-
Notifications
You must be signed in to change notification settings - Fork 5.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove underscore #11869
Closed
Closed
Remove underscore #11869
Changes from 54 commits
Commits
Show all changes
66 commits
Select commit
Hold shift + click to select a range
12da0ed
Move underscore and underscore-tests to deprecated directory
harryadel 91e646f
Remove underscore from tinytest
harryadel bcc5096
Remove underscore from facts-ui
harryadel bbd27c8
Remove underscore from twitter-oauth
harryadel 8db7551
Remove underscore from constraint-solver
harryadel e8a79e2
Set `deprecated: true` to underscore & underscore-tests
harryadel 7f62e44
Remove underscore from geojson-utils
harryadel f044b1b
Remove underscore from test-helpers
harryadel b6f173b
Remove underscore from ecmascript
harryadel 287116e
Remove underscore from webapp-hashing
harryadel 283d9d9
Remove underscore from test-in-console
harryadel 596efb7
Remove underscore from package-version-parser
harryadel f587a68
Remove underscore from test-server-tests-in-console-once
harryadel 6dcb5c2
Remove underscore from reload-safetybelt
harryadel d174454
Remove underscore from boilerplate-generator
harryadel dd72753
Remove underscore from diff-sequence
harryadel c096abb
Remove underscore from mongo
harryadel 2878f30
Remove underscore from logic-solver
harryadel 3bb9e32
Remove underscore from browser policy
harryadel 69b1a06
Remove underscore from browser-policy-content
harryadel 582f1fe
Remove underscore from browser-policy-framing
harryadel abd2205
Remove underscore from socket-stream-client
harryadel 4894707
Remove underscore from ddp-rate-limiter
harryadel 60450ba
Remove underscore from ddp-client
harryadel 4809a55
Remove underscore from ddp-server
harryadel dfd3d87
Remove underscore from meteor
harryadel 8cea140
Remove underscore from webapp
harryadel 69be593
Remove underscore from driver.js in test-in-browser
harryadel 531b318
Fix test-in-browser
harryadel 48ad2a0
Add lodash.isstring and lodash.isobject to constraint-solver
harryadel 4062b56
Fix data.forEach
harryadel 943cd62
Add missing packages for browser-policy-content
harryadel adc4a31
Add missing lodash packages for dpp-client
harryadel a66f7ed
Fix ddp-server name.forEach
harryadel 40ed0d8
Fix logic-solver tests
harryadel 7978481
Fix test-in-browser
harryadel c0db941
Make details assignation dynamic
harryadel da60135
Fix constraint-solver tests
harryadel 9b7d9a1
Fix typo
harryadel 5ec3f6d
Fix webapp tests
harryadel 2bf7bb4
Fix browser-policy tests
harryadel 5986c2d
Fix ddp-client tests
harryadel 988932b
Fix ddp-server tests
harryadel 17cbe59
dynamically get property in filter
harryadel 7c60970
Use npm.require instead of import
harryadel 3af2921
Remove underscore from boilerplate-generator-tests
harryadel 119374f
Fix getSortedVersionRecords
harryadel 6b9eb3d
Use createHash directly
harryadel d81f80e
Remove underscore from docs
harryadel ecabc20
Add guarding for writes
harryadel 07a47b7
Remove underscore reference in meteor-base README
harryadel 51d9208
Upate blaze submodule
harryadel 1f24594
converts paths value to an array
harryadel 47d0892
Merge branch 'devel' into remove-underscore
harryadel 3d329b3
Replace .indexOf check with .includes
harryadel c90380f
Blaze 2.6
StorytellerCZ 45cc549
Merge branch 'devel' of github.com:harryadel/meteor into remove-under…
harryadel 553b464
Merge branch 'devel' into remove-underscore
harryadel 67b83cd
Merge branch 'devel' into remove-underscore
harryadel 1054662
Update blaze to the latest commit
harryadel bf46455
Update blaze-html-templates version
harryadel d87043d
Remove blaze-html-templates version contrainsts in dynamic-import app
harryadel 3f2319a
Merge branch 'devel' into remove-underscore
harryadel ed5cb4f
Update non-core blaze submodule
harryadel 5695939
Update blaze non core submodules
harryadel e25c339
Merge branch 'devel' into remove-underscore
harryadel File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,3 +1,7 @@ | ||
const isEmpty = Npm.require('lodash.isempty'); | ||
const has = Npm.require('lodash.has'); | ||
const union = Npm.require('lodash.union'); | ||
|
||
// By adding this package, you get the following default policy: | ||
// No eval or other string-to-code, and content can only be loaded from the | ||
// same origin as the app (except for XHRs and websocket connections, which can | ||
|
@@ -56,12 +60,12 @@ BrowserPolicy.content = {}; | |
var parseCsp = function (csp) { | ||
var policies = csp.split("; "); | ||
cspSrcs = {}; | ||
_.each(policies, function (policy) { | ||
policies.forEach(function (policy) { | ||
if (policy[policy.length - 1] === ";") | ||
policy = policy.substring(0, policy.length - 1); | ||
var srcs = policy.split(" "); | ||
var directive = srcs[0]; | ||
if (_.indexOf(srcs, keywords.none) !== -1) | ||
if (srcs.indexOf(keywords.none) !== -1) | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Maybe we could use includes here. Should be a tiny bit faster as includes returns boolean. |
||
cspSrcs[directive] = null; | ||
else | ||
cspSrcs[directive] = srcs.slice(1); | ||
|
@@ -72,22 +76,24 @@ var parseCsp = function (csp) { | |
"browser-policy must specify a default-src."); | ||
|
||
// Copy default-src sources to other directives. | ||
_.each(cspSrcs, function (sources, directive) { | ||
cspSrcs[directive] = _.union(sources || [], cspSrcs["default-src"] || []); | ||
Object.entries(cspSrcs).forEach(function ([directive, sources]) { | ||
cspSrcs[directive] = union(sources || [], cspSrcs["default-src"] || []); | ||
}); | ||
}; | ||
|
||
var removeCspSrc = function (directive, src) { | ||
cspSrcs[directive] = _.without(cspSrcs[directive] || [], src); | ||
cspSrcs[directive] = (cspSrcs[directive] || []).filter(function(value) { | ||
return value !== src; | ||
}); | ||
}; | ||
|
||
// Prepare for a change to cspSrcs. Ensure that we have a key in the dictionary | ||
// and clear any cached CSP. | ||
var prepareForCspDirective = function (directive) { | ||
cspSrcs = cspSrcs || {}; | ||
cachedCsp = null; | ||
if (! _.has(cspSrcs, directive)) | ||
cspSrcs[directive] = _.clone(cspSrcs["default-src"]); | ||
if (!has(cspSrcs, directive)) | ||
cspSrcs[directive] = [...cspSrcs["default-src"]]; | ||
}; | ||
|
||
// Add `src` to the list of allowed sources for `directive`, with the | ||
|
@@ -100,7 +106,7 @@ var prepareForCspDirective = function (directive) { | |
// - Trim trailing slashes from `src`, since some browsers interpret | ||
// "foo.com/" as "foo.com" and some don't. | ||
var addSourceForDirective = function (directive, src) { | ||
if (_.contains(_.values(keywords), src)) { | ||
if (Object.values(keywords).includes(src)) { | ||
cspSrcs[directive].push(src); | ||
} else { | ||
var toAdd = []; | ||
|
@@ -123,7 +129,7 @@ var addSourceForDirective = function (directive, src) { | |
} | ||
} | ||
|
||
_.each(toAdd, function (s) { | ||
toAdd.forEach(function (s) { | ||
cspSrcs[directive].push(s); | ||
}); | ||
} | ||
|
@@ -148,23 +154,23 @@ var setWebAppInlineScripts = function (value) { | |
WebAppInternals.setInlineScriptsAllowed(value); | ||
}; | ||
|
||
_.extend(BrowserPolicy.content, { | ||
Object.assign(BrowserPolicy.content, { | ||
allowContentTypeSniffing: function () { | ||
contentSniffingAllowed = true; | ||
}, | ||
// Exported for tests and browser-policy-common. | ||
_constructCsp: function () { | ||
if (! cspSrcs || _.isEmpty(cspSrcs)) | ||
if (! cspSrcs || isEmpty(cspSrcs)) | ||
return null; | ||
|
||
if (cachedCsp) | ||
return cachedCsp; | ||
|
||
var header = _.map(cspSrcs, function (srcs, directive) { | ||
var header = Object.entries(cspSrcs).map(function ([directive, srcs]) { | ||
srcs = srcs || []; | ||
if (_.isEmpty(srcs)) | ||
if (isEmpty(srcs)) | ||
srcs = [keywords.none]; | ||
var directiveCsp = _.uniq(srcs).join(" "); | ||
var directiveCsp = [...new Set(srcs)].join(" "); | ||
return directive + " " + directiveCsp + ";"; | ||
}); | ||
|
||
|
@@ -187,7 +193,7 @@ _.extend(BrowserPolicy.content, { | |
|
||
_keywordAllowed: function (directive, keyword) { | ||
return (cspSrcs[directive] && | ||
_.indexOf(cspSrcs[directive], keyword) !== -1); | ||
cspSrcs[directive].indexOf(keyword) !== -1); | ||
}, | ||
|
||
// Helpers for creating content security policies | ||
|
@@ -228,7 +234,7 @@ _.extend(BrowserPolicy.content, { | |
}, | ||
allowOriginForAll: function (origin) { | ||
prepareForCspDirective("default-src"); | ||
_.each(_.keys(cspSrcs), function (directive) { | ||
Object.keys(cspSrcs).forEach(function (directive) { | ||
addSourceForDirective(directive, origin); | ||
}); | ||
}, | ||
|
@@ -260,12 +266,12 @@ var resources = [ | |
{ methodResource: "Frame", directive: "frame-src" }, | ||
{ methodResource: "FrameAncestors", directive: "frame-ancestors" } | ||
]; | ||
_.each(resources, function (resource) { | ||
var directive = resource.directive; | ||
var methodResource = resource.methodResource; | ||
resources.forEach(function (resource) { | ||
var directive = resource.directive; | ||
var methodResource = resource.methodResource; | ||
var allowMethodName = "allow" + methodResource + "Origin"; | ||
var disallowMethodName = "disallow" + methodResource; | ||
var allowDataMethodName = "allow" + methodResource + "DataUrl"; | ||
var allowDataMethodName = "allow" + methodResource + "DataUrl"; | ||
var allowBlobMethodName = "allow" + methodResource + "BlobUrl"; | ||
var allowSelfMethodName = "allow" + methodResource + "SameOrigin"; | ||
|
||
|
@@ -302,4 +308,4 @@ _.each(resources, function (resource) { | |
|
||
setDefaultPolicy(); | ||
|
||
exports.BrowserPolicy = BrowserPolicy; | ||
exports.BrowserPolicy = BrowserPolicy; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think for docs you will also need to replace underscore in the Meteor theme.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry but I don't understand. Replace underscore as in some config file or Meteor theme code?