Fixes based on Github's code scanning results

src/headless/plugins/chat/utils.js

@@ -95,7 +95,7 @@ export async function handleMessageStanza (stanza) {
     }
     let attrs;
     try {
-        attrs = await parseMessage(stanza, _converse);
+        attrs = await parseMessage(stanza);
     } catch (e) {
         return log.error(e);
     }

src/headless/plugins/headlines/index.js

@@ -4,7 +4,7 @@
  */
 import HeadlinesFeed from './feed.js';
 import headlines_api from './api.js';
-import { _converse, api, converse } from "@converse/headless/core";
+import { _converse, api, converse } from "../../core.js";
 import { onHeadlineMessage } from './utils.js';
 
 

src/headless/plugins/muc/muc.js

@@ -10,13 +10,13 @@ import { Model } from '@converse/skeletor/src/model.js';
 import { Strophe, $build, $iq, $msg, $pres } from 'strophe.js/src/strophe';
 import { _converse, api, converse } from '../../core.js';
 import { computeAffiliationsDelta, setAffiliations, getAffiliationList }  from './affiliations/utils.js';
-import { handleCorrection } from '@converse/headless/shared/chat/utils.js';
+import { handleCorrection } from '../../shared/chat/utils.js';
 import { getOpenPromise } from '@converse/openpromise';
-import { initStorage } from '@converse/headless/utils/storage.js';
+import { initStorage } from '../../utils/storage.js';
-import { isArchived, getMediaURLsMetadata } from '@converse/headless/shared/parsers.js';
+import { isArchived, getMediaURLsMetadata } from '../../shared/parsers.js';
-import { isUniView, getUniqueId, safeSave } from '@converse/headless/utils/core.js';
+import { isUniView, getUniqueId, safeSave } from '../../utils/core.js';
 import { parseMUCMessage, parseMUCPresence } from './parsers.js';
-import { sendMarker } from '@converse/headless/shared/actions.js';
+import { sendMarker } from '../../shared/actions.js';
 import { ROOMSTATUS } from './constants.js';
 
 const OWNER_COMMANDS = ['owner'];
@@ -444,7 +444,7 @@ const ChatRoomMixin = {
 
     async handleErrorMessageStanza (stanza) {
         const { __ } = _converse;
-        const attrs = await parseMUCMessage(stanza, this, _converse);
+        const attrs = await parseMUCMessage(stanza, this);
         if (!(await this.shouldShowErrorMessage(attrs))) {
             return;
         }
@@ -535,7 +535,7 @@ const ChatRoomMixin = {
                 'num_unread': this.get('num_unread') + mentions.length
             });
             mentions.forEach(async stanza => {
-                const attrs = await parseMUCMessage(stanza, this, _converse);
+                const attrs = await parseMUCMessage(stanza, this);
                 const data = { stanza, attrs, 'chatbox': this };
                 api.trigger('message', data);
             });
@@ -574,7 +574,7 @@ const ChatRoomMixin = {
          */
         let attrs;
         try {
-            attrs = await parseMUCMessage(stanza, this, _converse);
+            attrs = await parseMUCMessage(stanza, this);
         } catch (e) {
             return log.error(e);
         }
@@ -2455,14 +2455,15 @@ const ChatRoomMixin = {
         } else if (is_self && code in _converse.muc.new_nickname_messages) {
             // XXX: Side-effect of setting the nick. Should ideally be refactored out of this method
             let nick;
-            if (is_self && code === '210') {
+            if (code === '210') {
                 nick = Strophe.getResourceFromJid(stanza.getAttribute('from'));
-            } else if (is_self && code === '303') {
+            } else if (code === '303') {
                 nick = sizzle(`x[xmlns="${Strophe.NS.MUC_USER}"] item`, stanza).pop().getAttribute('nick');
             }
             this.save('nick', nick);
             data.message = __(_converse.muc.new_nickname_messages[code], nick);
         }
+
         if (data.message) {
             if (code === '201' && this.messages.findWhere(data)) {
                 return;

src/headless/utils/core.js

@@ -207,20 +207,22 @@ u.isServiceUnavailableError = function (stanza) {
 
 /**
  * Merge the second object into the first one.
- * @private
  * @method u#merge
- * @param { Object } first
+ * @param { Object } dst
- * @param { Object } second
+ * @param { Object } src
  */
-u.merge = function merge (first, second) {
+export function merge (dst, src) {
-    for (const k in second) {
+    for (const k in src) {
-        if (isObject(first[k])) {
+        if (!Object.prototype.hasOwnProperty.call(src, k)) continue;
-            merge(first[k], second[k]);
+        if (k === "__proto__" || k === "constructor") continue;
+
+        if (isObject(dst[k])) {
+            merge(dst[k], src[k]);
         } else {
-            first[k] = second[k];
+            dst[k] = src[k];
         }
     }
-};
+}
 
 u.getOuterWidth = function (el, include_margin=false) {
     let width = el.offsetWidth;
@@ -583,6 +585,7 @@ export default Object.assign({
     getUniqueId,
     isEmptyMessage,
     isValidJID,
+    merge,
     prefixMentions,
     stx,
     toStanza,

src/plugins/chatview/utils.js

@@ -1,6 +1,5 @@
 import { __ } from 'i18n';
 import { _converse, api } from '@converse/headless/core';
-import { html } from 'lit';
 
 export function clearHistory (jid) {
     if (_converse.router.history.getFragment() === `converse/chat?jid=${jid}`) {

src/plugins/register/templates/register_panel.js

@@ -75,7 +75,7 @@ export default o => {
     return html`
         <converse-brand-logo></converse-brand-logo>
         ${o.model.get('registration_status') === CHOOSE_PROVIDER ? tpl_choose_provider() : ''}
-        ${o.model.get('registration_status') === FETCHING_FORM ? tpl_form_request(o) : ''}
+        ${o.model.get('registration_status') === FETCHING_FORM ? tpl_form_request() : ''}
         ${o.model.get('registration_status') === REGISTRATION_FORM ? tpl_registration_form(o) : ''}
     `;
 };

src/plugins/roomslist/templates/roomslist.js

@@ -43,7 +43,7 @@ const room_item = (o) => {
         <div class="list-item controlbox-padded available-chatroom d-flex flex-row ${ o.currently_open(o.room) ? 'open' : '' } ${ has_unread_msgs ? 'unread-msgs' : '' }"
             data-room-jid="${o.room.get('jid')}">
 
-            ${ o.room.get('num_unread') ? unread_indicator(o) : (o.room.get('has_activity') ? activity_indicator(o) : '') }
+            ${ o.room.get('num_unread') ? unread_indicator(o) : (o.room.get('has_activity') ? activity_indicator() : '') }
 
             <a class="list-item-link open-room available-room w-100"
                 data-room-jid="${o.room.get('jid')}"

src/shared/rich-text.js

@@ -212,7 +212,7 @@ export class RichText extends String {
      * Look for XEP-0393 styling directives and add templates for rendering them.
      */
     addStyling () {
-        if (!containsDirectives(this, this.mentions)) {
+        if (!containsDirectives(this)) {
             return;
         }