Upgrade js to be more es6-like, fix small bugs and inconsistencies

Kevyn Bruyere · Kevyn Bruyere · commit 58de54f1cce5 · 2019-11-24T14:54:57.000+01:00
diff --git a/sections/errorhandling/centralizedhandling.md b/sections/errorhandling/centralizedhandling.md
@@ -80,7 +80,7 @@ app.use(async (err: Error, req: Request, res: Response, next: NextFunction) => {
 module.exports.handler = new errorHandler();
 
 function errorHandler() {
-  this.handleError = async function(err) {
+  this.handleError = async (err) => {
     await logger.logError(err);
     await sendMailToAdminIfCritical;
     await saveInOpsQueueIfCritical;
diff --git a/sections/errorhandling/shuttingtheprocess.md b/sections/errorhandling/shuttingtheprocess.md
@@ -11,22 +11,22 @@ Somewhere within your code, an error handler object is responsible for deciding
 
 ```javascript
 // Assuming developers mark known operational errors with error.isOperational=true, read best practice #3
-process.on('uncaughtException', function(error) {
+process.on('uncaughtException', (error) => {
   errorManagement.handler.handleError(error);
   if(!errorManagement.handler.isTrustedError(error))
     process.exit(1)
 });
 
 // centralized error handler encapsulates error-handling related logic
 function errorHandler() {
-  this.handleError = function (error) {
-    return logger.logError(err)
+  this.handleError = (error) => {
+    return logger.logError(error)
       .then(sendMailToAdminIfCritical)
       .then(saveInOpsQueueIfCritical)
       .then(determineIfOperationalError);
   }
 
-  this.isTrustedError = function (error) {
+  this.isTrustedError = (error) => {
     return error.isOperational;
   }
 }
diff --git a/sections/errorhandling/testingerrorflows.md b/sections/errorhandling/testingerrorflows.md
@@ -12,7 +12,7 @@ Testing ‘happy’ paths is no better than testing failures. Good testing code
 ```javascript
 describe("Facebook chat", () => {
   it("Notifies on new chat message", () => {
-    var chatService = new chatService();
+    const chatService = new chatService();
     chatService.participants = getDisconnectedParticipants();
     expect(chatService.sendMessage.bind({ message: "Hi" })).to.throw(ConnectionError);
   });
@@ -40,19 +40,18 @@ describe("Facebook chat", () => {
 <summary><strong>Javascript</strong></summary>
 
 ```javascript
-it("Creates new Facebook group", (done) => {
-  var invalidGroupInfo = {};
-  httpRequest({
+it("Creates new Facebook group", () => {
+  const invalidGroupInfo = {};
+  return httpRequest({
     method: 'POST',
     uri: "facebook.com/api/groups",
     resolveWithFullResponse: true,
     body: invalidGroupInfo,
     json: true
   }).then((response) => {
-    // if we were to execute the code in this block, no error was thrown in the operation above
+    expect.fail('if we were to execute the code in this block, no error was thrown in the operation above')
   }).catch((response) => {
     expect(400).to.equal(response.statusCode);
-    done();
   });
 });
 ```
diff --git a/sections/errorhandling/usematurelogger.md b/sections/errorhandling/usematurelogger.md
@@ -35,7 +35,7 @@ const options = {
 };
 
 // Find items logged between today and yesterday.
-winston.query(options, function (err, results) {
+winston.query(options, (err, results) => {
   // execute callback with results
 });
 ```
diff --git a/sections/performance/block-loop.md b/sections/performance/block-loop.md
@@ -6,13 +6,13 @@ Node handles the Event Loop mostly on a single thread rotating through multiple
 
 ### Example: blocking the event loop
 Let's take a look at an example from [Node Clinic](https://clinicjs.org/documentation/doctor/05-fixing-event-loop-problem).
-```
+```javascript
 function sleep (ms) {
   const future = Date.now() + ms
   while (Date.now() < future);
 }
 
-server.get('/', function (req, res, next) {
+server.get('/', (req, res, next) => {
   sleep(30)
   res.send({})
   next()
diff --git a/sections/performance/nativeoverutil.md b/sections/performance/nativeoverutil.md
@@ -20,10 +20,10 @@ The graph below shows the [mean of the benchmarks for a variety of Lodash method
 
 ### Code Example – Benchmark test on `_.concat`/`Array.concat`
 ```javascript
-const _ = require('lodash'),
-  __ = require('underscore'),
-  Suite = require('benchmark').Suite,
-  opts = require('./utils'); //cf. https://github.com/Berkmann18/NativeVsUtils/blob/master/utils.js
+const _ = require('lodash');
+const __ = require('underscore');
+const Suite = require('benchmark').Suite;
+const opts = require('./utils'); //cf. https://github.com/Berkmann18/NativeVsUtils/blob/master/utils.js
 
 const concatSuite = new Suite('concat', opts);
 const array = [0, 1, 2];
diff --git a/sections/production/assigntransactionid.md b/sections/production/assigntransactionid.md
@@ -14,7 +14,7 @@ A typical log is a warehouse of entries from all components and requests. Upon d
 // when receiving a new request, start a new isolated context and set a transaction Id. The following example is using the npm library continuation-local-storage to isolate requests
 
 const { createNamespace } = require('continuation-local-storage');
-var session = createNamespace('my session');
+const session = createNamespace('my session');
 
 router.get('/:id', (req, res, next) => {
     session.set('transactionId', 'some unique GUID');
@@ -25,14 +25,15 @@ router.get('/:id', (req, res, next) => {
 // Now any other service or components can have access to the contextual, per-request, data
 class someService {
     getById(id) {
-        logger.info(“Starting to get something by Id”);
+        logger.info('Starting to get something by Id');
         // other logic comes here
     }
 }
 
 // The logger can now append the transaction-id to each entry so that entries from the same request will have the same value
 class logger {
-    info (message)
-    {console.log(`${message} ${session.get('transactionId')}`);}
+    info (message) {
+        console.log(`${message} ${session.get('transactionId')}`);
+    }
 }
 ```
diff --git a/sections/production/bestateless.md b/sections/production/bestateless.md
@@ -16,13 +16,13 @@ This approach
 
 ```javascript
 // Typical mistake 1: saving uploaded files locally on a server
-var multer = require('multer'); // express middleware for handling multipart uploads
-var upload = multer({ dest: 'uploads/' });
+const multer = require('multer'); // express middleware for handling multipart uploads
+const upload = multer({ dest: 'uploads/' });
 
-app.post('/photos/upload', upload.array('photos', 12), function (req, res, next) {});
+app.post('/photos/upload', upload.array('photos', 12), (req, res, next) => {});
 
 // Typical mistake 2: storing authentication sessions (passport) in a local file or memory
-var FileStore = require('session-file-store')(session);
+const FileStore = require('session-file-store')(session);
 app.use(session({
     store: new FileStore(options),
     secret: 'keyboard cat'
diff --git a/sections/production/logrouting.md b/sections/production/logrouting.md
@@ -14,13 +14,16 @@ We often think of "separation of concerns" in terms of pieces of code between se
 
 ```javascript
 const { createLogger, transports, winston } = require('winston');
-const winston-mongodb = require('winston-mongodb');
+/**
+   * Requiring `winston-mongodb` will expose
+   * `winston.transports.MongoDB`
+   */
+require('winston-mongodb');
  
 // log to two different files, which the application now must be concerned with
 const logger = createLogger({
   transports: [
     new transports.File({ filename: 'combined.log' }),
- 
   ],
   exceptionHandlers: [
     new transports.File({ filename: 'exceptions.log' })
@@ -47,13 +50,13 @@ const logger = new winston.Logger({
 logger.log('info', 'Test Log Message with some parameter %s', 'some parameter', { anything: 'This is metadata' });
 ```
 Then, in the docker container `daemon.json`:
-```javascript
+```json5
 {
   "log-driver": "splunk", // just using Splunk as an example, it could be another storage type
   "log-opts": {
     "splunk-token": "",
     "splunk-url": "",
-    ...
+    //...
   }
 }
 ```
diff --git a/sections/production/setnodeenv.md b/sections/production/setnodeenv.md
@@ -10,13 +10,15 @@ Process environment variables is a set of key-value pairs made available to any
 
 ### Code example: Setting and reading the NODE_ENV environment variable
 
-```javascript
+```shell script
 // Setting environment variables in bash before starting the node process
 $ NODE_ENV=development
 $ node
+```
 
+```javascript
 // Reading the environment variable using code
-if (process.env.NODE_ENV === “production”)
+if (process.env.NODE_ENV === "production")
     useCaching = true;
 ```
 
diff --git a/sections/projectstructre/configguide.md b/sections/projectstructre/configguide.md
@@ -22,7 +22,7 @@ Some configuration libraries can provide most of these features for free, have a
 
 ### Code Example – hierarchical config helps to find entries and maintain huge config files
 
-```js
+```json5
 {
   // Customer module configs 
   "Customer": {
diff --git a/sections/projectstructre/separateexpress.md b/sections/projectstructre/separateexpress.md
@@ -23,15 +23,15 @@ app.use("/api/forms", forms);
 <summary><strong>Javascript</strong></summary>
 
 ```javascript
-var app = require('../app');
-var http = require('http');
+const app = require('../app');
+const http = require('http');
 
 // Get port from environment and store in Express.
-var port = normalizePort(process.env.PORT || '3000');
+const port = normalizePort(process.env.PORT || '3000');
 app.set('port', port);
 
 // Create HTTP server.
-var server = http.createServer(app);
+const server = http.createServer(app);
 ```
 </details>
 
@@ -59,7 +59,7 @@ const server = http.createServer(app);
 ```javascript
 const app = express();
 
-app.get('/user', function(req, res) {
+app.get('/user', (req, res) => {
   res.status(200).json({ name: 'tobi' });
 });
 
@@ -68,7 +68,7 @@ request(app)
   .expect('Content-Type', /json/)
   .expect('Content-Length', '15')
   .expect(200)
-  .end(function(err, res) {
+  .end((err, res) => {
     if (err) throw err;
   });
 ```
diff --git a/sections/security/avoideval.md b/sections/security/avoideval.md
@@ -8,7 +8,7 @@
 
 ```javascript
 // example of malicious code which an attacker was able to input
-userInput = "require('child_process').spawn('rm', ['-rf', '/'])";
+const userInput = "require('child_process').spawn('rm', ['-rf', '/'])";
 
 // malicious code executed
 eval(userInput);
diff --git a/sections/security/bcryptpasswords.md b/sections/security/bcryptpasswords.md
@@ -9,19 +9,21 @@ The `bcrypt` module or similar should be used as opposed to the JavaScript imple
 ### Code example
 
 ```javascript
+try {
 // asynchronously generate a secure password using 10 hashing rounds
-bcrypt.hash('myPassword', 10, function(err, hash) {
+  const hash = await bcrypt.hash('myPassword', 10);
   // Store secure hash in user record
-});
 
-// compare a provided password input with saved hash
-bcrypt.compare('somePassword', hash, function(err, match) {
-  if(match) {
+  // compare a provided password input with saved hash
+  const match = await bcrypt.compare('somePassword', hash);
+  if (match) {
    // Passwords match
   } else {
    // Passwords don't match
   } 
-});
+} catch {
+  logger.error('could not hash password.')
+}
 ```
 
 ### What other bloggers say
diff --git a/sections/security/expirejwt.md b/sections/security/expirejwt.md
@@ -18,7 +18,7 @@ blacklist.configure({
   strict: true,
   store: {
     type: 'memcached',
-    host: '127.0.0.1'
+    host: '127.0.0.1',
     port: 11211,
     keyPrefix: 'mywebapp:',
     options: {
@@ -32,7 +32,7 @@ app.use(jwt({
   isRevoked: blacklist.isRevoked
 }));
  
-app.get('/logout', function (req, res) {
+app.get('/logout', (req, res) => {
   blacklist.revoke(req.user)
   res.sendStatus(200);
 });
diff --git a/sections/security/hideerrors.md b/sections/security/hideerrors.md
@@ -8,10 +8,10 @@ If you pass an error to `next()` and you do not handle it in a custom error hand
 
 ### Code example: Express error handler
 
-``` javascript
+```javascript
 // production error handler
 // no stacktraces leaked to user
-app.use(function(err, req, res, next) {
+app.use((err, req, res, next) => {
     res.status(err.status || 500);
     res.render('error', {
         message: err.message,
diff --git a/sections/security/limitrequests.md b/sections/security/limitrequests.md
@@ -9,35 +9,33 @@ Rate limiting should be implemented in your application to protect a Node.js app
   ```javascript
  const http = require('http');
  const redis = require('redis');
- 
  const { RateLimiterRedis } = require('rate-limiter-flexible');
  
  const redisClient = redis.createClient({
    enable_offline_queue: false,
  });
- 
+
  // Maximum 20 requests per second
  const rateLimiter = new RateLimiterRedis({
    storeClient: redisClient,
    points: 20,
    duration: 1,
    blockDuration: 2, // block for 2 seconds if consumed more than 20 points per second
  });
- 
- http.createServer((req, res) => {
-   rateLimiter.consume(req.socket.remoteAddress)
-     .then((rateLimiterRes) => {
-        // Some app logic here
- 
-        res.writeHead(200);
-        res.end();
-      })
-      .catch(() => {
-        res.writeHead(429);
-        res.end('Too Many Requests');
-      });
-   }
- }).listen(3000);
+
+ http.createServer(async (req, res) => {
+    try {
+    const rateLimiterRes = await rateLimiter.consume(req.socket.remoteAddress);
+    // Some app logic here
+
+    res.writeHead(200);
+    res.end();
+    } catch {
+    res.writeHead(429);
+    res.end('Too Many Requests');
+    }
+ })
+   .listen(3000);
  ```
 
 You can find [more examples in the documentation](https://github.com/animir/node-rate-limiter-flexible/wiki/Overall-example).
@@ -46,12 +44,12 @@ You can find [more examples in the documentation](https://github.com/animir/node
 
 Using [express-rate-limiter](https://www.npmjs.com/package/express-rate-limit) npm package
 
-``` javascript
-var RateLimit = require('express-rate-limit');
+```javascript
+const RateLimit = require('express-rate-limit');
 // important if behind a proxy to ensure client IP is passed to req.ip
 app.enable('trust proxy'); 
  
-var apiLimiter = new RateLimit({
+const apiLimiter = new RateLimit({
   windowMs: 15*60*1000, // 15 minutes
   max: 100,
 });
diff --git a/sections/security/non-root-user.md b/sections/security/non-root-user.md
@@ -9,7 +9,7 @@ According to the 'Principle of least privilege' a user/process must be able to a
 
 ### Code example - Building a Docker image as non-root
 
-```javascript
+```dockerfile
 FROM node:latest
 COPY package.json .
 RUN npm install
diff --git a/sections/security/ormodmusage.md b/sections/security/ormodmusage.md
diff --git a/sections/security/regex.md b/sections/security/regex.md
diff --git a/sections/security/requestpayloadsizelimit.md b/sections/security/requestpayloadsizelimit.md
diff --git a/sections/security/safemoduleloading.md b/sections/security/safemoduleloading.md
diff --git a/sections/security/sandbox.md b/sections/security/sandbox.md
diff --git a/sections/security/validation.md b/sections/security/validation.md
diff --git a/sections/testingandquality/3-parts-in-name.md b/sections/testingandquality/3-parts-in-name.md
diff --git a/sections/testingandquality/citools.md b/sections/testingandquality/citools.md
