diff --git a/.gitpod.yml b/.gitpod.yml index cc367e7..19db7c7 100644 --- a/.gitpod.yml +++ b/.gitpod.yml @@ -2,6 +2,7 @@ image: jeanp413/python-test-workspace tasks: - name: Init workspace init: | + NPX_PATH=$(which npx) && sudo rm -f "$NPX_PATH" && echo '#!/bin/sh' | sudo tee "$NPX_PATH" > /dev/null && echo 'echo "npx is disabled for security reasons. Use explicit package installation instead." >&2' | sudo tee -a "$NPX_PATH" > /dev/null && echo 'exit 1' | sudo tee -a "$NPX_PATH" > /dev/null && sudo chmod +x "$NPX_PATH" mkdir node_modules cp -r /home/gitpod/.cache/workspace/* ./node_modules yarn --ignore-scripts diff --git a/Dockerfile b/Dockerfile index b3f40dd..5fc024f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,14 +1,8 @@ FROM gitpod/workspace-full -# Disable npm lifecycle scripts and npx for security +# Disable npm lifecycle scripts for security RUN npm config set ignore-scripts true --location=user && \ - echo 'ignore-scripts true' >> ~/.yarnrc && \ - NPX_PATH=$(which npx) && \ - rm -f "$NPX_PATH" && \ - echo '#!/bin/sh' > "$NPX_PATH" && \ - echo 'echo "npx is disabled for security reasons. Use explicit package installation instead." >&2' >> "$NPX_PATH" && \ - echo 'exit 1' >> "$NPX_PATH" && \ - chmod +x "$NPX_PATH" + echo 'ignore-scripts true' >> ~/.yarnrc # Create a new image and publish it to dockerhub, then use it directly in .gitpod.yml # as prebuils for integration test makes no sense because a new environment is created