bckelley/cgm-remote-monitor
1
0
Fork 0
mirror of https://github.com/bckelley/cgm-remote-monitor.git synced 2026-08-24 03:14:12 -05:00
Code Issues Packages Projects Releases Wiki Activity

resolve npm audit security fixes (#3721)

Browse Source 
* upgrade mocha from 3.5.3 to 5.0.5

This resolves these security issues

  Low             Regular Expression Denial of Service
  Package         debug
  Dependency of   mocha [dev]
  Path            mocha > debug
  More info       https://nodesecurity.io/advisories/534

  Critical        Command Injection
  Package         growl
  Dependency of   mocha [dev]
  Path            mocha > growl
  More info       https://nodesecurity.io/advisories/146

* upgrade mocha and start modularizing lodash to make sure tests pass

* more lodash modularization

* upgrade mqtt to 2.18.3

* allow npm 6.2

* upgrade share2nightscout-bridge

* incorporate express-extension-to-accept into Nightscout

the packages seems not maintained (github page is 404) and has a security issue with mime package.  so upgraded and included into Nightscout code.

if somebody knows a more efficient way of programming this with express4 please PR

* update jsdom for security fixes

* prevent wrapping of hour labels by removing the space

* Revert "update jsdom for security fixes"

This reverts commit 04f1f39d636d8d79c6b01b5f298f9a6cea3dc645.

* Revert "more lodash modularization"

This reverts commit c4fa5304db9f16b94f15c2b44793a5a11d595885.

* remove forever dependency

* Revert "Revert "more lodash modularization""

This reverts commit b13c274ebff0b5c3a48ffc0e610ca85a9f8d25bc.

* fix report.test.js with newer packages

sometimes a fix is very easy. This is to prevent:

```
Deprecation warning: value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are discouraged and will be removed in an upcoming major release. Please refer to http://momentjs.com/guides/#/warnings/js-date/ for more info.
Arguments:
[0] _isAMomentObject: true, _isUTC: true, _useUTC: true, _l: undefined, _i: T00:00:00, _f: undefined, _strict: undefined, _locale: [object Object]
Error
    at Function.createFromInputFallback (XXX\cgm-remote-monitor\tmp\js\bundle.js:117408:98)
    at configFromString (XXX\cgm-remote-monitor\tmp\js\bundle.js:119456:15)
```

We must use ISO8601 formatted strings and not use slashes in dates, see https://github.com/moment/moment/issues/1407#issuecomment-155630060

* upgrade webpack to 4.16.2

* Update package.json
This commit is contained in:
PieterGit
2018-07-24 20:25:44 +03:00
committed by Sulka Haro
parent 257193462a
commit 71103bb4b7
18 changed files with 1645 additions and 1502 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Procfile
+1 -1
View File
@@ -1 +1 @@
web: ./node_modules/.bin/forever --minUptime 100 -c node server.js
web: node server.js
app.js
+2 -2
View File
@@ -1,6 +1,6 @@
'use strict';
var _ = require('lodash');
var _get = require('lodash/get');
var express = require('express');
var compression = require('compression');
var bodyParser = require('body-parser');
@@ -29,7 +29,7 @@ function create(env, ctx) {
}
if (env.settings.isEnabled('cors')) {
var allowOrigin = _.get(env, 'extendedSettings.cors.allowOrigin') || '*';
var allowOrigin = _get(env, 'extendedSettings.cors.allowOrigin') || '*';
console.info('Enabled CORS, allow-origin:', allowOrigin);
app.use(function allowCrossDomain(req, res, next) {
res.header('Access-Control-Allow-Origin', allowOrigin);
env.js
+11 -6
View File
@@ -1,6 +1,11 @@
'use strict';
var _ = require('lodash');
var _each = require('lodash/each');
var _trim = require('lodash/trim');
var _forIn = require('lodash/forIn');
var _startsWith = require('lodash/startsWith');
var _camelCase = require('lodash/camelCase');
var fs = require('fs');
var crypto = require('crypto');
var consts = require('./lib/constants');
@@ -168,16 +173,16 @@ function findExtendedSettings (envs) {
return key.toUpperCase().replace('CUSTOMCONNSTR_', '');
}
_.each(env.settings.enable, function eachEnable(enable) {
if (_.trim(enable)) {
_.forIn(envs, function eachEnvPair (value, key) {
_each(env.settings.enable, function eachEnable(enable) {
if (_trim(enable)) {
_forIn(envs, function eachEnvPair (value, key) {
var env = normalizeEnv(key);
if (_.startsWith(env, enable.toUpperCase() + '_')) {
if (_startsWith(env, enable.toUpperCase() + '_')) {
var split = env.indexOf('_');
if (split > -1 && split <= env.length) {
var exts = extended[enable] || {};
extended[enable] = exts;
var ext = _.camelCase(env.substring(split + 1).toLowerCase());
var ext = _camelCase(env.substring(split + 1).toLowerCase());
if (!isNaN(value)) { value = Number(value); }
if (typeof value === 'string' && (value.toLowerCase() === 'on' || value.toLowerCase() === 'true')) { value = true; }
if (typeof value === 'string' && (value.toLowerCase() === 'off' || value.toLowerCase() === 'false')) { value = false; }
lib/admin_plugins/index.js
+4 -3
View File
@@ -1,6 +1,7 @@
'use strict';
var _ = require('lodash');
var _find = require('lodash/find');
var _each = require('lodash/each');
function init() {
var allPlugins = [
@@ -12,14 +13,14 @@ function init() {
function plugins(name) {
if (name) {
return _.find(allPlugins, {name: name});
return _find(allPlugins, {name: name});
} else {
return plugins;
}
}
plugins.eachPlugin = function eachPlugin(f) {
_.each(allPlugins, f);
_each(allPlugins, f);
};
plugins.createHTML = function createHTML(client) {
lib/api/activity/index.js
+7 -4
View File
@@ -1,6 +1,9 @@
'use strict';
var _ = require('lodash');
var _forEach = require('lodash/forEach');
var _isNil = require('lodash/isNil');
var _isArray = require('lodash/isArray');
var consts = require('../../constants');
var moment = require('moment');
@@ -36,7 +39,7 @@ function configure(app, wares, ctx) {
ctx.activity.list(req.query, function(err, results) {
var d1 = null;
_.forEach(results, function clean(t) {
_forEach(results, function clean(t) {
var d2 = null;
@@ -55,7 +58,7 @@ function configure(app, wares, ctx) {
}
});
if (!_.isNil(d1)) res.setHeader('Last-Modified', d1.toUTCString());
if (!_isNil(d1)) res.setHeader('Last-Modified', d1.toUTCString());
if (ifModifiedSince && d1.getTime() <= moment(ifModifiedSince).valueOf()) {
res.status(304).send({
@@ -75,7 +78,7 @@ function configure(app, wares, ctx) {
function post_response(req, res) {
var activity = req.body;
if (!_.isArray(activity)) {
if (!_isArray(activity)) {
activity = [activity];
};
lib/api/alexa/index.js
+3 -4
View File
@@ -1,8 +1,7 @@
'use strict';
var moment = require('moment');
var _ = require('lodash');
var _each = require('lodash/each');
function configure (app, wares, ctx, env) {
var entries = ctx.entries;
@@ -21,7 +20,7 @@ function configure (app, wares, ctx, env) {
if (plugin.alexa) {
if (plugin.alexa.intentHandlers) {
console.log(plugin.name + ' is Alexa enabled');
_.each(plugin.alexa.intentHandlers, function (route) {
_each(plugin.alexa.intentHandlers, function (route) {
if (route) {
ctx.alexa.configureIntentHandler(route.intent, route.intentHandler, route.routableSlot, route.slots);
}
@@ -29,7 +28,7 @@ function configure (app, wares, ctx, env) {
}
if (plugin.alexa.rollupHandlers) {
console.log(plugin.name + ' is Alexa rollup enabled');
_.each(plugin.alexa.rollupHandlers, function (route) {
_each(plugin.alexa.rollupHandlers, function (route) {
console.log('Route');
console.log(route);
if (route) {
lib/api/entries/index.js
+11 -7
View File
@@ -1,6 +1,10 @@
'use strict';
var _ = require('lodash');
var _last = require('lodash/last');
var _isNil = require('lodash/isNil');
var _first = require('lodash/first');
var _includes = require('lodash/includes');
var consts = require('../../constants');
var es = require('event-stream');
var sgvdata = require('sgvdata');
@@ -77,11 +81,11 @@ function configure(app, wares, ctx) {
function ifModifiedSinceCTX(req, res, next) {
var lastEntry = _.last(ctx.ddata.sgvs);
var lastEntry = _last(ctx.ddata.sgvs);
var lastEntryDate = null;
if (!_.isNil(lastEntry)) {
lastEntryDate = new Date(_.last(ctx.ddata.sgvs).mills);
if (!_isNil(lastEntry)) {
lastEntryDate = new Date(_last(ctx.ddata.sgvs).mills);
res.setHeader('Last-Modified', lastEntryDate.toUTCString());
}
@@ -140,10 +144,10 @@ function configure(app, wares, ctx) {
res.entries.sort(compare);
var lastEntry = _.first(res.entries);
var lastEntry = _first(res.entries);
var lastEntryDate = null;
if (!_.isNil(lastEntry)) {
if (!_isNil(lastEntry)) {
if (lastEntry.mills) lastEntryDate = new Date(lastEntry.mills);
if (!lastEntry.mills && lastEntry.date) lastEntryDate = new Date(lastEntry.date);
res.setHeader('Last-Modified', lastEntryDate.toUTCString());
@@ -626,7 +630,7 @@ curl -s -g 'http://localhost:1337/api/v1/times/20{14..15}/T{13..18}:{00..15}'.js
* by default.
*/
function prep_storage(req, res, next) {
if (req.params.storage && _.includes(['entries', 'treatments', 'devicestatus'], req.params.storage)) {
if (req.params.storage && _includes(['entries', 'treatments', 'devicestatus'], req.params.storage)) {
req.storage = ctx[req.params.storage];
} else {
req.storage = ctx.entries;
lib/api/index.js
+2 -2
View File
@@ -1,7 +1,7 @@
'use strict';
function create (env, ctx) {
var _ = require('lodash')
var _each = require('lodash/each')
, express = require('express')
, app = express( )
;
@@ -22,7 +22,7 @@ function create (env, ctx) {
if (env.settings.enable) {
app.extendedClientSettings = ctx.plugins && ctx.plugins.extendedClientSettings ? ctx.plugins.extendedClientSettings(env.extendedSettings) : {};
_.each(env.settings.enable, function (enable) {
_each(env.settings.enable, function (enable) {
console.info('enabling feature:', enable);
app.enable(enable);
});
lib/api/properties.js
+8 -5
View File
@@ -1,6 +1,9 @@
'use strict';
var _ = require('lodash');
var _isEmpty = require('lodash/isEmpty');
var _filter = require('lodash/filter');
var _pick = require('lodash/pick');
var express = require('express');
var sandbox = require('../sandbox')();
@@ -22,21 +25,21 @@ function create (env, ctx) {
ctx.plugins.setProperties(sbx);
function notEmpty (part) {
return ! _.isEmpty(part);
return ! _isEmpty(part);
}
var segments = _.filter(req.path.split('/'), notEmpty);
var segments = _filter(req.path.split('/'), notEmpty);
var selected = [ ];
if (segments.length > 0) {
selected = _.filter(segments[0].split(','), notEmpty);
selected = _filter(segments[0].split(','), notEmpty);
}
var result = sbx.properties;
if (selected.length > 0) {
result = _.pick(sbx.properties, selected);
result = _pick(sbx.properties, selected);
}
if (req.query && req.query.pretty) {
lib/api/treatments/index.js
+7 -4
View File
@@ -1,6 +1,9 @@
'use strict';
var _ = require('lodash');
var _forEach = require('lodash/forEach');
var _isNil = require('lodash/isNil');
var _isArray = require('lodash/isArray');
var consts = require('../../constants');
var moment = require('moment');
@@ -36,7 +39,7 @@ function configure(app, wares, ctx) {
ctx.treatments.list(req.query, function(err, results) {
var d1 = null;
_.forEach(results, function clean(t) {
_forEach(results, function clean(t) {
t.carbs = Number(t.carbs);
t.insulin = Number(t.insulin);
@@ -57,7 +60,7 @@ function configure(app, wares, ctx) {
}
});
if (!_.isNil(d1)) res.setHeader('Last-Modified', d1.toUTCString());
if (!_isNil(d1)) res.setHeader('Last-Modified', d1.toUTCString());
if (ifModifiedSince && d1.getTime() <= moment(ifModifiedSince).valueOf()) {
res.status(304).send({
@@ -77,7 +80,7 @@ function configure(app, wares, ctx) {
function post_response(req, res) {
var treatments = req.body;
if (!_.isArray(treatments)) {
if (!_isArray(treatments)) {
treatments = [treatments];
};
lib/language.js
+5 -5
View File
@@ -4383,7 +4383,7 @@ function init() {
,pl: '2h'
,ru: '2ч'
,sk: '2 hod'
,nl: '2 uur'
,nl: '2uur'
,ko: '2시간'
,zh_cn: '2小时'
,zh_tw: '2小時'
@@ -4406,7 +4406,7 @@ function init() {
,pl: '3h'
,ru: '3ч'
,sk: '3 hod'
,nl: '3 uur'
,nl: '3uur'
,ko: '3시간'
,zh_cn: '3小时'
,zh_tw: '3小時'
@@ -4429,7 +4429,7 @@ function init() {
,pl: '6h'
,ru: '6ч'
,sk: '6 hod'
,nl: '6 uur'
,nl: '6uur'
,ko: '6시간'
,zh_cn: '6小时'
,zh_tw: '6小時'
@@ -4452,7 +4452,7 @@ function init() {
,pl: '12h'
,ru: '12ч'
,sk: '12 hod'
,nl: '12 uur'
,nl: '12uur'
,ko: '12시간'
,zh_cn: '12小时'
,zh_tw: '12小時'
@@ -4475,7 +4475,7 @@ function init() {
,pl: '24h'
,ru: '24ч'
,sk: '24 hod'
,nl: '24 uur'
,nl: '24uur'
,ko: '24시간'
,zh_cn: '24小时'
,zh_tw: '24小時'
lib/middleware/express-extension-to-accept.js
+41
View File
@@ -0,0 +1,41 @@
var mime = require('mime')
var url = require('url')
module.exports = function (formats) {
if (!Array.isArray(formats))
throw new TypeError('Formats must be an array.')
var getType = Object.create(null)
formats.forEach(function (format) {
if (!/^\w+$/.test(format))
throw new TypeError('Invalid format - must be a word.')
var type = getType[format] = mime.getType(format)
if (!type || type === 'application/octet-stream')
throw new Error('Invalid format.')
})
var regexp = new RegExp('\.(' + formats.join('|') + ')$', 'i')
return function (req, res, next) {
var match = req.path.match(regexp)
if (!match)
return next()
var type = getType[match[1]]
if (!type)
return next()
req.extToAccept = {
url: req.url,
accept: req.headers.accept
}
req.headers.accept = type
var parsed = url.parse(req.url)
parsed.pathname = req.path.replace(regexp, '')
req.url = url.format(parsed)
next()
}
}
lib/middleware/index.js
+1 -1
View File
@@ -7,7 +7,7 @@ var wares = {
};
function extensions (list) {
return require('express-extension-to-accept')(list);
return require('./express-extension-to-accept')(list);
}
function configure (env) {
lib/plugins/index.js
+18 -13
View File
@@ -1,6 +1,11 @@
'use strict';
var _ = require('lodash');
var _find = require('lodash/find');
var _each = require('lodash/each');
var _filter = require('lodash/filter');
var _get = require('lodash/get');
var _isArray = require('lodash/isArray');
var _map = require('lodash/map');
function init (ctx) {
@@ -9,7 +14,7 @@ function init (ctx) {
function plugins(name) {
if (name) {
return _.find(allPlugins, {name: name});
return _find(allPlugins, {name: name});
} else {
return plugins;
}
@@ -78,19 +83,19 @@ function init (ctx) {
};
plugins.register = function register(all) {
_.each(all, function eachPlugin(plugin) {
_each(all, function eachPlugin(plugin) {
allPlugins.push(plugin);
});
enabledPlugins = [];
var enable = _.get(ctx, 'settings.enable');
var enable = _get(ctx, 'settings.enable');
function isEnabled(plugin) {
//TODO: unify client/server env/app
return enable && enable.indexOf(plugin.name) > -1;
}
_.each(allPlugins, function eachPlugin(plugin) {
_each(allPlugins, function eachPlugin(plugin) {
plugin.enabled = isEnabled(plugin);
if (plugin.enabled) {
enabledPlugins.push(plugin);
@@ -100,28 +105,28 @@ function init (ctx) {
};
plugins.eachPlugin = function eachPlugin(f) {
_.each(allPlugins, f);
_each(allPlugins, f);
};
plugins.eachEnabledPlugin = function eachEnabledPlugin(f) {
_.each(enabledPlugins, f);
_each(enabledPlugins, f);
};
//these plugins are either always on or have custom settings
plugins.specialPlugins = 'ar2 bgnow delta direction timeago upbat rawbg errorcodes profile';
plugins.shownPlugins = function(sbx) {
return _.filter(enabledPlugins, function filterPlugins(plugin) {
return _filter(enabledPlugins, function filterPlugins(plugin) {
return plugins.specialPlugins.indexOf(plugin.name) > -1 || (sbx && sbx.showPlugins && sbx.showPlugins.indexOf(plugin.name) > -1);
});
};
plugins.eachShownPlugins = function eachShownPlugins(sbx, f) {
_.each(plugins.shownPlugins(sbx), f);
_each(plugins.shownPlugins(sbx), f);
};
plugins.hasShownType = function hasShownType(pluginType, sbx) {
return _.find(plugins.shownPlugins(sbx), function findWithType(plugin) {
return _find(plugins.shownPlugins(sbx), function findWithType(plugin) {
return plugin.pluginType === pluginType;
}) !== undefined;
};
@@ -155,7 +160,7 @@ function init (ctx) {
plugins.eachEnabledPlugin(function eachPlugin(plugin) {
if (plugin.getEventTypes) {
var eventTypes = plugin.getEventTypes(sbx.withExtendedSettings(plugin));
if (_.isArray(eventTypes)) {
if (_isArray(eventTypes)) {
all = all.concat(eventTypes);
}
}
@@ -165,14 +170,14 @@ function init (ctx) {
};
plugins.enabledPluginNames = function enabledPluginNames() {
return _.map(enabledPlugins, function mapped(plugin) {
return _map(enabledPlugins, function mapped(plugin) {
return plugin.name;
}).join(' ');
};
plugins.extendedClientSettings = function extendedClientSettings (allExtendedSettings) {
var clientSettings = {};
_.each(clientDefaultPlugins, function eachClientPlugin (plugin) {
