mirror of
https://github.com/wekan/wekan.git
synced 2026-11-07 02:52:33 -05:00
Lauri Ojansivu
d6908cf418
A transitive walk from client/main.js found the remaining CommonJS
(module.exports) helpers that the rspack client build pulls into the ES
module graph and rejects: 3 client/lib helpers (cardDragGeometry,
inlinedFormManager, popupOffset), 4 imports/lib helpers (boardAutoScroll,
datePickerTime, fileNameDisplay, staleWhileRevalidate), imports/simpleSchema
(its meteor/aldeed:simple-schema require becomes a namespace import),
imports/i18n/loadHelpers, and 4 more models/lib helpers (cardLinkRedirect,
sandstormAutoOpen, securityCategories, securityLogFormat). All become
`export { ... }`; their .cjs unit tests use `await import(...js)`.
The only CJS files still reachable in the walk are server-only: the
server/lib/* files (Meteor never bundles server/ to the client) and the
fs-using models/lib file-storage helpers (reached only via the server-side
fileStoreStrategy; they would fail on require("fs") if they were actually in
the client bundle). Those correctly stay CommonJS.
Full tests/*.test.cjs suite: same 7 pre-existing failures, no new ones.
22 lines
928 B
JavaScript
22 lines
928 B
JavaScript
'use strict';
|
|
|
|
// Detail sanitizer for the event log (design: docs/Security/Remediation/WeKan.md §4).
|
|
// Events are stored as documents in the existing WeKan database (models/eventLog.js)
|
|
// via normal Meteor JavaScript queries, so there are no file/path/schema helpers
|
|
// here — only the pure, unit-testable text sanitizer. CommonJS so tests/*.test.cjs
|
|
// can load it.
|
|
|
|
const MAX_DETAIL = 500;
|
|
|
|
// Collapse to one line, strip ASCII control chars (incl. newlines/tabs/DEL), and
|
|
// cap length — a hostile/huge detail can never bloat a row, and since it is stored
|
|
// via a Meteor collection insert it is a bound value, never concatenated into a query.
|
|
function sanitizeDetail(s) {
|
|
if (s == null) return '';
|
|
let out = String(s).replace(/[\x00-\x1f\x7f]+/g, ' ').replace(/\s+/g, ' ').trim();
|
|
if (out.length > MAX_DETAIL) out = out.slice(0, MAX_DETAIL - 1) + '…';
|
|
return out;
|
|
}
|
|
|
|
export { MAX_DETAIL, sanitizeDetail };
|