From 015e1b5291f5d0965c10f2cb3d0baeb50f2a2d59 Mon Sep 17 00:00:00 2001 From: Patrick East Date: Mon, 16 Mar 2020 12:57:34 -0700 Subject: [PATCH] docs: Update acorn to fix CVE with dev tooling Fixing https://github.com/advisories/GHSA-7fhm-mqm4-2wp7 This also fixes the unit tests (not sure how long they've been borken) and makes them run as part of the netlify preview build, so any regressions should be seen in PR's. Signed-off-by: Patrick East --- Makefile | 2 +- docs/website/scripts/live-blocks/package-lock.json | 14 +++++++++++--- docs/website/scripts/live-blocks/package.json | 3 ++- docs/website/scripts/live-blocks/src/helpers.js | 14 +++++++++++++- .../scripts/live-blocks/test/helpers.test.js | 13 +------------ 5 files changed, 28 insertions(+), 18 deletions(-) diff --git a/Makefile b/Makefile index 8247ce0724..28d2f24ced 100644 --- a/Makefile +++ b/Makefile @@ -255,7 +255,7 @@ release-bugfix-travis: deploy-travis netlify-prod: clean docs-clean build docs-generate docs-production-build .PHONY: netlify-preview -netlify-preview: clean docs-clean build docs-generate docs-preview-build +netlify-preview: clean docs-clean build docs-live-blocks-install-deps docs-live-blocks-test docs-generate docs-preview-build ###################################################### # diff --git a/docs/website/scripts/live-blocks/package-lock.json b/docs/website/scripts/live-blocks/package-lock.json index a97144d5bf..69c6316b94 100644 --- a/docs/website/scripts/live-blocks/package-lock.json +++ b/docs/website/scripts/live-blocks/package-lock.json @@ -921,9 +921,9 @@ } }, "acorn": { - "version": "6.2.1", - "resolved": "https://registry.npmjs.org/acorn/-/acorn-6.2.1.tgz", - "integrity": "sha512-JD0xT5FCRDNyjDda3Lrg/IxFscp9q4tiYtxE1/nOzlKCk7hIRuYjhq1kCNkbPjMRMZuFq20HNQn1I9k8Oj0E+Q==", + "version": "7.1.1", + "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.1.1.tgz", + "integrity": "sha512-add7dgA5ppRPxCFJoAGfMDi7PIBXq1RtGo7BhbLaxwrXPOmw8gq48Y9ozT01hUKy9byMjlR20EJhu5zlkErEkg==", "dev": true }, "alphanum-sort": { @@ -3510,6 +3510,14 @@ "@types/estree": "0.0.39", "@types/node": "^12.6.2", "acorn": "^6.2.0" + }, + "dependencies": { + "acorn": { + "version": "6.4.1", + "resolved": "https://registry.npmjs.org/acorn/-/acorn-6.4.1.tgz", + "integrity": "sha512-ZVA9k326Nwrj3Cj9jlh3wGFutC2ZornPNARZwsNYqQYgN0EsV2d53w5RN/co65Ohn4sUAUtb1rSUAOD6XN9idA==", + "dev": true + } } }, "rollup-plugin-babel": { diff --git a/docs/website/scripts/live-blocks/package.json b/docs/website/scripts/live-blocks/package.json index 89280db04d..d30e00a875 100644 --- a/docs/website/scripts/live-blocks/package.json +++ b/docs/website/scripts/live-blocks/package.json @@ -46,6 +46,7 @@ "rollup-plugin-terser": "^5.1.1", "sinon": "^7.4.1", "sort-package-json": "^1.22.1", - "serialize-javascript": ">=2.1.1" + "serialize-javascript": ">=2.1.1", + "acorn": ">=6.4.1" } } diff --git a/docs/website/scripts/live-blocks/src/helpers.js b/docs/website/scripts/live-blocks/src/helpers.js index c9aa2040fa..9f39ad5044 100644 --- a/docs/website/scripts/live-blocks/src/helpers.js +++ b/docs/website/scripts/live-blocks/src/helpers.js @@ -80,7 +80,19 @@ export function getAllGroupModules(groups, groupName) { return out.reverse() // Correct the order } -// Returns an object of the form {module: string, package: string[, input: value][, query: string][, included: map[filename]string}, throws an error with a human-readable message if the specified or any included groups don't have modules, the group's package cannot be found, or if the input cannot be parsed. +// Returns an object of the form +// +// { +// module: string, +// package: string +// input: value +// query: string, +// included: map[filename]string +// } +// +// Throws an error with a human-readable message if the specified or any +// included groups don't have modules, the group's package cannot be found, or +// if the input cannot be parsed. export function getGroupData(groups, groupName) { const queryBlock = getGroupField(groups, groupName, BLOCK_TYPES.QUERY) const inputBlock = getGroupField(groups, groupName, BLOCK_TYPES.INPUT) diff --git a/docs/website/scripts/live-blocks/test/helpers.test.js b/docs/website/scripts/live-blocks/test/helpers.test.js index 9e96ab22ac..13b28fb274 100644 --- a/docs/website/scripts/live-blocks/test/helpers.test.js +++ b/docs/website/scripts/live-blocks/test/helpers.test.js @@ -247,18 +247,7 @@ describe('getGroupData', () => { 'a': {module: {get: () => 'package foo\na'}}, 'a/b/c': {module: {get: () => 'c'}, output: {tags: ['include(d)']}}, 'd': {module: {get: () => 'd'}} - }, 'a/b/c').included.d).to.equal('d') - }) - - it('doesn\'t mutate groups', () => { - const groups = { - 'a': {input: {get: () => '{}'}, module: {get: () => 'package foo\na'}}, // Will error if gets from this parent - 'a/b/c': {query: {get: () => 'foobar'}, module: {get: () => 'c'}} - } - const arg = Object.fromEntries(Object.entries(groups).map(([key, value]) => [key, Object.assign({}, value)])) // depth 2 object clone - - getGroupData(arg, 'a/b/c/d') - expect(arg).to.deep.equal(groups) + }, 'a/b/c').included["d.rego"]).to.equal('d') }) })