Skip to content

Remove string-replace-webpack-plugin to fix critical security warning. #7127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
na9da wants to merge 3 commits into from
Closed

Remove string-replace-webpack-plugin to fix critical security warning. #7127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1848d61
Remove `string-replace-webpack-plugin` to fix critical security warning.
na9da May 2, 2024
fa838ff
Update CHANGES.md.
na9da May 2, 2024
1dd931a
Merge branch 'main' into remove-string-replace-loader
na9da May 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
#### next release (8.7.2)

- Add NumberParameterEditor to enable WPS AllowedValues Ranges to be set and use DefaultValue
- Show Cesium's original credit message instead of a custom Terria one when using the default Ion access token.

#### 8.7.1 - 2024-04-16

Expand Down
62 changes: 0 additions & 62 deletions buildprocess/configureWebpack.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
const path = require("path");
const CopyPlugin = require("copy-webpack-plugin");
const StringReplacePlugin = require("string-replace-webpack-plugin");
const ForkTsCheckerWebpackPlugin = require("fork-ts-checker-webpack-plugin");
const ForkTsCheckerNotifierWebpackPlugin = require("fork-ts-checker-notifier-webpack-plugin");
const webpack = require("webpack");
Expand Down Expand Up @@ -51,66 +50,6 @@ function configureWebpack(
config.module = config.module || {};
config.module.rules = config.module.rules || [];

config.module.rules.push({
test: /\.js?$/,
include: path.dirname(require.resolve("terriajs-cesium/README.md")),
exclude: [
// require.resolve("terriajs-cesium/Source/ThirdParty/zip"),
// require.resolve("terriajs-cesium/Source/Core/buildModuleUrl"),
// require.resolve("terriajs-cesium/Source/Core/TaskProcessor")
],
loader: StringReplacePlugin.replace({
replacements: [
// {
// pattern: /buildModuleUrl\([\'|\"|\`](.*)[\'|\"|\`]\)/gi,
// replacement: function (match, p1, offset, string) {
// let p1_modified = p1.replace(/\\/g, "\\\\");
// return (
// "require(`" +
// cesiumDir.replace(/\\/g, "\\\\") +
// "/Source/" +
// p1_modified +
// "`)"
// );
// }
// },
{
pattern: /Please assign <i>Cesium.Ion.defaultAccessToken<\/i>/g,
replacement: function () {
return 'Please set "cesiumIonAccessToken" in config.json';
}
},
{
pattern: / before making any Cesium API calls/g,
replacement: function () {
return "";
}
}
Comment on lines -77 to -88

@na9da na9da May 2, 2024

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we really need this?

@tephenavies tephenavies May 2, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's pretty important. The default message is flat out wrong.

@na9da na9da May 2, 2024

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I'll work out a way to include it - I thought it was too small to read.

]
})
});

// The sprintf module included by Cesium includes a license comment with a big
// pile of links, some of which are apparently dodgy and cause Websense to flag
// web workers that include the comment as malicious. So here we munge URLs in
// comments so broken security software doesn't consider them links that a user
// might actually visit.
config.module.rules.push({
test: /\.js?$/,
include: path.resolve(cesiumDir, "Source", "ThirdParty"),
loader: StringReplacePlugin.replace({
replacements: [
{
pattern: /\/\*[\S\s]*?\*\//g, // find multi-line comments
replacement: function (match) {
// replace http:// and https:// with a spelling-out of it.
return match.replace(/(https?):\/\//g, "$1-colon-slashslash ");
}
}
]
})
});

Comment on lines -98 to -113

@na9da na9da May 2, 2024

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sprintf credits this was trying to replace is no longer a dependency of Cesium.

const zipJsDir = path.dirname(require.resolve("@zip.js/zip.js/package.json"));

config.module.rules.push({
Expand Down Expand Up @@ -316,7 +255,6 @@ function configureWebpack(
};

config.plugins = (config.plugins || []).concat([
new StringReplacePlugin(),
new webpack.IgnorePlugin(/^\.\/locale$/, /moment$/)
]);

Expand Down
2 changes: 0 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -172,8 +172,6 @@
"sass-loader": "^10",
"shpjs": "^4.0.4",
"simple-statistics": "^7.0.1",
"string-replace-loader": "^2.1.1",
"string-replace-webpack-plugin": "^0.1.3",
"style-loader": "^0.23.1",
"styled-components": "^5.3.9",
"svg-sprite-loader": "^6.0.11",
Expand Down