security: add .gitignore for credentials and remove eval() on remote content

[kanasimi]

Summary

Fixes the two critical issues found in a security scan of the repo (a collection of standalone MediaWiki bot scripts — no web server, so no CORS/auth/debug-endpoint surface).

1. No .gitignore → credential-leak risk (highest impact). The README setup tells users to copy wiki configuration.sample.js to wiki configuration.js and fill in real bot usernames/passwords, and wiki loader.js does require('./wiki configuration.js'). With no .gitignore, that secret file (and node_modules/) can easily be committed. Added a .gitignore that excludes wiki configuration.js, .env*, node_modules/, and common runtime artifacts. Verified no currently-tracked files are ignored, and the pattern does not match the legitimately-committed special page configuration.js.

2. eval() on remotely-fetched content → remote code execution. routine/20190629.import_tropical_cyclone_images.js did:

eval(html.between('var typhoonList=', '</script>').between(';', '/*'));

on the response from jma.go.jp. A manipulated/compromised response would run arbitrary code on the bot host. Replaced with a regex that extracts the typhoonList[i]="id" assignments — same resulting array, no code execution:

var PATTERN_typhoon_id = /typhoonList\s*\[\s*\d+\s*\]\s*=\s*(["'])([^"']*)\1/g, m;
while (m = PATTERN_typhoon_id.exec(typhoon_list_code)) typhoonList.push(m[2]);

Findings not changed here (no code touched)

• eval(html.between('=')) in routine/20180511.headline.js (parser_東方日報): same RCE class, but the remote payload is JS object literals of unknown shape, so a safe rewrite risks breaking parsing. Recommend converting to a bounded parser; flagged for owner review.
• Unpinned deps (cejs/wikiapi/gh-updater = "latest" in package.json): supply-chain risk; recommend pinning to reviewed versions.
• Not exploitable / operator-trusted, left as-is: SQL in task/process_dump.js (parameterized INSERT; DROP/CREATE use a constant table name), eval() over an internal counter in traversal_pages.js, and child_process calls (array args / constant URLs / dead code) in the Tool-Labs importer scripts. No hardcoded secrets found in the tree or history.

Link to Devin session: https://app.devin.ai/sessions/d9897a4abe2746b9ad05a27ad08a402f
Requested by: @kanasimi

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring