From 3e26d375eb2e12a1395b4c1d57c1858e91c82b5e Mon Sep 17 00:00:00 2001 From: Simon Lecoq <22963968+lowlighter@users.noreply.github.com> Date: Sun, 1 Aug 2021 13:58:41 +0200 Subject: [PATCH] Web instances: Add flags to enable unsafe extra features (#438) --- source/app/web/settings.example.json | 3 ++- source/plugins/core/index.mjs | 2 +- source/plugins/habits/README.md | 2 ++ source/plugins/habits/index.mjs | 5 ++--- source/plugins/languages/README.md | 4 +++- source/plugins/languages/index.mjs | 25 ++++++++++++++----------- source/plugins/licenses/README.md | 6 ++++-- source/plugins/licenses/index.mjs | 4 ++-- 8 files changed, 30 insertions(+), 21 deletions(-) diff --git a/source/app/web/settings.example.json b/source/app/web/settings.example.json index 4547715c..cdbd9cf1 100644 --- a/source/app/web/settings.example.json +++ b/source/app/web/settings.example.json @@ -27,7 +27,8 @@ }, "extras": { "default": false, "//": "Default extras state (advised to let 'false' unless in debug mode)", - "css": false, "//": "Allow use of 'extras.css' option" + "css": false, "//": "Allow use of 'extras.css' option", + "features": false, "//": "Enable extra features (advised to let 'false' on web instances)" }, "plugins.default": false, "//": "Default plugin state (advised to let 'false' unless in debug mode)", "plugins": { "//": "Global plugin configuration", diff --git a/source/plugins/core/index.mjs b/source/plugins/core/index.mjs index 18c82a8a..0acbb3e9 100644 --- a/source/plugins/core/index.mjs +++ b/source/plugins/core/index.mjs @@ -47,7 +47,7 @@ export default async function({login, q}, {conf, data, rest, graphql, plugins, q pending.push((async () => { try { console.debug(`metrics/compute/${login}/plugins > ${name} > started`) - data.plugins[name] = await imports.plugins[name]({login, q, imports, data, computed, rest, graphql, queries, account}, plugins[name]) + data.plugins[name] = await imports.plugins[name]({login, q, imports, data, computed, rest, graphql, queries, account}, {...plugins[name], extras:conf.settings?.extras?.features ?? conf.settings?.extras?.default ?? false}) console.debug(`metrics/compute/${login}/plugins > ${name} > completed`) } catch (error) { diff --git a/source/plugins/habits/README.md b/source/plugins/habits/README.md index f65c112b..5de92d15 100644 --- a/source/plugins/habits/README.md +++ b/source/plugins/habits/README.md @@ -21,6 +21,8 @@ Use a full `repo` scope token to access **private** events. By default, dates use Greenwich meridian (GMT/UTC). Be sure to set your timezone (see [here](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) for a list of supported timezones) for accurate metrics. +> 🔣 On web instances, *recent languages activity* is an extra feature and must be enabled globally in `settings.json` + #### ℹ️ Examples workflows [➡️ Available options for this plugin](metadata.yml) diff --git a/source/plugins/habits/index.mjs b/source/plugins/habits/index.mjs index 220db707..7d40d743 100644 --- a/source/plugins/habits/index.mjs +++ b/source/plugins/habits/index.mjs @@ -2,7 +2,7 @@ import { recent as recent_analyzer } from "./../languages/analyzers.mjs" //Setup -export default async function({login, data, rest, imports, q, account}, {enabled = false, ...defaults} = {}) { +export default async function({login, data, rest, imports, q, account}, {enabled = false, extras = false, ...defaults} = {}) { //Plugin execution try { //Check if plugin is enabled and requirements are met @@ -97,7 +97,7 @@ export default async function({login, data, rest, imports, q, account}, {enabled } //Linguist - if (charts) { + if ((extras)&&(charts)) { //Check if linguist exists console.debug(`metrics/compute/${login}/plugins > habits > searching recently used languages using linguist`) if (patches.length) { @@ -109,7 +109,6 @@ export default async function({login, data, rest, imports, q, account}, {enabled } else console.debug(`metrics/compute/${login}/plugins > habits > linguist not available`) - } //Results diff --git a/source/plugins/languages/README.md b/source/plugins/languages/README.md index c6b9684c..0d1070fe 100644 --- a/source/plugins/languages/README.md +++ b/source/plugins/languages/README.md @@ -30,9 +30,11 @@ If you work a lot with other people, these numbers may be less representative of The `plugin_languages_indepth` option lets you get more accurate metrics by cloning each repository you contributed to, running [github/linguist](https://github.com/github/linguist) on it and then iterating over patches matching your username from `git log`. This method is slower than the first one. -> ⚠️ Although *metrics* does not send any code to external sources, you must understand that when using this option repositories are cloned locally temporarly on the GitHub Action runner. If you work with sensitive data or company code, it is advised to keep this option disabled. *Metrics* cannot be held responsible for any eventual code leaks, use at your own risk. +> ⚠️ Although *metrics* does not send any code to external sources, you must understand that when using this option repositories are cloned locally temporarly on the GitHub Action runner. If you work with sensitive data or company code, it is advised to keep this option disabled. *Metrics* and its authors cannot be held responsible for any eventual code leaks, use at your own risk. > Source code is available for auditing at [analyzers.mjs](/source/plugins/languages/analyzers.mjs) +> 🔣 On web instances, `indepth` is an extra feature and must be enabled globally in `settings.json` + #### `commits_authoring` option Since Git lets you use any email and name for commits, metrics may not be able to detect whether you own a commit or not. By default, it'll check whether it matches your GitHub login. diff --git a/source/plugins/languages/index.mjs b/source/plugins/languages/index.mjs index 05c3d925..ecc88843 100644 --- a/source/plugins/languages/index.mjs +++ b/source/plugins/languages/index.mjs @@ -2,7 +2,7 @@ import { indepth as indepth_analyzer, recent as recent_analyzer } from "./analyzers.mjs" //Setup -export default async function({login, data, imports, q, rest, account}, {enabled = false} = {}) { +export default async function({login, data, imports, q, rest, account}, {enabled = false, extras = false} = {}) { //Plugin execution try { //Check if plugin is enabled and requirements are met @@ -52,17 +52,20 @@ export default async function({login, data, imports, q, rest, account}, {enabled } } - //Recently used languages - if ((sections.includes("recently-used"))&&(context.mode === "user")) { - console.debug(`metrics/compute/${login}/plugins > languages > using recent analyzer`) - languages["stats.recent"] = await recent_analyzer({login, data, imports, rest, account}, {skipped, days:_recent_days, load:_recent_load}) - } + //Extras features + if (extras) { + //Recently used languages + if ((sections.includes("recently-used"))&&(context.mode === "user")) { + console.debug(`metrics/compute/${login}/plugins > languages > using recent analyzer`) + languages["stats.recent"] = await recent_analyzer({login, data, imports, rest, account}, {skipped, days:_recent_days, load:_recent_load}) + } - //Indepth mode - if (indepth) { - console.debug(`metrics/compute/${login}/plugins > languages > switching to indepth mode (this may take some time)`) - Object.assign(languages, await indepth_analyzer({login, data, imports, repositories}, {skipped})) - console.debug(`metrics/compute/${login}/plugins > languages > indepth analysis missed ${languages.missed} commits`) + //Indepth mode + if (indepth) { + console.debug(`metrics/compute/${login}/plugins > languages > switching to indepth mode (this may take some time)`) + Object.assign(languages, await indepth_analyzer({login, data, imports, repositories}, {skipped})) + console.debug(`metrics/compute/${login}/plugins > languages > indepth analysis missed ${languages.missed} commits`) + } } //Compute languages stats diff --git a/source/plugins/licenses/README.md b/source/plugins/licenses/README.md index f0b2c2ff..fc686aca 100644 --- a/source/plugins/licenses/README.md +++ b/source/plugins/licenses/README.md @@ -1,8 +1,10 @@ ### 📜 Repository licenses > ⚠️ This is **NOT** legal advice, use at your own risk -> -> 💣 Do **NOT** enable this plugin on public web instances (plugin allows raw commands injection) + +> 🔣 On web instances, this plugin is an extra feature and must be enabled globally in `settings.json` +> 💣 Note that this plugin allows raw commands injection and is **NOT** advised to be enabled on them +> This could result in compromised server! The *licenses* plugin lets you display license informations like permissions, limitations and conditions along with additional metrics about dependencies. diff --git a/source/plugins/licenses/index.mjs b/source/plugins/licenses/index.mjs index 7575d7da..1530b937 100644 --- a/source/plugins/licenses/index.mjs +++ b/source/plugins/licenses/index.mjs @@ -1,9 +1,9 @@ //Setup -export default async function({login, q, imports, data, graphql, queries, account}, {enabled = false} = {}) { +export default async function({login, q, imports, data, graphql, queries, account}, {enabled = false, extras = false} = {}) { //Plugin execution try { //Check if plugin is enabled and requirements are met - if ((!enabled) || (!q.licenses)) + if ((!enabled) || (!extras) || (!q.licenses)) return null //Load inputs