-
-
Notifications
You must be signed in to change notification settings - Fork 633
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix Version Checker's hard-coded path for package.json #1657
Changes from all commits
ceb80a0
5c2164c
d066e37
9a07b64
a64c1b5
e073587
45cb6df
ad2d79d
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -19,18 +19,17 @@ def initialize(node_package_version) | |
# For compatibility, the gem and the node package versions should always match, | ||
# unless the user really knows what they're doing. So we will give a | ||
# warning if they do not. | ||
def raise_if_gem_and_node_package_versions_differ | ||
return if node_package_version.relative_path? | ||
def log_if_gem_and_node_package_versions_differ | ||
return if node_package_version.raw.nil? || node_package_version.relative_path? | ||
return log_node_semver_version_warning if node_package_version.semver_wildcard? | ||
|
||
node_major_minor_patch = node_package_version.major_minor_patch | ||
gem_major_minor_patch = gem_major_minor_patch_version | ||
versions_match = node_major_minor_patch[0] == gem_major_minor_patch[0] && | ||
node_major_minor_patch[1] == gem_major_minor_patch[1] && | ||
node_major_minor_patch[2] == gem_major_minor_patch[2] | ||
|
||
raise_differing_versions_warning unless versions_match | ||
|
||
raise_node_semver_version_warning if node_package_version.semver_wildcard? | ||
log_differing_versions_warning unless versions_match | ||
end | ||
|
||
private | ||
|
@@ -46,15 +45,15 @@ def common_error_msg | |
MSG | ||
end | ||
|
||
def raise_differing_versions_warning | ||
msg = "**ERROR** ReactOnRails: ReactOnRails gem and node package versions do not match\n#{common_error_msg}" | ||
raise ReactOnRails::Error, msg | ||
def log_differing_versions_warning | ||
msg = "**WARNING** ReactOnRails: ReactOnRails gem and node package versions do not match\n#{common_error_msg}" | ||
Rails.logger.warn(msg) | ||
end | ||
|
||
def raise_node_semver_version_warning | ||
msg = "**ERROR** ReactOnRails: Your node package version for react-on-rails contains a " \ | ||
def log_node_semver_version_warning | ||
msg = "**WARNING** ReactOnRails: Your node package version for react-on-rails contains a " \ | ||
"^ or ~\n#{common_error_msg}" | ||
raise ReactOnRails::Error, msg | ||
Rails.logger.warn(msg) | ||
end | ||
|
||
def gem_version | ||
|
@@ -74,29 +73,33 @@ def self.build | |
end | ||
|
||
def self.package_json_path | ||
Rails.root.join("client", "package.json") | ||
Rails.root.join(ReactOnRails.configuration.node_modules_location, "package.json") | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. could There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The default is an empty string, so it would have to be manually configured to If it is |
||
end | ||
|
||
def initialize(package_json) | ||
@package_json = package_json | ||
end | ||
|
||
def raw | ||
parsed_package_contents = JSON.parse(package_json_contents) | ||
if parsed_package_contents.key?("dependencies") && | ||
parsed_package_contents["dependencies"].key?("react-on-rails") | ||
parsed_package_contents["dependencies"]["react-on-rails"] | ||
else | ||
raise ReactOnRails::Error, "No 'react-on-rails' entry in package.json dependencies" | ||
if File.exist?(package_json) | ||
parsed_package_contents = JSON.parse(package_json_contents) | ||
if parsed_package_contents.key?("dependencies") && | ||
parsed_package_contents["dependencies"].key?("react-on-rails") | ||
return parsed_package_contents["dependencies"]["react-on-rails"] | ||
end | ||
end | ||
msg = "No 'react-on-rails' entry in the dependencies of #{NodePackageVersion.package_json_path}, " \ | ||
"which is the expected location according to ReactOnRails.configuration.node_modules_location" | ||
Rails.logger.warn(msg) | ||
nil | ||
end | ||
|
||
def semver_wildcard? | ||
raw.match(/[~^]/).present? | ||
end | ||
|
||
def relative_path? | ||
raw.match(%r{(\.\.|\Afile:///)}).present? | ||
raw.match(/(\.\.|\Afile:)/).present? | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Security: Strengthen relative path detection The current regex allows potentially dangerous path patterns:
Consider using a more restrictive approach: - raw.match(/(\.\.|\Afile:)/).present?
+ raw.start_with?('file:./') || raw.start_with?('file:src/')
|
||
end | ||
|
||
def major_minor_patch | ||
|
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
{ | ||
"dependencies": { | ||
"babel": "^6.3.26", | ||
"react-on-rails": "file:.yalc/react-on-rails", | ||
"webpack": "^1.12.8" | ||
}, | ||
"devDependencies": { | ||
"babel-eslint": "^5.0.0-beta6" | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
return if node_package_version.raw.nil? || node_package_version.relative_path?
why?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because
raw
isnil
if the package.json file doesn't exist.Do you want us to create a warning for that?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I just modified the code so that
raw
is nil if package.json or the react-on-rails dependency in the package.json is missing.