[misc] Use an allowlist for all JS includes

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Sails Changelog
 
+## master
+
+- Switch from an exclude list to an allow list for file extensions when loading services and the like
+
 ## 1.2.0
 
 - Added `sails migrate` for quickly running auto-migrations by hand

lib/hooks/moduleloader/index.js

@@ -26,7 +26,8 @@ module.exports = function(sails) {
   // > For full list, see:
   // > https://github.com/luislobo/common-js-file-extensions/blob/210fd15d89690c7aaa35dba35478cb91c693dfa8/README.md#code-file-extensions
   // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-  var BASIC_SUPPORTED_FILE_EXTENSIONS = COMMON_JS_FILE_EXTENSIONS.code;
+  var SUPPORTED_FILE_EXTENSIONS_FOR_CODE = COMMON_JS_FILE_EXTENSIONS.code.concat(['ejs']);
+  var SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX = new RegExp('^(.+)\\.(' + SUPPORTED_FILE_EXTENSIONS_FOR_CODE.join('|') + ')$');
 
   // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
   // Supported file extensions, ONLY for configuration files:
@@ -39,7 +40,7 @@ module.exports = function(sails) {
   // > For full list, see:
   // > https://github.com/luislobo/common-js-file-extensions/blob/210fd15d89690c7aaa35dba35478cb91c693dfa8/README.md#configobject-file-extensions
   // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
-  var SUPPORTED_FILE_EXTENSIONS_FOR_CONFIG = COMMON_JS_FILE_EXTENSIONS.config.concat(BASIC_SUPPORTED_FILE_EXTENSIONS);
+  var SUPPORTED_FILE_EXTENSIONS_FOR_CONFIG = COMMON_JS_FILE_EXTENSIONS.config.concat(SUPPORTED_FILE_EXTENSIONS_FOR_CODE);
 
 
   /**
@@ -303,7 +304,7 @@ module.exports = function(sails) {
       // Get the main model files
       includeAll.optional({
         dirname   : sails.config.paths.models,
-        filter    : /^(.+)\.(?:(?!md|txt).)+$/,
+        filter    : SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
         replaceExpr : /^.*\//,
         flatten: true
       }, function(err, models) {
@@ -338,7 +339,7 @@ module.exports = function(sails) {
     loadServices: function (cb) {
       includeAll.optional({
         dirname     : sails.config.paths.services,
-        filter      : /^(.+)\.(?:(?!md|txt).)+$/,
+        filter      : SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
         depth     : 1,
         caseSensitive : true
       }, bindToSails(cb));
@@ -353,7 +354,7 @@ module.exports = function(sails) {
     statViews: function (cb) {
       includeAll.optional({
         dirname: sails.config.paths.views,
-        filter: /^(.+)\.(?:(?!md|txt).)+$/,
+        filter: SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
         replaceExpr: null,
         dontLoad: true
       }, cb);
@@ -368,7 +369,7 @@ module.exports = function(sails) {
     loadPolicies: function (cb) {
       includeAll.optional({
         dirname: sails.config.paths.policies,
-        filter: /^(.+)\.(?:(?!md|txt).)+$/,
+        filter: SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
         replaceExpr: null,
         flatten: true,
         keepDirectoryPath: true
@@ -403,7 +404,7 @@ module.exports = function(sails) {
         hooksFolder: function(cb) {
           includeAll.optional({
             dirname: sails.config.paths.hooks,
-            filter: new RegExp('^(.+)\\.(' + BASIC_SUPPORTED_FILE_EXTENSIONS.join('|') + ')$'),
+            filter: SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
 
             // Hooks should be defined as either single files as a function
             // OR (better yet) a subfolder with an index.js file
@@ -579,7 +580,7 @@ module.exports = function(sails) {
     loadBlueprints: function (cb) {
       includeAll.optional({
         dirname: sails.config.paths.blueprints,
-        filter: /^(.+)\.(?:(?!md|txt).)+$/,
+        filter: SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
         useGlobalIdForKeyName: true
       }, cb);
     },
@@ -593,7 +594,7 @@ module.exports = function(sails) {
     loadResponses: function (cb) {
       includeAll.optional({
         dirname: sails.config.paths.responses,
-        filter: /^(.+)\.(?:(?!md|txt).)+$/,
+        filter: SUPPORTED_FILE_EXTENSIONS_FOR_CODE_REGEX,
         useGlobalIdForKeyName: true
       }, bindToSails(cb));
     },

test/integration/fixtures/sampleapp/api/controllers/.DoNotLoad.example

@@ -0,0 +1,2 @@
+This is just a file that we shouldn't try to load as a source file when loading
+this directory

test/integration/fixtures/sampleapp/api/models/DoNotLoad.html

@@ -0,0 +1,5 @@
+<html>
+  <body>
+    Just a sample file that we shouldn't load
+  </body>
+</html>

test/integration/fixtures/sampleapp/api/policies/DoNotLoad.rtd

@@ -0,0 +1 @@
+Another file we shouldn't try to load as source