mirror of
https://github.com/clusterio/clusterio.git
synced 2026-11-14 23:24:52 +09:00
Remove unused function parseJsString
Remove unused and dangerous parseJsString function from inventoryImports.
This commit is contained in:
1 parent
9c9b4463a4
commit
3b08b73c37
2 files changed
+1
-37
No files matched your search
@@ -3,22 +3,6 @@ const needle = require("needle");
|
||||
const pluginConfig = require("./config")
|
||||
const isJson = require("./isJson")
|
||||
|
||||
// returns JS object, throws if there are syntax errors in input string
|
||||
function parseJsString(string){
|
||||
// eval because my lua is writing a JS object instead of traditional JSON
|
||||
// this was done because I hate escaping strings and there are more quotes
|
||||
// in JSON than JS objects.
|
||||
|
||||
// since eval is unsafe, maybe use https://www.npmjs.com/package/eval-sanitizer
|
||||
if(string.includes("require") || string.includes(";") || string.includes("eval")){
|
||||
throw new Error("parseJsString might have gotten something that could be a xss attempt");
|
||||
}
|
||||
let inventory = "";
|
||||
eval("inventory = " + string);
|
||||
/*console.log(string)
|
||||
console.log(inventory)*/
|
||||
return inventory;
|
||||
}
|
||||
function handleInventory(json, config, callback){
|
||||
/*
|
||||
json is one of these two samples
|
||||
@@ -151,7 +135,6 @@ function pollInventories(outputFile){
|
||||
|
||||
module.exports = {
|
||||
handleInventory: handleInventory,
|
||||
parseJsString: parseJsString,
|
||||
pollInventories: pollInventories,
|
||||
insertItemsFromObject: insertItemsFromObject,
|
||||
}
|
||||
@@ -157,23 +157,4 @@ describe("inventoryImports/interfacingFunctions.js", function(){
|
||||
assert(isFactorioCommand(x) == true);
|
||||
});
|
||||
});
|
||||
describe("parseJsString(string) => object", function(){
|
||||
it("converts a string with JS object notation to object", function(){
|
||||
let x = functions.parseJsString("{hello:'thisAString!', yes:function(){return 'JS string!'}, not:'json'}");
|
||||
assert(!!x == true, "Should under no circumstance return a falsey value, even !!{} is truthy");
|
||||
assert(typeof x == "object", "parseJsString should return an object in this case");
|
||||
assert(typeof x.yes == "function", "parseJsString is not JSON, so it should be able to contain functions");
|
||||
});
|
||||
it("*Tries* to avoid XSS attempts by throwing on certain symbols", function(){
|
||||
assert.throws(function(){
|
||||
let x = functions.parseJsString("{};throw 'fail'");
|
||||
}, function(err) {
|
||||
let error = err+""
|
||||
/* istanbul ignore else */
|
||||
if(error.includes('parseJsString might have gotten something that could be a xss attempt')){
|
||||
return true;
|
||||
}
|
||||
}, "should throw when ; are passed because those are the simplest form of xss");
|
||||
});
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in new issue
Block a user