Commit abc88c28 authored by yPhil's avatar yPhil
Browse files

Sanitize + Helmet, libs version bump before release

parent b2b9afe9
Pipeline #391627 passed with stage
in 40 seconds
......@@ -5,6 +5,7 @@ const express = require('express'),
pjson = require('./package.json'),
bodyParser = require('body-parser'),
app = express(),
helmet = require("helmet"),
compression = require('compression');
if (!fs.existsSync(path.join(__dirname, pjson.FAVICONS_CACHE_DIR))){
......@@ -12,17 +13,22 @@ if (!fs.existsSync(path.join(__dirname, pjson.FAVICONS_CACHE_DIR))){
}
app.use(compression());
app.set('views', path.join(__dirname, 'views'));
app.engine('html', require('ejs').renderFile);
app.set('view engine', 'html');
app.disable('x-powered-by');
app.use(compression());
app.use('/favicons', express.static(path.join(__dirname, pjson.FAVICONS_CACHE_DIR)));
app.use('/static', express.static(path.join(__dirname, 'public')));
app.use('/bower', express.static(path.join(__dirname, 'bower_components')));
app.use('/', index);
app.use(helmet.originAgentCluster());
app.use(helmet.noSniff());
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: false }));
......
This diff is collapsed.
......@@ -32,11 +32,13 @@
"favrat": "git+https://framagit.org/yphil/favrat.git",
"feedparser": "^2.2.10",
"feedrat": "git+https://framagit.org/yphil/feedrat.git",
"helmet": "^4.4.1",
"iconv": "^3.0.0",
"morgan": "^1.10.0",
"npm": "^7.5.2",
"pm2": "^4.5.4",
"request": "^2.88.2"
"request": "^2.88.2",
"sanitize": "^2.1.0"
},
"devDependencies": {
"mocha": "^8.3.0",
......
@font-face {
font-family: 'fontello';
src: url('../font/fontello.eot?6944280');
src: url('../font/fontello.eot?6944280#iefix') format('embedded-opentype'),
url('../font/fontello.woff2?6944280') format('woff2'),
url('../font/fontello.woff?6944280') format('woff'),
url('../font/fontello.ttf?6944280') format('truetype'),
url('../font/fontello.svg?6944280#fontello') format('svg');
src: url('../font/fontello.eot?17884048');
src: url('../font/fontello.eot?17884048#iefix') format('embedded-opentype'),
url('../font/fontello.woff2?17884048') format('woff2'),
url('../font/fontello.woff?17884048') format('woff'),
url('../font/fontello.ttf?17884048') format('truetype'),
url('../font/fontello.svg?17884048#fontello') format('svg');
font-weight: normal;
font-style: normal;
}
......@@ -15,7 +15,7 @@
@media screen and (-webkit-min-device-pixel-ratio:0) {
@font-face {
font-family: 'fontello';
src: url('../font/fontello.svg?6944280#fontello') format('svg');
src: url('../font/fontello.svg?17884048#fontello') format('svg');
}
}
*/
......@@ -79,4 +79,5 @@
.icon-comments:before { content: '\e822'; } /* '' */
.icon-globe:before { content: '\e823'; } /* '' */
.icon-cloud:before { content: '\e824'; } /* '' */
.icon-error:before { content: '\e825'; } /* '' */
\ No newline at end of file
.icon-error:before { content: '\e825'; } /* '' */
.icon-note:before { content: '\e826'; } /* '' */
\ No newline at end of file
......@@ -851,7 +851,7 @@ ul.help li.rss::before {
ul.help li.publish::before {
content: "\E826";
color: var(--color-ui-success);
color: var(--color-ui-pri);
}
ul.help li.refresh::before {
......
