easy-team / easywebpack-cli Goto Github PK

NPM run dev，可以访问，但是npm run start，可以没有错误的启动，但是启动之后，页面没办法访问：
访问127.0.0.1:7001显示500错误
访问127.0.0.1:7001/client，在console打出以下错误：
GET http://localhost:7001/public/js/vendor.js net::ERR_ABORTED 07:27:12.282 client:1 GET http://localhost:7001/public/js/index/index.js net::ERR_ABORTED 07:27:12.301 client:1 GET http://localhost:7001/public/js/vendor.js net::ERR_ABORTED 07:27:12.301 client:1 Refused to execute script from 'http://localhost:7001/public/js/vendor.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled. 07:27:12.305 client:1 GET http://localhost:7001/public/js/index/index.js net::ERR_ABORTED 07:27:12.305 client:1 Refused to execute script from 'http://localhost:7001/public/js/index/index.js' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.

这里贴出npm log显示的我的环境：
2018-05-11 07:26:04,330 INFO 65204 [master] node version v8.11.1 2018-05-11 07:26:04,332 INFO 65204 [master] egg version 2.8.1 2018-05-11 07:26:04,333 INFO 65204 [master] start with options: { "framework": "P:\\workspace\\easywebpack\\btc\\node_modules\\egg", "baseDir": "P:\\workspace\\easywebpack\\btc", "workers": 8, "plugins": null, "https": false, "key": "", "cert": "", "typescript": false } 2018-05-11 07:26:04,338 INFO 65204 [master] start with env: isProduction: true, EGG_SERVER_ENV: prod, NODE_ENV: production

你好~ 我发现了easywebpack-cli的一个安全问题，在使用easywebpack-cli并使用-d参数指定了生效目录后，使用"../../"会造成目录穿越问题，能够查看主机中的文件（如数据库连接文件等）。
复现方法：
1、执行 npm i -g easywebpack-cli
2、执行 easy server -d mock -p 8009，-d 指向任意一个目录
3、使用postman或其他工具发包，即可查看文件

我并没有查看您的代码来定位问题位置，因此我也不太确定是否是easywebpack-cli引入easywebpack的问题，请见谅。
希望您能够确认问题或及时回复哦~ 多谢

Easywebpack-cli directory traversal vulnerability

Hello~ I found a security problem with easywebpack-cli. After using easywebpack-cli and using the -d parameter to specify the effective directory, using "../../" will cause directory traversal problems. You can view the host Files (such as database connection files, etc.).
Reproduction method:

1.npm i -g easywebpack-cli
2.easy server -d mock -p 8009, -d points to any directory
3.Use postman or other tools to send the request to view the file
（See above for related pictures)

bug描述：

选择的是less，但是出来的模板用的是scss...
工程为vue client render application -> vue single page application
easywebpack版本号:4.3.2

easy build dev 没有watch参数

import png格式的图片会报如下错误，svg格式的不会：
[easywebpack-cli] [/Users/tiwenleo/Liu/my/egg-stream-more/node_modules/webpack-tool/lib/tool.js] webpack build error { Error: spawn /Users/tiwenleo/Liu/my/egg-stream-more/node_modules/optipng-bin/vendor/optipng ENOENT at Process.ChildProcess._handle.onexit (internal/child_process.js:246:19) at onErrorNT (internal/child_process.js:427:16) at processTicksAndRejections (internal/process/next_tick.js:76:17)

[1/1] scripts.install [email protected] › [email protected] › [email protected] › [email protected] › fsevents@^1.2.7 run "node install", root: "/Users/celleo/.nvm/versions/node/v12.0.0/lib/node_modules/easywebpack-cli/node_modules/_fsevents@1.2.8@fsevents"
node-pre-gyp WARN Using needle for node-pre-gyp https download
node-pre-gyp http GET https://cdn.npm.taobao.org/dist/fsevents/v1.2.8/fse-v1.2.8-node-v72-darwin-x64.tar.gz
node-pre-gyp http 404 https://cdn.npm.taobao.org/dist/fsevents/v1.2.8/fse-v1.2.8-node-v72-darwin-x64.tar.gz
node-pre-gyp WARN Tried to download(404): https://cdn.npm.taobao.org/dist/fsevents/v1.2.8/fse-v1.2.8-node-v72-darwin-x64.tar.gz
node-pre-gyp WARN Pre-built binaries not found for [email protected] and [email protected] (node-v72 ABI, unknown) (falling back to source compile with node-gyp)
node-pre-gyp http 404 status code downloading tarball https://cdn.npm.taobao.org/dist/fsevents/v1.2.8/fse-v1.2.8-node-v72-darwin-x64.tar.gz
SOLINK_MODULE(target) Release/.node
CXX(target) Release/obj.target/fse/fsevents.o
../fsevents.cc:43:32: error: no template named 'Handle' in namespace 'v8'
static void Initialize(v8::Handlev8::Object exports);

环境：MacOS Mojave（版本 10.14.2）

$ npm ls -g -depth=0
/usr/local/lib
├── [email protected]
├── [email protected]
└── [email protected]

通过easy init初始化项目：

$ easy init
? please choose the boilerplate mode? Create Egg + Vue Server Side Render Application
? please choose the boilerplate project mode? Create Egg + Vue + TypeScript Application
? Please input project name: egg_vue_ssr_ts
? Please input project description:
? Please choose css style: stylus
? Please choose the way to install dependency: none
[easywebpack-cli]:query npm info of egg-vue-typescript-boilerplate
[easywebpack-cli]:downloading https://registry.npmjs.org/egg-vue-typescript-boilerplate/-/egg-vue-typescript-boilerplate-4.0.0
.tgz
[easywebpack-cli]:extract to /var/folders/v3/qpxzpw_54t3cstcdz91h7py00000gn/T/easywebpack-cli-init
[easywebpack-cli]:init egg_vue_ssr_ts project successfully!

[easywebpack-cli]:Now, start coding by follow step:
1) cd egg_vue_ssr_ts
2) npm install or yarn install
3) npm run dev or npm start

按README.MD发布，先npm run tsc

$ npm run tsc

> [email protected] tsc /Users/lfh/Developer/egg_vue_ssr_ts
> ets && tsc -p tsconfig.json

[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/app/extend/application.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/app/extend/context.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/app/controller/index.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/app/middleware/index.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/app/model/index.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/config/index.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/config/plugin.d.ts
[egg-ts-helper] create /Users/lfh/Developer/egg_vue_ssr_ts/typings/app/service/index.d.ts

然后再npm run build

AssertionError [ERR_ASSERTION]: dynamic create plugin[imagemini] error, please check the npm module [imagemin-webpack-plugin]whether installed. if not installed, please execute below command in command line:

            npm: npm install imagemin-webpack-plugin --save-dev

            cnpm: cnpm install imagemin-webpack-plugin --save-dev

            tnpm: tnpm install imagemin-webpack-plugin --save-dev

            yarn: yarn install imagemin-webpack-plugin --save-dev

按提示安装后，重新build

$ npm run build

> [email protected] build /Users/u1/work/egg_vue_ssr_ts
> easy build

clean-webpack-plugin: /Users/u1/work/egg_vue_ssr_ts/public has been removed.
webpack build [=======                                                                  ] 10% (0.0 seconds){ parser: "babylon" } is deprecated; we now treat it as { parser: "babel" }.
webpack build [=======================================================================] 100% (11.2 seconds)

Build completed in 11.218s

webpack build [=======================================================================] 100% (19.5 seconds)

Build completed in 19.556s

Hash: 0d15c6c757aa03d43f52
Version: webpack 4.29.0
Time: 19566ms
Built at: 2019/01/23 上午11:08:53
                           Asset      Size      Chunks  Chunk Names
     css/admin/home.99d61986.css   193 KiB  admin/home  admin/home
font/element-icons.2fad952a.woff  6.02 KiB
 font/element-icons.6f0a7632.ttf  10.8 KiB
 js/chunk/admin/home.6d5c08f0.js   647 KiB  admin/home  admin/home
     js/chunk/common.e5b0f845.js   110 KiB      common  common
          js/runtime.abe9d429.js  1.43 KiB     runtime  runtime

ERROR in ./app/web/page/admin/home/router/index.ts 21:48
Module parse failed: Unexpected token (21:48)
You may need an appropriate loader to handle this file type.
|             {
|                 path: '/article/add',
>                 component: function () { return import('../view/write/index.vue'); }
|             },
|             {
 @ ./app/web/page/admin/home/index.ts 4:0-42 6:79-91
Hash: dfbacb0d001acf089f19
Version: webpack 4.29.0
Time: 11224ms
Built at: 2019/01/23 上午11:08:44
        Asset      Size  Chunks  Chunk Names
admin/home.js  15.8 KiB       0  admin/home

ERROR in ./app/web/page/admin/home/router/index.ts 21:48
Module parse failed: Unexpected token (21:48)
You may need an appropriate loader to handle this file type.
|             {
|                 path: '/article/add',
>                 component: function () { return import('../view/write/index.vue'); }
|             },
|             {
 @ ./app/web/page/admin/home/index.ts 4:0-42 6:79-91
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] build: `easy build`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] build script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/u1/.npm/_logs/2019-01-23T03_08_53_365Z-debug.log

然后报错了，看到build过程有个提示：{ parser: "babylon" } is deprecated; we now treat it as { parser: "babel" }.

查看对应报错的文件，前端的路由，并无异常，请问该如何解决？

vscode的插件也是一言难尽呀 唉

I use the easy init command to create Egg + Vue Application，but don't work.its stuck.

the version of easywebpack-cli is 4.60

以为很简单，对着撸根本没用，还得看那该死的源码

系统： win 10
报错图片如下：
D:\project\aaa>npm run clean

[email protected] clean D:\project\aaa
easywebpack clean all

remove [ C:\Users\admin\AppData\Local\Temp\easywebpack\aaa ] success
fs.js:904
return binding.readdir(pathModule._makeLong(path), options.encoding);
^

Error: ENOTDIR: not a directory, scandir 'D:\project\aaa\config\manifest.json'
at Object.fs.readdirSync (fs.js:904:18)
at Object.exports.deleteFile.filepath [as deleteFile] (D:\project\aaa\node_modules_easywebpack-cli@3.11.2@easywebpack-cli
lib\tool.js:30:22)
at dirs.forEach.dir (D:\project\aaa\node_modules_easywebpack-cli@3.11.2@easywebpack-cli\lib\tool.js:14:15)
at Array.forEach ()
at Object.exports.rm.filepath [as rm] (D:\project\aaa\node_modules_easywebpack-cli@3.11.2@easywebpack-cli\lib\tool.js:11:8
)
at Object.clearManifest (D:\project\aaa\node_modules_easywebpack-cli@3.11.2@easywebpack-cli\lib\utils.js:151:12)
at Command.program.command.description.action.dir (D:\project\aaa\node_modules_easywebpack-cli@3.11.2@easywebpack-cli\bin
cli.js:180:13)
at Command.listener (D:\project\aaa\node_modules_commander@2.17.1@commander\index.js:315:8)
at emitTwo (events.js:126:13)
at Command.emit (events.js:214:7)
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] clean: easywebpack clean all
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the [email protected] clean script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

package.json都中相关包都更新到了5.0，但是打包时mini-css-extract-plugin报错了：


经过查看，easywebpack-react中引入的[email protected]中，mini-css-extract-plugin是0.11.0版本的，这个版本不支持webpack5，请问我要怎么解决这个报错呢？

在 node 15.2.0版本下 npm install @easy-team/easywebpack-cli --save-dev 执行报错
[email protected]: request-promise-native has been deprecated because it extends the now deprecated request package, see request/request#3142

问题描述 / 复现

1. git clone https://github.com/easy-team/egg-vue-webpack-boilerplate.git
2. 修改webpack.config.js (修改如下)
   plugins: [
   {imagemini: false},
   process.env.NODE_ENV !== "development"
   ? {
   uglifyJs: {
   args: {
   uglifyOptions: {
   warnings: false,
   compress: {
   dead_code: true,
   drop_console: true,
   drop_debugger: true
   },
   output: {
   comments: false
   }
   }
   }
   }
   }
   : {}
   ]

3. cnpm run build (抛错)

Unexpected token: keyword «const»

思考：网上找到相关的问题解释是uglifyJs 不支持es6的语法，所以才会出现这个问题

当

manifest.json root 其他文件为user 使用user账号运行easy build prod肯定不能覆盖manifest.json
但是不会报错

只能通过以下方法定位

该命令来自这个部署流程：https://www.yuque.com/hubcarl/ves/online#7h2dui

使用 --deps 参数可以看到

------ start npm install --production dependencies ------
------ npm install --production dependencies successfully ------

这两行输出，但没有看到安装依赖的过程，打包结果中也没有 node_modules 目录。

使用 --nodejs 参数后，命令行会去淘宝镜像下载 node-v8.11.3-win-x64.tar.gz 文件，但对应的目录中只有 7z 和 zip 后缀的文件，因此报 404 错误。

用 easy init 直接创建项目，不做修改，结果也一样。

按现在单页面这样可以当做一个demo了，要删去很多东西的。还有page目录下的一些命名等和vue推荐的目录结构有差别，感觉很不好。另外如果用nuxt渲染要怎么搞？小白求助

win10 1709 node 10.4.0
运行 easy init 之后 随便选一个然后就会卡住

program参数少了this.
const config = utils.initWebpackConfig(this.program, { env, framework: 'dll' }, { dll: true });