checkjs.py

"""Syntax-check the site's JavaScript with a real engine.

I have no browser here, so this is the cheapest honest check available: compile
the source with QuickJS (parse, don't run) so a typo can't reach the page.
It does not prove the script behaves correctly in a browser.
"""

import os
import sys

HERE = os.path.dirname(os.path.abspath(__file__))
sys.path.insert(0, os.path.join(HERE, "pylib"))
ROOT = os.path.abspath(os.path.join(HERE, ".."))

import quickjs  # noqa: E402

SCRIPTS = ["permalink.js", "tokens/app.js", "vocabulary/bpe.js", "vocabulary/app.js",
           "predict/ngram.js", "predict/app.js", "cost/app.js", "learn/mlp.js", "learn/app.js"]


def main():
    bad = 0
    for rel in SCRIPTS:
        src = open(os.path.join(ROOT, rel), encoding="utf-8").read()
        ctx = quickjs.Context()
        ctx.set("__src", src)
        try:
            # new Function() parses the body without executing it.
            ctx.eval("new Function(__src)")
            print(f"PASS  {rel:<20} parses ({len(src):,} bytes)")
        except Exception as e:
            print(f"FAIL  {rel:<20} {str(e)[:200]}")
            bad += 1

        for banned, why in [("innerHTML", "use DOM nodes, not markup injection"),
                            ("eval(", "no eval in shipped script"),
                            ("fetch(", "the page must make no network requests"),
                            ("XMLHttpRequest", "the page must make no network requests")]:
            if banned in src:
                print(f"FAIL  {rel:<20} contains {banned!r} — {why}")
                bad += 1

    return 1 if bad else 0


if __name__ == "__main__":
    sys.exit(main())