Merge branch 'master' into npm-latest-package-update

core/base-service/legacy-result-sender.js

@@ -11,6 +11,7 @@ function streamFromString(str) {
 
 function sendSVG(res, askres, end) {
   askres.setHeader('Content-Type', 'image/svg+xml;charset=utf-8')
+  askres.setHeader('Content-Security-Policy', "script-src 'none';")
   askres.setHeader('Content-Length', Buffer.byteLength(res, 'utf8'))
   end(null, { template: streamFromString(res) })
 }

core/server/server.spec.js

@@ -139,6 +139,27 @@ describe('The server', function () {
       expect(() => JSON.parse(body)).not.to.throw()
     })
 
+    describe('Content Security Policy', function () {
+      it('should disable javascript when serving SVG content (no extension)', async function () {
+        const { headers } = await got(`${baseUrl}:fruit-apple-green`)
+        expect(headers['content-security-policy']).to.equal(
+          "script-src 'none';",
+        )
+      })
+
+      it('should disable javascript when serving SVG content (with extension)', async function () {
+        const { headers } = await got(`${baseUrl}:fruit-apple-green.svg`)
+        expect(headers['content-security-policy']).to.equal(
+          "script-src 'none';",
+        )
+      })
+
+      it('should not send content security headers when serving JSON content', async function () {
+        const { headers } = await got(`${baseUrl}:fruit-apple-green.json`)
+        expect(headers).not.to.have.property('content-security-policy')
+      })
+    })
+
     it('should preserve label case', async function () {
       const { statusCode, body } = await got(`${baseUrl}:fRuiT-apple-green.svg`)
       expect(statusCode).to.equal(200)

services/clojars/clojars-version.service.js

@@ -34,6 +34,10 @@ class ClojarsVersionService extends BaseClojarsService {
   static defaultBadgeData = { label: 'clojars' }
 
   static render({ clojar, version }) {
+    // clojars format is non standard to fit community style
+    // dont use renderVersionBadge
+    // see also https://github.com/badges/shields/pull/431
+    // commit d0414c9
     return {
       message: `[${clojar} "${version}"]`,
       color: versionColor(version),

services/color-formatters.js

@@ -23,7 +23,10 @@ function version(version) {
   if (first === 'v') {
     first = version[1]
   }
-  if (first === '0' || /alpha|beta|snapshot|dev|pre|rc/i.test(version)) {
+  if (
+    first === '0' ||
+    /alpha|beta|snapshot|dev|pre|rc|scm|cvs/i.test(version)
+  ) {
     return 'orange'
   } else {
     return 'blue'

services/color-formatters.spec.js

@@ -105,6 +105,8 @@ describe('Color formatters', function () {
       given('1.0.1-dev'),
       given('2.1.6-prerelease'),
       given('2.1.6-RC1'),
+      given('cvs-1'),
+      given('scm-2'),
     ]).expect('orange')
 
     expect(() => version(null)).to.throw(

services/feedz/feedz.service.js

@@ -1,11 +1,11 @@
 import Joi from 'joi'
 import { BaseJsonService, NotFound, pathParams } from '../index.js'
 import {
-  renderVersionBadge,
   searchServiceUrl,
   stripBuildMetadata,
   selectVersion,
 } from '../nuget/nuget-helpers.js'
+import { renderVersionBadge } from '../version.js'
 
 const singlePageSchema = Joi.object({
   '@id': Joi.string().required(),
@@ -64,10 +64,6 @@ class FeedzVersionService extends BaseJsonService {
     label: 'feedz',
   }
 
-  static render(props) {
-    return renderVersionBadge(props)
-  }
-
   apiUrl({ organization, repository }) {
     return `https://f.feedz.io/${organization}/${repository}/nuget`
   }
@@ -122,9 +118,9 @@ class FeedzVersionService extends BaseJsonService {
     const json = await this.fetch({ baseUrl, packageName })
     const fetchedJson = await this.fetchItems({ json })
     const version = this.transform({ json: fetchedJson, includePrereleases })
-    return this.constructor.render({
+    return renderVersionBadge({
       version,
-      feed: FeedzVersionService.defaultBadgeData.label,
+      defaultLabel: FeedzVersionService.defaultBadgeData.label,
     })
   }
 }

services/feedz/feedz.tester.js

@@ -24,14 +24,6 @@ t.create('version (valid)')
     color: 'blue',
   })
 
-t.create('version (yellow badge)')
-  .get('/feedz/v/shieldstests/public/Shields.TestPreOnly.json')
-  .expectBadge({
-    label: 'feedz',
-    message: 'v0.1.0-pre',
-    color: 'yellow',
-  })
-
 t.create('version (orange badge)')
   .get('/feedz/v/shieldstests/public/Shields.NoV1.json')
   .expectBadge({
@@ -77,14 +69,6 @@ t.create('version (pre) (valid)')
     color: 'blue',
   })
 
-t.create('version (pre) (yellow badge)')
-  .get('/feedz/vpre/shieldstests/public/Shields.TestPreOnly.json')
-  .expectBadge({
-    label: 'feedz',
-    message: 'v0.1.0-pre',
-    color: 'yellow',
-  })
-
 t.create('version (pre) (orange badge)')
   .get('/feedz/vpre/shieldstests/public/Shields.NoV1.json')
   .expectBadge({

services/gitlab/gitlab-tag.service.js

@@ -1,8 +1,6 @@
 import Joi from 'joi'
-import { version as versionColor } from '../color-formatters.js'
 import { optionalUrl } from '../validators.js'
-import { latest } from '../version.js'
-import { addv } from '../text-formatters.js'
+import { latest, renderVersionBadge } from '../version.js'
 import { NotFound, pathParam, queryParam } from '../index.js'
 import { description, httpErrorsFor } from './gitlab-helper.js'
 import GitLabBase from './gitlab-base.js'
@@ -63,13 +61,6 @@ export default class GitlabTag extends GitLabBase {
 
   static defaultBadgeData = { label: 'tag' }
 
-  static render({ version, sort }) {
-    return {
-      message: addv(version),
-      color: sort === 'semver' ? versionColor(version) : 'blue',
-    }
-  }
-
   async fetch({ project, baseUrl }) {
     // https://docs.gitlab.com/ee/api/tags.html
     // N.B. the documentation has contradictory information about default sort order.
@@ -114,6 +105,6 @@ export default class GitlabTag extends GitLabBase {
       sort,
       includePrereleases: pre !== undefined,
     })
-    return this.constructor.render({ version, sort })
+    return renderVersionBadge({ version })
   }
 }

services/gitlab/gitlab-tag.spec.js

@@ -39,6 +39,7 @@ describe('GitLabTag', function () {
       ).to.deep.equal({
         message: 'v1.9',
         color: 'blue',
+        label: undefined,
       })
 
       scope.done()

services/luarocks/luarocks.service.js

@@ -1,6 +1,6 @@
 import Joi from 'joi'
-import { addv } from '../text-formatters.js'
 import { BaseJsonService, NotFound, pathParams } from '../index.js'
+import { renderVersionBadge } from '../version.js'
 import { latestVersion } from './luarocks-version-helpers.js'
 
 const schema = Joi.object({
@@ -42,25 +42,6 @@ export default class Luarocks extends BaseJsonService {
     label: 'luarocks',
   }
 
-  static render({ version }) {
-    // The badge colors are following the heuristic rule where `scm < dev <
-    // stable` (e.g., `scm-1` < `dev-1` < `0.1.0-1`).
-    let color
-    switch (version.slice(0, 3).toLowerCase()) {
-      case 'dev':
-        color = 'yellow'
-        break
-      case 'scm':
-      case 'cvs':
-        color = 'orange'
-        break
-      default:
-        color = 'brightgreen'
-    }
-
-    return { message: addv(version), color }
-  }
-
   async fetch({ user, moduleName }) {
     const { repository } = await this._requestJson({
       url: `https://luarocks.org/manifests/${encodeURIComponent(
@@ -91,6 +72,6 @@ export default class Luarocks extends BaseJsonService {
       const versions = Object.keys(moduleInfo)
       version = latestVersion(versions)
     }
-    return this.constructor.render({ version })
+    return renderVersionBadge({ version })
   }
 }

services/nuget/nuget-helpers.js

@@ -1,25 +1,8 @@
 import semver from 'semver'
-import { metric, addv } from '../text-formatters.js'
+import { metric } from '../text-formatters.js'
 import { downloadCount as downloadCountColor } from '../color-formatters.js'
 import { getCachedResource } from '../../core/base-service/resource-cache.js'
 
-function renderVersionBadge({ version, feed }) {
-  let color
-  if (version.includes('-')) {
-    color = 'yellow'
-  } else if (version.startsWith('0')) {
-    color = 'orange'
-  } else {
-    color = 'blue'
-  }
-
-  return {
-    message: addv(version),
-    color,
-    label: feed,
-  }
-}
-
 function renderDownloadBadge({ downloads }) {
   return {
     message: metric(downloads),
@@ -100,7 +83,6 @@ function selectVersion(versions, includePrereleases) {
 }
 
 export {
-  renderVersionBadge,
   renderDownloadBadge,
   odataToObject,
   searchServiceUrl,

services/nuget/nuget-helpers.spec.js

@@ -1,30 +1,11 @@
 import { test, given } from 'sazerac'
 import {
-  renderVersionBadge,
   odataToObject,
   stripBuildMetadata,
   selectVersion,
 } from './nuget-helpers.js'
 
 describe('NuGet helpers', function () {
-  test(renderVersionBadge, () => {
-    given({ version: '1.2-beta' }).expect({
-      label: undefined,
-      message: 'v1.2-beta',
-      color: 'yellow',
-    })
-    given({ version: '0.35' }).expect({
-      label: undefined,
-      message: 'v0.35',
-      color: 'orange',
-    })
-    given({ version: '1.2.7' }).expect({
-      label: undefined,
-      message: 'v1.2.7',
-      color: 'blue',
-    })
-  })
-
   test(odataToObject, () => {
     given({ 'm:properties': { 'd:Version': '1.2.3' } }).expect({
       Version: '1.2.3',

services/nuget/nuget-v2-service-family.js

@@ -9,11 +9,8 @@ import {
   pathParam,
   queryParam,
 } from '../index.js'
-import {
-  renderVersionBadge,
-  renderDownloadBadge,
-  odataToObject,
-} from './nuget-helpers.js'
+import { renderVersionBadge } from '../version.js'
+import { renderDownloadBadge, odataToObject } from './nuget-helpers.js'
 
 function createFilter({ packageName, includePrereleases }) {
   const releaseTypeFilter = includePrereleases
@@ -127,18 +124,14 @@ function createServiceFamily({
       label: defaultLabel,
     }
 
-    static render(props) {
-      return renderVersionBadge(props)
-    }
-
     async handle({ packageName }, queryParams) {
       const packageData = await fetch(this, {
         baseUrl: apiBaseUrl,
         packageName,
         includePrereleases: queryParams.include_prereleases !== undefined,
       })
       const version = packageData.NormalizedVersion || `${packageData.Version}`
-      return this.constructor.render({ version })
+      return renderVersionBadge({ version })
     }
   }
 

services/nuget/nuget-v3-service-family.js

@@ -1,8 +1,8 @@
 import Joi from 'joi'
 import RouteBuilder from '../route-builder.js'
 import { BaseJsonService, NotFound } from '../index.js'
+import { renderVersionBadge } from '../version.js'
 import {
-  renderVersionBadge,
   renderDownloadBadge,
   searchServiceUrl,
   stripBuildMetadata,
@@ -127,10 +127,6 @@ function createServiceFamily({
       label: defaultLabel,
     }
 
-    static render(props) {
-      return renderVersionBadge(props)
-    }
-
     /*
      * Extract version information from the raw package info.
      */
@@ -158,7 +154,7 @@ function createServiceFamily({
       })
       const json = await fetch(this, { baseUrl, packageName })
       const version = this.transform({ json, includePrereleases })
-      return this.constructor.render({ version, feed })
+      return renderVersionBadge({ version, defaultLabel: feed })
     }
   }