Skip to content

Conversation

romanzipp
Copy link
Contributor

@romanzipp romanzipp commented Apr 6, 2024

I would like to add a configuration option that will omit any specific version numbers in the generated output.

This change was motivated by the fact that possible attackers could easily determine if there are known vulnerabilities in a given node proejct if the license file is publicly available.

Unfortunately I'm not familiar with TS and testing in JavaScript so it could easily be possible that this change won't work in it's current form.

Thanks for your work on the project and let me know if you would be willing to implement such a change.

Proposed changes to the output file

This file was generated with the generate-license-file npm package!
https://www.npmjs.com/package/generate-license-file

The following npm package may be included in this product:

- - @xtuc/long@4.2.2
+ - @xtuc/long

This package contains the following license and notice below:

Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

@tobysmith568
Copy link
Member

Hey @romanzipp ,

Thank you for this suggestion and for raising a PR for it.

We'll try to find some time to look over this in the new few days, and we'll get back to you as soon as possible.

Thanks again :)

Copy link

codecov bot commented Apr 20, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (36c9f36) to head (8c3a45c).
Report is 8 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff            @@
##              main      #356   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           28        28           
  Lines          505       525   +20     
  Branches        80        89    +9     
=========================================
+ Hits           505       525   +20     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@tobysmith568
Copy link
Member

Hey @romanzipp ,

Thank you for raising this PR; we're up for merging this feature.

I hope you don't mind but we've pushed a couple of commits up to your branch.
There's still a couple of outstanding changes that we'll make tomorrow. If all goes well this could be released by early next week.

describe("omit-versions", () => {
it("should match snapshot when --omit-versions is given", async () => {
await execAsync(
`npx generate-license-file --input ${input} --output ${output} --omit-versions`

Check warning

Code scanning / CodeQL

Shell command built from environment values

This shell command depends on an uncontrolled [absolute path](1).
@tobybessant tobybessant merged commit 492cb5c into TobyAndToby:main Apr 21, 2024
@tobybessant
Copy link
Member

Hey @romanzipp,

We've released this feature as part of the latest minor release, v3.4.0, thanks for your contribution to the project.

@romanzipp romanzipp deleted the add-option-to-omit-version-number branch April 22, 2024 14:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants