Hackathon24 #100
Hackathon24 #100
Conversation
|
👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎ This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring: Next stepsTake a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with |
|
@SocketSecurity ignore-all |
|
😞 CodeQL again |
|
Report too large to display inline |
I was lurking here today and this made me laugh really hard after seeing how long that list was 😆 |
|
...i am so sorry, basically after i did this i was like... how do i undo now plz, and couldn't figure it out :O |
Summary of changes
The app should continue to work without clearing localStorage, but a few things might not function quite as intended.
via react-router-dombuilt-in; the newbasenameprop passed to theBadMagiccomponent defines the Bad Magic URL rootBadMagicPropsTesting
via
exampleprojectTo test with the included example project, follow the instructions in
README.md, i.e.:yarn && yarn linkin the root directoryyarn && yarn link badmagicin the./exampledirectorycraco, if you have issues inside theexampledirectory, runasdf install && npm i -g yarnyarnin the./example-apidirectory./exampledirectory, and./example-apidirectory, runyarn startin CMW
You should also be able to test inside of CMW.
yarnvia homebrew, or it'll cause issues:which yarnbrew uninstall yarnasdfshould be set up to read the.tool-versionsfile in your working directory, cd intobadmagic, runasdf installif necessary, and install yarn vianpm i -g yarnbadmagic. Runyarn -vand verify that you are running on 1.x (i.e. 1.22.22)yarn && yarn build && yarn packyarn packcommand should return a path to the generated tarball file; copy it to your clipboardcontrol.smartrent.com. Runyarn -vand verify that the yarn binary is being used from the project (i.e.3.2.0-rc.13)yarn add badmagic@file:<paste clipboard>, e.g.yarn add badmagic@/Users/yourname/code/badmagic/badmagic-v0.0.39.tgzassets/js/react/bundles/devtools/BadMagicClient.tsx. Add the propbasename="/dev/api"to the<BadMagic />component returned byBadMagicClientMarkdown CSS
I made some slight adjustments to the Markdown CSS file as well, though due to the fact that the syntax highlighter tries to automatically infer the language even without a language tag, I don't think you'll actually see the CSS changes because they were only affecting some unhighlighted code elements. Regardless, if you want to also test it with the latest CSS file:
yarn buildinside of thebadmagicrepository root so thatmarkdown.min.cssis generated and put inside of./example/public/cd ./example && yarn startand verify the example UI loads at http://localhost:3000/dev/apiapps/control_room/lib/control_room_web/templates/development/react/badmagic.html.eex. Replace theunpkgURL for BadMagic's stylesheet withhttp://localhost:3000/dev/api/markdown.min.cssapps/control_room/lib/control_room_web/plugs/secure_browser_headers.ex. Find the"style-src"list and append the"http://localhost:3000"string to the list of allowed domains.Most of the features are also testable in the demo app. An API server is included as well.