Returning to the Moon: Launchpad Security Penetration Exercise

There is an unexpected reward for moving source-code management of my Hexo-generated blogging to git and GitHub.  GitHub provides dependency analysis of node.js projects.  I receive an automated email about one dependency of my hexo-spanner code.

GitHub analysis of the hexo-spanner package.lock.json package reveals that UglifyJS2, depended on by Swig, has a known security vulnerability cured in a later version.

The uglify-js package is only depended on by Swig.  That places it in isolated use in confined ways under hexo.  I (will) do nothing to rely on Swig in any other manner.    I’ve dismissed the alert with explanation that the reported dependency is not exposed to the exploit.  I also created an issue on the hexo GitHub wondering if Swig can be deprecated from use in Hexo, since Swig is no longer maintained.

All in all, an amazing reward of my transposition of the Spanner Wingnut source-code management to GitHub.

This entry was posted in Blog Development, blogs, Git, Hexo, Security Vulnerabilities, Spanner Wingnut, Toolcraft and tagged , , , , . Bookmark the permalink.

21 Responses to Returning to the Moon: Launchpad Security Penetration Exercise

  1. Hello what would I need to know to understand this? Thank you, Doug

    • orcmid's avatar orcmid says:

      Start here: https://hexo.io/docs/

      You will need to use node.js from the command line.

      On Windows, I have a batch script that I use on start-up of cmd.exe to set parameters for node.js. Also, I use the GitHub desktop for Windows. I also install TortoiseGit. Those make it easier to track where I have made changes that need to be attended to.

      • orcmid's avatar orcmid says:

        Oh, and then I use GitHub to provide the online storage of my source-code and changes. I need to make a post about how I did that.

  2. The video from Giraffe Academy explained it well for installing node.js and git onto my computer so as to use Hexo to build blogs. What do they mean by describing it as a blog framework? And what is useful about using this tool for you?

    • orcmid's avatar orcmid says:

      1. I want a blog that stores static pages — nothing is done at the server to deliver the page to a browser apart from what web servers do. So I could move the pages to another server and be up and running again without difficulty. And I can preserve/backup the pages.
      2. I also want the static pages to place minimal demands on the browser and client computer. Hexo goes beyond the minimum, but it appears to be fine for modern browsers and the pages are “responsive” which is a bonus beyond my minimum requirements.
      3. This does move generation of the pages to my desktop computer, and that is tolerable although not quite as convenient as using something like WordPress.com or Blogger. There is also more work to configure the blog generation and formatting in a form that suits my intended purpose for my blogs. That is the difficult part so far, and the poor interoperability across browsers is a concern. That’s an unexpected challenge and I must blog about that :).

  3. PS: What is a batch script?

    • orcmid's avatar orcmid says:

      A batch script or batch file is a *.bat file. It is the MS-DOS/Windows counterpart of a shell script. I use them for simple operations that a novice can run without having to know too much. The tidygen.bat file that I am talking about in this post can be viewed at https://github.com/orcmid/hexo-spanner

      My batch scripts are meant to be safely usable but are more intricate than usual. I incorporate documentation and also provide error checking. But that doesn’t have to be understood simply to use it as written. (The current tidygen.bat is under development. It is missing some things ,identified in the TODOs near the end.)

  4. Sorry I couldn’t find the .bat file following that link, also what is a shell script?

  5. I found it I forgot to scroll down to the bottom

  6. You say the tidygen.bat file can be used by a novice:

    rem This procedure tidies the nfoCentrale/spanner Hexo-authoring folder
    rem prior to generation of updates to the public blog folder. This avoids
    rem interference with Hexo and cluttering of the material uploaded to
    rem .
    rem
    rem Tidying removes ephemeral files and *.scc files left as part of editing
    rem and source-code management operations. The clutter can also disrupt
    rem generation operations that fail on encountering unrecognized material.
    rem
    rem There are recursive file deletions. Protections against dangerous use
    rem are included. Performance from the proper location and configuration
    rem are checked. Along with that, a common nfoTools approach to command-line
    rem Windows batch files is employed, allowing embedded and terse options as
    rem well as the default verbose presentation.

    But don’t I need to understand the above to be able to use it?

    • orcmid's avatar orcmid says:

      The usage instructions are simply to run tidygen.bat after making any changes when I want to generate the blog with those changes made. That matters only for someone using a clone of the hexo-spanner project, and that’s not likely to be anyone but me. Better instructions would leave out most of those comments and have documentation outside of the batch file itself.

      Recall that the question was “what is a batch script?” I think I’ve answered that. To know more, do an Internet search for “windows batch script” and look at some of the resources that are found.

      • orcmid's avatar orcmid says:

        I should have been clear that I have a practice for making batch scripts for use by novices for things, and while tidygen.bat has some of the pattern (the messages, error checking, etc.) my first interest in tidygen.bat was having it work for me, since hexo-spanner is a personal project.

  7. Oh, ok thanks. I wasn’t sure at what level you are interested in teaching. So I suppose knucklehead questions aren’t what your looking for out of prospective students. That’s good to know.

    • orcmid's avatar orcmid says:

      The work with hexo is a personal project for restoring my blogs to operation with static generated pages. The account of my experience and the challenges qualify as a journal, I imagine. That is within scope for a blog. I believe the term is short for “web log.”

      I don’t intend this as a tutorial on creating a blog with hexo and the landscape theme. The account and especially results over at http://orcmid.com/BlunderDome/wingnut may be useful for someone undertaking a similar journey.
      I do other things that are tutorial in nature. This series is not that.

      • orcmid's avatar orcmid says:

        PS: I don’t mind your questions. It is useful to know what questions come up. In some cases, I don’t have an useful response because it doesn’t fit here. Asking questions is a perfectly fine way to learn that when it is not a familiar subject.

      • Well that is good you do tutorials. The main reason for this dialogue is that I am interested in what you do, and the fact that it is a subject that is interesting to me is an extra bonus.

  8. P.S. Do you get many comments? Or is this more like an online journal?

    • orcmid's avatar orcmid says:

      You can see the only comments that have been made on the subject of these posts. There are occasional comments on posts with different topics. This blog had been pretty quiet for some time, so I have no idea how many visitors there are now. Also, it presents ads to people. One thing about the hexo-generated blogs is there will be no ads.

    • orcmid's avatar orcmid says:

      There are statistics available about this WordPress blog. It seems the only visitors are the two of us :).

Leave a comment