Release v2.12.2 - #505
Merged
Merged
Conversation
- Engine.io endpoint is attached to the raw HTTP server, so connect's session middleware is not in its request path. Require a session handshake before honouring any message on that socket, mirroring how pylon.socket validates the smith.io attach message. Defer session object creation until it succeeds. Client sends the session id it already holds and queues outbound messages until the server acknowledges. Adds 11 regression tests. - Use local mocha - Fix tests - Report a non-zero exit status when any test file fails - New lock
- History.md update - New lock
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces important security and correctness improvements, especially for terminal session authentication, and modernizes test infrastructure and code compatibility. The most significant changes are the addition of application-layer authentication for terminal sessions, fixes for line numbering in code analysis, and updates to test dependencies and code for compatibility with newer Node.js and package versions.
Security and Authentication Improvements
Added application-layer authentication to the terminal client and server: the terminal socket now requires a session id handshake before accepting any commands, preventing unauthorized access if the session is invalid or expired. The server enforces an authentication timeout and only creates a session after successful authentication, with clear error handling and user feedback. (
plugins-client/ext.terminal/tty.js,plugins-server/pylon.ide.terminal/tty.js,plugins-server/pylon.ide.terminal/package.json,plugins-server/pylon.ide.terminal/terminal.js) [1] [2] [3] [4] [5] [6]Local terminal connections are now strictly enforced: connections from non-local addresses are refused and closed immediately, strengthening defense in depth. (
plugins-server/pylon.ide.terminal/tty.js)Correctness and Bug Fixes
Fixed line numbering mismatches between different components (treehugger, ACE, jshint) in code analysis and outline features, ensuring that markers and variable positions are displayed accurately in the editor. (
plugins-client/ext.jslanguage/scope_analyzer.js,plugins-client/ext.language/worker.js) [1] [2] [3]Removed a non-functional test case that depended on a missing
jquery.jsfixture and only served as a commented-out benchmark. (plugins-client/ext.jslanguage/outline_test.js)Test Harness and Dependency Updates
Restored and updated the test harness by adding
mochaandsinonas dev dependencies, and modernized test code to use up-to-date APIs (e.g., replacing deprecatedPath.existsSyncwithFs.existsSync, usingfs.rminstead ofrimraf). (package.json,plugins-server/pylon.ide.revisions/test/revisions_test.js,plugins-server/pylon.ide.filelist/filelist_test.js,plugins-server/pylon.ide.search/search_test.js) [1] [2] [3] [4] [5] [6] [7]Fixed a bug in the async
whilstusage in revisions handling to comply with modernasynclibrary requirements. (plugins-server/pylon.ide.revisions/revisions.js)Documentation
History.md,package.json) [1] [2]These changes collectively improve the security, reliability, and maintainability of the codebase.