jonathanwalsh / granule Goto Github PK

Hi!

It seems like granule changes paths in CSS files even if they start with "/" but it should not happen.
If I try to use absolute path without the domain name in CSS (located at /module/_ui/desktop/themes/file.css) like this:

background-image: url('/module/_ui/desktop/themes/images/someimage.jpg');

granule adds the relative path and the line ends up like this:

background-image: url('_ui/desktop/themes/module/_ui/desktop/themes/images/someimage.jpg');

Is there possibly some undocumented feature that fixes this?

Best regards,
Janis

First let me thanks for this fantastic software !!

My doubt is is there a way we could make the combine file remembered at browsers cache.. as any .css file or .js file will return HTTP code 304 (as no changes and loads from cache), it would improve the site loading time and performance.

But when we combine all resources it always return with HTTP 200 code that means every time page load the combine resources loads fresh copy..

Thanks,

When load balanced and depending the technology of the load balancer the current id generation prevent the resources to be hit on load balanced middled. Would be great to get a deterministic algorithm to solve it. The idea is to get the same request on all middles for the same resources whatever the local state is.

at Granule / tag-main / src / com / granule / cache / FileCache.java
https://github.com/JonathanWalsh/Granule/blob/5f185d4896d79ff8033162ae2b478324b31fcfd7/tag-main/src/com/granule/cache/FileCache.java
line 166:

logger.warn("Rebuilding from dublicate id");

"dublicate" should be "duplicate"

Vulnerability detected by Veracode

Dear @JonathanWalsh

Currently in the company where I work we use this library and it is giving us an flaw in veracode:
External Control of File Name or Path (CWE ID 73)

We need to solve all bugs detected by Veracode because of security.

Thanks.

The result give me <script src="//combined?id=xxxx" .../> (problem is 2 "/")

i have a quickfix patch here ;

diff --git a/tag-main/src/com/granule/CompressTagHandler.java b/tag-main/src/com/granule/CompressTagHandler.java
index 4e9ed57..4250c43 100644
--- a/tag-main/src/com/granule/CompressTagHandler.java
+++ b/tag-main/src/com/granule/CompressTagHandler.java
@@ -51,7 +51,7 @@ public class CompressTagHandler {

 private static final String JS_DUPLICATES = "granule_js_duplicates";

 private static final String CSS_DUPLICATES = "granule_css_duplicates";

 public CompressTagHandler(String id, String method, String options, String basepath) {

     this.id = id;

     this.method = method;

@@ -151,7 +151,12 @@ public class CompressTagHandler {
correction -= e.getEnd() - e.getBegin();

                     } else {

                         if (fragmentDescriptors.size() > 0) {

•                            String newText = "<script src=\"" + request.getContextPath() + "/combined.js?id="
  

•                            String contextPath = request.getContextPath();
  

•                            if (request.getContextPath() == null || request.getContextPath().equals("") || request.getContextPath().equals("/"))
  

•                            {
  

•                                contextPath = "";
  

•                            }
  

•                            String newText = "<script src=\"" + contextPath + "/combined.js?id="
  
                                   + bundleId + "\"></script>";
  
                           newBody = newBody.substring(0, e.getBegin() + correction) + newText
  
                                   + newBody.substring(e.getEnd() + correction);
  

@@ -341,9 +346,13 @@ public class CompressTagHandler {
int p = ld.index;

             sb.append(chunk.substring(start, links.get(p).getBegin()));

             if (ld.scriptId != null) {

•                if (request.getContextPath() == null || request.getContextPath().equals("") || request.getContextPath().equals("/"))
  

•                {
  

•                    contextPath = "";
  

•                }
  
               Attribute a = links.get(p).getAttributes().get("href");
  
               sb.append(chunk.substring(links.get(p).getBegin(), a.getBegin()));
  

•                sb.append("href=\"").append(request.getContextPath()).
  

•                sb.append("href=\"").append(contextPath).
  
                       append("/combined.css?id=").
  
                       append(ld.scriptId)
  
                       .append("\" ");
  

@@ -366,6 +375,6 @@ public class CompressTagHandler {
private HashSet getCssDuplicatesHash(IRequestProxy request) {

     return (HashSet<String>) request.getAttribute(CSS_DUPLICATES);

 }

 private static final Logger logger = LoggerFactory.getLogger(CompressTagHandler.class);

}

Like: https://code.google.com/archive/p/granule/issues/17

Hello @JonathanWalsh @DarioWunsch
Would you consider adding some new contributors to this projects as it still has an interest and there are some features/fixes pending ?

Cheers.

Dear @JonathanWalsh

Please your help because these vulnerabilities appear when using the library, after using the Veracode analysis.

Thanks.

granule is minifying the css file as combiled.css but it is not compressing combined.js.
Can you tell me what steps are needed to do that.

Thanks in advance

Dear @JonathanWalsh

Please your help because these vulnerabilities appear when using the library, after using the Veracode analysis.

Thanks.

I am currently using spring boot and gradle to build my project.

I have followed instruction and I am facing below error.

com.granule.JSCompileException: Granule cache was loaded not on the server start-up. Recommended to add the parameter 1 into servlet configuration in web.xml.
at com.granule.cache.TagCacheFactory.getInstance(TagCacheFactory.java:43) ~[granule1.0.9.jar:1.0.9]
at com.granule.CompressTagHandler.processChunk(CompressTagHandler.java:306) ~[granule1.0.9.jar:1.0.9]
at com.granule.CompressTagHandler.handleTag(CompressTagHandler.java:198) ~[granule1.0.9.jar:1.0.9]
at com.granule.CompressTag.doAfterBody(CompressTag.java:66) ~[granule1.0.9.jar:1.0.9]
at org.apache.jsp.WEB_002dINF.jsp.orderconfirmation_jsp._jspx_meth_g_005fcompress_005f0(orderconfirmation_jsp.java:371) ~[?:?]

I want to add a feature on granule, and I don't know if it already exists.
My idea is to use a method="none" in which the granule tag only adds the basepath scripts and links.
My idea with this feature is to provide a easy way to debug/analyze problems in any environment by always using granule by this way:

<granule:compress method="${param.granuleIgnore?'none' : 'closure-compiler'}">
    <script ...
  <granule:compress/>

So I can add a ?granuleIgnore=true on the request and see the same files I have on code.

Any feature like this, or can I start working on it?