Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions docs/labs/argument-injection.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,73 +3,73 @@ info =
hints: [
{
present: String.raw`exec \(`,
text: "The `exec` function is vulnerable to command injection. Replace it with `execFile` to improve security."
text: "The `exec` function is vulnerable to command injection. Replace it with `execFile` to improve security.",
},
{
absent: String.raw`^[\n\r]*\s*execFile\s*\(`,
text: "Use the `execFile` function instead of `exec` to avoid shell interpretation. Your line should start with `execFile(`."
text: "Use the `execFile` function instead of `exec` to avoid shell interpretation. Your line should start with `execFile(`.",
},
{
absent: String.raw`execFile\s*\(\s*['"${BACKQUOTE}]git['"${BACKQUOTE}]\s*,`,
text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git' without any of the command arguments."
text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git' without any of the command arguments.",
},
{
present: String.raw`['"${BACKQUOTE}]git\x20blame['"${BACKQUOTE}]`,
text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git', followed by an array with parameters, like this: `execFile('git', ['blame', ...])`."
text: "Separate the command and its arguments. The first argument to `execFile` should be the command 'git', followed by an array with parameters, like this: `execFile('git', ['blame', ...])`.",
},
{
absent: String.raw`\[ ['"${BACKQUOTE}]blame`,
text: "Pass the arguments as an array, like this: `execFile('git', ['blame', ...])`."
text: "Pass the arguments as an array, like this: `execFile('git', ['blame', ...])`.",
},
{
present: "--",
absent: String.raw`['"${BACKQUOTE}]--['"${BACKQUOTE}]`,
text: "To pass `--` you need to pass it as a literal string. Typically this is notated as `'--'` or `\"--\"`."
text: "To pass `--` you need to pass it as a literal string. Typically this is notated as `'--'` or `\"--\"`.",
},
{
absent: String.raw`\[ ['"${BACKQUOTE}]blame['"${BACKQUOTE}] , ['"${BACKQUOTE}]--['"${BACKQUOTE}] ,`,
text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', ...`."
text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', ...`.",
},
{
present: String.raw`['"${BACKQUOTE}]filePath['"${BACKQUOTE}]`,
text: "`filePath` is a variable, use it directly without using quote marks."
text: "`filePath` is a variable, use it directly without using quote marks.",
},
{
present: String.raw`['"]\$\{filePath\}['"]`,
text: "`filePath` is a variable, use it directly without using quote marks."
text: "`filePath` is a variable, use it directly without using quote marks.",
},
{
present: String.raw`${BACKQUOTE}\$\{filePath\}${BACKQUOTE}`,
text: "Strictly speaking, using a backquoted template with a single reference to a variable name works. In this case, it's being done to `filePath`. However, this is unnecessarily complicated. When you want to simply refer to a variable's value, use the variable name."
text: "Strictly speaking, using a backquoted template with a single reference to a variable name works. In this case, it's being done to `filePath`. However, this is unnecessarily complicated. When you want to simply refer to a variable's value, use the variable name.",
},
{
absent: String.raw`\[ ['"${BACKQUOTE}]blame['"${BACKQUOTE}] , ['"${BACKQUOTE}]--['"${BACKQUOTE}] , filePath \]`,
text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', filePath]`."
text: "Pass the arguments as an array. Include '--' before the file path to prevent argument injection. Your array should look like `['blame', '--', filePath]`.",
},
{
present: "shell = [fF]alse",
text: "When passing options to execFile, you need an option with the options, and those use `:` not `=`. So you should say something like: `{shell: false}`."
text: "When passing options to execFile, you need an option with the options, and those use `:` not `=`. So you should say something like: `{shell: false}`.",
},
{
present: "[F]alse",
text: "JavaScript is case-sensitive. The false value is spelled as `false` and not `False`."
text: "JavaScript is case-sensitive. The false value is spelled as `false` and not `False`.",
},
{
absent: String.raw`\{ shell : false \}`,
present: "shell : false",
text: "When passing options to execFile, you must provide those options as a JavaScript object. That means you must surround them with `{...}` like this: `{shell: false}`."
text: "When passing options to execFile, you must provide those options as a JavaScript object. That means you must surround them with `{...}` like this: `{shell: false}`.",
},
{
absent: String.raw`\{ shell : false \}`,
text: "We encourage you to explicitly set `shell: false` in the options object to prevent shell interpretation. That is something like this: `execFile('git', ['blame', '--', filePath], { shell: false }, ...`"
text: "We encourage you to explicitly set `shell: false` in the options object to prevent shell interpretation. That is something like this: `execFile('git', ['blame', '--', filePath], { shell: false }, ...`",
},
{
absent: String.raw`\(\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*,\s*[a-zA-Z_$][a-zA-Z0-9_$]*\s*\)\s*=>`,
text: "Maintain the callback function structure with three parameters (typically named error, stdout, and stderr, but any valid variable names are acceptable)."
text: "Maintain the callback function structure with three parameters (typically named error, stdout, and stderr, but any valid variable names are acceptable).",
},
{
present: String.raw`\) \) =>`,
text: "The `exec` function should be closed in later lines, not here."
text: "The `exec` function should be closed in later lines, not here.",
},
],
expected: [
Expand Down
14 changes: 7 additions & 7 deletions docs/labs/assert.js
Original file line number Diff line number Diff line change
Expand Up @@ -17,11 +17,11 @@ info =
},
{
present: "(bindingresult|BindingResult)",
text: "Java is case-sensitive. Use `bindingResult`, not `bindingresult` nor `BindingResult`."
text: "Java is case-sensitive. Use `bindingResult`, not `bindingresult` nor `BindingResult`.",
},
{
present: "(haserrors|HasErrors)",
text: "Java is case-sensitive. Use `hasErrors`, not `haserrors` nor `HasErrors`."
text: "Java is case-sensitive. Use `hasErrors`, not `haserrors` nor `HasErrors`.",
},
{
present: String.raw`^\s*if\s*[^\(\s]`,
Expand All @@ -39,25 +39,25 @@ info =
},
{
absent: String.raw`^ if \( bindingResult \. hasErrors \( \) \) `,
text: "Begin the answer with the text `if (bindingResult.hasErrors())` so that a statement will be executed if that condition is true."
text: "Begin the answer with the text `if (bindingResult.hasErrors())` so that a statement will be executed if that condition is true.",
},
{
present: String.raw`if \( bindingResult \. hasErrors \( \) \) [^\{\s] `,
text: "Follow the conditional with an open brace, e.g., `if (bindingResult.hasErrors()) {...`."
text: "Follow the conditional with an open brace, e.g., `if (bindingResult.hasErrors()) {...`.",
},
{
absent: String.raw`return "form"
`,
text: "You need to use `return \"form\";` somewhere."
text: "You need to use `return \"form\";` somewhere.",
},
{
present: String.raw`return "form"`,
absent: String.raw`return "form" ;`,
text: "You need to use `;` (semicolon) after `return \"form\"` because in Java statements must be followed by a semicolon."
text: "You need to use `;` (semicolon) after `return \"form\"` because in Java statements must be followed by a semicolon.",
},
{
absent: String.raw`\} $`,
text: "The answer needs to end with `}` (closing brace)."
text: "The answer needs to end with `}` (closing brace).",
},
],
expected: [
Expand Down
4 changes: 2 additions & 2 deletions docs/labs/conversion.js
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ info =
hints: [
{
absent: "unsigned",
text: "The type defined for queue_count should exactly match the return type of get_queue."
text: "The type defined for queue_count should exactly match the return type of get_queue.",
},
{
present: String.raw`unsigned\s+queue_count`,
text: "The declared return type of get_queue is `unsigned int`; you should match it exactly instead of using a synonym like `unsigned`."
text: "The declared return type of get_queue is `unsigned int`; you should match it exactly instead of using a synonym like `unsigned`.",
},
],
expected: [
Expand Down
18 changes: 9 additions & 9 deletions docs/labs/csp1.js
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ info =
},
{
absent: "const",
text: "Start with const."
text: "Start with const.",
},
{
absent: String.raw`const\s+helmet =`,
Expand All @@ -39,22 +39,22 @@ info =
{
absent: String.raw`\s* app \. use \( helmet \( \{`,
index: 1,
text: "Your code should begin with app.use(helmet({"
text: "Your code should begin with app.use(helmet({",
},
{
absent: String.raw`\s* app \. use \( helmet \( \{
contentSecurityPolicy: \{ \s*
`,
index: 1,
text: "Your code should begin with:\napp.use(helmet({\n contentSecurityPolicy: {\n"
text: "Your code should begin with:\napp.use(helmet({\n contentSecurityPolicy: {\n",
},
{
absent: String.raw`\s* app \. use \( helmet \( \{
contentSecurityPolicy: \{
directives: \{ \s*
`,
index: 1,
text: "Your code should begin with:\napp.use(helmet({\n contentSecurityPolicy: {\n directives: {\n"
text: "Your code should begin with:\napp.use(helmet({\n contentSecurityPolicy: {\n directives: {\n",
},
{
absent: String.raw`\s* app \. use \( helmet \( \{
Expand All @@ -63,26 +63,26 @@ info =
"script-src": \[ "'self'" , ["']https://example.com["'] \] , \s*
`,
index: 1,
text: "Your code should continue with:\napp.use(helmet({\n contentSecurityPolicy: {\n directives: {\n \"script-src\": [\"'self'\", \"https://example.com\"],\n"
text: "Your code should continue with:\napp.use(helmet({\n contentSecurityPolicy: {\n directives: {\n \"script-src\": [\"'self'\", \"https://example.com\"],\n",
},
{
absent: String.raw`"style-src": \[ "'self'" \]
`,
index: 1,
text: "Don't forget to include \"style-src\": [\"'self'\"]\n"
text: "Don't forget to include \"style-src\": [\"'self'\"]\n",
},
{
absent: "; $",
index: 1,
text: "JavaScript doesn''t require semicolon terminators, but the rest of the code uses them. You should try to match a coding style when modifying existing code unless there''s an important reason not to. Please update the second statement to use a semicolon terminator."
text: "JavaScript doesn''t require semicolon terminators, but the rest of the code uses them. You should try to match a coding style when modifying existing code unless there''s an important reason not to. Please update the second statement to use a semicolon terminator.",
},
{
absent: String.raw`\} \} \) \) ; $`,
index: 1,
text: "The correct answer is expected to end with `} } ) ) ;` ignoring whitespace. Check that you have matching parentheses and braces."
text: "The correct answer is expected to end with `} } ) ) ;` ignoring whitespace. Check that you have matching parentheses and braces.",
},
{
text: "I do not have more specific hints to provide. Please ensure that the parentheses, braces, and brackets pair correctly, as that is often the problem."
text: "I do not have more specific hints to provide. Please ensure that the parentheses, braces, and brackets pair correctly, as that is often the problem.",
},
],
expected: [
Expand Down
22 changes: 11 additions & 11 deletions docs/labs/deserialization.js
Original file line number Diff line number Diff line change
Expand Up @@ -27,31 +27,31 @@ info =
},
{
term: "CONDALL",
value: "(COND0 && (COND1 && COND2|COND2 && COND1))"
value: "(COND0 && (COND1 && COND2|COND2 && COND1))",
},
],
hints: [
{
absent: "^ const data =\n",
text: "The first section should begin with `const data =`"
text: "The first section should begin with `const data =`",
},
{
present: "json",
text: "the JSON built-in global object is witten in uppercase."
text: "the JSON built-in global object is witten in uppercase.",
},
{
absent: String.raw`JSON \. parse
`,
text: "Make a call to `JSON.parse` with the data retrieved, e.g., `JSON.parse(base64Decoded)` should be stored in `data`."
text: "Make a call to `JSON.parse` with the data retrieved, e.g., `JSON.parse(base64Decoded)` should be stored in `data`.",
},
{
present: String.raw`\+
`,
text: "You should not have any concatenation (`+`) in the first section."
text: "You should not have any concatenation (`+`) in the first section.",
},
{
absent: "; $\n",
text: "JavaScript does not require semicolons at the end of a statement, but since the other statements terminate with semicolons, you should also terminate your statement with a semicolon to be consistent."
text: "JavaScript does not require semicolons at the end of a statement, but since the other statements terminate with semicolons, you should also terminate your statement with a semicolon to be consistent.",
},
{
absent: String.raw`^ if \(`,
Expand All @@ -68,28 +68,28 @@ info =
absent: String.raw`data \. username
`,
index: 1,
text: "Check if the data object has a property called username. You can do this by referencing data.username."
text: "Check if the data object has a property called username. You can do this by referencing data.username.",
},
{
absent: String.raw`\&\&`,
index: 1,
text: "To combine multiple conditions in JavaScript use &&. This operator means 'and', so both conditions must be true for the entire statement to pass."
text: "To combine multiple conditions in JavaScript use &&. This operator means 'and', so both conditions must be true for the entire statement to pass.",
},
{
absent: "typeof",
index: 1,
text: "Use typeof to check the type of the operand's value. You should have `typeof data.username == 'string'` or similar."
text: "Use typeof to check the type of the operand's value. You should have `typeof data.username == 'string'` or similar.",
},
{
present: String.raw`typeof data \. username == 'String'
`,
index: 1,
text: "When using typeof, JavaScript expects \"string\" all lowercase."
text: "When using typeof, JavaScript expects \"string\" all lowercase.",
},
{
absent: "length",
index: 1,
text: "check if the length of the string is smaller than 20 characters. Use the expression `data.username.length < 20` to determine this."
text: "check if the length of the string is smaller than 20 characters. Use the expression `data.username.length < 20` to determine this.",
},
{
present: String.raw`^ if \(`,
Expand Down
10 changes: 5 additions & 5 deletions docs/labs/format-strings.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,24 +4,24 @@ info =
{
present: String.raw`def format_event \( user_input
`,
text: "The `user_format` should no longer be used, so we should remove it from the list of parameters being passed into the function being defined by `def`. The first line should read `def format_event(new_event):`"
text: "The `user_format` should no longer be used, so we should remove it from the list of parameters being passed into the function being defined by `def`. The first line should read `def format_event(new_event):`",
},
{
present: "user_input",
text: "Do not support a user-provided format at all. In this case there is no need for it."
text: "Do not support a user-provided format at all. In this case there is no need for it.",
},
{
absent: "event",
text: "We want to see `event`, e.g., return '{event.level},...'.format(event=new_event)"
text: "We want to see `event`, e.g., return '{event.level},...'.format(event=new_event)",
},
{
present: String.raw`\{0`,
text: "For our purposes we want to use named parameters, so do not use `{0}` or similar."
text: "For our purposes we want to use named parameters, so do not use `{0}` or similar.",
},
{
absent: String.raw`\'\{event.level\},\{event.message\}\'
`,
text: "The constant text `'{event.level},{event.message}'` should be present."
text: "The constant text `'{event.level},{event.message}'` should be present.",
},
],
expected: [
Expand Down
2 changes: 1 addition & 1 deletion docs/labs/free.js
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ info =
},
{
absent: "return",
text: "This fails to return the result."
text: "This fails to return the result.",
},
{
absent: String.raw`\s* [^;]+;[^;]+;[^;]+; \s*`,
Expand Down
2 changes: 1 addition & 1 deletion docs/labs/handling-errors.js
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ info =
{
index: 0,
absent: "; $",
text: "This code uses the convention of terminating each line with a semicolon; please follow the conventions of the code being modified.\n"
text: "This code uses the convention of terminating each line with a semicolon; please follow the conventions of the code being modified.\n",
},
{
index: 0,
Expand Down
Loading