zulip/tools
Anders Kaseorg 68cfcd6446 CVE-2020-9444: Prevent reverse tabnabbing attacks.
While we could fix this issue by changing the markdown processor,
doing so is not a robust solution, because even a momentary bug in the
markdown processor could allow cached messages that do not follow our
security policy.

This change ensures that even if our markdown processor has bugs that
result in rendered content that does not properly follow our policy of
using rel="noopener noreferrer" on links, we'll still do something
reasonable.

Co-authored-by: Tim Abbott <tabbott@zulipchat.com>
Signed-off-by: Anders Kaseorg <anders@zulipchat.com>
2020-04-01 14:01:45 -07:00
..
ci text: Fix some typos (most of them found and fixed by codespell). 2020-03-27 17:25:56 -07:00
circleci circleci: Add base image for Ubuntu Focal. 2020-03-25 16:09:59 -07:00
documentation_crawler tests: Treat github.com/zulip links as external. 2020-03-19 09:27:40 -04:00
droplets python: Convert json.loads(f.read()) to json.load(f). 2020-03-24 10:46:32 -07:00
i18n mypy: Upgrade from 0.720 to 0.730. 2019-11-13 12:38:45 -08:00
lib provision: switch Focal to use PGroonga from PPA. 2020-03-31 15:02:31 -07:00
linter_lib CVE-2020-9444: Prevent reverse tabnabbing attacks. 2020-04-01 14:01:45 -07:00
setup install-shellcheck: Check the tarball’s SHA-256 hash. 2020-03-31 15:01:54 -07:00
test-install test-install: Use lxc-destroy -f instead of lxc-stop. 2019-12-18 03:48:39 -08:00
tests template_parser: Fix Jinja2 tag matching with strip whitespace syntax. 2020-01-16 12:53:34 -08:00
zulip-export api: Rename subject_links to topic_links. 2020-02-07 14:35:22 -08:00
README.md cleanup: Delete trailing newlines. 2019-08-06 23:29:11 -07:00
__init__.py
build-docs docs: Replace Makefile based on output of newer sphinx-quickstart. 2019-12-02 18:39:33 -08:00
build-release-tarball build-release-tarball: Run with zulip-py-venv symlink present. 2019-07-21 18:43:52 -07:00
cache-zulip-git-version version: Only let `git describe` match tags beginning with a digit. 2019-10-24 14:54:45 -07:00
check-capitalization i18n: Move static/locale back to locale. 2019-07-02 14:57:55 -07:00
check-frontend-i18n i18n: Move static/locale back to locale. 2019-07-02 14:57:55 -07:00
check-issue-labels lint: Fix code that evaded our lint checks for string % non-tuple. 2019-04-23 15:21:37 -07:00
check-openapi js: Convert a.indexOf(…) !== -1 to a.includes(…). 2020-02-10 14:08:12 -08:00
check-provision tools: Extract get_provisioning_status check logic. 2019-06-23 21:55:02 -07:00
check-templates linter_lib: Fix mypy errors. 2019-08-09 17:22:45 -07:00
clean-branches text: Fix some typos (most of them found and fixed by codespell). 2020-03-27 17:25:56 -07:00
clean-repo
commit-message-lint commit-message-lint: Detect the upstream remote name. 2020-02-04 13:57:51 -08:00
commit-msg Use #!/usr/bin/env for bash shebangs. 2018-12-17 17:21:08 -08:00
conf.ini-template
coveragerc validator: Optionally record a type_structure attribute. 2020-03-06 17:07:14 -08:00
create-test-api-docs api_docs: Replaced cgi.escape with html.escape. 2020-03-23 10:28:21 -07:00
debug-require-webpack-plugin.ts webpack: Generalize debug-require-webpack-plugin interface. 2020-02-25 14:01:06 -08:00
debug-require.js webpack: Generalize debug-require-webpack-plugin interface. 2020-02-25 14:01:06 -08:00
deploy-branch Use #!/usr/bin/env for bash shebangs. 2018-12-17 17:21:08 -08:00
diagnose typing: Remove now-unnecessary conditional import. 2019-07-29 15:18:22 -07:00
django-template-graph django-template-graph: Fix shellcheck warnings. 2018-10-17 17:38:56 -07:00
do-destroy-rebuild-database flush-memcached: Respect MEMCACHED_LOCATION; handle errors. 2019-10-01 16:05:55 -07:00
do-destroy-rebuild-test-database do-destroy-rebuild-test-database: Fix shellcheck warnings. 2018-08-03 09:15:26 -07:00
documentation.vnufilter test-documentation: Validate HTML with vnu.jar. 2019-06-27 14:53:21 -07:00
fetch-pull-request Use #!/usr/bin/env for bash shebangs. 2018-12-17 17:21:08 -08:00
fetch-rebase-pull-request Use #!/usr/bin/env for bash shebangs. 2018-12-17 17:21:08 -08:00
find-unused-css Use #!/usr/bin/env for bash shebangs. 2018-12-17 17:21:08 -08:00
get-handlebar-vars python: Migrate open statements to use with. 2019-07-20 15:48:52 -07:00
html-grep templates: Rename *.handlebars ↦ *.hbs and - ↦ _. 2019-07-12 21:11:03 -07:00
js-dep-visualizer.py tools: Add TypeScript to the dependency visualizer. 2019-04-12 11:14:42 -07:00
lint lint: Run whitespace linter against .yml files. 2020-03-24 15:31:59 -07:00
pre-commit lint: Add --skip arg to replace --no-gitlint/mypy. 2019-06-18 11:32:04 -07:00
pretty-print-html python: Migrate open statements to use with. 2019-07-20 15:48:52 -07:00
provision install, provision: Treat all nonzero exit codes as failure, not just 1. 2019-07-19 11:22:11 -07:00
push-to-pull-request reset-to-pull-request: Add a usage message. 2020-02-11 14:45:17 -08:00
release-tarball-exclude.txt tests: Move zerver/fixtures to zerver/tests/fixtures for clarity. 2018-04-19 21:50:17 -07:00
renumber-migrations renumber-migrations: Exclude migration 0209. 2019-12-11 16:08:32 -08:00
replacer zulint: Move lister.py to tools/zulint. 2018-08-04 19:53:53 -07:00
reset-to-pull-request reset-to-pull-request: Add a usage message. 2020-02-11 14:45:17 -08:00
review tools/review: Don’t pretend to emulate shell=True either. 2018-07-30 22:39:08 -07:00
run-dev.py Revert "run-dev: Run process_queue with DJANGO_AUTORELOAD_ENV." 2020-03-26 21:38:19 -07:00
run-mypy lint: Run mypy with --no-error-summary. 2019-11-13 13:26:02 -08:00
run-tsc tsconfig: Move to top level. 2019-11-04 18:12:11 -08:00
run-yarn-deduplicate yarn.lock: Share duplicate packages with yarn-deduplicate. 2019-09-02 19:30:09 -07:00
setup-git-repo Use #!/usr/bin/env for bash shebangs. 2018-12-17 17:21:08 -08:00
show-profile-results
stop-run-dev
test-all lint: Use --groups to specify specific groups to run. 2019-06-23 22:23:15 -07:00
test-api populate_db, tests: Restrict emails in zulip realm. 2020-03-19 16:21:31 -07:00
test-backend tests: Create new test mode for generating stripe fixtures. 2020-03-17 16:46:56 -07:00
test-documentation test-documentation: Invoke sphinx-build via make instead of directly. 2019-12-02 18:39:33 -08:00
test-emoji-name-scripts test-emoji-name-scripts: Avoid hardcoded paths in /var/tmp. 2019-01-15 16:05:50 -08:00
test-help-documentation test-help-documentation: Bind vnu.jar to 127.0.0.1. 2019-06-28 18:18:29 -07:00
test-js-with-casper
test-js-with-node node tests: Actually test `translations.js`. 2020-02-29 12:19:51 -08:00
test-js-with-puppeteer tests: Add `test-js-with-puppeteer` similar to `test-js-with-casper`. 2020-03-22 11:42:14 -07:00
test-locked-requirements test-locked-requirements: Improve logged output. 2019-08-25 15:03:20 -07:00
test-migrations requirements: Upgrade django-otp from 0.5.2 to 0.6.0. 2019-07-07 22:28:54 -07:00
test-queue-worker-reload queue: Remove missedmessage_email_senders. 2020-01-31 12:13:51 -08:00
test-run-dev Revert "test-run-dev: Use a pipe rather than polling a log file." 2020-03-17 14:16:18 -07:00
test-tools tools: Revert to Python 2 typing syntax for now. 2017-12-13 10:38:15 -08:00
update-authors-json text: Fix some typos (most of them found and fixed by codespell). 2020-03-27 17:25:56 -07:00
update-locked-requirements requirements: Fork pip.txt to pip2.txt for Python 2. 2020-02-05 12:38:10 -08:00
update-prod-static setup_path_on_import: Replace with setup_path function. 2020-02-25 15:40:21 -08:00
update-zuliprc-api-field tools: Add tool to update API field of local zuliprc file. 2019-07-17 16:00:21 -07:00
webpack webpack: Enable code splitting and deduplication. 2019-10-28 15:53:15 -07:00
webpack-helpers.ts js: Automatically convert var to let and const in more files. 2019-11-20 14:10:47 -08:00
webpack.assets.json emoji: Resolve emoji sprite sheets and stylesheets through Webpack. 2020-02-25 14:43:46 -08:00
webpack.config.ts CVE-2020-9444: Prevent reverse tabnabbing attacks. 2020-04-01 14:01:45 -07:00
zanitizer docs: Avoid hardcoded /tmp paths in miscellaneous documentation. 2019-01-15 16:16:12 -08:00
zanitizer_config.pm.sample zanitizer_config.pm.sample: keep_file → scrub_filename 2018-09-23 20:42:27 -07:00

README.md

This directory contains scripts that are used in building, managing, testing, and other forms of work in a Zulip development environment. Note that tools that are also useful in production belong in scripts/ or should be Django management commands.

For more details, see https://zulip.readthedocs.io/en/latest/overview/directory-structure.html.