41–50 of 80 posts
Dependency installation should be a bit frictional...
That's interesting, tell me more?
However, I'm not sure I agree with the statement - you could use this tool and still have the discipline not to pull in random packages.
Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST. I've successfully used Detective in a couple of my personal projects to find all require statements. Relevant issue on Detective: https://github.com/substack/node-detective/issues/8
So i wouldn't call regex a 'very naive' choice, since people making it are aware of tradeoffs and pick regex intentionally.
Earlier quoted context omitted.
It has to open and read a .js file already, it can certainly turn that into the representative AST for said file and then use the data from that. It will be slower, but it will also be more accurate and less likely to turn up false positives or miss things.
It has to parse a javascript file, which isn't trivial. The reason they use regular expression is because implementing a javascript parser isn't an easy problem to solve fast, even though the grammar is available.
Earlier quoted context omitted.
Typos with npm have always allowed RCE. You can have typos while doing $npm install ... .
Right, but when you are running npm install you know you are installing and so you know you should be careful, and only hit return if you are sure it is right. With this, you have to be careful the WHOLE time you are typing. You normally don't worry about hitting return in your editor causing RCE.
Opened an issue here: https://github.com/siddharthkp/auto-install/issues/2
I mean, wow. I've seen half-baked ideas before, but this takes the cake. Typos now equal remote code execution, and it's even easier to enter dependancy hell, because deps are now implicit.
Earlier quoted context omitted.
Right, but when you are running npm install you know you are installing and so you know you should be careful, and only hit return if you are sure it is right. With this, you have to be careful the WHOLE time you are typing. You normally don't worry about hitting return in your editor causing RCE.
Good point, any ideas on handling this better? Opened an issue here: https://github.com/siddharthkp/auto-install/issues/2
One other possibility is to have a delay, so that it waits an amount of time before installing, to give a chance to catch and fix the typo.
Regular expressions are a very naive way of detecting calls to 'require'. For correctness you're better off recursively walking the AST. I've successfully used Detective in a couple of my personal projects to find all require statements. Relevant issue on Detective: https://github.com/substack/node-detective/issues/8
Earlier quoted context omitted.
Typos with npm have always allowed RCE. You can have typos while doing $npm install ... .
Right, but when you are running npm install you know you are installing and so you know you should be careful, and only hit return if you are sure it is right. With this, you have to be careful the WHOLE time you are typing. You normally don't worry about hitting return in your editor causing RCE.
I mean, wow. I've seen half-baked ideas before, but this takes the cake. Typos now equal remote code execution, and it's even easier to enter dependancy hell, because deps are now implicit.
The documentation currently just says 'avoid typos'.
siddharthkp: please give me a way to contact you. see my contact info on my profile.
Oh wait, npm doesn't even have namespaces...
Remind me again why everyone is using this shitheap?