add possible rest api clients

Bump node-fetch from 2.6.0 to 2.6.1

.eslintrc

@@ -8,7 +8,7 @@
     "prettier/standard"
   ],
   "parserOptions": {
-    "ecmaVersion": 2017
+    "ecmaVersion": 2018
   },
   "plugins": [
     "mocha",

.github/dependabot.yml

@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "daily"
+
+    pull-request-branch-name:
+      # Separate sections of the branch name with a hyphen
+      # Docker images use the branch name and do not support slashes in tags
+      # https://github.com/overleaf/google-ops/issues/822
+      # https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#pull-request-branch-nameseparator
+      separator: "-"
+
+    # Block informal upgrades -- security upgrades use a separate queue.
+    # https://docs.github.com/en/github/administering-a-repository/configuration-options-for-dependency-updates#open-pull-requests-limit
+    open-pull-requests-limit: 0
+
+    # currently assign team-magma to all dependabot PRs - this may change in
+    # future if we reorganise teams
+    labels:
+      - "dependencies"
+      - "Team-Magma"

.gitignore

@@ -11,3 +11,6 @@ db.sqlite-wal
 db.sqlite-shm
 config/*
 npm-debug.log
+
+# managed by dev-environment$ bin/update_build_scripts
+.npmrc

.nvmrc

@@ -1 +1 @@
-10.21.0
+10.22.1

Dockerfile

@@ -2,7 +2,7 @@
 # Instead run bin/update_build_scripts from
 # https://github.com/sharelatex/sharelatex-dev-environment
 
-FROM node:10.21.0 as base
+FROM node:10.22.1 as base
 
 WORKDIR /app
 COPY install_deps.sh /app
@@ -15,12 +15,10 @@ FROM base as app
 #wildcard as some files may not be in all repos
 COPY package*.json npm-shrink*.json /app/
 
-RUN npm install --quiet
+RUN npm ci --quiet
 
 COPY . /app
 
-
-
 FROM base
 
 COPY --from=app /app /app

Jenkinsfile

@@ -1,131 +0,0 @@
-String cron_string = BRANCH_NAME == "master" ? "@daily" : ""
-
-pipeline {
-  agent any
-
-  environment {
-    GIT_PROJECT = "clsi"
-    JENKINS_WORKFLOW = "clsi-sharelatex"
-    TARGET_URL = "${env.JENKINS_URL}blue/organizations/jenkins/${JENKINS_WORKFLOW}/detail/$BRANCH_NAME/$BUILD_NUMBER/pipeline"
-    GIT_API_URL = "https://api.github.com/repos/overleaf/${GIT_PROJECT}/statuses/$GIT_COMMIT"
-  }
-
-  triggers {
-    pollSCM('* * * * *')
-    cron(cron_string)
-  }
-
-  stages {
-
-    stage('Install') {
-      steps {
-        withCredentials([usernamePassword(credentialsId: 'GITHUB_INTEGRATION', usernameVariable: 'GH_AUTH_USERNAME', passwordVariable: 'GH_AUTH_PASSWORD')]) {
-          sh "curl $GIT_API_URL \
-            --data '{ \
-            \"state\" : \"pending\", \
-            \"target_url\": \"$TARGET_URL\", \
-            \"description\": \"Your build is underway\", \
-            \"context\": \"ci/jenkins\" }' \
-            -u $GH_AUTH_USERNAME:$GH_AUTH_PASSWORD"
-        }
-      }
-    }
-
-    stage('Build') {
-      steps {
-        sh 'make build'
-      }
-    }
-
-    stage('Linting') {
-      steps {
-        sh 'DOCKER_COMPOSE_FLAGS="-f docker-compose.ci.yml" make format'
-        sh 'DOCKER_COMPOSE_FLAGS="-f docker-compose.ci.yml" make lint'
-      }
-    }
-
-    stage('Unit Tests') {
-      steps {
-        sh 'DOCKER_COMPOSE_FLAGS="-f docker-compose.ci.yml" make test_unit'
-      }
-    }
-
-    stage('Acceptance Tests') {
-      steps {
-        sh 'DOCKER_COMPOSE_FLAGS="-f docker-compose.ci.yml" make test_acceptance'
-      }
-    }
-
-    stage('Package and docker push') {
-      steps {
-        sh 'echo ${BUILD_NUMBER} > build_number.txt'
-        sh 'touch build.tar.gz' // Avoid tar warning about files changing during read
-        sh 'DOCKER_COMPOSE_FLAGS="-f docker-compose.ci.yml" make tar'
-        
-        withCredentials([file(credentialsId: 'gcr.io_overleaf-ops', variable: 'DOCKER_REPO_KEY_PATH')]) {
-          sh 'docker login -u _json_key --password-stdin https://gcr.io/overleaf-ops < ${DOCKER_REPO_KEY_PATH}'
-        }
-        sh 'DOCKER_REPO=gcr.io/overleaf-ops make publish'
-        sh 'docker logout https://gcr.io/overleaf-ops'
-        
-      }
-    }
-
-    stage('Publish to s3') {
-      steps {
-        sh 'echo ${BRANCH_NAME}-${BUILD_NUMBER} > build_number.txt'
-        withAWS(credentials:'S3_CI_BUILDS_AWS_KEYS', region:"${S3_REGION_BUILD_ARTEFACTS}") {
-            s3Upload(file:'build.tar.gz', bucket:"${S3_BUCKET_BUILD_ARTEFACTS}", path:"${JOB_NAME}/${BUILD_NUMBER}.tar.gz")
-        }
-        withAWS(credentials:'S3_CI_BUILDS_AWS_KEYS', region:"${S3_REGION_BUILD_ARTEFACTS}") {
-            // The deployment process uses this file to figure out the latest build
-            s3Upload(file:'build_number.txt', bucket:"${S3_BUCKET_BUILD_ARTEFACTS}", path:"${JOB_NAME}/latest")
-        }
-      }
-    }
-  }
-
-  post {
-    always {
-      sh 'DOCKER_COMPOSE_FLAGS="-f docker-compose.ci.yml" make test_clean'
-      sh 'make clean'
-    }
-
-    success {
-      withCredentials([usernamePassword(credentialsId: 'GITHUB_INTEGRATION', usernameVariable: 'GH_AUTH_USERNAME', passwordVariable: 'GH_AUTH_PASSWORD')]) {
-        sh "curl $GIT_API_URL \
-          --data '{ \
-          \"state\" : \"success\", \
-          \"target_url\": \"$TARGET_URL\", \
-          \"description\": \"Your build succeeded!\", \
-          \"context\": \"ci/jenkins\" }' \
-          -u $GH_AUTH_USERNAME:$GH_AUTH_PASSWORD"
-      }
-    }
-
-    failure {
-      mail(from: "${EMAIL_ALERT_FROM}",
-           to: "${EMAIL_ALERT_TO}",
-           subject: "Jenkins build failed: ${JOB_NAME}:${BUILD_NUMBER}",
-           body: "Build: ${BUILD_URL}")
-      withCredentials([usernamePassword(credentialsId: 'GITHUB_INTEGRATION', usernameVariable: 'GH_AUTH_USERNAME', passwordVariable: 'GH_AUTH_PASSWORD')]) {
-        sh "curl $GIT_API_URL \
-          --data '{ \
-          \"state\" : \"failure\", \
-          \"target_url\": \"$TARGET_URL\", \
-          \"description\": \"Your build failed\", \
-          \"context\": \"ci/jenkins\" }' \
-          -u $GH_AUTH_USERNAME:$GH_AUTH_PASSWORD"
-      }
-    }
-  }
-
-  // The options directive is for configuration that applies to the whole job.
-  options {
-    // we'd like to make sure remove old builds, so we don't fill up our storage!
-    buildDiscarder(logRotator(numToKeepStr:'50'))
-
-    // And we'd really like to be sure that this build doesn't hang forever, so let's time it out after:
-    timeout(time: 30, unit: 'MINUTES')
-  }
-}

Makefile

@@ -25,13 +25,13 @@ clean:
 	docker rmi gcr.io/overleaf-ops/$(PROJECT_NAME):$(BRANCH_NAME)-$(BUILD_NUMBER)
 
 format:
-	$(DOCKER_COMPOSE) run --rm test_unit npm run format
+	$(DOCKER_COMPOSE) run --rm test_unit npm run --silent format
 
 format_fix:
-	$(DOCKER_COMPOSE) run --rm test_unit npm run format:fix
+	$(DOCKER_COMPOSE) run --rm test_unit npm run --silent format:fix
 
 lint:
-	$(DOCKER_COMPOSE) run --rm test_unit npm run lint
+	$(DOCKER_COMPOSE) run --rm test_unit npm run --silent lint
 
 test: format lint test_unit test_acceptance
 

README.md

@@ -1,6 +1,8 @@
 overleaf/clsi
 ===============
 
+**Note:** Original repo here: https://github.com/overleaf/clsi
+
 A web api for compiling LaTeX documents in the cloud
 
 The Common LaTeX Service Interface (CLSI) provides a RESTful interface to traditional LaTeX tools (or, more generally, any command line tool for composing marked-up documents into a display format such as PDF or HTML). The CLSI listens on the following ports by default:
@@ -34,20 +36,21 @@ The CLSI can be installed and set up as part of the entire [Overleaf stack](http
 
     $ git clone git@github.com:overleaf/clsi.git
     
-Then install the require npm modules:
+Then install the require npm modules and run:
 
     $ npm install
+    $ npm start
     
-Then compile the coffee script source files:
-
-    $ grunt install
-    
-Finally, (after configuring your local database - see the Config section), run the CLSI service:
-
-    $ grunt run
     
 The CLSI should then be running at http://localhost:3013.
 
+**Note:** to install texlive-full on ubuntu:
+    $ sudo apt install texlive-full
+
+Possible REST API clients to test are:
+* Postman
+* Insomnia
+    
 Config
 ------
 

app.js

@@ -134,17 +134,16 @@ const staticServer = ForbidSymlinks(express.static, Settings.path.compilesDir, {
   }
 })
 
-app.get('/project/:project_id/user/:user_id/build/:build_id/output/*', function(
-  req,
-  res,
-  next
-) {
+app.get(
+  '/project/:project_id/user/:user_id/build/:build_id/output/*',
+  function (req, res, next) {
     // for specific build get the path from the OutputCacheManager (e.g. .clsi/buildId)
     req.url =
       `/${req.params.project_id}-${req.params.user_id}/` +
       OutputCacheManager.path(req.params.build_id, `/${req.params[0]}`)
     return staticServer(req, res, next)
-})
+  }
+)
 
 app.get('/project/:project_id/build/:build_id/output/*', function (
   req,
@@ -208,7 +207,7 @@ if (Settings.processLifespanLimitMs) {
 function runSmokeTest() {
   if (Settings.processTooOld) return
   logger.log('running smoke tests')
-  smokeTest.triggerRun(err => {
+  smokeTest.triggerRun((err) => {
     if (err) logger.error({ err }, 'smoke tests failed')
     setTimeout(runSmokeTest, 30 * 1000)
   })
@@ -301,12 +300,12 @@ loadHttpServer.post('/state/maint', function(req, res, next) {
 const port =
   __guard__(
     Settings.internal != null ? Settings.internal.clsi : undefined,
-    x => x.port
+    (x) => x.port
   ) || 3013
 const host =
   __guard__(
     Settings.internal != null ? Settings.internal.clsi : undefined,
-    x1 => x1.host
+    (x1) => x1.host
   ) || 'localhost'
 
 const loadTcpPort = Settings.internal.load_balancer_agent.load_port
@@ -314,7 +313,7 @@ const loadHttpPort = Settings.internal.load_balancer_agent.local_port
 
 if (!module.parent) {
   // Called directly
-  app.listen(port, host, error => {
+  app.listen(port, host, (error) => {
     if (error) {
       logger.fatal({ error }, `Error starting CLSI on ${host}:${port}`)
     } else {

app/js/CompileController.js

@@ -116,7 +116,7 @@ module.exports = CompileController = {
               compile: {
                 status,
                 error: (error != null ? error.message : undefined) || error,
-                outputFiles: outputFiles.map(file => ({
+                outputFiles: outputFiles.map((file) => ({
                   url:
                     `${Settings.apis.clsi.url}/project/${request.project_id}` +
                     (request.user_id != null
@@ -197,17 +197,21 @@ module.exports = CompileController = {
     const v = parseFloat(req.query.v)
     const { project_id } = req.params
     const { user_id } = req.params
-    return CompileManager.syncFromPdf(project_id, user_id, page, h, v, function(
-      error,
-      codePositions
-    ) {
+    return CompileManager.syncFromPdf(
+      project_id,
+      user_id,
+      page,
+      h,
+      v,
+      function (error, codePositions) {
         if (error != null) {
           return next(error)
         }
         return res.json({
           code: codePositions
         })
-    })
+      }
+    )
   },
 
   wordcount(req, res, next) {
@@ -218,6 +222,15 @@ module.exports = CompileController = {
     const { project_id } = req.params
     const { user_id } = req.params
     const { image } = req.query
+    if (
+      image &&
+      Settings.clsi &&
+      Settings.clsi.docker &&
+      Settings.clsi.docker.allowedImages &&
+      !Settings.clsi.docker.allowedImages.includes(image)
+    ) {
+      return res.status(400).send('invalid image')
+    }
     logger.log({ image, file, project_id }, 'word count request')
 
     return CompileManager.wordcount(project_id, user_id, file, image, function (

app/js/CompileManager.js

@@ -61,7 +61,7 @@ module.exports = CompileManager = {
       }
       return LockManager.runWithLock(
         lockFile,
-        releaseLock => CompileManager.doCompile(request, releaseLock),
+        (releaseLock) => CompileManager.doCompile(request, releaseLock),
         callback
       )
     })
@@ -120,7 +120,7 @@ module.exports = CompileManager = {
         }
       }
 
-      const createTikzFileIfRequired = callback =>
+      const createTikzFileIfRequired = (callback) =>
         TikzManager.checkMainFile(
           compileDir,
           request.rootResourcePath,
@@ -177,9 +177,9 @@ module.exports = CompileManager = {
                 request.imageName != null
                   ? request.imageName.match(/:(.*)/)
                   : undefined,
-                x1 => x1[1]
+                (x1) => x1[1]
               ),
-              x => x.replace(/\./g, '-')
+              (x) => x.replace(/\./g, '-')
             ) || 'default'
           if (!request.project_id.match(/^[0-9a-f]{24}$/)) {
             tag = 'other'
@@ -206,9 +206,7 @@ module.exports = CompileManager = {
               // request was for validation only
               let metric_key, metric_value
               if (request.check === 'validate') {
-                const result = (error != null
-                ? error.code
-                : undefined)
+                const result = (error != null ? error.code : undefined)
                   ? 'fail'
                   : 'pass'
                 error = new Error('validation')
@@ -339,7 +337,7 @@ module.exports = CompileManager = {
       proc.on('error', callback)
 
       let stderr = ''
-      proc.stderr.setEncoding('utf8').on('data', chunk => (stderr += chunk))
+      proc.stderr.setEncoding('utf8').on('data', (chunk) => (stderr += chunk))
 
       return proc.on('close', function (code) {
         if (code === 0) {
@@ -360,7 +358,7 @@ module.exports = CompileManager = {
       if (err != null) {
         return callback(err)
       }
-      const allDirs = Array.from(files).map(file => Path.join(root, file))
+      const allDirs = Array.from(files).map((file) => Path.join(root, file))
       return callback(null, allDirs)
     })
   },
@@ -512,7 +510,7 @@ module.exports = CompileManager = {
     const timeout = 60 * 1000 // increased to allow for large projects
     const compileName = getCompileName(project_id, user_id)
     const compileGroup = 'synctex'
-    CompileManager._checkFileExists(directory, 'output.synctex.gz', error => {
+    CompileManager._checkFileExists(directory, 'output.synctex.gz', (error) => {
       if (error) {
         return callback(error)
       }
@@ -520,7 +518,9 @@ module.exports = CompileManager = {
         compileName,
         command,
         directory,
-        Settings.clsi != null ? Settings.clsi.docker.image : undefined,
+        Settings.clsi && Settings.clsi.docker
+          ? Settings.clsi.docker.image
+          : undefined,
         timeout,
         {},
         compileGroup,

app/js/DockerRunner.js

@@ -1,21 +1,3 @@
-/* eslint-disable
-    camelcase,
-    handle-callback-err,
-    no-return-assign,
-    no-unused-vars,
-*/
-// TODO: This file was created by bulk-decaffeinate.
-// Fix any style issues and re-enable lint.
-/*
- * decaffeinate suggestions:
- * DS101: Remove unnecessary use of Array.from
- * DS102: Remove unnecessary code created because of implicit returns
- * DS103: Rewrite code to no longer use __guard__
- * DS205: Consider reworking code to avoid use of IIFEs
- * DS207: Consider shorter variations of null checks
- * Full docs: https://github.com/decaffeinate/decaffeinate/blob/master/docs/suggestions.md
- */
-let DockerRunner, oneHour
 const Settings = require('settings-sharelatex')
 const logger = require('logger-sharelatex')
 const Docker = require('dockerode')
@@ -27,25 +9,23 @@ const fs = require('fs')
 const Path = require('path')
 const _ = require('lodash')
 
+const ONE_HOUR_IN_MS = 60 * 60 * 1000
 logger.info('using docker runner')
 
-const usingSiblingContainers = () =>
-  __guard__(
-    Settings != null ? Settings.path : undefined,
-    x => x.sandboxedCompilesHostDir
-  ) != null
+function usingSiblingContainers() {
+  return (
+    Settings != null &&
+    Settings.path != null &&
+    Settings.path.sandboxedCompilesHostDir != null
+  )
+}
 
 let containerMonitorTimeout
 let containerMonitorInterval
 
-module.exports = DockerRunner = {
-  ERR_NOT_DIRECTORY: new Error('not a directory'),
-  ERR_TERMINATED: new Error('terminated'),
-  ERR_EXITED: new Error('exited'),
-  ERR_TIMED_OUT: new Error('container timed out'),
-
+const DockerRunner = {
   run(
-    project_id,
+    projectId,
     command,
     directory,
     image,
@@ -54,10 +34,6 @@ module.exports = DockerRunner = {
     compileGroup,
     callback
   ) {
-    let name
-    if (callback == null) {
-      callback = function(error, output) {}
-    }
     if (usingSiblingContainers()) {
       const _newPath = Settings.path.sandboxedCompilesHostDir
       logger.log(
@@ -74,16 +50,20 @@ module.exports = DockerRunner = {
       )
     }
 
-    const volumes = {}
-    volumes[directory] = '/compile'
+    const volumes = { [directory]: '/compile' }
 
-    command = Array.from(command).map(arg =>
-      __guardMethod__(arg.toString(), 'replace', o =>
-        o.replace('$COMPILE_DIR', '/compile')
-      )
+    command = command.map((arg) =>
+      arg.toString().replace('$COMPILE_DIR', '/compile')
     )
     if (image == null) {
-      ;({ image } = Settings.clsi.docker)
+      image = Settings.clsi.docker.image
+    }
+
+    if (
+      Settings.clsi.docker.allowedImages &&
+      !Settings.clsi.docker.allowedImages.includes(image)
+    ) {
+      return callback(new Error('image not allowed'))
     }
 
     if (Settings.texliveImageNameOveride != null) {
@@ -100,25 +80,27 @@ module.exports = DockerRunner = {
       compileGroup
     )
     const fingerprint = DockerRunner._fingerprintContainer(options)
-    options.name = name = `project-${project_id}-${fingerprint}`
+    const name = `project-${projectId}-${fingerprint}`
+    options.name = name
 
     // logOptions = _.clone(options)
     // logOptions?.HostConfig?.SecurityOpt = "secomp used, removed in logging"
-    logger.log({ project_id }, 'running docker container')
-    DockerRunner._runAndWaitForContainer(options, volumes, timeout, function(
-      error,
-      output
-    ) {
+    logger.log({ projectId }, 'running docker container')
+    DockerRunner._runAndWaitForContainer(
+      options,
+      volumes,
+      timeout,
+      (error, output) => {
         if (error && error.statusCode === 500) {
           logger.log(
-          { err: error, project_id },
+            { err: error, projectId },
             'error running container so destroying and retrying'
           )
-        return DockerRunner.destroyContainer(name, null, true, function(error) {
+          DockerRunner.destroyContainer(name, null, true, (error) => {
             if (error != null) {
               return callback(error)
             }
-          return DockerRunner._runAndWaitForContainer(
+            DockerRunner._runAndWaitForContainer(
               options,
               volumes,
               timeout,
@@ -126,108 +108,93 @@ module.exports = DockerRunner = {
             )
           })
         } else {
-        return callback(error, output)
+          callback(error, output)
         }
-    })
+      }
+    )
 
+    // pass back the container name to allow it to be killed
     return name
-  }, // pass back the container name to allow it to be killed
+  },
 
-  kill(container_id, callback) {
-    if (callback == null) {
-      callback = function(error) {}
-    }
-    logger.log({ container_id }, 'sending kill signal to container')
-    const container = dockerode.getContainer(container_id)
-    return container.kill(function(error) {
+  kill(containerId, callback) {
+    logger.log({ containerId }, 'sending kill signal to container')
+    const container = dockerode.getContainer(containerId)
+    container.kill((error) => {
       if (
         error != null &&
-        __guardMethod__(error != null ? error.message : undefined, 'match', o =>
-          o.match(/Cannot kill container .* is not running/)
-        )
+        error.message != null &&
+        error.message.match(/Cannot kill container .* is not running/)
       ) {
         logger.warn(
-          { err: error, container_id },
+          { err: error, containerId },
           'container not running, continuing'
         )
         error = null
       }
       if (error != null) {
-        logger.error({ err: error, container_id }, 'error killing container')
-        return callback(error)
+        logger.error({ err: error, containerId }, 'error killing container')
+        callback(error)
       } else {
-        return callback()
+        callback()
       }
     })
   },
 
   _runAndWaitForContainer(options, volumes, timeout, _callback) {
-    if (_callback == null) {
-      _callback = function(error, output) {}
-    }
-    const callback = function(...args) {
-      _callback(...Array.from(args || []))
-      // Only call the callback once
-      return (_callback = function() {})
-    }
-
+    const callback = _.once(_callback)
     const { name } = options
 
     let streamEnded = false
     let containerReturned = false
     let output = {}
 
-    const callbackIfFinished = function() {
+    function callbackIfFinished() {
       if (streamEnded && containerReturned) {
-        return callback(null, output)
+        callback(null, output)
       }
     }
 
-    const attachStreamHandler = function(error, _output) {
+    function attachStreamHandler(error, _output) {
       if (error != null) {
         return callback(error)
       }
       output = _output
       streamEnded = true
-      return callbackIfFinished()
+      callbackIfFinished()
     }
 
-    return DockerRunner.startContainer(
+    DockerRunner.startContainer(
       options,
       volumes,
       attachStreamHandler,
-      function(error, containerId) {
+      (error, containerId) => {
         if (error != null) {
           return callback(error)
         }
 
