Skip to content
This repository has been archived by the owner on Aug 30, 2021. It is now read-only.

fix(security): updating vulnerable packages #1802

Merged
merged 3 commits into from
Jul 2, 2017
Merged

fix(security): updating vulnerable packages #1802

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4504505
fix(security): updating vulnerable packages
lirantal Jun 28, 2017
b9c6b82
fix(helmet): updating to support latest changes, transition from ms t…
lirantal Jun 29, 2017
1170a78
comment on SIX_MONTHS variable
lirantal Jul 1, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ addons:
- clang
before_install:
- npm install nsp -g
- npm install snyk -g
# - npm install snyk -g
- npm install protractor
- 'export DISPLAY=:99.0'
- 'sh -e /etc/init.d/xvfb start'
Expand All @@ -42,7 +42,7 @@ before_install:
# - snyk test
after_script:
- nsp check
- snyk test
# - snyk test
- gulp test:coverage
- node_modules/.bin/lcov-result-merger 'coverage/**/lcov.info' | node_modules/coveralls/bin/coveralls.js
notifications:
Expand Down
2 changes: 1 addition & 1 deletion config/lib/express.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ module.exports.initModulesConfiguration = function (app, db) {
*/
module.exports.initHelmetHeaders = function (app) {
// Use helmet to secure Express headers
var SIX_MONTHS = 15778476000;
var SIX_MONTHS = 15778476;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it make sense to just use 15778476 directly in hsts settings object since this variable isn't used anywhere else?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also it'll be useful for anyone modifying this to have a short comment mentioning it's seconds.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nah because then it's just magic number, very unreadable.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah I wasn't sure if to add that comment or not because someone who would change it will probably be aware of helmet

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, I prefer having a note that it's in seconds here. Even those that understand that Helmet expects seconds, it may be easy to forget or be overlooked by others coming in.

To me it looks less like a "magic" number when I see a comment about seconds.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, updated.

app.use(helmet.frameguard());
app.use(helmet.xssFilter());
app.use(helmet.noSniff());
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
"express-session": "~1.15.2",
"generate-password": "~1.3.0",
"glob": "~7.1.1",
"helmet": "~2.3.0",
"helmet": "~3.6.1",
"jasmine-core": "~2.5.2",
"lodash": "~4.17.4",
"lusca": "~1.4.1",
Expand Down