Remove unused function parseJsString

Remove unused and dangerous parseJsString function from
inventoryImports.
This commit is contained in:
Hornwitser committed 2019-08-24 11:55:19 +02:00
1 parent 9c9b4463a4
commit 3b08b73c37
2 files changed
+1 -37

No files matched your search

@@ -3,22 +3,6 @@ const needle = require("needle");
const pluginConfig = require("./config")
const isJson = require("./isJson")
// returns JS object, throws if there are syntax errors in input string
function parseJsString(string){
// eval because my lua is writing a JS object instead of traditional JSON
// this was done because I hate escaping strings and there are more quotes
// in JSON than JS objects.
// since eval is unsafe, maybe use https://www.npmjs.com/package/eval-sanitizer
if(string.includes("require") || string.includes(";") || string.includes("eval")){
throw new Error("parseJsString might have gotten something that could be a xss attempt");
}
let inventory = "";
eval("inventory = " + string);
/*console.log(string)
console.log(inventory)*/
return inventory;
}
function handleInventory(json, config, callback){
/*
json is one of these two samples
@@ -151,7 +135,6 @@ function pollInventories(outputFile){
module.exports = {
handleInventory: handleInventory,
parseJsString: parseJsString,
pollInventories: pollInventories,
insertItemsFromObject: insertItemsFromObject,
}
@@ -157,23 +157,4 @@ describe("inventoryImports/interfacingFunctions.js", function(){
assert(isFactorioCommand(x) == true);
});
});
describe("parseJsString(string) => object", function(){
it("converts a string with JS object notation to object", function(){
let x = functions.parseJsString("{hello:'thisAString!', yes:function(){return 'JS string!'}, not:'json'}");
assert(!!x == true, "Should under no circumstance return a falsey value, even !!{} is truthy");
assert(typeof x == "object", "parseJsString should return an object in this case");
assert(typeof x.yes == "function", "parseJsString is not JSON, so it should be able to contain functions");
});
it("*Tries* to avoid XSS attempts by throwing on certain symbols", function(){
assert.throws(function(){
let x = functions.parseJsString("{};throw 'fail'");
}, function(err) {
let error = err+""
/* istanbul ignore else */
if(error.includes('parseJsString might have gotten something that could be a xss attempt')){
return true;
}
}, "should throw when ; are passed because those are the simplest form of xss");
});
});
});
});