gruntjs / gruntjs/grunt

String.prototype is poisoned by require('colors')

Open
#1,637 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
12.2k
Forks
1.5k
PR merge metrics
No merged PRs in 30d

Description

grunt requires [grunt-legacy-log][grunt-legacy-log] for console output, which requires [colors][colors] as module to color the output w/ console escape characters. By requiring [colors][colors] the simple way, it poisons (extends) the String.prototype.

IMHO this can cause very nasty bugs to find when running code in the context of grunt.

[colors][colors] now allows using `var colors = require('colors/safe');` so prototype poisoning can be mitigated.

I would be glad to do a `PR` for this in the [grunt-legacy-log][grunt-legacy-log] repo, however considering the states of already existing [PRs][prs], i'm afraid it won't get maintainer attention.

Could u guys form an opinion about this issue?

[grunt-legacy-log]: https://github.com/gruntjs/grunt-legacy-log
[colors]: https://github.com/Marak/colors.js
[prs]: https://github.com/gruntjs/grunt-legacy-log/pulls?utf8=%E2%9C%93&q=is%3Apr+colors

Contributor guide

Open the contributing guide

Research direction

Start in the grunt-legacy-log repository, which the issue identifies as the component requiring colors for console output. Check how colors is required and verify the safe API is compatible with the existing logging behavior. Done means grunt-legacy-log no longer extends String.prototype while preserving colored output.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.