-
Notifications
You must be signed in to change notification settings - Fork 1
This is the pull request. #3
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: 1.6.0
Are you sure you want to change the base?
Changes from 222 commits
7cfb959
d636b58
cc7d68a
3f46c1b
a63664e
34f7830
6bd46a9
adbba68
8c37f4d
4e8f528
e317bd4
1c8dd6a
8216440
6e1876c
a4d0963
d18990b
e27bf14
57c6150
9757986
6d9a53c
aad7d08
7c46efd
dc034cb
833d9ea
2832c5d
c9eb296
508f131
79bec70
53f7c4b
8e019ff
6b22310
7ab8860
18de771
eac8d07
3499c49
8756f03
29d6f3c
ec38d20
ed99296
6314b35
3122999
e50cc4f
a50aa50
2020fad
ba11266
2233992
2b67d28
ec4bcd8
65e101c
7147821
a3f21f5
df0635d
d1ba278
5438b24
8e2199f
4e258e3
3cde82d
18c2c31
2b4be6f
0426a11
1e33250
4fbf595
c945fca
00d4a41
9ca386b
8992a6b
442db65
39d8a9d
f502730
da5d01b
650b6b4
4ec0f1a
84343b0
dc044ba
34eb5d0
7c676ac
c95d0ff
c5fd99a
d71eb80
b17d557
8a5a2c1
b071454
e43315d
c179636
220eda7
1607ef4
f1a1e44
ed25408
cf2ef35
0450773
2dd73eb
541e7f9
078ff72
82cf70f
9830ac1
4871f62
5d80d41
8bd9a96
e2871a1
97f4890
0722a56
d936bed
07406e1
11365dd
7580256
e6a53d5
ddc5e60
7613bea
0e792e5
4e335be
4e10186
37ec3e5
2755d43
4ab2645
71f5d2d
763c249
1371869
49abe77
f1e0e08
1813058
1c8a500
2aa8414
be3f9ce
7adee7a
1b3e5dc
e8e79a1
6b7ae6d
427e223
cfd6478
1aa36ef
026122d
013131b
62b2e70
663ba51
042b6ba
4f43d5b
e4df8a9
c3d0d23
e8732aa
c3bb566
b4500af
bf505a9
cd5fb08
bc09ec5
34cc564
e1749e3
bb61817
f9fd897
b65410b
dc629d7
d7ada95
e0379c0
1f4a5c4
22ee708
0c57b81
61cc642
45040a9
9aef544
cfd762f
9783d86
40e8d90
3d6c198
6a07000
5d2d7e8
ec0c9ce
c2666f0
f6f4a0d
2bafe25
2043bbf
16f0409
fa74819
959bf4d
fe1f632
7a8f17c
67cf6a3
4de4b1e
05b0db6
6e21ff3
ce76b63
b53c7e2
24c3d2b
d6a81ce
d202a0c
eedc9db
cc8de63
771f4f1
8acfe7f
1abd9fb
de69cab
29e3909
2d118b3
c043b75
6c849ec
b76a53e
6cd9b4a
2603aa2
bb8395f
985e4ed
b3c2f98
f1847cf
90b502f
7a5ce6c
226d504
c01539b
0352d37
1b00b3a
7b6ffff
581e7bc
abd5c1d
eb0a02d
66eb708
0b63e99
c54c690
a586e7a
ff2b4b1
244b09e
0cea9f5
336028b
0663db7
3157719
5a19ca5
2732afd
30b401f
a9dc46c
23fa7dc
dcb8ac4
2a69aea
ccd6d9e
f4e793e
47f6ed1
57c9a8f
d1da611
fe36652
91fcbfd
2a0b15f
05d364c
c85f64b
b4ed109
fd6105b
594c008
04c138a
a028104
9d88b15
286cdea
40e4748
39a0c8a
eba383f
d36fa0f
b3fd877
0635b42
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # These are supported funding model platforms | ||
|
|
||
| github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2] | ||
| patreon: # Replace with a single Patreon username | ||
| open_collective: # Replace with a single Open Collective username | ||
| ko_fi: # Replace with a single Ko-fi username | ||
| tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel | ||
| community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry | ||
| liberapay: # Replace with a single Liberapay username | ||
| issuehunt: # Replace with a single IssueHunt username | ||
| lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry | ||
| polar: # Replace with a single Polar username | ||
| buy_me_a_coffee: # Replace with a single Buy Me a Coffee username | ||
| thanks_dev: # Replace with a single thanks.dev username | ||
| custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2'] |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| # This workflow uses actions that are not certified by GitHub. | ||
| # They are provided by a third-party and are governed by | ||
| # separate terms of service, privacy policy, and support | ||
| # documentation. | ||
|
|
||
| # This workflow will install Deno then run `deno lint` and `deno test`. | ||
| # For more information see: https://github.com/denoland/setup-deno | ||
|
|
||
| name: Deno | ||
|
|
||
| on: | ||
| push: | ||
| branches: ["1.6.0"] | ||
| pull_request: | ||
| branches: ["1.6.0"] | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Setup repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Deno | ||
| # uses: denoland/setup-deno@v1 | ||
| uses: denoland/setup-deno@61fe2df320078202e33d7d5ad347e7dcfa0e8f31 # v1.1.2 | ||
| with: | ||
| deno-version: v1.x | ||
|
|
||
| # Uncomment this step to verify the use of 'deno fmt' on each commit. | ||
| # - name: Verify formatting | ||
| # run: deno fmt --check | ||
|
|
||
| - name: Run linter | ||
| run: deno lint | ||
|
|
||
| - name: Run tests | ||
| run: deno test -A | ||
|
Comment on lines
+41
to
+42
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/deno.yml
printf '%s\n' '--- repository files relevant to Deno tests ---'
git ls-files | rg '(^|/)(deno\.jsonc?|deno\.lock|.*\.(ts|tsx|js|jsx)$)' | head -200
printf '%s\n' '--- workflow triggers and permissions ---'
rg -n -C 3 '^(on:| pull_request| push|permissions:| permissions:|deno test|uses:)' .github/workflows/deno.yml
printf '%s\n' '--- test commands and permission-sensitive APIs ---'
rg -n -C 2 'deno test|Deno\.(read|write|env|listen|connect|run|Command|serve)|fetch\(' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -300Repository: Rafafrias2012/BonziWORLD-patched Length of output: 2643 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- complete tracked-file inventory ---'
git ls-files | sed -n '1,300p'
printf '%s\n' '--- test-like files and Deno configuration ---'
git ls-files | rg -i '(^|/)(deno\.json(c)?|.*(^|[_./-])test([s._/-]|$).*\.(js|jsx|ts|tsx|mjs|cjs)$|.*_test\.(js|jsx|ts|tsx|mjs|cjs)$)' || true
printf '%s\n' '--- all permission-sensitive calls in tracked source files ---'
git grep -n -E 'Deno\.(read|write|env|listen|connect|run|Command|serve|open|remove|mkdir|create|chmod|chown|symlink|link|stat|lstat|readTextFile|writeTextFile)|fetch\(' -- '*.js' '*.jsx' '*.ts' '*.tsx' '*.mjs' '*.cjs' || true
printf '%s\n' '--- repository metadata and workflow history summary ---'
git ls-files -z | xargs -0 grep -Il -E 'deno test|Deno\.test|_test\.(js|ts)' 2>/dev/null || true
git status --shortRepository: Rafafrias2012/BonziWORLD-patched Length of output: 5116 🌐 Web query:
💡 Result: To run tests in Deno with full system permissions, you can use the --allow-all flag, which is synonymous with the -A flag [1][2]. When executing tests with the Deno CLI, passing --allow-all or -A disables the security sandbox for the test process, granting it unrestricted access to system resources such as the file system, network, and environment variables [1][2]. Example command: deno test --allow-all Key points regarding permissions and deno test: 1. Permission Inheritance: Deno runs code in a secure sandbox by default [2]. Any permission required by your test code must be explicitly granted via CLI flags (e.g., --allow-read, --allow-net) when running deno test [3][2]. 2. Scoping: It is recommended to use granular permissions (e.g., --allow-read=/tmp) rather than --allow-all to maintain the security benefits of the Deno runtime [2]. 3. Configuration Files: You can define sets of permissions in your deno.json file and reference them using the -P flag when running deno test, which provides a more manageable way to handle complex permission requirements across different environments [4]. 4. Documentation Tests: If you are running documentation tests (tests embedded in code comments), these also respect the permissions granted to the parent deno test process. They cannot be granted broader permissions than those provided to the initial command [5]. For more details on specific permission types and the security model, refer to the official Deno documentation on permissions [1][6]. Citations:
Restrict Deno test permissions. This 🤖 Prompt for AI Agents |
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| # Simple workflow for deploying static content to GitHub Pages | ||
| name: Deploy static content to Pages | ||
|
|
||
| on: | ||
| # Runs on pushes targeting the default branch | ||
| push: | ||
| branches: ["1.6.0"] | ||
|
|
||
| # Allows you to run this workflow manually from the Actions tab | ||
| workflow_dispatch: | ||
|
|
||
| # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages | ||
| permissions: | ||
| contents: read | ||
| pages: write | ||
| id-token: write | ||
|
|
||
| # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. | ||
| # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. | ||
| concurrency: | ||
| group: "pages" | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| # Single deploy job since we're just deploying | ||
| deploy: | ||
| environment: | ||
| name: github-pages | ||
| url: ${{ steps.deployment.outputs.page_url }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Pages | ||
| uses: actions/configure-pages@v5 | ||
| - name: Upload artifact | ||
| uses: actions/upload-pages-artifact@v3 | ||
| with: | ||
| # Upload entire repository | ||
| path: '.' | ||
|
Comment on lines
+36
to
+40
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win Upload the generated site, not the repository. The supplied Build the client before uploading and set the artifact path to 🤖 Prompt for AI Agents |
||
| - name: Deploy to GitHub Pages | ||
| id: deployment | ||
| uses: actions/deploy-pages@v5 | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| MIT License | ||
|
|
||
| Copyright © 2000-2026 Felipe Angelo, Inc. | ||
|
|
||
| Permission is hereby granted, free of charge, to any person obtaining a copy | ||
| of this software and associated documentation files (the "Software"), to deal | ||
| in the Software without restriction, including without limitation the rights | ||
| to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
| copies of the Software, and to permit persons to whom the Software is | ||
| furnished to do so, subject to the following conditions: | ||
|
|
||
| The above copyright notice and this permission notice shall be included in all | ||
| copies or substantial portions of the Software. | ||
|
|
||
| THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
| IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
| FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
| AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
| LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
| OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| SOFTWARE. |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,43 +1,74 @@ | ||||||||||||||||||||||||||||||||||
| # BonziWORLD Patched | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| This respository is a fork of the [original](https://github.com/heyjoeway/BonziWORLD). It will be updated frequently to be fully secure and fix problems with either the server or the client. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| This project was discontinued by heyjoeway due to his time being taken up by other responsibilities. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| All the source code for the server and client is publically available here. If you want to run your own BonziWORLD, by all means go ahead. Do whatever you'd like with this code. Just try to put me somewhere in the credits. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## Dependencies | ||||||||||||||||||||||||||||||||||
| - Node.js and npm | ||||||||||||||||||||||||||||||||||
| - Ruby | ||||||||||||||||||||||||||||||||||
| - Sass | ||||||||||||||||||||||||||||||||||
| - Git | ||||||||||||||||||||||||||||||||||
| - Cordova (Optional) | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## Setup | ||||||||||||||||||||||||||||||||||
| In a terminal/command prompt, navigate to where you'd like BonziWORLD to be placed and run the following: | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| git clone https://github.com/Seamusmario/BonziWORLD-patched | ||||||||||||||||||||||||||||||||||
| cd BonziWORLD-patched | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ### Client | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| cd src | ||||||||||||||||||||||||||||||||||
| npm install | ||||||||||||||||||||||||||||||||||
| grunt build_www | ||||||||||||||||||||||||||||||||||
| cd .. | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ### Server | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| cd server | ||||||||||||||||||||||||||||||||||
| npm install | ||||||||||||||||||||||||||||||||||
| node index.js | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| After this, BonziWORLD will be accessible on port 3000. (http://localhost:3000/) | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## Disclaimer | ||||||||||||||||||||||||||||||||||
| I'm not responsible if you screw up anything with your computer while setting this up. I have no idea how you would, but someone will find a way. I also will not provide support for installing dependencies. If you have everything installed properly, the above commands will work. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## License | ||||||||||||||||||||||||||||||||||
| MIT | ||||||||||||||||||||||||||||||||||
| # BonziWORLD | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| This repository is a fork of the [original](https://github.com/heyjoeway/BonziWORLD), [patched](https://github.com/duckduckstab1/BonziWORLD-patched), and [fully patched](https://github.com/Rafafrias20[...] | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| This project was discontinued by heyjoeway due to his time being taken up by other repositories. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| All the source code for the server and client is publicly available here. If you want to run your own BonziWORLD, by all means go ahead. Do whatever you'd like with this code. _Just try to put me some[...] | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## Dependencies | ||||||||||||||||||||||||||||||||||
| - Node.js and npm | ||||||||||||||||||||||||||||||||||
| - Ruby | ||||||||||||||||||||||||||||||||||
| - Scss/Sass | ||||||||||||||||||||||||||||||||||
| - Git | ||||||||||||||||||||||||||||||||||
| - Cordova (Optional) | ||||||||||||||||||||||||||||||||||
| - Grunt | ||||||||||||||||||||||||||||||||||
| - Winston | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## Setup | ||||||||||||||||||||||||||||||||||
| In a terminal and/or command prompt, navigate to where you'd like BonziWORLD to be placed and run the following: | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| git clone https://github.com/felipeangeloben-create/BonziWORLD | ||||||||||||||||||||||||||||||||||
| cd BonziWORLD | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ### Client | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| cd src | ||||||||||||||||||||||||||||||||||
| npm install | ||||||||||||||||||||||||||||||||||
| grunt build_www | ||||||||||||||||||||||||||||||||||
| cd .. | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ### Server | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| cd server | ||||||||||||||||||||||||||||||||||
| npm install | ||||||||||||||||||||||||||||||||||
| node index.js | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| ### Server (nginx) | ||||||||||||||||||||||||||||||||||
| <pre><span><code>Check out this <a href="https://www.youtube.com/watch?v=krcYPrjIDzU" alt="Tutorial" title="Tutorial">tutorial</a> below. | ||||||||||||||||||||||||||||||||||
| </code></span></pre> | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ### Deploy GitHub Project on Render | ||||||||||||||||||||||||||||||||||
| You can deploy this project on Render (https://render.com) for automatic builds and hosted runtime. The steps below guide you through a simple Web Service deployment that builds the client and runs the Node server. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| 1. Create a Render account and connect your GitHub account. | ||||||||||||||||||||||||||||||||||
| 2. In Render, click New -> Web Service and select the `felipeangeloben-create/BonziWORLD` repository (choose the branch you want to deploy). | ||||||||||||||||||||||||||||||||||
| 3. Configure the service: | ||||||||||||||||||||||||||||||||||
| - Environment: Node | ||||||||||||||||||||||||||||||||||
| - Build Command: | ||||||||||||||||||||||||||||||||||
| ```bash | ||||||||||||||||||||||||||||||||||
| # from the repository root, build the client and install server deps | ||||||||||||||||||||||||||||||||||
| bash -lc "cd src && npm install && npx grunt build_www && cd ../server && npm install" | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| - Start Command: | ||||||||||||||||||||||||||||||||||
| ```bash | ||||||||||||||||||||||||||||||||||
| node server/index.js | ||||||||||||||||||||||||||||||||||
| ``` | ||||||||||||||||||||||||||||||||||
| - Instance Type / Plan: choose according to your traffic needs (Free tier available on Render). | ||||||||||||||||||||||||||||||||||
| 4. Environment variables (optional): If your server expects any secrets or environment variables (e.g. session secrets, API keys), add them under Environment in Render. | ||||||||||||||||||||||||||||||||||
| 5. Port handling: Render provides a PORT environment variable for web services. Ensure `server/index.js` uses `process.env.PORT || 3000` when binding the HTTP server. If it does not, update the server code to read `process.env.PORT` so Render can route traffic properly. | ||||||||||||||||||||||||||||||||||
| 6. Deploy: click Create Web Service. Render will run the build command and start the service. Subsequent pushes to the selected branch will trigger automatic deploys. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| Notes: | ||||||||||||||||||||||||||||||||||
| - The build command above uses `npx grunt` so you don't need a global Grunt CLI install on Render. If your repo defines npm scripts to build the client or start the server, you can replace the Build/Start commands with those scripts. | ||||||||||||||||||||||||||||||||||
| - If you need HTTPS, custom domains, or background workers, Render provides those features in the service settings. | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| After that, BonziWORLD will be accessible on port 3000. (http://localhost:3000/) | ||||||||||||||||||||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win Correct the Render port and URL instructions. Line 61 tells maintainers to change Line 68 places Proposed documentation fix-5. Port handling: Render provides a PORT environment variable for web services. Ensure `server/index.js` uses `process.env.PORT || 3000` when binding the HTTP server. If it does not, update the server code to read `process.env.PORT` so Render can route traffic properly.
+5. Port handling: Render provides the `PORT` environment variable. `server/index.js` reads `process.env.PORT || settings.port`, so no additional port change is required.
-After that, BonziWORLD will be accessible on port 3000. (http://localhost:3000/)
+For local runs, open `http://localhost:3000/` when `settings.port` is 3000. For Render, open the public service URL provided by Render.📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## Disclaimer | ||||||||||||||||||||||||||||||||||
| I'm not responsible if you screw up anything with your computer while setting this up. I have no idea how you would, but someone will find a way. I also will not provide support for installing depende[...] | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| ## License | ||||||||||||||||||||||||||||||||||
| MIT | ||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -7,14 +7,13 @@ const io = require('./index.js').io; | |||||||||||||||||||||||||||||||||
| let bans; | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| exports.init = function() { | ||||||||||||||||||||||||||||||||||
| fs.writeFile("./bans.json", "{}", { flag: 'wx' }, function(err) { | ||||||||||||||||||||||||||||||||||
| if (!err) console.log("Created empty bans list."); | ||||||||||||||||||||||||||||||||||
| try { | ||||||||||||||||||||||||||||||||||
| bans = require("./bans.json"); | ||||||||||||||||||||||||||||||||||
| } catch(e) { | ||||||||||||||||||||||||||||||||||
| throw "Could not load bans.json. Check syntax and permissions."; | ||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||||||||||||
| try { | ||||||||||||||||||||||||||||||||||
| let content = fs.readFileSync("./bans.json", "utf8").trim(); | ||||||||||||||||||||||||||||||||||
| bans = content ? JSON.parse(content) : {}; | ||||||||||||||||||||||||||||||||||
| } catch(e) { | ||||||||||||||||||||||||||||||||||
| bans = {}; | ||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||
| fs.writeFileSync("./bans.json", JSON.stringify(bans)); | ||||||||||||||||||||||||||||||||||
|
Comment on lines
+10
to
+16
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Do not overwrite a ban list after a read or parse failure. A malformed or unreadable Only create a new file for Proposed fix exports.init = function() {
+ let content;
try {
- let content = fs.readFileSync("./bans.json", "utf8").trim();
+ content = fs.readFileSync("./bans.json", "utf8").trim();
bans = content ? JSON.parse(content) : {};
} catch(e) {
+ if (e.code !== "ENOENT") throw e;
bans = {};
}
fs.writeFileSync("./bans.json", JSON.stringify(bans));
};📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| exports.saveBans = function() { | ||||||||||||||||||||||||||||||||||
|
|
@@ -90,4 +89,4 @@ exports.kick = function(ip, reason) { | |||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| exports.isBanned = function(ip) { | ||||||||||||||||||||||||||||||||||
| return Object.keys(bans).indexOf(ip) != -1; | ||||||||||||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -4,8 +4,9 @@ const Utils = require("./utils.js"); | |
| const io = require('./index.js').io; | ||
| const settings = require("./settings.json"); | ||
| const sanitize = require('sanitize-html'); | ||
| const Profanity = require('./profanity.js'); | ||
|
|
||
| let roomsPublic = []; | ||
| let roomsPublic = ["default"]; | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
ast-grep outline server/meat.js --items all
rg -n -C 6 'newRoom\s*\(|roomsPublic|["'\'']default["'\'']|prefs\.(public|private)' \
server/meat.js server/index.js src/www/js/main.jsRepository: Rafafrias2012/BonziWORLD-patched Length of output: 5727 Initialize the
📍 Affects 2 files
🤖 Prompt for AI Agents |
||
| let rooms = {}; | ||
| let usersAll = []; | ||
|
|
||
|
|
@@ -168,7 +169,7 @@ let userCommands = { | |
| }); | ||
| }, | ||
| "linux": "passthrough", | ||
| "pawn": "passthrough", | ||
| "intro": "passthrough", | ||
| "bees": "passthrough", | ||
| "color": function(color) { | ||
| if (typeof color != "undefined") { | ||
|
|
@@ -189,14 +190,14 @@ let userCommands = { | |
| this.public.color = "pope"; | ||
| this.room.updateUser(this); | ||
| }, | ||
| "asshole": function() { | ||
| this.room.emit("asshole", { | ||
| "stink": function() { | ||
| this.room.emit("stink", { | ||
| guid: this.guid, | ||
| target: sanitize(Utils.argsString(arguments)) | ||
| }); | ||
| }, | ||
| "owo": function() { | ||
| this.room.emit("owo", { | ||
| "notice": function() { | ||
| this.room.emit("notice", { | ||
| guid: this.guid, | ||
| target: sanitize(Utils.argsString(arguments)) | ||
| }); | ||
|
|
@@ -417,6 +418,7 @@ class User { | |
| return; | ||
|
|
||
| let text = this.private.sanitize ? sanitize(data.text) : data.text; | ||
| text = Profanity.filter(text); | ||
| if ((text.length <= this.room.prefs.char_limit) && (text.length > 0)) { | ||
| this.room.emit('talk', { | ||
| guid: this.guid, | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ | |
| "fs-extra": "^7.0.1", | ||
| "merge": "^1.2.1", | ||
| "sanitize-html": "^1.20.0", | ||
| "socket.io": "^2.2.0", | ||
| "socket.io": "^4.6.0", | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
ast-grep outline src/www/js_ext/lib/socket.io.js --items all
rg -n -C 3 'Socket\.IO|socket\.io|EIO=|protocol|allowEIO3' \
src/www/js_ext/lib/socket.io.js server/index.js server/package.jsonRepository: Rafafrias2012/BonziWORLD-patched Length of output: 50388 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- server/package.json ---'
cat -n server/package.json
printf '%s\n' '--- server/index.js Socket.IO setup and usage ---'
rg -n -C 8 'require\(["'\'']socket\.io|io\s*=|io\.on|socket\.on|allowEIO3|cors' server/index.js
printf '%s\n' '--- bundled client fingerprints ---'
python3 - <<'PY'
from pathlib import Path
p = Path("src/www/js_ext/lib/socket.io.js")
s = p.read_text(errors="replace")
for needle in (
'exports.protocol=',
'parser.protocol=',
'protocol=',
'Socket.IO',
'socket.io-client',
'engine.io-client',
'io=function',
'Manager.prototype',
):
positions = [i for i in range(len(s)) if s.startswith(needle, i)]
print(needle, len(positions), positions[:5])
print("size", len(s))
PY
printf '%s\n' '--- dependency manifests ---'
git ls-files '*package*.json' '*lock*' | sort
rg -n -C 2 '"socket\.io"|socket\.io-client|engine\.io|allowEIO3' --glob '*package*.json' --glob '*lock*' .Repository: Rafafrias2012/BonziWORLD-patched Length of output: 6007 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- lockfile root and Socket.IO entries ---'
sed -n '1,45p' server/package-lock.json
sed -n '840,905p' server/package-lock.json
printf '%s\n' '--- client bundle usage ---'
rg -n -C 4 'js_ext/lib/socket\.io\.js|socket\.io\.js|io\(' src build www server --glob '*.html' --glob '*.js' --glob '*.json' 2>/dev/null || true
printf '%s\n' '--- bundle version/protocol markers ---'
python3 - <<'PY'
from pathlib import Path
import re
s = Path("src/www/js_ext/lib/socket.io.js").read_text(errors="replace")
patterns = {
"engine_protocol_3": r'exports\.protocol=3',
"engine_protocol_4": r'exports\.protocol=4',
"socket_io_client_2_version": r'(?:version|VERSION)[^\\n]{0,80}2\.[0-9]+\.[0-9]+',
"socket_io_client_4_version": r'(?:version|VERSION)[^\\n]{0,80}4\.[0-9]+\.[0-9]+',
"socket_io_manager": r'Manager\.prototype',
}
for name, pattern in patterns.items():
matches = list(re.finditer(pattern, s, re.I))
print(name, len(matches))
for m in matches[:3]:
print(" ", repr(s[max(0, m.start()-80):m.end()+100]))
PY
printf '%s\n' '--- package-lock metadata ---'
python3 - <<'PY'
import json
from pathlib import Path
d = json.loads(Path("server/package-lock.json").read_text())
print("lockfileVersion:", d.get("lockfileVersion"))
print("root dependencies:", d.get("dependencies", {}).get("socket.io", {}))
PYRepository: Rafafrias2012/BonziWORLD-patched Length of output: 50389 Update the Socket.IO dependency set and browser bundle. When the server installs Socket.IO 4, 🤖 Prompt for AI Agents |
||
| "winston": "^3.1.0" | ||
| } | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: Rafafrias2012/BonziWORLD-patched
Length of output: 2976
🌐 Web query:
actions/checkout v4 persist-credentials false default GITHUB_TOKEN .git/config documentation💡 Result:
In GitHub Actions, the
actions/checkoutaction (including version 4) uses thepersist-credentialsinput to control whether the authentication token (such asGITHUB_TOKEN) or SSH key is configured in the local Git environment [1][2]. Default Behavior: By default,persist-credentialsis set totrue[2]. When enabled, the action configures the authentication credentials into the local Git environment so that subsequent steps in the same job can execute authenticated Git commands (e.g.,git push,git fetch) without needing to manually provide credentials again [1][3]. How it works with.git/config: Inactions/checkoutv4, the credentials are typically associated with the repository's Git configuration, which allows the runner's Git commands to automatically use the token [1][4]. Because these credentials persist on the runner's disk during the job, there is a risk that subsequent steps might inadvertently leak them—for example, if a step archives or uploads the workspace directory (including the.gitfolder) as a build artifact [5][4]. Using persist-credentials: false: Settingpersist-credentials: falsein your workflow YAML prevents the action from configuring these credentials [1][5]. This is a security best practice if your job does not require subsequent authenticated Git operations, as it reduces the attack surface for credential leakage [4]. Example configuration: - uses: actions/checkout@v4 with: persist-credentials: false If you disable this, any subsequent Git commands in your workflow that require authentication will fail unless you manually configure alternative credentials [3]. Note on newer versions: In newer iterations ofactions/checkout(such as v6+), the mechanism has been updated to store credentials in a separate file within$RUNNER_TEMPrather than directly inside.git/configto improve security, thoughpersist-credentials: falseremains the recommended way to opt out of credential persistence entirely [6][4].Citations:
persist-credentials: falseon checkout steps cli/go-gh#225🏁 Script executed:
Repository: Rafafrias2012/BonziWORLD-patched
Length of output: 4600
🌐 Web query:
actions/upload-pages-artifact v3 excludes .git directory artifact source code💡 Result:
Yes, the actions/upload-pages-artifact action (including version v3) unconditionally excludes the.git directory from the generated artifact [1][2][3]. The action operates as a composite action that archives your static files into a tarball before uploading [2][4]. During this archiving process, the action explicitly uses command-line tar flags to exclude the.git directory and the.github directory, regardless of other configuration settings [2][3]. Specifically, the action's implementation includes the following exclusion patterns in its archival step [2]: --exclude=.git --exclude=.github Even if you enable the include-hidden-files input, which allows other hidden files (those starting with a dot) to be included in the artifact, the.git and.github directories remain unconditionally excluded [1][3].
Citations:
include-hidden-filesinput actions/upload-pages-artifact#137Disable persisted GitHub credentials in the Deno workflow checkout.
deno test -Acan read the persistedGITHUB_TOKENfrom the Git configuration. Addpersist-credentials: falseto.github/workflows/deno.yml.The Pages artifact action excludes
.git, so this concern is not confirmed for.github/workflows/static.yml.🧰 Tools
🪛 zizmor (1.29.0)
[warning] 25-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 2 files
.github/workflows/deno.yml#L25-L26(this comment).github/workflows/static.yml#L32-L33🤖 Prompt for AI Agents
Source: Linters/SAST tools