 +34,21 @@ All this document refer to `splunk_xml.js`
     b. For each event try to parse as XML
     c. Highligh all event in another div
 2. On click on style
-    a. When another style is selected a new CSS is download and a reference is set in a cookie
+    a. When another style is selected a new CSS is download and a reference is set in a local storage
+
+Github Source: https://github.com/jynolen/splunk_xml_formatter/
+
+## Note for Chrome & Mozilla reviewers
+This addons use 2 external libs:
+    - highlightjs <=> highlightjs.min.js
+    - jquery <=> jquery.min.js
+Here the link for each release:
+    - highlightjs <https://github.com/highlightjs/highlight.js/tree/10.0.3>
+    - jquery <https://github.com/jquery/jquery/tree/3.5.1>
 
-Github Source: https://github.com/jynolen/splunk_xml_formatter/
+Check done at build time:
+    - Validate sha256sum of external libs
+    - jquery.min.js
+        - f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d  
+    - highlightjs.min.js
+        - ff60b70807e6b931a452a2b6995ae191369c06c72847571a134bb6419677521f