[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Security concerns with minified javascript code



On 08/28/2015 01:14 AM, Russ Allbery wrote:
> Bas Wijnen <wijnen@debian.org> writes:
> 
> Last time I checked, Doxygen includes minified Javascript in all of its
> generated output.  Would we have to move every piece of Doxygen-generated
> documentation into a separate package so that we could put it in contrib,
> or strip it from our packages?

how is that related?
doxygen is a compiler (of sorts), and parts of its output is minified js.
the minified js needs to come from "somewhere", either it is somehow
generated from the doxy-file or it is copied from a file provided by the
doxygen package.

if doxygen is in main (which might imply that the minified js it
includes in generated output has source-code available and can be
generated using Debian tools), then there is no reason to move a package
into contrib.

>  Maybe someone has fixed this in Doxygen
> somehow?

i think the annoying part about doxygen is, that the binary packages
with doxygen generated documentation include a full copy of the js files
(whether minified or not), which is more like *static linking*. urgh.

gfmasrd
IOhannes


Attachment: signature.asc
Description: OpenPGP digital signature


Reply to: