@zulip/shared - npm Package Compare versions

Comparing version 0.0.5 to 0.0.6

js/emoji.js

@@ -7,3 +7,3 @@ import _ from "lodash";
 // `emojis_by_name` is the central data source that is supposed to be
-// used by every widget in the webapp for gathering data for displaying
+// used by every widget in the web app for gathering data for displaying
 // emojis. Emoji picker uses this data to derive data for its own use.
@@ -10,0 +10,0 @@ export const emojis_by_name = new Map();

js/fenced_code.js

@@ -12,3 +12,3 @@ import katex from "katex";
 const fencestr =
-    "^(~{3,}|`{3,})" + // Opening Fence
+    "^(~{3,}|`{3,})" + // Opening fence
     "[ ]*" + // Spaces
@@ -76,7 +76,5 @@ "(" +
     try {
-        return katex.renderToString(tex, {
-            displayMode: true,
-        });
+        return "<p>" + katex.renderToString(tex, {displayMode: true}) + "</p>";
     } catch {
-        return '<span class="tex-error">' + _.escape(tex) + "</span>";
+        return '<p><span class="tex-error">' + _.escape(tex) + "</span></p>";
     }
@@ -113,59 +111,22 @@ }
         // don't do syntax highlighting yet
-        return (function () {
-            const lines = [];
-            if (lang === "quote") {
-                return {
-                    handle_line(line) {
-                        if (line === fence) {
-                            this.done();
-                        } else {
-                            consume_line(lines, line);
-                        }
-                    },
+        const lines = [];
+        if (lang === "quote") {
+            return {
+                handle_line(line) {
+                    if (line === fence) {
+                        this.done();
+                    } else {
+                        consume_line(lines, line);
+                    }
+                },
 
-                    done() {
-                        const text = wrap_quote(lines.join("\n"));
-                        output_lines.push("", text, "");
-                        handler_stack.pop();
-                    },
-                };
-            }
+                done() {
+                    const text = wrap_quote(lines.join("\n"));
+                    output_lines.push("", text, "");
+                    handler_stack.pop();
+                },
+            };
+        }
 
-            if (lang === "math") {
-                return {
-                    handle_line(line) {
-                        if (line === fence) {
-                            this.done();
-                        } else {
-                            lines.push(line);
-                        }
-                    },
-
-                    done() {
-                        const text = wrap_tex(lines.join("\n"));
-                        const placeholder = stash_func(text, true);
-                        output_lines.push("", placeholder, "");
-                        handler_stack.pop();
-                    },
-                };
-            }
-
-            if (lang === "spoiler") {
-                return {
-                    handle_line(line) {
-                        if (line === fence) {
-                            this.done();
-                        } else {
-                            lines.push(line);
-                        }
-                    },
-
-                    done() {
-                        const text = wrap_spoiler(header, lines.join("\n"), stash_func);
-                        output_lines.push("", text, "");
-                        handler_stack.pop();
-                    },
-                };
-            }
-
+        if (lang === "math") {
             return {
@@ -176,3 +137,3 @@ handle_line(line) {
                     } else {
-                        lines.push(line.trimEnd());
+                        lines.push(line);
                     }
@@ -182,4 +143,3 @@ },
                 done() {
-                    const text = wrap_code(lines.join("\n"), lang);
-                    // insert safe HTML that is passed through the parsing
+                    const text = wrap_tex(lines.join("\n"));
                     const placeholder = stash_func(text, true);
@@ -190,3 +150,39 @@ output_lines.push("", placeholder, "");
             };
-        })();
+        }
+
+        if (lang === "spoiler") {
+            return {
+                handle_line(line) {
+                    if (line === fence) {
+                        this.done();
+                    } else {
+                        lines.push(line);
+                    }
+                },
+
+                done() {
+                    const text = wrap_spoiler(header, lines.join("\n"), stash_func);
+                    output_lines.push("", text, "");
+                    handler_stack.pop();
+                },
+            };
+        }
+
+        return {
+            handle_line(line) {
+                if (line === fence) {
+                    this.done();
+                } else {
+                    lines.push(line.trimEnd());
+                }
+            },
+
+            done() {
+                const text = wrap_code(lines.join("\n"), lang);
+                // insert safe HTML that is passed through the parsing
+                const placeholder = stash_func(text, true);
+                output_lines.push("", placeholder, "");
+                handler_stack.pop();
+            },
+        };
     }
@@ -193,0 +189,0 @@

js/poll_data.js

@@ -0,1 +1,5 @@
+// Any single user should send add a finite number of options
+// to a poll. We arbitrarily pick this value.
+const MAX_IDX = 1000;
+
 export class PollData {
@@ -11,2 +15,3 @@ // This object just holds data for a poll, although it
     constructor({
+        message_sender_id,
         current_user_id,
@@ -19,2 +24,3 @@ is_my_poll,
     }) {
+        this.message_sender_id = message_sender_id;
         this.me = current_user_id;
@@ -99,5 +105,17 @@ this.is_my_poll = is_my_poll;
             inbound: (sender_id, data) => {
+                // All message readers may add a new option to the poll.
                 const idx = data.idx;
+                const option = data.option;
+
+                if (!Number.isInteger(idx) || idx < 0 || idx > MAX_IDX) {
+                    this.report_error_function("poll widget: bad type for inbound option idx");
+                    return;
+                }
+
+                if (typeof option !== "string") {
+                    this.report_error_function("poll widget: bad type for inbound option");
+                    return;
+                }
+
                 const key = sender_id + "," + idx;
-                const option = data.option;
                 const votes = new Map();
@@ -111,3 +129,4 @@
 
-                if (this.my_idx <= idx) {
+                // I may have added a poll option from another device.
+                if (sender_id === this.me && this.my_idx <= idx) {
                     this.my_idx = idx + 1;
@@ -131,2 +150,15 @@ }
             inbound: (sender_id, data) => {
+                // Only the message author can edit questions.
+                if (sender_id !== this.message_sender_id) {
+                    this.report_error_function(
+                        `user ${sender_id} is not allowed to edit the question`,
+                    );
+                    return;
+                }
+
+                if (typeof data.question !== "string") {
+                    this.report_error_function("poll widget: bad type for inbound question");
+                    return;
+                }
+
                 this.set_question(data.question);
@@ -155,4 +187,16 @@ },
             inbound: (sender_id, data) => {
+                // All message readers may vote on poll options.
                 const key = data.key;
                 const vote = data.vote;
+
+                if (typeof key !== "string") {
+                    this.report_error_function("poll widget: bad type for inbound vote key");
+                    return;
+                }
+
+                if (!Number.isInteger(vote) || !(vote === 1 || vote === -1)) {
+                    this.report_error_function("poll widget: bad value for inbound vote count");
+                    return;
+                }
+
                 const option = this.key_to_option.get(key);
@@ -178,4 +222,6 @@
         const type = data.type;
-        if (this.handle[type]) {
+        if (this.handle[type] && this.handle[type].inbound) {
             this.handle[type].inbound(sender_id, data);
+        } else {
+            this.report_error_function(`poll widget: unknown inbound type: ${type}`);
         }
@@ -182,0 +228,0 @@ }

package.json

 {
   "name": "@zulip/shared",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "license": "Apache-2.0",
@@ -5,0 +5,0 @@ "dependencies": {

README.md

@@ -6,3 +6,3 @@ The files in this subtree are part of the Zulip web frontend,
 
- * In the webapp, this code is deployed in the same way as the rest of
+ * In the web app, this code is deployed in the same way as the rest of
    the web frontend: it's part of the server tree, and the browser
@@ -22,1 +22,6 @@ gets it from the server, so the client is always running the same
    commit in the mobile app pulls them in.
+
+To update the version of @zulip/shared on NPM, see the
+[instructions][publishing-shared] in the mobile repo.
+
+[publishing-shared]: https://github.com/zulip/zulip-mobile/blob/master/docs/howto/shared.md#publishing-zulipshared-to-npm

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

32844

increased by5.94%

Lines of code

826

increased by4.16%

Number of lines in readme file

26

increased by23.81%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes