Fix some security issues found by npm

* use npm instead of yarn
* group frontend stuff
* group backend stuff

.drone.yml

@@ -3,26 +3,27 @@ name: default
 
 steps:
 - name: prepare-workdir
-  image: alpine:3.11.0
+  image: alpine:3.11.3
   commands:
   - mkdir canapeapp
 
 - name: frontend
-  image: node:13.5.0
+  image: node:13.8.0
   commands:
-  - npm install yarn
-  - yarn install
-  - yarn build
+  - cd frontend
+  - npm install
+  - npm run-script build
 
 - name: backend
-  image: golang:1.13.5
+  image: golang:1.14.0-alpine3.11
   commands:
+  - apk --no-cache add git
   - GO111MODULE=off go get -tags 'postgres' -u github.com/golang-migrate/migrate/cmd/migrate
   - cp $$GOPATH/bin/migrate migrate
-  - go build -v -o canapeapp/app backend/*.go
+  - CGO_ENABLED=0 go build -ldflags '-extldflags "-static"' -trimpath -v -o canapeapp/app backend/*.go
 
 - name: prepare-docker
-  image: alpine:3.11.0
+  image: alpine:3.11.3
   commands:
   - cp docker/run.sh canapeapp/run.sh
   - cp migrate canapeapp/migrate

README.md

@@ -1,17 +1,10 @@
 ## Install dependencies
 
-### Install node
+### Install node and npm
 
 You'll need node v6+, here's a link to install it:
 https://nodejs.org/en/download/package-manager/#debian-and-ubuntu-based-linux-distributions
 
-### Install yarn and dependencies
-
-```
-sudo npm install -g yarn
-yarn install
-```
-
 ## Dev
 
 #### Check your config.yml file

backend/fresh.conf

@@ -1,6 +1,6 @@
+root: .
+valid_ext: .go
+colors: 1
 build_name: dev-build
 build_log: dev-build.log
-tmp_path: ./build
-valid_ext: .go
-root: ./backend
-colors: 1
+tmp_path: ../build

config.yml.exemple

@@ -4,7 +4,7 @@ authorizer:
   cost: 10
 pgdsn: postgres://test:test@127.0.0.1:5432/dev?sslmode=disable
 listen_port: 3000
-public_dir: build/public
+public_dir: ../build/public
 # default prefix, will be served by the go http server
 img_url_prefix: img/
 periodic_refresh:

dev.sh

@@ -65,7 +65,7 @@ _migrate() {
 
 _ensure_command jq
 _ensure_command go
-_ensure_command yarn
+_ensure_command npm
 
 _check_command migrate || {
 	_log_info "Installing migrate"
@@ -135,7 +135,7 @@ case $1 in
 		# Apply the migrations
 		_migrate -path "$MIGRATION_SCHEMA" up
 
-		CONFIG_FILE="./config.yml" fresh -c fresh.conf
+		(cd backend && CONFIG_FILE="../config.yml" fresh -c fresh.conf)
 		;;
 	docker-db)
 		_ensure_command docker
@@ -144,8 +144,7 @@ case $1 in
 		docker-compose -f "$DOCKER_COMPOSE_FILE" "$@"
 		;;
 	front)
-		yarn install
-		yarn start
+		(cd frontend && npm install && npm run-script start)
 		;;
 	db-init)
                 _ensure_command jq

frontend/js/auth.js

@@ -10,7 +10,7 @@ const protectedRoute = ({
   isActivated,
   isTokenSet,
   setUserToken,
-  ...otherProps,
+  ...otherProps
 }) => {
   const isAuthenticated = () => {
     if (isTokenSet) {

frontend/package.json

@@ -3,7 +3,7 @@
     "scripts": {
         "start": "NODE_ENV=development ./node_modules/webpack/bin/webpack.js -d --progress --colors --watch",
         "build": "NODE_ENV=production  ./node_modules/webpack/bin/webpack.js -p --progress --colors",
-        "lint": "./node_modules/eslint/bin/eslint.js frontend/."
+        "lint": "./node_modules/eslint/bin/eslint.js ."
     },
     "dependencies": {
         "bootstrap": "^4.3.1",
@@ -12,7 +12,7 @@
         "fuzzy": "^0.1.3",
         "history": "^4.9.0",
         "immutable": "^4.0.0-rc.12",
-        "jquery": "^2.2.4",
+        "jquery": "^3.4.1",
         "jwt-decode": "^2.1.0",
         "moment": "^2.20.1",
         "popper.js": "^1.15.0",
@@ -26,8 +26,8 @@
         "react-loading": "2.0.3",
         "react-redux": "6.0.1",
         "react-router": "5.0.1",
-        "react-router-dom": "^5.0.1",
         "react-router-bootstrap": "^0.25.0",
+        "react-router-dom": "^5.0.1",
         "redux": "^4.0.1",
         "redux-logger": "^3.0.6",
         "redux-thunk": "^2.3.0",
@@ -39,11 +39,11 @@
         "@babel/preset-env": "^7.5.0",
         "@babel/preset-react": "^7.0.0",
         "autoprefixer": "^9.5.1",
-        "axios": "^0.17.1",
+        "axios": "^0.19.2",
         "babel-eslint": "^10.0.1",
         "babel-loader": "^8.0.6",
         "clean-webpack-plugin": "^3.0.0",
-        "css-loader": "^0.26.0",
+        "css-loader": "^3.4.2",
         "del": "^3.0.0",
         "eslint": "^5.16.0",
         "eslint-plugin-react": "^7.6.1",
@@ -60,6 +60,6 @@
         "webpack": "^4.31.0",
         "webpack-cli": "^3.3.2",
         "webpack-pwa-manifest": "^4.0.0",
-        "webpack-stream": "^4.0.1"
+        "webpack-stream": "^5.2.1"
     }
 }

frontend/webpack.config.js

@@ -5,18 +5,18 @@ var HtmlWebpackPlugin = require("html-webpack-plugin");
 var { CleanWebpackPlugin } = require("clean-webpack-plugin");
 
 var mode = "development";
-var BUILD_DIR = path.resolve(__dirname, "build/public/");
+var BUILD_DIR = path.resolve(__dirname, "../build/public/");
 
 if (process.env.NODE_ENV === "production") {
   mode = "production";
-  BUILD_DIR = path.resolve(__dirname, "canapeapp/public/");
+  BUILD_DIR = path.resolve(__dirname, "../canapeapp/public/");
 }
 
-var SRC_DIR = path.resolve(__dirname, "frontend/js");
+var SRC_DIR = path.resolve(__dirname);
 
 const config = {
   mode: mode,
-  entry: path.join(SRC_DIR, "app.js"),
+  entry: path.join(SRC_DIR, "js/app.js"),
   output: {
     path: BUILD_DIR,
     filename: "[contenthash]-app.js",
@@ -77,7 +77,7 @@ const config = {
       cleanOnceBeforeBuildPatterns: ["**/*", "!img/**/*", "!img"],
     }),
     new HtmlWebpackPlugin({
-      template: path.join(SRC_DIR, "../index.html"),
+      template: path.join(SRC_DIR, "index.html"),
     }),
     new WebpackPwaManifest({
       fingerprints: true,
@@ -96,11 +96,11 @@ const config = {
       start_url: "/",
       icons: [
         {
-          src: path.resolve(__dirname, "frontend/img/android-chrome-512x512.png"),
+          src: path.resolve(__dirname, "img/android-chrome-512x512.png"),
           sizes: [96, 128, 192, 256, 384, 512],
         },
         {
-          src: path.resolve(__dirname, "frontend/img/apple-touch-icon.png"),
+          src: path.resolve(__dirname, "img/apple-touch-icon.png"),
           sizes: [80, 120, 152, 167, 180],
           ios: true
         },