Files
cgm-remote-monitor/app.js
T
PieterGitandSulka Haro 71103bb4b7 resolve npm audit security fixes (#3721)
* upgrade mocha from 3.5.3 to 5.0.5

This resolves these security issues

  Low             Regular Expression Denial of Service
  Package         debug
  Dependency of   mocha [dev]
  Path            mocha > debug
  More info       https://nodesecurity.io/advisories/534

  Critical        Command Injection
  Package         growl
  Dependency of   mocha [dev]
  Path            mocha > growl
  More info       https://nodesecurity.io/advisories/146

* upgrade mocha and start modularizing lodash to make sure tests pass

* more lodash modularization

* upgrade mqtt to 2.18.3

* allow npm 6.2

* upgrade share2nightscout-bridge

* incorporate express-extension-to-accept into Nightscout

the packages seems not maintained (github page is 404) and has a security issue with mime package.  so upgraded and included into Nightscout code.

if somebody knows a more efficient way of programming this with express4 please PR

* update jsdom for security fixes

* prevent wrapping of hour labels by removing the space

* Revert "update jsdom for security fixes"

This reverts commit 04f1f39d636d8d79c6b01b5f298f9a6cea3dc645.

* Revert "more lodash modularization"

This reverts commit c4fa5304db9f16b94f15c2b44793a5a11d595885.

* remove forever dependency

* Revert "Revert "more lodash modularization""

This reverts commit b13c274ebff0b5c3a48ffc0e610ca85a9f8d25bc.

* fix report.test.js with newer packages

sometimes a fix is very easy. This is to prevent:

```
Deprecation warning: value provided is not in a recognized RFC2822 or ISO format. moment construction falls back to js Date(), which is not reliable across all browsers and versions. Non RFC2822/ISO date formats are discouraged and will be removed in an upcoming major release. Please refer to http://momentjs.com/guides/#/warnings/js-date/ for more info.
Arguments:
[0] _isAMomentObject: true, _isUTC: true, _useUTC: true, _l: undefined, _i: T00:00:00, _f: undefined, _strict: undefined, _locale: [object Object]
Error
    at Function.createFromInputFallback (XXX\cgm-remote-monitor\tmp\js\bundle.js:117408:98)
    at configFromString (XXX\cgm-remote-monitor\tmp\js\bundle.js:119456:15)
```

We must use ISO8601 formatted strings and not use slashes in dates, see https://github.com/moment/moment/issues/1407#issuecomment-155630060

* upgrade webpack to 4.16.2

* Update package.json
2018-07-24 20:25:44 +03:00

211 lines
6.3 KiB
JavaScript

'use strict';
var _get = require('lodash/get');
var express = require('express');
var compression = require('compression');
var bodyParser = require('body-parser');
var prettyjson = require('prettyjson');
var path = require('path');
var fs = require('fs');
function create(env, ctx) {
var app = express();
var appInfo = env.name + ' ' + env.version;
app.set('title', appInfo);
app.enable('trust proxy'); // Allows req.secure test on heroku https connections.
app.set('view engine', 'ejs');
// this allows you to render .html files as templates in addition to .ejs
app.engine('html', require('ejs').renderFile);
app.engine('appcache', require('ejs').renderFile);
app.set("views", path.join(__dirname, "views/"));
app.locals.cachebuster = fs.readFileSync(process.cwd() + '/tmp/cacheBusterToken').toString().trim();
if (ctx.bootErrors && ctx.bootErrors.length > 0) {
app.get('*', require('./lib/server/booterror')(ctx));
return app;
}
if (env.settings.isEnabled('cors')) {
var allowOrigin = _get(env, 'extendedSettings.cors.allowOrigin') || '*';
console.info('Enabled CORS, allow-origin:', allowOrigin);
app.use(function allowCrossDomain(req, res, next) {
res.header('Access-Control-Allow-Origin', allowOrigin);
res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE,OPTIONS');
res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, Content-Length, X-Requested-With');
// intercept OPTIONS method
if ('OPTIONS' === req.method) {
res.send(200);
} else {
next();
}
});
}
///////////////////////////////////////////////////
// api and json object variables
///////////////////////////////////////////////////
var api = require('./lib/api/')(env, ctx);
var ddata = require('./lib/data/endpoints')(env, ctx);
app.use(compression({
filter: function shouldCompress(req, res) {
//TODO: return false here if we find a condition where we don't want to compress
// fallback to standard filter function
return compression.filter(req, res);
}
}));
app.get("/", (req, res) => {
res.render("index.html", {
locals: app.locals
});
});
var appPages = {
"/clock-color.html":"clock-color.html",
"/admin":"adminindex.html",
"/profile":"profileindex.html",
"/food":"foodindex.html",
"/bgclock.html":"bgclock.html",
"/report":"reportindex.html",
"/translations":"translationsindex.html",
"/clock.html":"clock.html"
};
Object.keys(appPages).forEach(function(page) {
app.get(page, (req, res) => {
res.render(appPages[page], {
locals: app.locals
});
});
});
app.get("/nightscout.appcache", (req, res) => {
res.render("nightscout.appcache", {
locals: app.locals
});
});
app.use('/api/v1', bodyParser({
limit: 1048576 * 50
}), api);
app.use('/api/v2/properties', ctx.properties);
app.use('/api/v2/authorization', ctx.authorization.endpoints);
app.use('/api/v2/ddata', ddata);
// pebble data
app.get('/pebble', ctx.pebble);
// expose swagger.json
app.get('/swagger.json', function(req, res) {
res.sendFile(__dirname + '/swagger.json');
});
/*
if (env.settings.isEnabled('dumps')) {
var heapdump = require('heapdump');
app.get('/api/v2/dumps/start', function(req, res) {
var path = new Date().toISOString() + '.heapsnapshot';
path = path.replace(/:/g, '-');
console.info('writing dump to', path);
heapdump.writeSnapshot(path);
res.send('wrote dump to ' + path);
});
}
*/
//app.get('/package.json', software);
// Allow static resources to be cached for week
var maxAge = 7 * 24 * 60 * 60 * 1000;
if (process.env.NODE_ENV === 'development') {
maxAge = 10;
console.log('Development environment detected, setting static file cache age to 10 seconds');
app.get('/nightscout.appcache', function(req, res) {
res.sendStatus(404);
});
}
//TODO: JC - changed cache to 1 hour from 30d ays to bypass cache hell until we have a real solution
var staticFiles = express.static(env.static_files, {
maxAge: maxAge
});
// serve the static content
app.use(staticFiles);
var swaggerFiles = express.static(env.swagger_files, {
maxAge: maxAge
});
// serve the static content
app.use('/swagger-ui-dist', swaggerFiles);
var tmpFiles = express.static('tmp', {
maxAge: maxAge
});
// serve the static content
app.use(tmpFiles);
if (process.env.NODE_ENV !== 'development') {
console.log('Production environment detected, enabling Minify');
var minify = require('express-minify');
var myUglifyJS = require('uglify-js');
var myCssmin = require('cssmin');
app.use(minify({
js_match: /\.js/,
css_match: /\.css/,
sass_match: /scss/,
less_match: /less/,
stylus_match: /stylus/,
coffee_match: /coffeescript/,
json_match: /json/,
uglifyJS: myUglifyJS,
cssmin: myCssmin,
cache: __dirname + '/tmp',
onerror: undefined,
}));
}
// if this is dev environment, package scripts on the fly
// if production, rely on postinstall script to run packaging for us
if (process.env.NODE_ENV === 'development') {
var webpack = require("webpack");
var webpack_conf = require('./webpack.config');
webpack(webpack_conf, function(err, stats) {
var json = stats.toJson() // => webpack --json
var options = {
noColor: true
};
console.log(prettyjson.render(json.errors, options));
console.log(prettyjson.render(json.assets, options));
});
}
// Handle errors with express's errorhandler, to display more readable error messages.
var errorhandler = require('errorhandler');
//if (process.env.NODE_ENV === 'development') {
app.use(errorhandler());
//}
return app;
}
module.exports = create;