[Pkg-mozext-maintainers] Bug#1042757: ublock-origin: embded javascript lib

[Bastien Roucariès]

Le vendredi 18 août 2023, 23:16:04 UTC Markus Koschany a écrit :
> Am Montag, dem 31.07.2023 um 11:56 +0000 schrieb Bastien Roucariès:
> > Source: ublock-origin
> > Severity: serious
> > Justification: not prefered form of modification
> > 
> > Dear Maintainer,
> > 
> > src/lib include a few library that are already packaged for debian.
> > 
> > per se it is not a serious bug, but we should try if possible after testing
> > to
> > use packaged version
> > 
> > The serious bug is due that for instance punycode was not in prefered form of
> > modification due to being wepackaged (transpiled) in order to be an ES
> > module.
> > 
> > They may be other transpiled package in this subdirectory
> 
> Hello Bastien,
> 
> thanks for the report. I have reviewed the src/lib directory and replaced the
> embedded Javascript libraries of csstree and js-beautify with Debian's system
> libraries. I also added the source file of hsluv to debian/missing-sources and
> documented the licenses of these three Javascript libraries in
> debian/copyright.
> 
> I decided against replacing punycode because punycode.js in ublock-origin looks
> like the preferred form for me.

No unfortunatly this is transpiled aka compiled by webpack
see the first line
export default (function() {

This is make by webpack or rollup that are automated tools. This means that this code is transpiled and I do not know the extend of transpiling.

it may be only the es6 upstream code:
https://sources.debian.org/src/node-punycode/2.2.3-2/scripts/prepublish.js/
or something worst that replace the constant by something else.

if you see the original code here:
https://sources.debian.org/src/node-punycode/2.2.3-2/punycode.js/

you do not see the export default (function() { 
line

Javascript is strange you could edit generated file and min.js is not the only problem

Thanks

Bastien

> The file is not minified and can be edited
> without problems. I believe you were referring to hsluv instead. I believe this
> issue is fixed in version 1.51.0+dfsg-2 soon.
> 
> Regards,
> 
> Markus
> 
> 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part.
URL: <http://alioth-lists.debian.net/pipermail/pkg-mozext-maintainers/attachments/20230819/857c5e69/attachment-0001.sig>