less-openui5 - npm Package Compare versions

Comparing version 0.9.0 to 0.10.0

CHANGELOG.md

@@ -5,4 +5,15 @@ # Changelog
 
-A list of unreleased changes can be found [here](https://github.com/SAP/less-openui5/compare/v0.9.0...HEAD).
+A list of unreleased changes can be found [here](https://github.com/SAP/less-openui5/compare/v0.10.0...HEAD).
 
+<a name="v0.10.0"></a>
+## [v0.10.0] - 2021-01-29
+### Breaking Changes
+- **Security:** Disable JavaScript execution in Less.js [`c0d3a85`](https://github.com/SAP/less-openui5/commit/c0d3a8572974a20ea6cee42da11c614a54f100e8)
+
+### BREAKING CHANGE
+
+Parser option `javascriptEnabled` has been removed. JavaScript is always
+disabled and cannot be enabled.
+
+
 <a name="v0.9.0"></a>
@@ -85,2 +96,3 @@ ## [v0.9.0] - 2020-11-06
 
+[v0.10.0]: https://github.com/SAP/less-openui5/compare/v0.9.0...v0.10.0
 [v0.9.0]: https://github.com/SAP/less-openui5/compare/v0.8.7...v0.9.0
@@ -87,0 +99,0 @@ [v0.8.7]: https://github.com/SAP/less-openui5/compare/v0.8.6...v0.8.7

lib/thirdparty/less/env.js

@@ -17,3 +17,5 @@ (function (tree) {
         'syncImport',       // option - whether to import synchronously
-        'javascriptEnabled',// option - whether JavaScript is enabled. if undefined, defaults to true
+        /* BEGIN MODIFICATION */
+        // Removed 'javascriptEnabled'
+        /* END MODIFICATION */
         'mime',             // browser only - mime type for sheet import
@@ -20,0 +22,0 @@ 'useFileCache',     // browser only - whether to use the per file session cache

lib/thirdparty/less/functions.js

@@ -216,3 +216,7 @@ (function (tree) {
     e: function (str) {
-        return new(tree.Anonymous)(str instanceof tree.JavaScript ? str.evaluated : str);
+        /* BEGIN MODIFICATION */
+        // Removed handling of tree.JavaScript
+        return new(tree.Anonymous)(str);
+        /* END MODIFICATION */
+
     },
@@ -219,0 +223,0 @@ escape: function (str) {

lib/thirdparty/less/index.js

@@ -115,3 +115,5 @@ var path = require('path'),
 require('./tree/value');
-require('./tree/javascript');
+/* BEGIN MODIFICATION */
+// Removed require('./tree/javascript');
+/* END MODIFICATION */
 require('./tree/assignment');
@@ -118,0 +120,0 @@ require('./tree/condition');

lib/thirdparty/less/lessc_helper.js

@@ -34,3 +34,5 @@ // lessc_helper.js
         console.log("  --no-ie-compat           Disable IE compatibility checks.");
-        console.log("  --no-js                  Disable JavaScript in less files");
+        /* BEGIN MODIFICATION */
+        // Removed --no-js option
+        /* END MODIFICATION */
         console.log("  -l, --lint               Syntax check only (lint).");
@@ -37,0 +39,0 @@ console.log("  -s, --silent             Suppress output of error messages.");

lib/thirdparty/less/README.md

@@ -6,1 +6,5 @@ # less.js
 The files `browser.js` and `rhino.js` have been removed, as they are not relevant for the Node.js implementation.
+
+The file `tree/javascript.js` has been removed to disable JavaScript execution.
+
+Modifications within the files are marked with `/* BEGIN MODIFICATION */` and `/* END MODIFICATION */` comments.

lib/thirdparty/less/tree/quoted.js

@@ -25,3 +25,9 @@ (function (tree) {
         var value = this.value.replace(/`([^`]+)`/g, function (_, exp) {
-            return new(tree.JavaScript)(exp, that.index, true).eval(env).value;
+            /* BEGIN MODIFICATION */
+            // Removed support for javascript
+            const error = new Error("You are using JavaScript, which has been disabled.");
+            error.index = that.index;
+            error.type = "Syntax";
+            throw error;
+            /* END MODIFICATION */
         }).replace(/@\{([\w-]+)\}/g, function (_, name) {
@@ -28,0 +34,0 @@ var v = new(tree.Variable)('@' + name, that.index, that.currentFileInfo).eval(env, true);

package.json

 {
-  "name": "less-openui5",
-  "version": "0.9.0",
-  "description": "Build OpenUI5 themes with Less.js",
-  "scripts": {
-    "lint": "eslint lib test",
-    "unit": "mocha test/*.js",
-    "unit-debug": "mocha --inspect --inspect-brk test/*.js",
-    "test": "npm run lint && npm run unit",
-    "preversion": "npm test",
-    "version": "git-chglog --next-tag v$npm_package_version -o CHANGELOG.md 0.7.0.. && git add CHANGELOG.md",
-    "postversion": "git push --follow-tags",
-    "release-note": "git-chglog -c .chglog/release-config.yml v$npm_package_version"
-  },
-  "main": "lib/index.js",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/SAP/less-openui5.git"
-  },
-  "files": [
-    "CONTRIBUTING.md",
-    "lib/**",
-    "LICENSES/**",
-    ".reuse/**"
-  ],
-  "keywords": [
-    "less",
-    "less.js",
-    "openui5",
-    "theme"
-  ],
-  "author": "SAP SE",
-  "license": "Apache-2.0",
-  "engines": {
-    "node": ">= 10"
-  },
-  "dependencies": {
-    "clone": "^2.1.0",
-    "css": "^3.0.0",
-    "mime": "^1.6.0"
-  },
-  "devDependencies": {
-    "eslint": "^6.8.0",
-    "eslint-config-google": "^0.14.0",
-    "graceful-fs": "^4.2.4",
-    "mocha": "^7.2.0"
-  }
+	"name": "less-openui5",
+	"version": "0.10.0",
+	"description": "Build OpenUI5 themes with Less.js",
+	"author": {
+		"name": "SAP SE",
+		"email": "[e-mail]",
+		"url": "https://www.sap.com"
+	},
+	"license": "Apache-2.0",
+	"keywords": [
+		"openui5",
+		"sapui5",
+		"ui5",
+		"less",
+		"less.js",
+		"theme"
+	],
+	"main": "lib/index.js",
+	"engines": {
+		"node": ">= 10",
+		"npm": ">= 5"
+	},
+	"scripts": {
+		"lint": "eslint ./",
+		"unit": "mocha test/*.js",
+		"unit-debug": "mocha --inspect --inspect-brk test/*.js",
+		"coverage": "nyc npm run unit",
+		"test": "npm run lint && npm run coverage && npm run depcheck",
+		"preversion": "npm test",
+		"version": "git-chglog --next-tag v$npm_package_version -o CHANGELOG.md 0.7.0.. && git add CHANGELOG.md",
+		"postversion": "git push --follow-tags",
+		"release-note": "git-chglog -c .chglog/release-config.yml v$npm_package_version",
+		"depcheck": "depcheck --ignores clean-css,source-map"
+	},
+	"files": [
+		"CONTRIBUTING.md",
+		"lib/**",
+		"LICENSES/**",
+		".reuse/**"
+	],
+	"nyc": {
+		"reporter": [
+			"lcov",
+			"text",
+			"text-summary"
+		],
+		"exclude": [
+			"coverage/**",
+			"test/**",
+			".eslintrc.js",
+			"lib/thirdparty/**"
+		],
+		"check-coverage": true,
+		"statements": 90,
+		"branches": 85,
+		"functions": 90,
+		"lines": 90,
+		"watermarks": {
+			"statements": [
+				70,
+				90
+			],
+			"branches": [
+				70,
+				90
+			],
+			"functions": [
+				70,
+				90
+			],
+			"lines": [
+				70,
+				90
+			]
+		},
+		"cache": true,
+		"all": true
+	},
+	"repository": {
+		"type": "git",
+		"url": "[e-mail]:SAP/less-openui5.git"
+	},
+	"dependencies": {
+		"clone": "^2.1.0",
+		"css": "^3.0.0",
+		"mime": "^1.6.0"
+	},
+	"devDependencies": {
+		"depcheck": "^1.3.1",
+		"eslint": "^6.8.0",
+		"eslint-config-google": "^0.14.0",
+		"graceful-fs": "^4.2.4",
+		"mocha": "^7.2.0",
+		"nyc": "^15.1.0"
+	}
 }

README.md

@@ -152,4 +152,7 @@ ![OpenUI5](http://openui5.org/images/OpenUI5_new_big_side.png)
 Options for the [less](http://lesscss.org) parser (`less.Parser`).  
-**Note:** Default of `relativeUrls` option is changed from `false` to `true`.
 
+**Note**
+- Default of `relativeUrls` option is changed from `false` to `true`.
+- Option `javascriptEnabled` has been removed. JavaScript is always disabled and cannot be enabled.
+
 ##### compiler
@@ -156,0 +159,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Improved metrics

Number of lines in readme file

264

increased by1.15%

Number of medium supply chain risk alerts

0

decreased by-100%

Worsened metrics

Total package byte prevSize

360762

decreased by-0.09%

Dev dependency count

6

increased by50%

Number of package files

61

decreased by-1.61%

Lines of code

8159

decreased by-0.49%

No dependency changes