-        return DockerRunner.waitForContainer(name, timeout, function(
-          error,
-          exitCode
-        ) {
-          let err
+        DockerRunner.waitForContainer(name, timeout, (error, exitCode) => {
           if (error != null) {
             return callback(error)
           }
           if (exitCode === 137) {
             // exit status from kill -9
-            err = DockerRunner.ERR_TERMINATED
+            const err = new Error('terminated')
             err.terminated = true
             return callback(err)
           }
           if (exitCode === 1) {
             // exit status from chktex
-            err = DockerRunner.ERR_EXITED
+            const err = new Error('exited')
             err.code = exitCode
             return callback(err)
           }
           containerReturned = true
-          __guard__(
-            options != null ? options.HostConfig : undefined,
-            x => (x.SecurityOpt = null)
-          ) // small log line
-          logger.log({ err, exitCode, options }, 'docker container has exited')
-          return callbackIfFinished()
+          if (options != null && options.HostConfig != null) {
+            options.HostConfig.SecurityOpt = null
+          }
+          logger.log({ exitCode, options }, 'docker container has exited')
+          callbackIfFinished()
         })
       }
     )
@@ -241,13 +208,11 @@ module.exports = DockerRunner = {
     environment,
     compileGroup
   ) {
-    let m, year
-    let key, value, hostVol, dockerVol
     const timeoutInSeconds = timeout / 1000
 
     const dockerVolumes = {}
-    for (hostVol in volumes) {
-      dockerVol = volumes[hostVol]
+    for (const hostVol in volumes) {
+      const dockerVol = volumes[hostVol]
       dockerVolumes[dockerVol] = {}
 
       if (volumes[hostVol].slice(-3).indexOf(':r') === -1) {
@@ -258,17 +223,14 @@ module.exports = DockerRunner = {
     // merge settings and environment parameter
     const env = {}
     for (const src of [Settings.clsi.docker.env, environment || {}]) {
-      for (key in src) {
-        value = src[key]
+      for (const key in src) {
+        const value = src[key]
         env[key] = value
       }
     }
     // set the path based on the image year
-    if ((m = image.match(/:([0-9]+)\.[0-9]+/))) {
-      year = m[1]
-    } else {
-      year = '2014'
-    }
+    const match = image.match(/:([0-9]+)\.[0-9]+/)
+    const year = match ? match[1] : '2014'
     env.PATH = `/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/texlive/${year}/bin/x86_64-linux/`
     const options = {
       Cmd: command,
@@ -278,23 +240,11 @@ module.exports = DockerRunner = {
       NetworkDisabled: true,
       Memory: 1024 * 1024 * 1024 * 1024, // 1 Gb
       User: Settings.clsi.docker.user,
-      Env: (() => {
-        const result = []
-        for (key in env) {
-          value = env[key]
-          result.push(`${key}=${value}`)
-        }
-        return result
-      })(), // convert the environment hash to an array
+      Env: Object.entries(env).map(([key, value]) => `${key}=${value}`),
       HostConfig: {
-        Binds: (() => {
-          const result1 = []
-          for (hostVol in volumes) {
-            dockerVol = volumes[hostVol]
-            result1.push(`${hostVol}:${dockerVol}`)
-          }
-          return result1
-        })(),
+        Binds: Object.entries(volumes).map(
+          ([hostVol, dockerVol]) => `${hostVol}:${dockerVol}`
+        ),
         LogConfig: { Type: 'none', Config: {} },
         Ulimits: [
           {
@@ -308,10 +258,7 @@ module.exports = DockerRunner = {
       }
     }
 
-    if (
-      (Settings.path != null ? Settings.path.synctexBinHostPath : undefined) !=
-      null
-    ) {
+    if (Settings.path != null && Settings.path.synctexBinHostPath != null) {
       options.HostConfig.Binds.push(
         `${Settings.path.synctexBinHostPath}:/opt/synctex:ro`
       )
@@ -330,6 +277,7 @@ module.exports = DockerRunner = {
     if (Settings.clsi.docker.Readonly) {
       options.HostConfig.ReadonlyRootfs = true
       options.HostConfig.Tmpfs = { '/tmp': 'rw,noexec,nosuid,size=65536k' }
+      options.Volumes['/home/tex'] = {}
     }
 
     // Allow per-compile group overriding of individual settings
@@ -338,8 +286,7 @@ module.exports = DockerRunner = {
       Settings.clsi.docker.compileGroupConfig[compileGroup]
     ) {
       const override = Settings.clsi.docker.compileGroupConfig[compileGroup]
-      let key
-      for (key in override) {
+      for (const key in override) {
         _.set(options, key, override[key])
       }
     }
@@ -350,25 +297,22 @@ module.exports = DockerRunner = {
   _fingerprintContainer(containerOptions) {
     // Yay, Hashing!
     const json = JSON.stringify(containerOptions)
-    return crypto
-      .createHash('md5')
-      .update(json)
-      .digest('hex')
+    return crypto.createHash('md5').update(json).digest('hex')
   },
 
   startContainer(options, volumes, attachStreamHandler, callback) {
-    return LockManager.runWithLock(
+    LockManager.runWithLock(
       options.name,
-      releaseLock =>
+      (releaseLock) =>
         // Check that volumes exist before starting the container.
         // When a container is started with volume pointing to a
         // non-existent directory then docker creates the directory but
         // with root ownership.
-        DockerRunner._checkVolumes(options, volumes, function(err) {
+        DockerRunner._checkVolumes(options, volumes, (err) => {
           if (err != null) {
             return releaseLock(err)
           }
-          return DockerRunner._startContainer(
+          DockerRunner._startContainer(
             options,
             volumes,
             attachStreamHandler,
@@ -382,93 +326,85 @@ module.exports = DockerRunner = {
 
   // Check that volumes exist and are directories
   _checkVolumes(options, volumes, callback) {
-    if (callback == null) {
-      callback = function(error, containerName) {}
-    }
     if (usingSiblingContainers()) {
       // Server Pro, with sibling-containers active, skip checks
       return callback(null)
     }
 
     const checkVolume = (path, cb) =>
-      fs.stat(path, function(err, stats) {
+      fs.stat(path, (err, stats) => {
         if (err != null) {
           return cb(err)
         }
-        if (!(stats != null ? stats.isDirectory() : undefined)) {
-          return cb(DockerRunner.ERR_NOT_DIRECTORY)
+        if (!stats.isDirectory()) {
+          return cb(new Error('not a directory'))
         }
-        return cb()
+        cb()
       })
     const jobs = []
     for (const vol in volumes) {
-      ;(vol => jobs.push(cb => checkVolume(vol, cb)))(vol)
+      jobs.push((cb) => checkVolume(vol, cb))
     }
-    return async.series(jobs, callback)
+    async.series(jobs, callback)
   },
 
   _startContainer(options, volumes, attachStreamHandler, callback) {
-    if (callback == null) {
-      callback = function(error, output) {}
-    }
     callback = _.once(callback)
     const { name } = options
 
     logger.log({ container_name: name }, 'starting container')
     const container = dockerode.getContainer(name)
 
-    const createAndStartContainer = () =>
-      dockerode.createContainer(options, function(error, container) {
+    function createAndStartContainer() {
+      dockerode.createContainer(options, (error, container) => {
         if (error != null) {
           return callback(error)
         }
-        return startExistingContainer()
+        startExistingContainer()
       })
-    var startExistingContainer = () =>
+    }
+
+    function startExistingContainer() {
       DockerRunner.attachToContainer(
         options.name,
         attachStreamHandler,
-        function(error) {
+        (error) => {
           if (error != null) {
             return callback(error)
           }
-          return container.start(function(error) {
-            if (
-              error != null &&
-              (error != null ? error.statusCode : undefined) !== 304
-            ) {
-              // already running
-              return callback(error)
+          container.start((error) => {
+            if (error != null && error.statusCode !== 304) {
+              callback(error)
             } else {
-              return callback()
+              // already running
+              callback()
             }
           })
         }
       )
-    return container.inspect(function(error, stats) {
-      if ((error != null ? error.statusCode : undefined) === 404) {
-        return createAndStartContainer()
+    }
+
+    container.inspect((error, stats) => {
+      if (error != null && error.statusCode === 404) {
+        createAndStartContainer()
       } else if (error != null) {
         logger.err(
           { container_name: name, error },
           'unable to inspect container to start'
         )
-        return callback(error)
+        callback(error)
       } else {
-        return startExistingContainer()
+        startExistingContainer()
       }
     })
   },
 
   attachToContainer(containerId, attachStreamHandler, attachStartCallback) {
     const container = dockerode.getContainer(containerId)
-    return container.attach({ stdout: 1, stderr: 1, stream: 1 }, function(
-      error,
-      stream
-    ) {
+    container.attach({ stdout: 1, stderr: 1, stream: 1 }, (error, stream) => {
       if (error != null) {
         logger.error(
-          { err: error, container_id: containerId },
+          { err: error, containerId },
           'error attaching to container'
         )
         return attachStartCallback(error)
@@ -476,10 +412,10 @@ module.exports = DockerRunner = {
         attachStartCallback()
       }
 
-      logger.log({ container_id: containerId }, 'attached to container')
+      logger.log({ containerId }, 'attached to container')
 
       const MAX_OUTPUT = 1024 * 1024 // limit output to 1MB
-      const createStringOutputStream = function(name) {
+      function createStringOutputStream(name) {
         return {
           data: '',
           overflowed: false,
@@ -488,18 +424,18 @@ module.exports = DockerRunner = {
               return
             }
             if (this.data.length < MAX_OUTPUT) {
-              return (this.data += data)
+              this.data += data
             } else {
               logger.error(
                 {
-                  container_id: containerId,
+                  containerId,
                   length: this.data.length,
                   maxLen: MAX_OUTPUT
                 },
                 `${name} exceeds max size`
               )
               this.data += `(...truncated at ${MAX_OUTPUT} chars...)`
-              return (this.overflowed = true)
+              this.overflowed = true
             }
           }
           // kill container if too much output
@@ -512,63 +448,52 @@ module.exports = DockerRunner = {
 
       container.modem.demuxStream(stream, stdout, stderr)
 
-      stream.on('error', err =>
+      stream.on('error', (err) =>
         logger.error(
-          { err, container_id: containerId },
+          { err, containerId },
           'error reading from container stream'
         )
       )
 
-      return stream.on('end', () =>
+      stream.on('end', () =>
         attachStreamHandler(null, { stdout: stdout.data, stderr: stderr.data })
       )
     })
   },
 
   waitForContainer(containerId, timeout, _callback) {
-    if (_callback == null) {
-      _callback = function(error, exitCode) {}
-    }
-    const callback = function(...args) {
-      _callback(...Array.from(args || []))
-      // Only call the callback once
-      return (_callback = function() {})
-    }
+    const callback = _.once(_callback)
 
     const container = dockerode.getContainer(containerId)
 
     let timedOut = false
-    const timeoutId = setTimeout(function() {
+    const timeoutId = setTimeout(() => {
       timedOut = true
-      logger.log(
-        { container_id: containerId },
-        'timeout reached, killing container'
-      )
-      return container.kill(function() {})
+      logger.log({ containerId }, 'timeout reached, killing container')
+      container.kill((err) => {
+        logger.warn({ err, containerId }, 'failed to kill container')
+      })
     }, timeout)
 
-    logger.log({ container_id: containerId }, 'waiting for docker container')
-    return container.wait(function(error, res) {
+    logger.log({ containerId }, 'waiting for docker container')
+    container.wait((error, res) => {
       if (error != null) {
         clearTimeout(timeoutId)
-        logger.error(
-          { err: error, container_id: containerId },
-          'error waiting for container'
-        )
+        logger.error({ err: error, containerId }, 'error waiting for container')
         return callback(error)
       }
       if (timedOut) {
         logger.log({ containerId }, 'docker container timed out')
-        error = DockerRunner.ERR_TIMED_OUT
+        error = new Error('container timed out')
         error.timedout = true
-        return callback(error)
+        callback(error)
       } else {
         clearTimeout(timeoutId)
         logger.log(
-          { container_id: containerId, exitCode: res.StatusCode },
+          { containerId, exitCode: res.StatusCode },
           'docker container returned'
         )
-        return callback(null, res.StatusCode)
+        callback(null, res.StatusCode)
       }
     })
   },
@@ -580,12 +505,9 @@ module.exports = DockerRunner = {
     // async exception, but if you delete by id it just does a normal
     // error callback. We fall back to deleting by name if no id is
     // supplied.
-    if (callback == null) {
-      callback = function(error) {}
-    }
-    return LockManager.runWithLock(
+    LockManager.runWithLock(
       containerName,
-      releaseLock =>
+      (releaseLock) =>
         DockerRunner._destroyContainer(
           containerId || containerName,
           shouldForce,
@@ -596,46 +518,31 @@ module.exports = DockerRunner = {
   },
 
   _destroyContainer(containerId, shouldForce, callback) {
-    if (callback == null) {
-      callback = function(error) {}
-    }
-    logger.log({ container_id: containerId }, 'destroying docker container')
+    logger.log({ containerId }, 'destroying docker container')
     const container = dockerode.getContainer(containerId)
-    return container.remove({ force: shouldForce === true }, function(error) {
-      if (
-        error != null &&
-        (error != null ? error.statusCode : undefined) === 404
-      ) {
+    container.remove({ force: shouldForce === true, v: true }, (error) => {
+      if (error != null && error.statusCode === 404) {
         logger.warn(
-          { err: error, container_id: containerId },
+          { err: error, containerId },
           'container not found, continuing'
         )
         error = null
       }
       if (error != null) {
-        logger.error(
-          { err: error, container_id: containerId },
-          'error destroying container'
-        )
+        logger.error({ err: error, containerId }, 'error destroying container')
       } else {
-        logger.log({ container_id: containerId }, 'destroyed container')
+        logger.log({ containerId }, 'destroyed container')
       }
-      return callback(error)
+      callback(error)
     })
   },
 
   // handle expiry of docker containers
 
-  MAX_CONTAINER_AGE:
-    Settings.clsi.docker.maxContainerAge || (oneHour = 60 * 60 * 1000),
+  MAX_CONTAINER_AGE: Settings.clsi.docker.maxContainerAge || ONE_HOUR_IN_MS,
 
   examineOldContainer(container, callback) {
-    if (callback == null) {
-      callback = function(error, name, id, ttl) {}
-    }
-    const name =
-      container.Name ||
-      (container.Names != null ? container.Names[0] : undefined)
+    const name = container.Name || (container.Names && container.Names[0])
     const created = container.Created * 1000 // creation time is returned in seconds
     const now = Date.now()
     const age = now - created
@@ -645,39 +552,29 @@ module.exports = DockerRunner = {
       { containerName: name, created, now, age, maxAge, ttl },
       'checking whether to destroy container'
     )
-    return callback(null, name, container.Id, ttl)
+    return { name, id: container.Id, ttl }
   },
 
   destroyOldContainers(callback) {
-    if (callback == null) {
-      callback = function(error) {}
-    }
-    return dockerode.listContainers({ all: true }, function(error, containers) {
+    dockerode.listContainers({ all: true }, (error, containers) => {
       if (error != null) {
         return callback(error)
       }
       const jobs = []
-      for (const container of Array.from(containers || [])) {
-        ;(container =>
-          DockerRunner.examineOldContainer(container, function(
-            err,
-            name,
-            id,
-            ttl
-          ) {
+      for (const container of containers) {
+        const { name, id, ttl } = DockerRunner.examineOldContainer(container)
         if (name.slice(0, 9) === '/project-' && ttl <= 0) {
           // strip the / prefix
           // the LockManager uses the plain container name
-              name = name.slice(1)
-              return jobs.push(cb =>
-                DockerRunner.destroyContainer(name, id, false, () => cb())
+          const plainName = name.slice(1)
+          jobs.push((cb) =>
+            DockerRunner.destroyContainer(plainName, id, false, () => cb())
           )
         }
-          }))(container)
       }
       // Ignore errors because some containers get stuck but
       // will be destroyed next time
-      return async.series(jobs, callback)
+      async.series(jobs, callback)
     })
   },
 
@@ -694,8 +591,13 @@ module.exports = DockerRunner = {
     const randomDelay = Math.floor(Math.random() * 5 * 60 * 1000)
     containerMonitorTimeout = setTimeout(() => {
       containerMonitorInterval = setInterval(
-        () => DockerRunner.destroyOldContainers(),
-        (oneHour = 60 * 60 * 1000)
+        () =>
+          DockerRunner.destroyOldContainers((err) => {
+            if (err) {
+              logger.error({ err }, 'failed to destroy old containers')
+            }
+          }),
+        ONE_HOUR_IN_MS
       )
     }, randomDelay)
   },
@@ -706,27 +608,12 @@ module.exports = DockerRunner = {
       containerMonitorTimeout = undefined
     }
     if (containerMonitorInterval) {
-      clearInterval(containerMonitorTimeout)
-      containerMonitorTimeout = undefined
+      clearInterval(containerMonitorInterval)
+      containerMonitorInterval = undefined
     }
   }
 }
 
 DockerRunner.startContainerMonitor()
 
-function __guard__(value, transform) {
-  return typeof value !== 'undefined' && value !== null
-    ? transform(value)
-    : undefined
-}
-function __guardMethod__(obj, methodName, transform) {
-  if (
-    typeof obj !== 'undefined' &&
-    obj !== null &&
-    typeof obj[methodName] === 'function'
-  ) {
-    return transform(obj, methodName)
-  } else {
-    return undefined
-  }
-}
+module.exports = DockerRunner

app/js/LatexRunner.js

@@ -96,13 +96,13 @@ module.exports = LatexRunner = {
         }
         const runs =
           __guard__(
-            __guard__(output != null ? output.stderr : undefined, x1 =>
+            __guard__(output != null ? output.stderr : undefined, (x1) =>
               x1.match(/^Run number \d+ of .*latex/gm)
             ),
-            x => x.length
+            (x) => x.length
           ) || 0
         const failed =
-          __guard__(output != null ? output.stdout : undefined, x2 =>
+          __guard__(output != null ? output.stdout : undefined, (x2) =>
             x2.match(/^Latexmk: Errors/m)
           ) != null
             ? 1
@@ -122,21 +122,21 @@ module.exports = LatexRunner = {
             stderr != null
               ? stderr.match(/Percent of CPU this job got: (\d+)/m)
               : undefined,
-            x3 => x3[1]
+            (x3) => x3[1]
           ) || 0
         timings['cpu-time'] =
           __guard__(
             stderr != null
               ? stderr.match(/User time.*: (\d+.\d+)/m)
               : undefined,
-            x4 => x4[1]
+            (x4) => x4[1]
           ) || 0
         timings['sys-time'] =
           __guard__(
             stderr != null
               ? stderr.match(/System time.*: (\d+.\d+)/m)
               : undefined,
-            x5 => x5[1]
+            (x5) => x5[1]
           ) || 0
         // record output files
         LatexRunner.writeLogOutput(project_id, directory, output, () => {
@@ -153,7 +153,7 @@ module.exports = LatexRunner = {
     // internal method for writing non-empty log files
     function _writeFile(file, content, cb) {
       if (content && content.length > 0) {
-        fs.writeFile(file, content, err => {
+        fs.writeFile(file, content, (err) => {
           if (err) {
             logger.error({ project_id, file }, 'error writing log file') // don't fail on error
           }
@@ -202,7 +202,7 @@ module.exports = LatexRunner = {
     return (
       __guard__(
         Settings != null ? Settings.clsi : undefined,
-        x => x.latexmkCommandPrefix
+        (x) => x.latexmkCommandPrefix
       ) || []
     ).concat(args)
   },

app/js/LocalCommandRunner.js

@@ -15,6 +15,7 @@
  */
 let CommandRunner
 const { spawn } = require('child_process')
+const _ = require('underscore')
 const logger = require('logger-sharelatex')
 
 logger.info('using standard command runner')
@@ -33,8 +34,10 @@ module.exports = CommandRunner = {
     let key, value
     if (callback == null) {
       callback = function (error) {}
+    } else {
+      callback = _.once(callback)
     }
-    command = Array.from(command).map(arg =>
+    command = Array.from(command).map((arg) =>
       arg.toString().replace('$COMPILE_DIR', directory)
     )
     logger.log({ project_id, command, directory }, 'running command')
@@ -55,7 +58,7 @@ module.exports = CommandRunner = {
     const proc = spawn(command[0], command.slice(1), { cwd: directory, env })
 
     let stdout = ''
-    proc.stdout.setEncoding('utf8').on('data', data => (stdout += data))
+    proc.stdout.setEncoding('utf8').on('data', (data) => (stdout += data))
 
     proc.on('error', function (err) {
       logger.err(

app/js/OutputCacheManager.js

@@ -99,13 +99,16 @@ module.exports = OutputCacheManager = {
       (Settings.clsi != null ? Settings.clsi.archive_logs : undefined) ||
       (Settings.clsi != null ? Settings.clsi.strace : undefined)
     ) {
-      OutputCacheManager.archiveLogs(outputFiles, compileDir, buildId, function(
-        err
-      ) {
+      OutputCacheManager.archiveLogs(
+        outputFiles,
+        compileDir,
+        buildId,
+        function (err) {
           if (err != null) {
             return logger.warn({ err }, 'erroring archiving log files')
           }
-      })
+        }
+      )
     }
 
     // make the new cache directory
@@ -280,7 +283,7 @@ module.exports = OutputCacheManager = {
         // we can get the build time from the first part of the directory name DDDD-RRRR
         // DDDD is date and RRRR is random bytes
         const dirTime = parseInt(
-          __guard__(dir.split('-'), x => x[0]),
+          __guard__(dir.split('-'), (x) => x[0]),
           16
         )
         const age = currentTime - dirTime

app/js/OutputFileFinder.js

@@ -44,7 +44,7 @@ module.exports = OutputFileFinder = {
         if (!incomingResources[file]) {
           outputFiles.push({
             path: file,
-            type: __guard__(file.match(/\.([^\.]+)$/), x => x[1])
+            type: __guard__(file.match(/\.([^\.]+)$/), (x) => x[1])
           })
         }
       }
@@ -87,7 +87,7 @@ module.exports = OutputFileFinder = {
 
     const proc = spawn('find', args)
     let stdout = ''
-    proc.stdout.setEncoding('utf8').on('data', chunk => (stdout += chunk))
+    proc.stdout.setEncoding('utf8').on('data', (chunk) => (stdout += chunk))
     proc.on('error', callback)
     return proc.on('close', function (code) {
       if (code !== 0) {

app/js/OutputFileOptimiser.js

@@ -77,7 +77,7 @@ module.exports = OutputFileOptimiser = {
     const timer = new Metrics.Timer('qpdf')
     const proc = spawn('qpdf', args)
     let stdout = ''
-    proc.stdout.setEncoding('utf8').on('data', chunk => (stdout += chunk))
+    proc.stdout.setEncoding('utf8').on('data', (chunk) => (stdout += chunk))
     callback = _.once(callback) // avoid double call back for error and close event
     proc.on('error', function (err) {
       logger.warn({ err, args }, 'qpdf failed')

app/js/ProjectPersistenceManager.js

@@ -50,7 +50,7 @@ module.exports = ProjectPersistenceManager = {
     if (callback == null) {
       callback = function (error) {}
     }
-    const job = cb =>
+    const job = (cb) =>
       db.Project.findOrCreate({ where: { project_id } })
         .spread((project, created) =>
           project
@@ -74,8 +74,8 @@ module.exports = ProjectPersistenceManager = {
         return callback(error)
       }
       logger.log({ project_ids }, 'clearing expired projects')
-      const jobs = Array.from(project_ids || []).map(project_id =>
-        (project_id => callback =>
+      const jobs = Array.from(project_ids || []).map((project_id) =>
+        ((project_id) => (callback) =>
           ProjectPersistenceManager.clearProjectFromCache(project_id, function (
             err
           ) {
@@ -91,7 +91,7 @@ module.exports = ProjectPersistenceManager = {
         }
         return CompileManager.clearExpiredProjects(
           ProjectPersistenceManager.EXPIRY_TIMEOUT,
-          error => callback()
+          (error) => callback()
         )
       })
     })
@@ -148,7 +148,7 @@ module.exports = ProjectPersistenceManager = {
       callback = function (error) {}
     }
     logger.log({ project_id }, 'clearing project from database')
-    const job = cb =>
+    const job = (cb) =>
       db.Project.destroy({ where: { project_id } })
         .then(() => cb())
         .error(cb)
@@ -166,10 +166,10 @@ module.exports = ProjectPersistenceManager = {
       const q = {}
       q[db.op.lt] = keepProjectsFrom
       return db.Project.findAll({ where: { lastAccessed: q } })
-        .then(projects =>
+        .then((projects) =>
           cb(
             null,
-            projects.map(project => project.project_id)
+            projects.map((project) => project.project_id)
           )
         )
         .error(cb)

app/js/RequestParser.js

@@ -61,7 +61,13 @@ module.exports = RequestParser = {
       response.imageName = this._parseAttribute(
         'imageName',
         compile.options.imageName,
-        { type: 'string' }
+        {
+          type: 'string',
+          validValues:
+            settings.clsi &&
+            settings.clsi.docker &&
+            settings.clsi.docker.allowedImages
+        }
       )
       response.draft = this._parseAttribute('draft', compile.options.draft, {
         default: false,

app/js/ResourceStateManager.js

@@ -56,7 +56,9 @@ module.exports = ResourceStateManager = {
       })
     } else {
       logger.log({ state, basePath }, 'writing sync state')
-      const resourceList = Array.from(resources).map(resource => resource.path)
+      const resourceList = Array.from(resources).map(
+        (resource) => resource.path
+      )
       return fs.writeFile(
         stateFile,
         [...Array.from(resourceList), `stateHash:${state}`].join('\n'),
@@ -86,7 +88,7 @@ module.exports = ResourceStateManager = {
         )
       }
       const array =
-        __guard__(result != null ? result.toString() : undefined, x =>
+        __guard__(result != null ? result.toString() : undefined, (x) =>
           x.split('\n')
         ) || []
       const adjustedLength = Math.max(array.length, 1)
@@ -102,7 +104,7 @@ module.exports = ResourceStateManager = {
           new Errors.FilesOutOfSyncError('invalid state for incremental update')
         )
       } else {
-        const resources = Array.from(resourceList).map(path => ({ path }))
+        const resources = Array.from(resourceList).map((path) => ({ path }))
         return callback(null, resources)
       }
     })
@@ -116,7 +118,7 @@ module.exports = ResourceStateManager = {
     }
     for (file of Array.from(resources || [])) {
       for (const dir of Array.from(
-        __guard__(file != null ? file.path : undefined, x => x.split('/'))
+        __guard__(file != null ? file.path : undefined, (x) => x.split('/'))
       )) {
         if (dir === '..') {
           return callback(new Error('relative path in resource file list'))
@@ -129,8 +131,8 @@ module.exports = ResourceStateManager = {
       seenFile[file] = true
     }
     const missingFiles = Array.from(resources)
-      .filter(resource => !seenFile[resource.path])
-      .map(resource => resource.path)
+      .filter((resource) => !seenFile[resource.path])
+      .map((resource) => resource.path)
     if ((missingFiles != null ? missingFiles.length : undefined) > 0) {
       logger.err(
         { missingFiles, basePath, allFiles, resources },

app/js/ResourceWriter.js

@@ -109,13 +109,13 @@ module.exports = ResourceWriter = {
     if (callback == null) {
       callback = function (error) {}
     }
-    return this._createDirectory(basePath, error => {
+    return this._createDirectory(basePath, (error) => {
       if (error != null) {
         return callback(error)
       }
-      const jobs = Array.from(resources).map(resource =>
-        (resource => {
-          return callback =>
+      const jobs = Array.from(resources).map((resource) =>
+        ((resource) => {
+          return (callback) =>
             this._writeResourceToDisk(project_id, resource, basePath, callback)
         })(resource)
       )
@@ -127,17 +127,17 @@ module.exports = ResourceWriter = {
     if (callback == null) {
       callback = function (error) {}
     }
-    return this._createDirectory(basePath, error => {
+    return this._createDirectory(basePath, (error) => {
       if (error != null) {
         return callback(error)
       }
-      return this._removeExtraneousFiles(resources, basePath, error => {
+      return this._removeExtraneousFiles(resources, basePath, (error) => {
         if (error != null) {
           return callback(error)
         }
-        const jobs = Array.from(resources).map(resource =>
-          (resource => {
-            return callback =>
+        const jobs = Array.from(resources).map((resource) =>
+          ((resource) => {
+            return (callback) =>
               this._writeResourceToDisk(
                 project_id,
                 resource,
@@ -242,7 +242,7 @@ module.exports = ResourceWriter = {
             should_delete = true
           }
           if (should_delete) {
-            return jobs.push(callback =>
+            return jobs.push((callback) =>
               ResourceWriter._deleteFileIfNotDirectory(
                 Path.join(basePath, path),
                 callback
@@ -303,7 +303,9 @@ module.exports = ResourceWriter = {
       if (error != null) {
         return callback(error)
       }
-      return fs.mkdir(Path.dirname(path), { recursive: true }, function(error) {
+      return fs.mkdir(Path.dirname(path), { recursive: true }, function (
+        error
+      ) {
         if (error != null) {
           return callback(error)
         }

app/js/StaticServerForbidSymlinks.js

@@ -26,7 +26,7 @@ module.exports = ForbidSymlinks = function(staticFn, root, options) {
   const basePath = Path.resolve(root)
   return function (req, res, next) {
     let file, project_id, result
-    const path = __guard__(url.parse(req.url), x => x.pathname)
+    const path = __guard__(url.parse(req.url), (x) => x.pathname)
     // check that the path is of the form /project_id_or_name/path/to/file.log
     if ((result = path.match(/^\/?([a-zA-Z0-9_-]+)\/(.*)/))) {
       project_id = result[1]

app/js/TikzManager.js

@@ -42,7 +42,10 @@ module.exports = TikzManager = {
       if (error != null) {
         return callback(error)
       }
-      return SafeReader.readFile(path, 65536, 'utf8', function(error, content) {
+      return SafeReader.readFile(path, 65536, 'utf8', function (
+        error,
+        content
+      ) {
         if (error != null) {
           return callback(error)
         }

app/js/UrlCache.js

@@ -60,8 +60,8 @@ module.exports = UrlCache = {
       if (error != null) {
         return callback(error)
       }
-      const jobs = Array.from(urls || []).map(url =>
-        (url => callback =>
+      const jobs = Array.from(urls || []).map((url) =>
+        ((url) => (callback) =>
           UrlCache._clearUrlFromCache(project_id, url, function (error) {
             if (error != null) {
               logger.error(
@@ -98,7 +98,7 @@ module.exports = UrlCache = {
           return UrlFetcher.pipeUrlToFileWithRetry(
             url,
             UrlCache._cacheFilePathForUrl(project_id, url),
-            error => {
+            (error) => {
               if (error != null) {
                 return callback(error)
               }
@@ -106,7 +106,7 @@ module.exports = UrlCache = {
                 project_id,
                 url,
                 lastModified,
-                error => {
+                (error) => {
                   if (error != null) {
                     return callback(error)
                   }
@@ -153,14 +153,7 @@ module.exports = UrlCache = {
   },
 
   _cacheFileNameForUrl(project_id, url) {
-    return (
-      project_id +
-      ':' +
-      crypto
-        .createHash('md5')
-        .update(url)
-        .digest('hex')
-    )
+    return project_id + ':' + crypto.createHash('md5').update(url).digest('hex')
   },
 
   _cacheFilePathForUrl(project_id, url) {
@@ -197,7 +190,9 @@ module.exports = UrlCache = {
       if (error != null) {
         return callback(error)
       }
-      return UrlCache._deleteUrlCacheFromDisk(project_id, url, function(error) {
+      return UrlCache._deleteUrlCacheFromDisk(project_id, url, function (
+        error
+      ) {
         if (error != null) {
           return callback(error)
         }
@@ -226,9 +221,9 @@ module.exports = UrlCache = {
     if (callback == null) {
       callback = function (error, urlDetails) {}
     }
-    const job = cb =>
+    const job = (cb) =>
       db.UrlCache.findOne({ where: { url, project_id } })
-        .then(urlDetails => cb(null, urlDetails))
+        .then((urlDetails) => cb(null, urlDetails))
         .error(cb)
     return dbQueue.queue.push(job, callback)
   },
@@ -237,7 +232,7 @@ module.exports = UrlCache = {
     if (callback == null) {
       callback = function (error) {}
     }
-    const job = cb =>
+    const job = (cb) =>
       db.UrlCache.findOrCreate({ where: { url, project_id } })
         .spread((urlDetails, created) =>
           urlDetails
@@ -253,7 +248,7 @@ module.exports = UrlCache = {
     if (callback == null) {
       callback = function (error) {}
     }
-    const job = cb =>
+    const job = (cb) =>
       db.UrlCache.destroy({ where: { url, project_id } })
         .then(() => cb(null))
         .error(cb)
@@ -264,12 +259,12 @@ module.exports = UrlCache = {
     if (callback == null) {
       callback = function (error, urls) {}
     }
-    const job = cb =>
+    const job = (cb) =>
       db.UrlCache.findAll({ where: { project_id } })
-        .then(urlEntries =>
+        .then((urlEntries) =>
           cb(
             null,
-            urlEntries.map(entry => entry.url)
+            urlEntries.map((entry) => entry.url)
           )
         )
         .error(cb)

app/js/db.js

@@ -62,6 +62,6 @@ module.exports = {
     return sequelize
       .sync()
       .then(() => logger.log('db sync complete'))
-      .catch(err => console.log(err, 'error syncing'))
+      .catch((err) => console.log(err, 'error syncing'))
   }
 }

buildscript.txt

@@ -1,11 +1,9 @@
 clsi
---acceptance-creds=None
 --data-dirs=cache,compiles,db
 --dependencies=
 --docker-repos=gcr.io/overleaf-ops
 --env-add=
 --env-pass-through=TEXLIVE_IMAGE
---language=es
---node-version=10.21.0
+--node-version=10.22.1
 --public-repo=True
---script-version=2.1.0
+--script-version=3.3.3

config/settings.defaults.js

@@ -129,6 +129,17 @@ if (process.env.DOCKER_RUNNER) {
     process.exit(1)
   }
 
+  if (process.env.ALLOWED_IMAGES) {
+    try {
+      module.exports.clsi.docker.allowedImages = process.env.ALLOWED_IMAGES.split(
+        ' '
+      )
+    } catch (error) {
+      console.error(error, 'could not apply allowed images setting')
+      process.exit(1)
+    }
+  }
+
   module.exports.path.synctexBaseDir = () => '/compile'
 
   module.exports.path.sandboxedCompilesHostDir = process.env.COMPILES_HOST_DIR

docker-compose-config.yml

@@ -3,6 +3,7 @@ version: "2.3"
 services:
   dev:
     environment:
+      ALLOWED_IMAGES: "quay.io/sharelatex/texlive-full:2017.1"
       TEXLIVE_IMAGE: quay.io/sharelatex/texlive-full:2017.1
       TEXLIVE_IMAGE_USER: "tex"
       SHARELATEX_CONFIG: /app/config/settings.defaults.coffee
@@ -18,6 +19,7 @@ services:
       
   ci:
     environment:
+      ALLOWED_IMAGES: ${TEXLIVE_IMAGE}
       TEXLIVE_IMAGE: quay.io/sharelatex/texlive-full:2017.1
       TEXLIVE_IMAGE_USER: "tex"
       SHARELATEX_CONFIG: /app/config/settings.defaults.coffee

docker-compose.ci.yml

@@ -10,6 +10,7 @@ services:
     command: npm run test:unit:_run
     environment:
       NODE_ENV: test
+      NODE_OPTIONS: "--unhandled-rejections=strict"
 
 
   test_acceptance:
@@ -25,6 +26,7 @@ services:
       POSTGRES_HOST: postgres
       MOCHA_GREP: ${MOCHA_GREP}
       NODE_ENV: test
+      NODE_OPTIONS: "--unhandled-rejections=strict"
       TEXLIVE_IMAGE:
     command: npm run test:acceptance:_run
 

docker-compose.yml

@@ -15,7 +15,8 @@ services:
     environment:
       MOCHA_GREP: ${MOCHA_GREP}
       NODE_ENV: test
-    command: npm run test:unit
+      NODE_OPTIONS: "--unhandled-rejections=strict"
+    command: npm run --silent test:unit
 
   test_acceptance:
     build:
@@ -35,5 +36,6 @@ services:
       MOCHA_GREP: ${MOCHA_GREP}
       LOG_LEVEL: ERROR
       NODE_ENV: test
-    command: npm run test:acceptance
+      NODE_OPTIONS: "--unhandled-rejections=strict"
+    command: npm run --silent test:acceptance
 

nodemon.json

@@ -8,7 +8,6 @@
   "execMap": {
     "js": "npm run start"
   },
-
   "watch": [
     "app/js/",
     "app.js",

package.json

@@ -13,7 +13,7 @@
     "test:unit:_run": "mocha --recursive --reporter spec $@ test/unit/js",
     "test:unit": "npm run test:unit:_run -- --grep=$MOCHA_GREP",
     "nodemon": "nodemon --config nodemon.json",
-    "lint": "node_modules/.bin/eslint .",
+    "lint": "node_modules/.bin/eslint --max-warnings 0 .",
     "format": "node_modules/.bin/prettier-eslint $PWD'/**/*.js' --list-different",
     "format:fix": "node_modules/.bin/prettier-eslint $PWD'/**/*.js' --write"
   },
@@ -27,8 +27,8 @@
     "fs-extra": "^8.1.0",
     "heapdump": "^0.3.15",
     "lockfile": "^1.0.4",
-    "lodash": "^4.17.15",
-    "logger-sharelatex": "^1.9.1",
+    "lodash": "^4.17.20",
+    "logger-sharelatex": "^2.2.0",
     "lynx": "0.2.0",
     "metrics-sharelatex": "^2.6.0",
     "mysql": "^2.18.1",
@@ -36,6 +36,7 @@
     "sequelize": "^5.21.5",
     "settings-sharelatex": "git+https://github.com/sharelatex/settings-sharelatex.git#v1.1.0",
     "sqlite3": "^4.1.1",
+    "underscore": "^1.11.0",
     "v8-profiler-node8": "^6.1.1",
     "wrench": "~1.5.9"
   },
@@ -59,7 +60,7 @@
     "eslint-plugin-react": "^7.19.0",
     "eslint-plugin-standard": "^4.0.1",
     "mocha": "^7.1.0",
-    "prettier": "^1.19.1",
+    "prettier": "^2.0.0",
     "prettier-eslint-cli": "^5.0.0",
     "sandboxed-module": "^2.0.3",
     "sinon": "~9.0.1",

test/acceptance/js/AllowedImageNames.js

@@ -0,0 +1,102 @@
+const Client = require('./helpers/Client')
+const ClsiApp = require('./helpers/ClsiApp')
+const { expect } = require('chai')
+
+describe('AllowedImageNames', function () {
+  beforeEach(function (done) {
+    this.project_id = Client.randomId()
+    this.request = {
+      options: {
+        imageName: undefined
+      },
+      resources: [
+        {
+          path: 'main.tex',
+          content: `\
+\\documentclass{article}
+\\begin{document}
+Hello world
+\\end{document}\
+`
+        }
+      ]
+    }
+    ClsiApp.ensureRunning(done)
+  })
+
+  describe('with a valid name', function () {
+    beforeEach(function (done) {
+      this.request.options.imageName = process.env.TEXLIVE_IMAGE
+
+      Client.compile(this.project_id, this.request, (error, res, body) => {
+        this.error = error
+        this.res = res
+        this.body = body
+        done(error)
+      })
+    })
+    it('should return success', function () {
+      expect(this.res.statusCode).to.equal(200)
+    })
+
+    it('should return a PDF', function () {
+      let pdf
+      try {
+        pdf = Client.getOutputFile(this.body, 'pdf')
+      } catch (e) {}
+      expect(pdf).to.exist
+    })
+  })
+
+  describe('with an invalid name', function () {
+    beforeEach(function (done) {
+      this.request.options.imageName = 'something/evil:1337'
+      Client.compile(this.project_id, this.request, (error, res, body) => {
+        this.error = error
+        this.res = res
+        this.body = body
+        done(error)
+      })
+    })
+    it('should return non success', function () {
+      expect(this.res.statusCode).to.not.equal(200)
+    })
+
+    it('should not return a PDF', function () {
+      let pdf
+      try {
+        pdf = Client.getOutputFile(this.body, 'pdf')
+      } catch (e) {}
+      expect(pdf).to.not.exist
+    })
+  })
+
+  describe('wordcount', function () {
+    beforeEach(function (done) {
+      Client.compile(this.project_id, this.request, done)
+    })
+    it('should error out with an invalid imageName', function () {
+      Client.wordcountWithImage(
+        this.project_id,
+        'main.tex',
+        'something/evil:1337',
+        (error, result) => {
+          expect(String(error)).to.include('statusCode=400')
+        }
+      )
+    })
+
+    it('should produce a texcout a valid imageName', function () {
+      Client.wordcountWithImage(
+        this.project_id,
+        'main.tex',
+        process.env.TEXLIVE_IMAGE,
+        (error, result) => {
+          expect(error).to.not.exist
+          expect(result).to.exist
+          expect(result.texcount).to.exist
+        }
+      )
+    })
+  })
+})

test/acceptance/js/ExampleDocumentTests.js

@@ -24,7 +24,7 @@ const ChildProcess = require('child_process')
 const ClsiApp = require('./helpers/ClsiApp')
 const logger = require('logger-sharelatex')
 const Path = require('path')
-const fixturePath = path => {
+const fixturePath = (path) => {
   if (path.slice(0, 3) === 'tmp') {
     return '/tmp/clsi_acceptance_tests' + path.slice(3)
   }
@@ -50,8 +50,8 @@ const convertToPng = function(pdfPath, pngPath, callback) {
   console.log(command)
   const convert = ChildProcess.exec(command)
   const stdout = ''
-  convert.stdout.on('data', chunk => console.log('STDOUT', chunk.toString()))
-  convert.stderr.on('data', chunk => console.log('STDERR', chunk.toString()))
+  convert.stdout.on('data', (chunk) => console.log('STDOUT', chunk.toString()))
+  convert.stderr.on('data', (chunk) => console.log('STDERR', chunk.toString()))
   return convert.on('exit', () => callback())
 }
 
@@ -66,11 +66,11 @@ const compare = function(originalPath, generatedPath, callback) {
     )} ${diff_file}`
   )
   let stderr = ''
-  proc.stderr.on('data', chunk => (stderr += chunk))
+  proc.stderr.on('data', (chunk) => (stderr += chunk))
   return proc.on('exit', () => {
     if (stderr.trim() === '0 (0)') {
       // remove output diff if test matches expected image
-      fs.unlink(diff_file, err => {
+      fs.unlink(diff_file, (err) => {
         if (err) {
           throw err
         }
@@ -89,8 +89,8 @@ const checkPdfInfo = function(pdfPath, callback) {
   }
   const proc = ChildProcess.exec(`pdfinfo ${fixturePath(pdfPath)}`)
   let stdout = ''
-  proc.stdout.on('data', chunk => (stdout += chunk))
-  proc.stderr.on('data', chunk => console.log('STDERR', chunk.toString()))
+  proc.stdout.on('data', (chunk) => (stdout += chunk))
+  proc.stderr.on('data', (chunk) => console.log('STDERR', chunk.toString()))
   return proc.on('exit', () => {
     if (stdout.match(/Optimized:\s+yes/)) {
       return callback(null, true)
@@ -136,14 +136,14 @@ const comparePdf = function(project_id, example_dir, callback) {
   return convertToPng(
     `tmp/${project_id}.pdf`,
     `tmp/${project_id}-generated.png`,
-    error => {
+    (error) => {
       if (error != null) {
         throw error
       }
       return convertToPng(
         `examples/${example_dir}/output.pdf`,
         `tmp/${project_id}-source.png`,
-        error => {
+        (error) => {
           if (error != null) {
             throw error
           }
@@ -163,7 +163,7 @@ const comparePdf = function(project_id, example_dir, callback) {
                   }
                 )
               } else {
-                return compareMultiplePages(project_id, error => {
+                return compareMultiplePages(project_id, (error) => {
                   if (error != null) {
                     throw error
                   }
@@ -178,7 +178,12 @@ const comparePdf = function(project_id, example_dir, callback) {
   )
 }
 
-const downloadAndComparePdf = function(project_id, example_dir, url, callback) {
+const downloadAndComparePdf = function (
+  project_id,
+  example_dir,
+  url,
+  callback
+) {
   if (callback == null) {
     callback = function (error) {}
   }
@@ -212,8 +217,9 @@ describe('Example Documents', function() {
     fsExtra.remove(fixturePath('tmp'), done)
   })
 
-  return Array.from(fs.readdirSync(fixturePath('examples'))).map(example_dir =>
-    (example_dir =>
+  return Array.from(fs.readdirSync(fixturePath('examples'))).map(
+    (example_dir) =>
+      ((example_dir) =>
         describe(example_dir, function () {
           before(function () {
             return (this.project_id = Client.randomId() + '_' + example_dir)
@@ -231,10 +237,16 @@ describe('Example Documents', function() {
                   error ||
                   __guard__(
                     body != null ? body.compile : undefined,
-                  x => x.status
+                    (x) => x.status
                   ) === 'failure'
                 ) {
-                console.log('DEBUG: error', error, 'body', JSON.stringify(body))
+                  console.log(
+                    'DEBUG: error',
+                    error,
+                    'body',
+                    JSON.stringify(body)
+                  )
+                  return done(new Error('Compile failed'))
                 }
                 const pdf = Client.getOutputFile(body, 'pdf')
                 return downloadAndComparePdf(
@@ -259,10 +271,16 @@ describe('Example Documents', function() {
                   error ||
                   __guard__(
                     body != null ? body.compile : undefined,
-                  x => x.status
+                    (x) => x.status
                   ) === 'failure'
                 ) {
-                console.log('DEBUG: error', error, 'body', JSON.stringify(body))
+                  console.log(
+                    'DEBUG: error',
+                    error,
+                    'body',
+                    JSON.stringify(body)
+                  )
+                  return done(new Error('Compile failed'))
                 }
                 const pdf = Client.getOutputFile(body, 'pdf')
                 return downloadAndComparePdf(

test/acceptance/js/TimeoutTests.js

@@ -56,7 +56,7 @@ describe('Timed out compile', function() {
   })
 
   return it('should return the log output file name', function () {
-    const outputFilePaths = this.body.compile.outputFiles.map(x => x.path)
+    const outputFilePaths = this.body.compile.outputFiles.map((x) => x.path)
     return outputFilePaths.should.include('output.log')
   })
 })

test/acceptance/js/UrlCachingTests.js

@@ -35,9 +35,7 @@ const Server = {
   getFile() {},
 
   randomId() {
-    return Math.random()
-      .toString(16)
-      .slice(2)
+    return Math.random().toString(16).slice(2)
   }
 }
 
@@ -338,7 +336,7 @@ describe('Url Caching', function() {
         ]
       }
 
-      return Client.compile(this.project_id, this.request, error => {
+      return Client.compile(this.project_id, this.request, (error) => {
         if (error != null) {
           throw error
         }

test/acceptance/js/helpers/Client.js

@@ -23,9 +23,7 @@ module.exports = Client = {
   host: Settings.apis.clsi.url,
 
   randomId() {
-    return Math.random()
-      .toString(16)
-      .slice(2)
+    return Math.random().toString(16).slice(2)
   },
 
   compile(project_id, data, callback) {
@@ -64,7 +62,7 @@ module.exports = Client = {
     const app = express()
     app.use(express.static(directory))
     console.log('starting test server on', port, host)
-    return app.listen(port, host).on('error', error => {
+    return app.listen(port, host).on('error', (error) => {
       console.error('error starting server:', error.message)
       return process.exit(1)
     })
@@ -130,7 +128,7 @@ module.exports = Client = {
         entities = entities.concat(
           fs
             .readdirSync(`${baseDirectory}/${directory}/${entity}`)
-            .map(subEntity => {
+            .map((subEntity) => {
               if (subEntity === 'main.tex') {
                 rootResourcePath = `${entity}/${subEntity}`
               }
@@ -189,6 +187,11 @@ module.exports = Client = {
   },
 
   wordcount(project_id, file, callback) {
+    const image = undefined
+    Client.wordcountWithImage(project_id, file, image, callback)
+  },
+
+  wordcountWithImage(project_id, file, image, callback) {
     if (callback == null) {
       callback = function (error, pdfPositions) {}
     }
@@ -196,6 +199,7 @@ module.exports = Client = {
       {
         url: `${this.host}/project/${project_id}/wordcount`,
         qs: {
+          image,
           file
         }
       },
@@ -203,6 +207,9 @@ module.exports = Client = {
         if (error != null) {
           return callback(error)
         }
+        if (response.statusCode !== 200) {
+          return callback(new Error(`statusCode=${response.statusCode}`))
+        }
         return callback(null, JSON.parse(body))
       }
     )

test/acceptance/js/helpers/ClsiApp.js

@@ -35,10 +35,10 @@ module.exports = {
       return app.listen(
         __guard__(
           Settings.internal != null ? Settings.internal.clsi : undefined,
-          x => x.port
+          (x) => x.port
         ),
         'localhost',
-        error => {
+        (error) => {
           if (error != null) {
             throw error
           }

test/load/js/loadTest.js

@@ -17,7 +17,7 @@ const _ = require('lodash')
 const concurentCompiles = 5
 const totalCompiles = 50
 
-const buildUrl = path =>
+const buildUrl = (path) =>
   `http://${Settings.internal.clsi.host}:${Settings.internal.clsi.port}/${path}`
 
 const mainTexContent = fs.readFileSync('./bulk.tex', 'utf-8')
@@ -74,12 +74,12 @@ ${bodyContent}
   )
 }
 
-const jobs = _.map(__range__(1, totalCompiles, true), i => cb =>
+const jobs = _.map(__range__(1, totalCompiles, true), (i) => (cb) =>
   makeRequest(i, cb)
 )
 
 const startTime = new Date()
-async.parallelLimit(jobs, concurentCompiles, err => {
+async.parallelLimit(jobs, concurentCompiles, (err) => {
   if (err != null) {
     console.error(err)
   }

test/smoke/js/SmokeTests.js

@@ -1,20 +1,20 @@
 const request = require('request')
 const Settings = require('settings-sharelatex')
 
-const buildUrl = path =>
+const buildUrl = (path) =>
   `http://${Settings.internal.clsi.host}:${Settings.internal.clsi.port}/${path}`
 
 const url = buildUrl(`project/smoketest-${process.pid}/compile`)
 
 module.exports = {
   sendNewResult(res) {
-    this._run(error => this._sendResponse(res, error))
+    this._run((error) => this._sendResponse(res, error))
   },
   sendLastResult(res) {
     this._sendResponse(res, this._lastError)
   },
   triggerRun(cb) {
-    this._run(error => {
+    this._run((error) => {
       this._lastError = error
       cb(error)
     })

test/unit/js/CompileControllerTests.js

@@ -12,6 +12,7 @@
 const SandboxedModule = require('sandboxed-module')
 const sinon = require('sinon')
 require('chai').should()
+const { expect } = require('chai')
 const modulePath = require('path').join(
   __dirname,
   '../../../app/js/CompileController'
@@ -114,7 +115,7 @@ describe('CompileController', function() {
             compile: {
               status: 'success',
               error: null,
-              outputFiles: this.output_files.map(file => {
+              outputFiles: this.output_files.map((file) => {
                 return {
                   url: `${this.Settings.apis.clsi.url}/project/${this.project_id}/build/${file.build}/output/${file.path}`,
                   path: file.path,
@@ -287,21 +288,60 @@ describe('CompileController', function() {
       this.CompileManager.wordcount = sinon
         .stub()
         .callsArgWith(4, null, (this.texcount = ['mock-texcount']))
-      return this.CompileController.wordcount(this.req, this.res, this.next)
     })
 
     it('should return the word count of a file', function () {
+      this.CompileController.wordcount(this.req, this.res, this.next)
       return this.CompileManager.wordcount
         .calledWith(this.project_id, undefined, this.file, this.image)
         .should.equal(true)
     })
 
-    return it('should return the texcount info', function() {
+    it('should return the texcount info', function () {
+      this.CompileController.wordcount(this.req, this.res, this.next)
       return this.res.json
         .calledWith({
           texcount: this.texcount
         })
         .should.equal(true)
     })
+
+    describe('when allowedImages is set', function () {
+      beforeEach(function () {
+        this.Settings.clsi = { docker: {} }
+        this.Settings.clsi.docker.allowedImages = [
+          'repo/image:tag1',
+          'repo/image:tag2'
+        ]
+        this.res.send = sinon.stub()
+        this.res.status = sinon.stub().returns({ send: this.res.send })
+      })
+
+      describe('with an invalid image', function () {
+        beforeEach(function () {
+          this.req.query.image = 'something/evil:1337'
+          this.CompileController.wordcount(this.req, this.res, this.next)
+        })
+        it('should return a 400', function () {
+          expect(this.res.status.calledWith(400)).to.equal(true)
+        })
+        it('should not run the query', function () {
+          expect(this.CompileManager.wordcount.called).to.equal(false)
+        })
+      })
+
+      describe('with a valid image', function () {
+        beforeEach(function () {
+          this.req.query.image = 'repo/image:tag1'
+          this.CompileController.wordcount(this.req, this.res, this.next)
+        })
+        it('should not return a 400', function () {
+          expect(this.res.status.calledWith(400)).to.equal(false)
+        })
+        it('should run the query', function () {
+          expect(this.CompileManager.wordcount.called).to.equal(true)
+        })
+      })
+    })
   })
 })

test/unit/js/CompileManagerTests.js

@@ -374,7 +374,7 @@ describe('CompileManager', function() {
       this.column = 3
       this.file_name = 'main.tex'
       this.child_process.execFile = sinon.stub()
-      return (this.Settings.path.synctexBaseDir = project_id =>
+      return (this.Settings.path.synctexBaseDir = (project_id) =>
         `${this.Settings.path.compilesDir}/${this.project_id}-${this.user_id}`)
     })
 

test/unit/js/DockerLockManagerTests.js

@@ -36,7 +36,7 @@ describe('LockManager', function() {
         this.callback = sinon.stub()
         return this.LockManager.runWithLock(
           'lock-one',
-          releaseLock =>
+          (releaseLock) =>
             setTimeout(() => releaseLock(null, 'hello', 'world'), 100),
 
           (err, ...args) => {
@@ -59,7 +59,7 @@ describe('LockManager', function() {
         this.callback2 = sinon.stub()
         this.LockManager.runWithLock(
           'lock-one',
-          releaseLock =>
+          (releaseLock) =>
             setTimeout(() => releaseLock(null, 'hello', 'world', 'one'), 100),
 
           (err, ...args) => {
@@ -68,7 +68,7 @@ describe('LockManager', function() {
         )
         return this.LockManager.runWithLock(
           'lock-two',
-          releaseLock =>
+          (releaseLock) =>
             setTimeout(() => releaseLock(null, 'hello', 'world', 'two'), 200),
 
           (err, ...args) => {
@@ -100,7 +100,7 @@ describe('LockManager', function() {
           this.callback2 = sinon.stub()
           this.LockManager.runWithLock(
             'lock',
-            releaseLock =>
+            (releaseLock) =>
               setTimeout(() => releaseLock(null, 'hello', 'world', 'one'), 100),
 
             (err, ...args) => {
@@ -109,7 +109,7 @@ describe('LockManager', function() {
           )
           return this.LockManager.runWithLock(
             'lock',
-            releaseLock =>
+            (releaseLock) =>
               setTimeout(() => releaseLock(null, 'hello', 'world', 'two'), 200),
 
             (err, ...args) => {
@@ -154,7 +154,7 @@ describe('LockManager', function() {
           }
           this.LockManager.runWithLock(
             'lock',
-            releaseLock =>
+            (releaseLock) =>
               setTimeout(
                 () => releaseLock(null, 'hello', 'world', 'one'),
                 1100
@@ -167,7 +167,7 @@ describe('LockManager', function() {
           )
           return this.LockManager.runWithLock(
             'lock',
-            releaseLock =>
+            (releaseLock) =>
               setTimeout(() => releaseLock(null, 'hello', 'world', 'two'), 100),
 
             (err, ...args) => {
@@ -211,7 +211,7 @@ describe('LockManager', function() {
           }
           this.LockManager.runWithLock(
             'lock',
-            releaseLock =>
+            (releaseLock) =>
               setTimeout(
                 () => releaseLock(null, 'hello', 'world', 'one'),
                 1500
@@ -224,7 +224,7 @@ describe('LockManager', function() {
           )
           return this.LockManager.runWithLock(
             'lock',
-            releaseLock =>
+            (releaseLock) =>
               setTimeout(() => releaseLock(null, 'hello', 'world', 'two'), 100),
 
             (err, ...args) => {

test/unit/js/DockerRunnerTests.js

@@ -273,7 +273,7 @@ describe('DockerRunner', function() {
       })
     })
 
-    return describe('with image override', function() {
+    describe('with image override', function () {
       beforeEach(function () {
         this.Settings.texliveImageNameOveride = 'overrideimage.com/something'
         this.DockerRunner._runAndWaitForContainer = sinon
@@ -296,6 +296,62 @@ describe('DockerRunner', function() {
         return image.should.equal('overrideimage.com/something/image:2016.2')
       })
     })
+
+    describe('with image restriction', function () {
+      beforeEach(function () {
+        this.Settings.clsi.docker.allowedImages = [
+          'repo/image:tag1',
+          'repo/image:tag2'
+        ]
+        this.DockerRunner._runAndWaitForContainer = sinon
+          .stub()
+          .callsArgWith(3, null, (this.output = 'mock-output'))
+      })
+
+      describe('with a valid image', function () {
+        beforeEach(function () {
+          this.DockerRunner.run(
+            this.project_id,
+            this.command,
+            this.directory,
+            'repo/image:tag1',
+            this.timeout,
+            this.env,
+            this.compileGroup,
+            this.callback
+          )
+        })
+
+        it('should setup the container', function () {
+          this.DockerRunner._getContainerOptions.called.should.equal(true)
+        })
+      })
+
+      describe('with a invalid image', function () {
+        beforeEach(function () {
+          this.DockerRunner.run(
+            this.project_id,
+            this.command,
+            this.directory,
+            'something/different:evil',
+            this.timeout,
+            this.env,
+            this.compileGroup,
+            this.callback
+          )
+        })
+
+        it('should call the callback with an error', function () {
+          const err = new Error('image not allowed')
+          this.callback.called.should.equal(true)
+          this.callback.args[0][0].message.should.equal(err.message)
+        })
+
+        it('should not setup the container', function () {
+          this.DockerRunner._getContainerOptions.called.should.equal(false)
+        })
+      })
+    })
   })
 
   describe('run with _getOptions', function () {
@@ -682,7 +738,7 @@ describe('DockerRunner', function() {
       this.DockerRunner.MAX_CONTAINER_AGE = oneHourInMilliseconds
       this.listContainers.callsArgWith(1, null, this.containers)
       this.DockerRunner.destroyContainer = sinon.stub().callsArg(3)
-      return this.DockerRunner.destroyOldContainers(error => {
+      return this.DockerRunner.destroyOldContainers((error) => {
         this.callback(error)
         return done()
       })
@@ -729,7 +785,7 @@ describe('DockerRunner', function() {
       return this.DockerRunner._destroyContainer(
         this.containerId,
         false,
-        err => {
+        (err) => {
           this.Docker.prototype.getContainer.callCount.should.equal(1)
           this.Docker.prototype.getContainer
             .calledWith(this.containerId)
@@ -743,10 +799,10 @@ describe('DockerRunner', function() {
       return this.DockerRunner._destroyContainer(
         this.containerId,
         true,
-        err => {
+        (err) => {
           this.fakeContainer.remove.callCount.should.equal(1)
           this.fakeContainer.remove
-            .calledWith({ force: true })
+            .calledWith({ force: true, v: true })
             .should.equal(true)
           return done()
         }
@@ -757,10 +813,10 @@ describe('DockerRunner', function() {
       return this.DockerRunner._destroyContainer(
         this.containerId,
         false,
-        err => {
+        (err) => {
           this.fakeContainer.remove.callCount.should.equal(1)
           this.fakeContainer.remove
-            .calledWith({ force: false })
+            .calledWith({ force: false, v: true })
             .should.equal(true)
           return done()
         }
@@ -771,7 +827,7 @@ describe('DockerRunner', function() {
       return this.DockerRunner._destroyContainer(
         this.containerId,
         false,
-        err => {
+        (err) => {
           expect(err).to.equal(null)
           return done()
         }
@@ -794,7 +850,7 @@ describe('DockerRunner', function() {
         return this.DockerRunner._destroyContainer(
           this.containerId,
           false,
-          err => {
+          (err) => {
             expect(err).to.equal(null)
             return done()
           }
@@ -818,7 +874,7 @@ describe('DockerRunner', function() {
         return this.DockerRunner._destroyContainer(
           this.containerId,
           false,
-          err => {
+          (err) => {
             expect(err).to.not.equal(null)
             expect(err).to.equal(this.fakeError)
             return done()
@@ -838,7 +894,7 @@ describe('DockerRunner', function() {
     })
 
     it('should get the container', function (done) {
-      return this.DockerRunner.kill(this.containerId, err => {
+      return this.DockerRunner.kill(this.containerId, (err) => {
         this.Docker.prototype.getContainer.callCount.should.equal(1)
         this.Docker.prototype.getContainer
           .calledWith(this.containerId)
@@ -848,14 +904,14 @@ describe('DockerRunner', function() {
     })
 
     it('should try to force-destroy the container', function (done) {
-      return this.DockerRunner.kill(this.containerId, err => {
+      return this.DockerRunner.kill(this.containerId, (err) => {
         this.fakeContainer.kill.callCount.should.equal(1)
         return done()
       })
     })
 
     it('should not produce an error', function (done) {
-      return this.DockerRunner.kill(this.containerId, err => {
+      return this.DockerRunner.kill(this.containerId, (err) => {
         expect(err).to.equal(undefined)
         return done()
       })
@@ -876,7 +932,7 @@ describe('DockerRunner', function() {
       })
 
       return it('should not produce an error', function (done) {
-        return this.DockerRunner.kill(this.containerId, err => {
+        return this.DockerRunner.kill(this.containerId, (err) => {
           expect(err).to.equal(undefined)
           return done()
         })
@@ -897,7 +953,7 @@ describe('DockerRunner', function() {
       })
 
       return it('should produce an error', function (done) {
-        return this.DockerRunner.kill(this.containerId, err => {
+        return this.DockerRunner.kill(this.containerId, (err) => {
           expect(err).to.not.equal(undefined)
           expect(err).to.equal(this.fakeError)
           return done()

test/unit/js/LatexRunnerTests.js

@@ -144,7 +144,7 @@ describe('LatexRunner', function() {
       return it('should include the flags in the command', function () {
         const command = this.CommandRunner.run.args[0][1]
         const flags = command.filter(
-          arg => arg === '-file-line-error' || arg === '-halt-on-error'
+          (arg) => arg === '-file-line-error' || arg === '-halt-on-error'
         )
         flags.length.should.equal(2)
         flags[0].should.equal('-file-line-error')

test/unit/js/OutputFileOptimiserTests.js

@@ -126,10 +126,7 @@ describe('OutputFileOptimiser', function() {
         .stub()
         .withArgs(this.fd)
         .yields(null, 100, Buffer.from('hello /Linearized 1'))
-      this.fs.close = sinon
-        .stub()
-        .withArgs(this.fd)
-        .yields(null)
+      this.fs.close = sinon.stub().withArgs(this.fd).yields(null)
       return this.OutputFileOptimiser.checkIfPDFIsOptimised(
         this.src,
         this.callback

test/unit/js/ProjectPersistenceManagerTests.js

@@ -109,7 +109,7 @@ describe('ProjectPersistenceManager', function() {
     })
 
     it('should clear each expired project', function () {
-      return Array.from(this.project_ids).map(project_id =>
+      return Array.from(this.project_ids).map((project_id) =>
         this.ProjectPersistenceManager.clearProjectFromCache
           .calledWith(project_id)
           .should.equal(true)

test/unit/js/RequestParserTests.js

@@ -114,6 +114,48 @@ describe('RequestParser', function() {
     })
   })
 
+  describe('when image restrictions are present', function () {
+    beforeEach(function () {
+      this.settings.clsi = { docker: {} }
+      this.settings.clsi.docker.allowedImages = [
+        'repo/name:tag1',
+        'repo/name:tag2'
+      ]
+    })
+
+    describe('with imageName set to something invalid', function () {
+      beforeEach(function () {
+        const request = this.validRequest
+        request.compile.options.imageName = 'something/different:latest'
+        this.RequestParser.parse(request, (error, data) => {
+          this.error = error
+          this.data = data
+        })
+      })
+
+      it('should throw an error for imageName', function () {
+        expect(String(this.error)).to.include(
+          'imageName attribute should be one of'
+        )
+      })
+    })
+
+    describe('with imageName set to something valid', function () {
+      beforeEach(function () {
+        const request = this.validRequest
+        request.compile.options.imageName = 'repo/name:tag1'
+        this.RequestParser.parse(request, (error, data) => {
+          this.error = error
+          this.data = data
+        })
+      })
+
+      it('should set the imageName', function () {
+        this.data.imageName.should.equal('repo/name:tag1')
+      })
+    })
+  })
+
   describe('with flags set', function () {
     beforeEach(function () {
       this.validRequest.compile.options.flags = ['-file-line-error']

test/unit/js/ResourceWriterTests.js

@@ -78,7 +78,7 @@ describe('ResourceWriter', function() {
     })
 
     it('should write each resource to disk', function () {
-      return Array.from(this.resources).map(resource =>
+      return Array.from(this.resources).map((resource) =>
         this.ResourceWriter._writeResourceToDisk
           .calledWith(this.project_id, resource, this.basePath)
           .should.equal(true)
@@ -139,7 +139,7 @@ describe('ResourceWriter', function() {
     })
 
     it('should write each resource to disk', function () {
-      return Array.from(this.resources).map(resource =>
+      return Array.from(this.resources).map((resource) =>
         this.ResourceWriter._writeResourceToDisk
           .calledWith(this.project_id, resource, this.basePath)
           .should.equal(true)

test/unit/js/UrlCacheTests.js

@@ -342,7 +342,7 @@ describe('UrlCache', function() {
     })
 
     it('should clear the cache for each url in the project', function () {
-      return Array.from(this.urls).map(url =>
+      return Array.from(this.urls).map((url) =>
         this.UrlCache._clearUrlFromCache
           .calledWith(this.project_id, url)
           .should.equal(true)

test/unit/js/UrlFetcherTests.js

@@ -40,7 +40,7 @@ describe('UrlFetcher', function() {
 
     it('should call pipeUrlToFile', function (done) {
       this.UrlFetcher.pipeUrlToFile.callsArgWith(2)
-      this.UrlFetcher.pipeUrlToFileWithRetry(this.url, this.path, err => {
+      this.UrlFetcher.pipeUrlToFileWithRetry(this.url, this.path, (err) => {
         expect(err).to.equal(undefined)
         this.UrlFetcher.pipeUrlToFile.called.should.equal(true)
         done()
@@ -50,7 +50,7 @@ describe('UrlFetcher', function() {
     it('should call pipeUrlToFile multiple times on error', function (done) {
       const error = new Error("couldn't download file")
       this.UrlFetcher.pipeUrlToFile.callsArgWith(2, error)
-      this.UrlFetcher.pipeUrlToFileWithRetry(this.url, this.path, err => {
+      this.UrlFetcher.pipeUrlToFileWithRetry(this.url, this.path, (err) => {
         expect(err).to.equal(error)
         this.UrlFetcher.pipeUrlToFile.callCount.should.equal(3)
         done()
@@ -60,7 +60,7 @@ describe('UrlFetcher', function() {
     it('should call pipeUrlToFile twice if only 1 error', function (done) {
       this.UrlFetcher.pipeUrlToFile.onCall(0).callsArgWith(2, 'error')
       this.UrlFetcher.pipeUrlToFile.onCall(1).callsArgWith(2)
-      this.UrlFetcher.pipeUrlToFileWithRetry(this.url, this.path, err => {
+      this.UrlFetcher.pipeUrlToFileWithRetry(this.url, this.path, (err) => {
         expect(err).to.equal(undefined)
         this.UrlFetcher.pipeUrlToFile.callCount.should.equal(2)
         done()
@@ -167,7 +167,7 @@ describe('UrlFetcher', function() {
 
       describe('with non success status code', function () {
         beforeEach(function (done) {
-          this.UrlFetcher.pipeUrlToFile(this.url, this.path, err => {
+          this.UrlFetcher.pipeUrlToFile(this.url, this.path, (err) => {
             this.callback(err)
             return done()
           })
@@ -188,7 +188,7 @@ describe('UrlFetcher', function() {
 
       return describe('with error', function () {
         beforeEach(function (done) {
-          this.UrlFetcher.pipeUrlToFile(this.url, this.path, err => {
+          this.UrlFetcher.pipeUrlToFile(this.url, this.path, (err) => {
             this.callback(err)
             return done()
           })