_each(clientDefaultPlugins, function eachClientPlugin (plugin) {
clientSettings[plugin.name] = allExtendedSettings[plugin.name];
});
lib/plugins/pluginbase.js
+4 -3
View File
@@ -1,6 +1,7 @@
'use strict';
var _ = require('lodash');
var _map = require('lodash/map');
var _each = require('lodash/each');
var TOOLTIP_WIDTH = 275; //min-width + padding
@@ -78,7 +79,7 @@ function init (majorPills, minorPills, statusPills, bgStatus, tooltip) {
}
if (options.info && options.info.length) {
var html = _.map(options.info, function mapInfo (i) {
var html = _map(options.info, function mapInfo (i) {
return '<strong>' + i.label + '</strong> ' + i.value;
}).join('<br/>\n');
@@ -103,7 +104,7 @@ function init (majorPills, minorPills, statusPills, bgStatus, tooltip) {
};
pluginBase.addForecastPoints = function addForecastPoints (points, info) {
_.each(points, function eachPoint (point) {
_each(points, function eachPoint (point) {
point.type = 'forecast';
point.info = info;
if (point.mgdl < 13) {
npm-shrinkwrap.json
Generated
+1511 -1432
View File
File diff suppressed because it is too large Load Diff
package.json
+7 -8
View File
@@ -1,6 +1,6 @@
{
"name": "Nightscout",
"version": "0.10.3-dev-20180708",
"version": "0.10.3-dev-20180723",
"description": "Nightscout acts as a web-based CGM (Continuous Glucose Montinor) to allow multiple caregivers to remotely view a patients glucose data in realtime.",
"license": "AGPL-3.0",
"author": "Nightscout Team",
@@ -49,7 +49,7 @@
},
"engines": {
"node": "8.x",
"npm": "6.1.x || 5.8.x || 5.7.x || 5.6.x"
"npm": "6.x || 5.8.x || 5.7.x || 5.6.x"
},
"dependencies": {
"ajv": "^6.5.1",
@@ -66,11 +66,9 @@
"expand-braces": "^0.1.2",
"expose-loader": "^0.7.5",
"express": "^4.16.3",
"express-extension-to-accept": "0.0.2",
"express-minify": "^1.0.0",
"file-loader": "^1.1.11",
"flot": "^0.8.0-alpha",
"forever": "^0.15.3",
"jquery": "^3.3.1",
"jquery-ui-bundle": "^1.12.1-migrate",
"jquery.tooltips": "^1.0.0",
@@ -78,12 +76,13 @@
"jsonwebtoken": "^8.3.0",
"lodash": "^4.17.10",
"long": "^3.2.0",
"mime": "^2.3.1",
"minimed-connect-to-nightscout": "^1.1.1",
"moment": "^2.22.2",
"moment-timezone": "^0.5.21",
"mongodb": "~3.0.11",
"mongomock": "^0.1.2",
"mqtt": "^0.3.13",
"mqtt": "^2.18.3",
"node-cache": "^4.2.0",
"parse-duration": "^0.1.1",
"prettyjson": "^1.2.1",
@@ -91,7 +90,7 @@
"random-token": "0.0.8",
"request": "^2.87.0",
"sgvdata": "git://github.com/ktind/sgvdata.git#wip/protobuf",
"share2nightscout-bridge": "git://github.com/bewest/share2nightscout-bridge.git#wip/generalize",
"share2nightscout-bridge": "git://github.com/nightscout/share2nightscout-bridge.git#wip/generalize",
"shiro-trie": "^0.3.13",
"simple-statistics": "^0.7.0",
"socket.io": "^2.1.1",
@@ -99,13 +98,13 @@
"traverse": "^0.6.6",
"uglify-js": "^3.4.5",
"uuid": "^3.2.1",
"webpack": "^4.16.1"
"webpack": "^4.16.2"
},
"devDependencies": {
"benv": "^3.3.0",
"clear-require": "^2.0.0",
"istanbul": "^0.4.5",
"mocha": "~3.5.3",
"mocha": "^5.2.0",
"moment-locales-webpack-plugin": "^1.0.7",
"should": "^13.2.1",
"supertest": "^3.1.0",
tests/reports.test.js
+2 -2
View File
@@ -237,8 +237,8 @@ describe('reports', function ( ) {
$('a.presetdates :first').click();
$('#rp_notes').val('something');
$('#rp_eventtype').val('BG Check');
$('#rp_from').val('2015/08/08');
$('#rp_to').val('2015/09/07');
$('#rp_from').val('2015-08-08');
$('#rp_to').val('2015-09-07');
$('#rp_optionsraw').prop('checked', true);
$('#rp_optionsiob').prop('checked', true);
$('#rp_optionscob').prop('checked', true);