......@@ -163,6 +163,12 @@
"css": "error",
"code": 59429,
"src": "elusive"
},
{
"uid": "29f4bce4a60650057c5248e30baa15a6",
"css": "note",
"code": 59430,
"src": "linecons"
}
]
}
\ No newline at end of file
No preview for this file type
......@@ -55,6 +55,8 @@
<glyph glyph-name="cloud" unicode="&#xe824;" d="M794 506q107 0 184-76t77-184-77-184-184-77l-573 0q-87 0-154 62t-67 147q0 66 48 122t96 79l0 8q0 128 97 220t228 92q102 0 189-59t118-151q4 0 9 1t9 0z m0-416q65 0 110 46t46 110-45 111-110 46q-17 0-42-8l-57-15-10 56q-13 75-71 125t-134 49q-86 0-147-61t-60-146q0-23 4-43l12-62-74 1q-40 0-69-31t-29-74q0-44 30-74t73-30l287 0 0 198-112-113q-7-7-18-7-17 0-24 16t5 29l156 156q6 6 18 7t20-7l156-156q12-13 5-29t-24-16q-11 0-19 7l-111 113 0-198 234 0z" horiz-adv-x="1055" />
<glyph glyph-name="error" unicode="&#xe825;" d="M0 350q0 207 147 354t353 146 354-146 146-354-146-354-354-146-353 146-147 354z m164-133l672 0 0 266-672 0 0-266z" horiz-adv-x="1000" />
<glyph glyph-name="note" unicode="&#xe826;" d="M0-25l0 750q0 39 27 66t67 28l656 0q25 0 45-18l187-187q18-20 18-45l0-594q0-39-27-66t-67-28l-812 0q-39 0-67 28t-27 66z m63 0q0-14 8-23t23-8l812 0q14 0 23 8t8 23l0 563-124 0q-40 0-67 27t-27 66l0 125-625 0q-14 0-23-9t-8-22l0-750z m62 78q0 16 16 16l718 0q16 0 16-16t-16-15l-718 0q-16 0-16 15z m0 94q0 16 16 16l718 0q16 0 16-16t-16-16l-718 0q-16 0-16 16z m0 94q0 15 16 15l718 0q16 0 16-15t-16-16l-718 0q-16 0-16 16z m0 93q0 16 16 16l718 0q16 0 16-16t-16-15l-718 0q-16 0-16 15z m0 110l0 187q0 14 9 23t22 8l219 0q14 0 22-8t9-23l0-187q0-14-9-23t-22-8l-219 0q-13 0-22 8t-9 23z m63 31l156 0 0 125-156 0 0-125z m281-47q0 16 15 16l375 0q16 0 16-16t-16-15l-375 0q-15 0-15 15z m0 94q0 16 15 16l157 0q15 0 15-16t-15-16l-157 0q-15 0-15 16z m0 94q0 15 15 15l157 0q15 0 15-15t-15-16l-157 0q-15 0-15 16z m281 15q0-25 19-44t43-18l125 0-187 187 0-125z" horiz-adv-x="1000" />
</font>
</defs>
</svg>
\ No newline at end of file
No preview for this file type
......@@ -276,7 +276,7 @@ PTL.util = {
position: 'top'
},
{
element: 'fieldset#feedLimit',
element: 'fieldset#feedLimitFieldset',
intro: PTL.tr('How many new items should this feed display at a time?'),
position: 'top'
},
......
......@@ -10,30 +10,18 @@ const express = require('express'),
crypto = require('crypto'),
pjson = require('../package.json'),
Iconv = require('iconv').Iconv,
sanitize = require('sanitize').middleware,
zlib = require('zlib'),
morgan = require('morgan');
require('events').EventEmitter.defaultMaxListeners = 15;
// console.log('####### START ## Version (%s)', pjson.version);
console.error('####### Pétrolette (re)START ## Version (%s)', pjson.version);
process.on('uncaughtException', function(err) {
console.log('### uncaughtException (%s) : ', err);
console.error('### Pétrolette uncaughtException: %s', err);
});
function escape(s) {
if (s) {
return s.replace(/[&"<>]/g, function (c) {
return {
'&': "&amp;",
'"': "&quot;",
'<': "&lt;",
'>': "&gt;"
}[c];
});
}
}
function maybeDecompress (res, encoding) {
var decompress;
if (encoding.match(/\bdeflate\b/)) {
......@@ -120,6 +108,8 @@ function getFeed (urlfeed, callback) {
});
}
router.use(sanitize);
router.get('/feed', function(req, res) {
var dnsreq = request(req.query.feedurl);
......@@ -127,7 +117,7 @@ router.get('/feed', function(req, res) {
dnsreq
.on('error', function(error) {
// The only way so far to catch a DNS error
// console.log('Err: %s (%s)', {error:error.code}, req.query.feedurl);
console.error('Err: %s (%s)', {error:error.code}, req.query.feedurl);
res.send({error:error.code});
})
.on('response', function(response) {
......@@ -203,7 +193,7 @@ router.use(morgan('combined'));
router.get('/', function(req, res) {
res.render('index', {
queryString: escape(req.query.add),
queryString: req.query.add,
version: pjson.version
});
});
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment