Sitelet https://web.archive.org/web/20220705081615/https://github.com/PowerShell/PowerShell/pull/12549
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restore markdownlint tests #12549

Merged
merged 12 commits into from Jun 2, 2020
Merged

Restore markdownlint tests #12549

merged 12 commits into from Jun 2, 2020

Conversation

xtqqczze
Copy link
Contributor

@xtqqczze xtqqczze commented May 2, 2020

PR Summary

Fix #12539

PR Context

markdownlint tests were removed in #10163 due to a security issue whoch has since been fixed in a newer version of markdownlint

PR Checklist

@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 2, 2020

Codacy markdown issues seem to contradict markdownlint issues.

iSazonov
iSazonov previously approved these changes May 2, 2020
View changes
@iSazonov iSazonov assigned TravisEz13 and unassigned daxian-dbw May 2, 2020
xtqqczze
xtqqczze reviewed May 2, 2020
View changes
test/common/markdown/gulpfile.js
.pipe(through2.obj(function obj(file, enc, next) {
markdownlint({
"files": [file.path],
"config": require(rootJsonFile)
Copy link
Contributor Author

@xtqqczze xtqqczze May 2, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found non-literal argument in require (security/detect-non-literal-require)

@iSazonov iSazonov self-requested a review May 2, 2020
@iSazonov iSazonov dismissed their stale review May 2, 2020

New commits

@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 2, 2020 •
edited 

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gulp > gulp-cli > yargs > yargs-parser                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘

The maintainer of the affected package claims the yargs-parser vulnerability does not introduce an attack vector in gulp.

See: gulpjs/gulp#2438

@TravisEz13
Copy link
Member

@TravisEz13 TravisEz13 commented May 4, 2020

There mere presence of a high scored vuln on the machine will trigger the same issue that cause this to be removed.

@TravisEz13
Copy link
Member

@TravisEz13 TravisEz13 commented May 4, 2020

I made a couple of edits to your branch. Please pull your branch if you need to edit something.

@TravisEz13
Copy link
Member

@TravisEz13 TravisEz13 commented May 4, 2020

That component is not currently generating an alert.

@TravisEz13 TravisEz13 added the CL-Test label May 4, 2020
@TravisEz13 TravisEz13 added this to the 7.1.0-preview.3 milestone May 4, 2020
@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 5, 2020

The maintainer of gulp says the vulnerable dependency will not be updated until the project releases a new major version, which does not appear to be imminient.

See: yargs/yargs-parser#264 (comment)

@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 5, 2020

@TravisEz13 Perhaps we could do without gulp anyway, and use npm-run-script or equivalent?

@TravisEz13
Copy link
Member

@TravisEz13 TravisEz13 commented May 5, 2020

@xtqqczze I'm not tied to gulp. As long as we still get test results. But if it reduces dependencies, I'm all for it.

@TravisEz13
Copy link
Member

@TravisEz13 TravisEz13 commented May 5, 2020

Tell me if you want me to merge this as is and then update, or you want to change it first.

@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 6, 2020

@TravisEz13 Merge this for now please.

TravisEz13
TravisEz13 reviewed May 6, 2020
View changes
test/common/markdown/gulpfile.js Outdated Show resolved Hide resolved
@TravisEz13 TravisEz13 removed this from the 7.1.0-preview.3 milestone May 14, 2020
@TravisEz13 TravisEz13 added this to the 7.1.0-preview.4 milestone May 14, 2020
@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 30, 2020

rebased to resolve conflicts

@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 30, 2020 •
edited

@TravisEz13 I'm not my change in 4180235 to use Write-Host is the best approach (CodeFactor issue), but I think we should log $markdownErrors somehow...

xtqqczze and others added 4 commits May 30, 2020
@xtqqczze
Fix markdownlint errors
00256c6 
* Split `\install-powershell-readme.md` into `install-powershell.ps1-README.md` and `install-powershell.sh-README.md` to fix `single-h1`
* Formatting changes to github issue templates as a result of fixing `single-h1`
@xtqqczze
Run yarn upgrade
c56002e
@xtqqczze
Update misc-analysis.yml
fd56dc7
@xtqqczze
Write errors to host
3a1a172
@xtqqczze
Copy link
Contributor Author

@xtqqczze xtqqczze commented May 30, 2020

rebased to fix additionally markdownlint errors

TravisEz13
TravisEz13 requested changes Jun 2, 2020
View changes
Copy link
Member

@TravisEz13 TravisEz13 left a comment

One one comment to address

@msftbot msftbot bot added the Waiting on Author label Jun 2, 2020
@msftbot msftbot bot removed this from the 7.1.0-preview.4 milestone Jun 2, 2020
@TravisEz13
Copy link
Member

@TravisEz13 TravisEz13 commented Jun 2, 2020

@PoshChan Please remind me in 1 hour

@PoshChan
Copy link
Collaborator

@PoshChan PoshChan commented Jun 2, 2020

@TravisEz13, this is the reminder you requested 1 hour ago

@TravisEz13 TravisEz13 changed the title Restore markdownlint tests Restore markdownlint tests Jun 2, 2020
@TravisEz13 TravisEz13 merged commit b03b968 into PowerShell:master Jun 2, 2020
7 of 8 checks passed
@iSazonov iSazonov removed the Waiting on Author label Jun 3, 2020
@iSazonov iSazonov added this to the 7.1.0-preview.4 milestone Jun 3, 2020
@msftbot
Copy link

@msftbot msftbot bot commented Jun 25, 2020

🎉v7.1.0-preview.4 has been released which incorporates this pull request.🎉

Handy links:

@msftbot msftbot bot mentioned this pull request Jun 25, 2020
Closed
@xtqqczze xtqqczze deleted the restore-markdownlint branch Jun 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@TravisEz13 TravisEz13

@adityapatwardhan adityapatwardhan

@anmenaga anmenaga

@daxian-dbw daxian-dbw

@joeyaiello joeyaiello

@iSazonov iSazonov

Assignees

@TravisEz13 TravisEz13

Labels
CL-Test
Projects
None yet
Milestone
7.1.0-preview.4
Development

Successfully merging this pull request may close these issues.

Restore markdownlint tests
5 participants
@xtqqczze @TravisEz13 @PoshChan @iSazonov @daxian-dbw