Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Decide the fate of custom site/project prefixing in the UserScript metadata block #285

Closed
Martii opened this issue Jul 29, 2014 · 20 comments
Labels
CODE Some other Code related issue and it should clearly describe what it is affecting in a comment. DB Pertains inclusively to the Database operations. DOC Pertains inclusively to the Documentation operations. migration Use this to indicate that it may apply to an existing or announced migration. UI Pertains inclusively to the User Interface.
Milestone

Comments

@Martii
Copy link
Member

Martii commented Jul 29, 2014

In relation to greasemonkey/greasemonkey#1963 I see 3 possibilities so far over the past few days to address an impending conflict with everyones project.

// ==UserScript==
// @run-at             document-end
// @namespace          http://localhost.localdomain
// @name               RFC 2606§3 - @license and @licence (recovered) Unit Test
// @name:de-DE         RFC 2606§3 - @license und @licence (wiederhergestellt) Komponententest
// @name:fr            RFC 2606§3 - @license et @licence (récupéré) Test unitaire
// @description        Tests out non-unique keys
// @description:de-DE  Tests, nicht eindeutige Schlüssel
// @description:fr     Tests de clefs non unique
// @copyright          2007+, Marti Martz (http://userscripts.org/users/37004)
// @license            GPL version 3 or any later version; http://www.gnu.org/copyleft/gpl.html
// @version            0.0.0
// @include            http://www.example.com/*
// ==/UserScript==

// ==OpenUserJS==
// @author Marti
// @collaborator jerone
// @collaborator sizzle
// @collaborator Zren
// @hash 131a5eddc53f4018d6b5ee76d8543cb3cb4e50fa
// @somefutureidea somevalue
// ==/OpenUserJS==
  • Has the disadvantage that any user.js engine may not read it. EDIT: ...but at the same time resolves any external conflicts and is in the spirit of optional collaboration instead of mutual collaboration.
  • OUJS could store the raw formatted metadata blocks text instead of the single metadata block Object... and a migration routine put in place or applied. EDIT: We should do at least the latter part of this anyways for Localized script name and description greasemonkey/greasemonkey#1963 support no matter what site/project prefixing we support. I highly recommend the former as well but depends on how we finalize the stored Object or not.

or

// ==UserScript==
// @run-at             document-end
// @namespace          http://localhost.localdomain
// @name               RFC 2606§3 - @license and @licence (recovered) Unit Test
// @name:de-DE         RFC 2606§3 - @license und @licence (wiederhergestellt) Komponententest
// @name:fr            RFC 2606§3 - @license et @licence (récupéré) Test unitaire
// @description        Tests out non-unique keys
// @description:de-DE  Tests, nicht eindeutige Schlüssel
// @description:fr     Tests de clefs non unique
// @copyright          2007+, Marti Martz (http://userscripts.org/users/37004)
// @license            GPL version 3 or any later version; http://www.gnu.org/copyleft/gpl.html
// @version            0.0.0
// @include            http://www.example.com/*
// @oujs.author Marti
// @oujs.collaborator jerone
// @oujs.collaborator sizzle
// @oujs.collaborator Zren
// @oujs.hash 131a5eddc53f4018d6b5ee76d8543cb3cb4e50fa
// @oujs.somefutureidea somevalue
// ==/UserScript==
  • Using some other character. Since the damage is done with the dash operator may as well continue with destruction. Not backwards compatible. We also might run into this situation again if one of the user.js engines support the character we already do.

or

// ==UserScript==
// @run-at             document-end
// @namespace          http://localhost.localdomain
// @name               RFC 2606§3 - @license and @licence (recovered) Unit Test
// @name:de-DE         RFC 2606§3 - @license und @licence (wiederhergestellt) Komponententest
// @name:fr            RFC 2606§3 - @license et @licence (récupéré) Test unitaire
// @description        Tests out non-unique keys
// @description:de-DE  Tests, nicht eindeutige Schlüssel
// @description:fr     Tests de clefs non unique
// @copyright          2007+, Marti Martz (http://userscripts.org/users/37004)
// @license            GPL version 3 or any later version; http://www.gnu.org/copyleft/gpl.html
// @version            0.0.0
// @include            http://www.example.com/*
// @oujs:author: Marti
// @oujs:collaborator: jerone
// @oujs:collaborator: sizzle
// @oujs:collaborator: Zren
// @oujs:hash: 131a5eddc53f4018d6b5ee76d8543cb3cb4e50fa
// @oujs:somefutureidea: somevalue
// ==/UserScript==

This entails extra coding to maintain the : because we won't always know if a key is a site prefix or a locale... so must pad using an extra :. Padding will need to be maintained.

Everyone, especially the maintainers at @arantius @johan @gera2ld @derjanb @OpenUserJs/admin @OpenUserJs/owners @OpenUserJs/backend @OpenUserJs/frontend and @JasonBarnabe, is welcome to participate in this team effort meta discussion as usual.

Please let me know if any other ideas are better, worse, ineffective, etc. :)

Refs:

@Martii Martii changed the title Decide the fate of custom site/project prefixing Decide the fate of custom site/project prefixing in the metadata block Jul 29, 2014
@Martii Martii self-assigned this Jul 29, 2014
@Zren
Copy link
Contributor

Zren commented Jul 29, 2014

Or manage stuff like collaboration on the website itself.

#208 (comment)

I say we axe it.

Martii pushed a commit to Martii/UserScripts that referenced this issue Jul 29, 2014
* Show a modified parseMeta routine for `:` padding support

**NOTE** This alpha version pulls full script source and won't be in user.js release

Applies to:
* OpenUserJS/OpenUserJS.org#285
@Martii
Copy link
Member Author

Martii commented Jul 29, 2014

Or manage stuff like collaboration on the website itself.

That is only a small piece of it. Moving collaboration to group structure doesn't address any other site specific metadata block(s) options... see the updated refs section above. The reason I made the request on userscripts.org (USO) for // @uso:hash is for integrity checks which USO and GM did adopt in a similar fashion with another purpose. I used it for backing up versions from USO in Count Issues. I'd like to see that here as well in another pr/issue since it is beneficial all around.

I've already done a certain amount of the necessary migration routines depending on what way we all decide to go with site/project prefix options.


See an additional marked EDIT(s) above too.

@johan
Copy link

johan commented Jul 30, 2014

@Zren has a good point. If someone writes a malicious script and tag it as authored by Martii and publish it, that's not a good reason for him to get falsely accredited as that script's author.

@Martii
Copy link
Member Author

Martii commented Jul 30, 2014

If someone writes a malicious script and tag it as authored by Martii and publish it, that's not a good reason for him to get falsely accredited as that script's author.

This is #208 from above. It's easy enough to check if the user exists (which is why at least the collaborators are hyperlinked and there are already some safeguards in place) and check if the script exists under that users authors account. If it doesn't disable collaboration and/or prevent uploading. We can always pull the reference from the metadata block(s) retrieval too which is primarily what this issue is about here on OUJS. Administrative side if a moderator and up sees that someone or some script doesn't exist then the script should get axed currently or perhaps a gentle notice like I've already done once with @vBm. If a network of trust isn't solid then the source author shouldn't do this even with GitHubs collaborations. Same way GM allows Ventero to be unfettered. That is part of GM's network of trust.

One could also use someone elses // @namespace http://github.com/johan/ or even just a general JavaScript comment too. The use case you mentioned isn't isolated to the metadata block(s). We do have some control over what's published and what isn't including tracking what was and what is. The benefit of cross-site development is a feature that a lot of us, including other users and authors, are striving for but there will be hurdles to overcome.

We'll work on that soon but I think until then the fate of any site specific key needs to be determined in the standard metadata block... if "GM/GMP/TM/VM/anyone else" are going to be mutually collaborative or optionally collaborative... e.g. Do we hear that the user.js engines don't care about anyone else or are they willing to listen to common ideas. I appreciate your input though as I know you have gone between Scriptish and GM in the past and definitely beneficial to the community as a whole.

Me personally, I'm leaning towards the separate metadata block for our site to prevent any future conflicts and from what everyone else has been typing... but am looking for alternatives. If another user.js engine or another site wants to pick up on it then that is great. Cave monkeys beware of evolution! ;) :)

Martii pushed a commit to Martii/UserScripts that referenced this issue Jul 31, 2014
* Show a modified parseMeta routine for multiple metadata blocks

**NOTE** This alpha version pulls full script source and won't be in user.js release

Applies to:
* OpenUserJS/OpenUserJS.org#285
@Martii
Copy link
Member Author

Martii commented Oct 23, 2014

bump There's some options to decide in here that I've been waiting for some response in here. After some wait time with Zren and his efforts and some tinkering with the alpha some more most likely this is going to be tackled.

@Martii
Copy link
Member Author

Martii commented Dec 2, 2014

Still awaiting... there are two trains of thought over the past few months... keep parseMeta as is with the object level bump as depicted in Meta View Alpha above (I seriously doubt there is going to be any major modification to existing @keys but one never knows)... the other is to use pegjs (or better) and modify just about every reference to retrieving the metadata blocks... which will increase the complexity of the MVC of OUJS as a whole.

@Martii Martii changed the title Decide the fate of custom site/project prefixing in the metadata block Decide the fate of custom site/project prefixing in the UserScript metadata block May 1, 2015
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue Jul 2, 2015
* TODO: Needs further diagnosis in real-time and eventually permanently fixed on completion of OpenUserJS#285
* [oujs - Meta View](https://openuserjs.org/scripts/Marti/oujs_-_Meta_View) **not** exhibiting this behavior... so appears to be a difference in current V8 *node* versus browser JavaScript parse
* Not sure when this occurred as there are scripts uploaded currently that utilizes the localizations of `@description` and `@name` but is responsible for some of the server restarts
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue Jul 18, 2015
Misc note(s):
* `$ git checkout greasemonkey/greasemonkey/master peg.txt` after remote is added temporarily

Applies to OpenUserJS#285
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue Jul 18, 2015
* *pegjs* files are technically models just not DB oriented much like our settings.json files are. Can move on refactoring if needed.

Applies to OpenUserJS#285
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue Jul 18, 2015
* Further cleanup will be needed before implemented hopefully later this weekend

Applies to OpenUserJS#285
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue Jul 18, 2015
* This allows the browser to view these instead of downloading
* May also prevent some warnings from security sites
* Using generic JavaScript MIME type as that is what my editor is saying it is on auto-detect... PEG.js is very closely related to JavaScript so should be okay.

Applies to OpenUserJS#285
@Martii
Copy link
Member Author

Martii commented Aug 25, 2015

Bingo... figured out the migration routine issue... all metadata is (should be) correct on production (save for the Graveyard still)... been doing this issue too long with too many variants of the code. :)

Martii pushed a commit to Martii/UserScripts that referenced this issue Aug 25, 2015
* End focusing on peg and restore half/half viewing
* Stop simulating the OpenUserJS metadata block since OUJS has support natively from OpenUserJS/OpenUserJS.org#285 via OpenUserJS/OpenUserJS.org#717

**NOTE** This will need some tweaking to dynamically handle any other blocks we may add for other sites should they choose to evolve this route just like OUJS is set up to do.
@Martii
Copy link
Member Author

Martii commented Aug 25, 2015

  • All dev script meta has been "extremely lazy" migrated to v0.2.0 of the project e.g. won't throw exceptions with current HEAD when accessing metadata (and things show up on scripts that I didn't upload there... e.g. should be restored to a functional state)
  • All dev removed (Graveyard) script meta has been "extremely lazy" migrated to v0.2.0 of the project
  • All pro removed (Graveyard) script meta has been "extremely lazy" migrated to v0.2.0 of the project

"extremely lazy" (for me at least) means that the old meta objects were transformed into the new meta objects unlike what I did with production (active) scripts which the meta was regenerated from script source.


Btw GH is sooooooooooooooooper slow right now. :\

@Martii
Copy link
Member Author

Martii commented Aug 26, 2015

@sizzlemctwizzle
I have encountered/seen zero issues... so this can be unblocked at your leisure. Went through all references and retested things (removed mitigations, etc. on other related issues/PRs)

Closure!!! :)

@Martii Martii removed the sooner Sooner would be appreciated. label Aug 26, 2015
@sizzlemctwizzle sizzlemctwizzle removed the BLOCKING Concentrate on bug fixes primarily. label Aug 27, 2015
@Martii Martii removed their assignment Aug 27, 2015
@Martii
Copy link
Member Author

Martii commented Aug 27, 2015

Closed by #717 and the plethora of comments here.

@Martii Martii closed this as completed Aug 27, 2015
Martii added a commit that referenced this issue Aug 30, 2015
Add *pegjs* to the dispersed

Applies to #285
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue Aug 30, 2015
* Fix grammar rule that used to work in 0.8.0 to work with 0.9.0 ... this was my bad too
* Knew `var` was going to be needed at some point with `upmix` as I thought it was a little peculiar in *pegjs* grammar
* Retested both grammars at http://pegjs.org/online ... should be a bit faster now that it alleges strict mode for that project

* Update *jwt-simple*... only code change is an exception trap for lack of token

Some post OpenUserJS#285 fixes with/and upward migration
This was referenced Aug 30, 2015
@Martii Martii self-assigned this Sep 2, 2015
@Martii
Copy link
Member Author

Martii commented Sep 2, 2015

Reopened due to #729

@Martii Martii reopened this Sep 2, 2015
@Martii Martii added the expedite Immediate and on the front burner. label Sep 2, 2015
@Martii
Copy link
Member Author

Martii commented Sep 4, 2015

As previously announced yesterday... taking server offline for migration hump... see everyone on the other side. :)

@Martii
Copy link
Member Author

Martii commented Sep 4, 2015

Back online... revalidating... on current master commit on production.

@Martii
Copy link
Member Author

Martii commented Sep 4, 2015

Graveyard is not complete yet... so leaving open until I get this done... this is a bit more complicated due to mongoose requirements of sub-Objects and the virtual "reason" I put in with removerAutomated... so I'll probably do this next week... again it's not as critical at this moment so a slower time table can happen with this. I do not need to take production offline to do these.

@Martii Martii removed the expedite Immediate and on the front burner. label Sep 8, 2015
@Martii
Copy link
Member Author

Martii commented Sep 8, 2015

Graveyard should be complete.... also zapped that final script without source on sizzles account (This particluar issue was possibly somewhere around #633 based off most of the dates I skimmed over... don't know for sure). Closing as redone.

@Martii Martii closed this as completed Sep 8, 2015
@Martii Martii removed their assignment Sep 8, 2015
Martii pushed a commit to Martii/OpenUserJS.org that referenced this issue May 29, 2016
Martii added a commit to Martii/OpenUserJS.org that referenced this issue Jul 27, 2019
* This has resurfaced with another Author misunderstanding collaboration and potentially opening up a security hole with their script being edited by others. So at least we can check to see if the account(s) currently exists. They are still responsible for any unauthorized edits if they type the incorrect existing username.
* Also fixes a feature with unhandled casing... probably best to leave it exact unlike URLs to user homepages. Really don't need different casings floating around in these labels i.e. symmetry.

Post OpenUserJS#285
Martii added a commit that referenced this issue Jul 27, 2019
* This has resurfaced with another Author misunderstanding collaboration and potentially opening up a security hole with their script being edited by others. So at least we can check to see if the account(s) currently exists. They are still responsible for any unauthorized edits if they type the incorrect existing username.
* Also fixes a feature with unhandled casing... probably best to leave it exact unlike URLs to user homepages. Really don't need different casings floating around in these labels i.e. symmetry.

Post #285

Auto-merge
@OpenUserJS OpenUserJS locked as resolved and limited conversation to collaborators Apr 12, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
CODE Some other Code related issue and it should clearly describe what it is affecting in a comment. DB Pertains inclusively to the Database operations. DOC Pertains inclusively to the Documentation operations. migration Use this to indicate that it may apply to an existing or announced migration. UI Pertains inclusively to the User Interface.
Development

No branches or pull requests

4 participants