Re: Security concerns with minified javascript code
On Thu, Aug 27, 2015 at 04:14:53PM -0700, Russ Allbery wrote:
> Last time I checked, Doxygen includes minified Javascript in all of its
> generated output. Would we have to move every piece of Doxygen-generated
> documentation into a separate package so that we could put it in contrib,
> or strip it from our packages? Maybe someone has fixed this in Doxygen
> somehow?
Indeed, Doxygen used to ship minified JavaScript and the corresponding
source was attached to the Debian packaging, but not regenerated during
build. Since then this has changed and the doxygen package does run the
yui compressor during package build ensuring that the minification is
redoable. The current state is documented at
/usr/share/doc/doxygen/README.jquery. Last time I wondered whether
packages that use Doxygen during build, should also emit a Built-Using
header, it was agreed that Built-Using has a different purpose. So even
though the situation could be improved here, it currently is DFSG
compatible and build from source is ensured. Help with fixing the
embedding issue is welcome of course. When will we have dynamic linking
for JavaScript libraries?
Helmut
Reply to: