better code injection handling for js

samples/client/petstore-security-test/javascript/node_modules/jshint/LICENSE

@@ -0,0 +1,20 @@
+Copyright 2012 Anton Kovalyov (http://jshint.com)
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

samples/client/petstore-security-test/javascript/node_modules/jshint/README.md

@@ -0,0 +1,111 @@
+# JSHint, A Static Code Analysis Tool for JavaScript
+
+\[ [Use it online](http://jshint.com/) •
+[Docs](http://jshint.com/docs/) • [FAQ](http://jshint.com/docs/faq) •
+[Install](http://jshint.com/install/) •
+[Contribute](http://jshint.com/contribute/) •
+[Blog](http://jshint.com/blog/) • [Twitter](https://twitter.com/jshint/) \]
+
+[![NPM version](https://img.shields.io/npm/v/jshint.svg?style=flat)](https://www.npmjs.com/package/jshint)
+[![Linux Build Status](https://img.shields.io/travis/jshint/jshint/master.svg?style=flat&label=Linux%20build)](https://travis-ci.org/jshint/jshint)
+[![Windows Build status](https://img.shields.io/appveyor/ci/jshint/jshint/master.svg?style=flat&label=Windows%20build)](https://ci.appveyor.com/project/jshint/jshint/branch/master)
+[![Dependency Status](https://img.shields.io/david/jshint/jshint.svg?style=flat)](https://david-dm.org/jshint/jshint)
+[![devDependency Status](https://img.shields.io/david/dev/jshint/jshint.svg?style=flat)](https://david-dm.org/jshint/jshint#info=devDependencies)
+[![Coverage Status](https://img.shields.io/coveralls/jshint/jshint.svg?style=flat)](https://coveralls.io/r/jshint/jshint?branch=master)
+
+JSHint is a community-driven tool to detect errors and potential problems in
+JavaScript code and to enforce your team's coding conventions. It is very
+flexible so you can easily adjust it to your particular coding guidelines and
+the environment you expect your code to execute in. JSHint is open source and
+will always stay this way.
+
+## Our goal
+
+The goal of this project is to help JavaScript developers write complex programs
+without worrying about typos and language gotchas.
+
+Any code base eventually becomes huge at some point, and simple mistakes—that
+would not show themselves when written—can become show stoppers and waste
+hours of debugging. And this is when static code analysis tools come into play
+and help developers to spot such problems. JSHint scans a program written in
+JavaScript and reports about commonly made mistakes and potential bugs. The
+potential problem could be a syntax error, a bug due to implicit type
+conversion, a leaking variable or something else.
+
+Only 15% of all programs linted on [jshint.com](http://jshint.com) pass the
+JSHint checks. In all other cases, JSHint finds some red flags that could've
+been bugs or potential problems.
+
+Please note, that while static code analysis tools can spot many different kind
+of mistakes, it can't detect if your program is correct, fast or has memory
+leaks. You should always combine tools like JSHint with unit and functional
+tests as well as with code reviews.
+
+## Reporting a bug
+
+To report a bug simply create a
+[new GitHub Issue](https://github.com/jshint/jshint/issues/new) and describe
+your problem or suggestion. We welcome all kinds of feedback regarding
+JSHint including but not limited to:
+
+ * When JSHint doesn't work as expected
+ * When JSHint complains about valid JavaScript code that works in all browsers
+ * When you simply want a new option or feature
+
+Before reporting a bug look around to see if there are any open or closed tickets
+that cover your issue. And remember the wisdom: pull request > bug report > tweet.
+
+## Who uses JSHint?
+
+Engineers from these companies and projects use JSHint:
+
+* [Mozilla](https://www.mozilla.org/)
+* [Wikipedia](https://wikipedia.org/)
+* [Facebook](https://facebook.com/)
+* [Twitter](https://twitter.com/)
+* [Bootstrap](http://getbootstrap.com/)
+* [Disqus](https://disqus.com/)
+* [Medium](https://medium.com/)
+* [Yahoo!](https://yahoo.com/)
+* [SmugMug](http://smugmug.com/)
+* [jQuery](http://jquery.com/)
+* [PDF.js](http://mozilla.github.io/pdf.js)
+* [Coursera](http://coursera.com/)
+* [Adobe Brackets](http://brackets.io/)
+* [Apache Cordova](http://cordova.io/)
+* [RedHat](http://redhat.com/)
+* [SoundCloud](http://soundcloud.com/)
+* [Nodejitsu](http://nodejitsu.com/)
+* [Yelp](https://yelp.com/)
+* [Voxer](http://voxer.com/)
+* [EnyoJS](http://enyojs.com/)
+* [QuickenLoans](http://quickenloans.com/)
+* [oDesk](http://www.odesk.com/)
+* [Cloud9](http://c9.io/)
+* [CodeClimate](https://codeclimate.com/)
+* [Pandoo TEK](http://pandootek.com/)
+* [Zendesk](http://zendesk.com/)
+* [Apache CouchDB](http://couchdb.apache.org/)
+
+And many more!
+
+## License
+
+Most files are published using [the standard MIT Expat
+license](https://www.gnu.org/licenses/license-list.html#Expat). One file,
+however, is provided under a slightly modified version of that license. The
+so-called [JSON license](https://www.gnu.org/licenses/license-list.html#JSON)
+is a non-free license, and unfortunately, we can't change it due to historical
+reasons. This license is included as an in-line within the file it concerns.
+
+## The JSHint Team
+
+JSHint is currently maintained by [Rick Waldron](https://github.com/rwaldron/),
+[Caitlin Potter](https://github.com/caitp/), [Mike
+Sherov](https://github.com/mikesherov/), [Mike
+Pennisi](https://github.com/jugglinmike/), and [Luke
+Page](https://github.com/lukeapage).
+
+## Thank you!
+
+We really appreciate all kinds of feedback and contributions. Thanks for using and supporting JSHint!

samples/client/petstore-security-test/javascript/node_modules/jshint/bin/apply

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+
+var shjs = require("shelljs");
+var url  = "https://github.com/jshint/jshint/pull/" + process.argv[2] + ".diff";
+
+shjs.exec('curl "' + url + '" | git apply');

samples/client/petstore-security-test/javascript/node_modules/jshint/bin/build

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/*jshint shelljs:true */
+
+"use strict";
+
+var path       = require("path");
+var build      = require("../scripts/build");
+require("shelljs/make");
+
+var distDir    = path.join(__dirname, "../dist");
+
+if (!test("-e", distDir))
+  mkdir(distDir);
+
+build("web", function(err, version, src) {
+  if (err) {
+    console.error(err);
+    process.exit(1);
+  }
+
+  src.to(distDir + "/jshint.js");
+  console.log("Built: " + version + " (web)");
+});
+
+build("rhino", function(err, version, src) {
+  var dest;
+
+  if (err) {
+    console.error(err);
+    process.exit(1);
+  }
+
+  dest  = distDir + "/jshint-rhino.js";
+  chmod("+x", dest);
+
+  src.to(dest);
+  console.log("Built: " + version + " (Rhino)");
+});

samples/client/petstore-security-test/javascript/node_modules/jshint/bin/jshint

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+
+require("../src/cli.js").interpret(process.argv);

samples/client/petstore-security-test/javascript/node_modules/jshint/bin/land

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+
+"use strict";
+
+var url   = "https://github.com/jshint/jshint/pull/" + process.argv[2] + ".patch";
+var https = require("https");
+var shjs  = require("shelljs");
+var opts  = require("url").parse(url);
+var msg   = process.argv[3];
+
+opts.rejectUnauthorized = false;
+opts.agent = new https.Agent(opts);
+
+https.get(opts, succ).on("error", err);
+
+function succ(res) {
+  if (res.statusCode !== 200)
+    return void console.log("error:", res.statusCode);
+
+  var data = "";
+  res.on("data", function (chunk) {
+    data += chunk.toString();
+  });
+
+  res.on("end", function () {
+    data = data.split("\n");
+    data = data[1].replace(/^From\:\s/, "");
+    data = data.replace(/"/g, "");
+
+    shjs.exec("git commit -s --author=\"" + data + "\" --message=\"" + msg + "\"");
+  });
+}
+
+function err(res) {
+  console.log("error:", res.message);
+}

samples/client/petstore-security-test/javascript/node_modules/jshint/data/ascii-identifier-data.js

@@ -0,0 +1,22 @@
+var identifierStartTable = [];
+
+for (var i = 0; i < 128; i++) {
+  identifierStartTable[i] =
+    i === 36 ||           // $
+    i >= 65 && i <= 90 || // A-Z
+    i === 95 ||           // _
+    i >= 97 && i <= 122;  // a-z
+}
+
+var identifierPartTable = [];
+
+for (var i = 0; i < 128; i++) {
+  identifierPartTable[i] =
+    identifierStartTable[i] || // $, _, A-Z, a-z
+    i >= 48 && i <= 57;        // 0-9
+}
+
+module.exports = {
+  asciiIdentifierStartTable: identifierStartTable,
+  asciiIdentifierPartTable: identifierPartTable
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/node_modules/minimatch/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

samples/client/petstore-security-test/javascript/node_modules/jshint/node_modules/minimatch/README.md

@@ -0,0 +1,216 @@
+# minimatch
+
+A minimal matching utility.
+
+[![Build Status](https://secure.travis-ci.org/isaacs/minimatch.png)](http://travis-ci.org/isaacs/minimatch)
+
+
+This is the matching library used internally by npm.
+
+It works by converting glob expressions into JavaScript `RegExp`
+objects.
+
+## Usage
+
+```javascript
+var minimatch = require("minimatch")
+
+minimatch("bar.foo", "*.foo") // true!
+minimatch("bar.foo", "*.bar") // false!
+minimatch("bar.foo", "*.+(bar|foo)", { debug: true }) // true, and noisy!
+```
+
+## Features
+
+Supports these glob features:
+
+* Brace Expansion
+* Extended glob matching
+* "Globstar" `**` matching
+
+See:
+
+* `man sh`
+* `man bash`
+* `man 3 fnmatch`
+* `man 5 gitignore`
+
+## Minimatch Class
+
+Create a minimatch object by instanting the `minimatch.Minimatch` class.
+
+```javascript
+var Minimatch = require("minimatch").Minimatch
+var mm = new Minimatch(pattern, options)
+```
+
+### Properties
+
+* `pattern` The original pattern the minimatch object represents.
+* `options` The options supplied to the constructor.
+* `set` A 2-dimensional array of regexp or string expressions.
+  Each row in the
+  array corresponds to a brace-expanded pattern.  Each item in the row
+  corresponds to a single path-part.  For example, the pattern
+  `{a,b/c}/d` would expand to a set of patterns like:
+
+        [ [ a, d ]
+        , [ b, c, d ] ]
+
+    If a portion of the pattern doesn't have any "magic" in it
+    (that is, it's something like `"foo"` rather than `fo*o?`), then it
+    will be left as a string rather than converted to a regular
+    expression.
+
+* `regexp` Created by the `makeRe` method.  A single regular expression
+  expressing the entire pattern.  This is useful in cases where you wish
+  to use the pattern somewhat like `fnmatch(3)` with `FNM_PATH` enabled.
+* `negate` True if the pattern is negated.
+* `comment` True if the pattern is a comment.
+* `empty` True if the pattern is `""`.
+
+### Methods
+
+* `makeRe` Generate the `regexp` member if necessary, and return it.
+  Will return `false` if the pattern is invalid.
+* `match(fname)` Return true if the filename matches the pattern, or
+  false otherwise.
+* `matchOne(fileArray, patternArray, partial)` Take a `/`-split
+  filename, and match it against a single row in the `regExpSet`.  This
+  method is mainly for internal use, but is exposed so that it can be
+  used by a glob-walker that needs to avoid excessive filesystem calls.
+
+All other methods are internal, and will be called as necessary.
+
+## Functions
+
+The top-level exported function has a `cache` property, which is an LRU
+cache set to store 100 items.  So, calling these methods repeatedly
+with the same pattern and options will use the same Minimatch object,
+saving the cost of parsing it multiple times.
+
+### minimatch(path, pattern, options)
+
+Main export.  Tests a path against the pattern using the options.
+
+```javascript
+var isJS = minimatch(file, "*.js", { matchBase: true })
+```
+
+### minimatch.filter(pattern, options)
+
+Returns a function that tests its
+supplied argument, suitable for use with `Array.filter`.  Example:
+
+```javascript
+var javascripts = fileList.filter(minimatch.filter("*.js", {matchBase: true}))
+```
+
+### minimatch.match(list, pattern, options)
+
+Match against the list of
+files, in the style of fnmatch or glob.  If nothing is matched, and
+options.nonull is set, then return a list containing the pattern itself.
+
+```javascript
+var javascripts = minimatch.match(fileList, "*.js", {matchBase: true}))
+```
+
+### minimatch.makeRe(pattern, options)
+
+Make a regular expression object from the pattern.
+
+## Options
+
+All options are `false` by default.
+
+### debug
+
+Dump a ton of stuff to stderr.
+
+### nobrace
+
+Do not expand `{a,b}` and `{1..3}` brace sets.
+
+### noglobstar
+
+Disable `**` matching against multiple folder names.
+
+### dot
+
+Allow patterns to match filenames starting with a period, even if
+the pattern does not explicitly have a period in that spot.
+
+Note that by default, `a/**/b` will **not** match `a/.d/b`, unless `dot`
+is set.
+
+### noext
+
+Disable "extglob" style patterns like `+(a|b)`.
+
+### nocase
+
+Perform a case-insensitive match.
+
+### nonull
+
+When a match is not found by `minimatch.match`, return a list containing
+the pattern itself if this option is set.  When not set, an empty list
+is returned if there are no matches.
+
+### matchBase
+
+If set, then patterns without slashes will be matched
+against the basename of the path if it contains slashes.  For example,
+`a?b` would match the path `/xyz/123/acb`, but not `/xyz/acb/123`.
+
+### nocomment
+
+Suppress the behavior of treating `#` at the start of a pattern as a
+comment.
+
+### nonegate
+
+Suppress the behavior of treating a leading `!` character as negation.
+
+### flipNegate
+
+Returns from negate expressions the same as if they were not negated.
+(Ie, true on a hit, false on a miss.)
+
+
+## Comparisons to other fnmatch/glob implementations
+
+While strict compliance with the existing standards is a worthwhile
+goal, some discrepancies exist between minimatch and other
+implementations, and are intentional.
+
+If the pattern starts with a `!` character, then it is negated.  Set the
+`nonegate` flag to suppress this behavior, and treat leading `!`
+characters normally.  This is perhaps relevant if you wish to start the
+pattern with a negative extglob pattern like `!(a|B)`.  Multiple `!`
+characters at the start of a pattern will negate the pattern multiple
+times.
+
+If a pattern starts with `#`, then it is treated as a comment, and
+will not match anything.  Use `\#` to match a literal `#` at the
+start of a line, or set the `nocomment` flag to suppress this behavior.
+
+The double-star character `**` is supported by default, unless the
+`noglobstar` flag is set.  This is supported in the manner of bsdglob
+and bash 4.1, where `**` only has special significance if it is the only
+thing in a path part.  That is, `a/**/b` will match `a/x/y/b`, but
+`a/**b` will not.
+
+If an escaped pattern has no matches, and the `nonull` flag is set,
+then minimatch.match returns the pattern as-provided, rather than
+interpreting the character escapes.  For example,
+`minimatch.match([], "\\*a\\?")` will return `"\\*a\\?"` rather than
+`"*a?"`.  This is akin to setting the `nullglob` option in bash, except
+that it does not resolve escaped pattern characters.
+
+If brace expansion is not disabled, then it is performed before any
+other interpretation of the glob pattern.  Thus, a pattern like
+`+(a|{b),c)}`, which would not be valid in bash or zsh, is expanded
+**first** into the set of `+(a|b)` and `+(a|c)`, and those patterns are
+checked for validity.  Since those two are valid, matching proceeds.

samples/client/petstore-security-test/javascript/node_modules/jshint/node_modules/minimatch/minimatch.js

@@ -0,0 +1,912 @@
+module.exports = minimatch
+minimatch.Minimatch = Minimatch
+
+var path = { sep: '/' }
+try {
+  path = require('path')
+} catch (er) {}
+
+var GLOBSTAR = minimatch.GLOBSTAR = Minimatch.GLOBSTAR = {}
+var expand = require('brace-expansion')
+
+// any single thing other than /
+// don't need to escape / when using new RegExp()
+var qmark = '[^/]'
+
+// * => any number of characters
+var star = qmark + '*?'
+
+// ** when dots are allowed.  Anything goes, except .. and .
+// not (^ or / followed by one or two dots followed by $ or /),
+// followed by anything, any number of times.
+var twoStarDot = '(?:(?!(?:\\\/|^)(?:\\.{1,2})($|\\\/)).)*?'
+
+// not a ^ or / followed by a dot,
+// followed by anything, any number of times.
+var twoStarNoDot = '(?:(?!(?:\\\/|^)\\.).)*?'
+
+// characters that need to be escaped in RegExp.
+var reSpecials = charSet('().*{}+?[]^$\\!')
+
+// "abc" -> { a:true, b:true, c:true }
+function charSet (s) {
+  return s.split('').reduce(function (set, c) {
+    set[c] = true
+    return set
+  }, {})
+}
+
+// normalizes slashes.
+var slashSplit = /\/+/
+
+minimatch.filter = filter
+function filter (pattern, options) {
+  options = options || {}
+  return function (p, i, list) {
+    return minimatch(p, pattern, options)
+  }
+}
+
+function ext (a, b) {
+  a = a || {}
+  b = b || {}
+  var t = {}
+  Object.keys(b).forEach(function (k) {
+    t[k] = b[k]
+  })
+  Object.keys(a).forEach(function (k) {
+    t[k] = a[k]
+  })
+  return t
+}
+
+minimatch.defaults = function (def) {
+  if (!def || !Object.keys(def).length) return minimatch
+
+  var orig = minimatch
+
+  var m = function minimatch (p, pattern, options) {
+    return orig.minimatch(p, pattern, ext(def, options))
+  }
+
+  m.Minimatch = function Minimatch (pattern, options) {
+    return new orig.Minimatch(pattern, ext(def, options))
+  }
+
+  return m
+}
+
+Minimatch.defaults = function (def) {
+  if (!def || !Object.keys(def).length) return Minimatch
+  return minimatch.defaults(def).Minimatch
+}
+
+function minimatch (p, pattern, options) {
+  if (typeof pattern !== 'string') {
+    throw new TypeError('glob pattern string required')
+  }
+
+  if (!options) options = {}
+
+  // shortcut: comments match nothing.
+  if (!options.nocomment && pattern.charAt(0) === '#') {
+    return false
+  }
+
+  // "" only matches ""
+  if (pattern.trim() === '') return p === ''
+
+  return new Minimatch(pattern, options).match(p)
+}
+
+function Minimatch (pattern, options) {
+  if (!(this instanceof Minimatch)) {
+    return new Minimatch(pattern, options)
+  }
+
+  if (typeof pattern !== 'string') {
+    throw new TypeError('glob pattern string required')
+  }
+
+  if (!options) options = {}
+  pattern = pattern.trim()
+
+  // windows support: need to use /, not \
+  if (path.sep !== '/') {
+    pattern = pattern.split(path.sep).join('/')
+  }
+
+  this.options = options
+  this.set = []
+  this.pattern = pattern
+  this.regexp = null
+  this.negate = false
+  this.comment = false
+  this.empty = false
+
+  // make the set of regexps etc.
+  this.make()
+}
+
+Minimatch.prototype.debug = function () {}
+
+Minimatch.prototype.make = make
+function make () {
+  // don't do it more than once.
+  if (this._made) return
+
+  var pattern = this.pattern
+  var options = this.options
+
+  // empty patterns and comments match nothing.
+  if (!options.nocomment && pattern.charAt(0) === '#') {
+    this.comment = true
+    return
+  }
+  if (!pattern) {
+    this.empty = true
+    return
+  }
+
+  // step 1: figure out negation, etc.
+  this.parseNegate()
+
+  // step 2: expand braces
+  var set = this.globSet = this.braceExpand()
+
+  if (options.debug) this.debug = console.error
+
+  this.debug(this.pattern, set)
+
+  // step 3: now we have a set, so turn each one into a series of path-portion
+  // matching patterns.
+  // These will be regexps, except in the case of "**", which is
+  // set to the GLOBSTAR object for globstar behavior,
+  // and will not contain any / characters
+  set = this.globParts = set.map(function (s) {
+    return s.split(slashSplit)
+  })
+
+  this.debug(this.pattern, set)
+
+  // glob --> regexps
+  set = set.map(function (s, si, set) {
+    return s.map(this.parse, this)
+  }, this)
+
+  this.debug(this.pattern, set)
+
+  // filter out everything that didn't compile properly.
+  set = set.filter(function (s) {
+    return s.indexOf(false) === -1
+  })
+
+  this.debug(this.pattern, set)
+
+  this.set = set
+}
+
+Minimatch.prototype.parseNegate = parseNegate
+function parseNegate () {
+  var pattern = this.pattern
+  var negate = false
+  var options = this.options
+  var negateOffset = 0
+
+  if (options.nonegate) return
+
+  for (var i = 0, l = pattern.length
+    ; i < l && pattern.charAt(i) === '!'
+    ; i++) {
+    negate = !negate
+    negateOffset++
+  }
+
+  if (negateOffset) this.pattern = pattern.substr(negateOffset)
+  this.negate = negate
+}
+
+// Brace expansion:
+// a{b,c}d -> abd acd
+// a{b,}c -> abc ac
+// a{0..3}d -> a0d a1d a2d a3d
+// a{b,c{d,e}f}g -> abg acdfg acefg
+// a{b,c}d{e,f}g -> abdeg acdeg abdeg abdfg
+//
+// Invalid sets are not expanded.
+// a{2..}b -> a{2..}b
+// a{b}c -> a{b}c
+minimatch.braceExpand = function (pattern, options) {
+  return braceExpand(pattern, options)
+}
+
+Minimatch.prototype.braceExpand = braceExpand
+
+function braceExpand (pattern, options) {
+  if (!options) {
+    if (this instanceof Minimatch) {
+      options = this.options
+    } else {
+      options = {}
+    }
+  }
+
+  pattern = typeof pattern === 'undefined'
+    ? this.pattern : pattern
+
+  if (typeof pattern === 'undefined') {
+    throw new Error('undefined pattern')
+  }
+
+  if (options.nobrace ||
+    !pattern.match(/\{.*\}/)) {
+    // shortcut. no need to expand.
+    return [pattern]
+  }
+
+  return expand(pattern)
+}
+
+// parse a component of the expanded set.
+// At this point, no pattern may contain "/" in it
+// so we're going to return a 2d array, where each entry is the full
+// pattern, split on '/', and then turned into a regular expression.
+// A regexp is made at the end which joins each array with an
+// escaped /, and another full one which joins each regexp with |.
+//
+// Following the lead of Bash 4.1, note that "**" only has special meaning
+// when it is the *only* thing in a path portion.  Otherwise, any series
+// of * is equivalent to a single *.  Globstar behavior is enabled by
+// default, and can be disabled by setting options.noglobstar.
+Minimatch.prototype.parse = parse
+var SUBPARSE = {}
+function parse (pattern, isSub) {
+  var options = this.options
+
+  // shortcuts
+  if (!options.noglobstar && pattern === '**') return GLOBSTAR
+  if (pattern === '') return ''
+
+  var re = ''
+  var hasMagic = !!options.nocase
+  var escaping = false
+  // ? => one single character
+  var patternListStack = []
+  var negativeLists = []
+  var plType
+  var stateChar
+  var inClass = false
+  var reClassStart = -1
+  var classStart = -1
+  // . and .. never match anything that doesn't start with .,
+  // even when options.dot is set.
+  var patternStart = pattern.charAt(0) === '.' ? '' // anything
+  // not (start or / followed by . or .. followed by / or end)
+  : options.dot ? '(?!(?:^|\\\/)\\.{1,2}(?:$|\\\/))'
+  : '(?!\\.)'
+  var self = this
+
+  function clearStateChar () {
+    if (stateChar) {
+      // we had some state-tracking character
+      // that wasn't consumed by this pass.
+      switch (stateChar) {
+        case '*':
+          re += star
+          hasMagic = true
+        break
+        case '?':
+          re += qmark
+          hasMagic = true
+        break
+        default:
+          re += '\\' + stateChar
+        break
+      }
+      self.debug('clearStateChar %j %j', stateChar, re)
+      stateChar = false
+    }
+  }
+
+  for (var i = 0, len = pattern.length, c
+    ; (i < len) && (c = pattern.charAt(i))
+    ; i++) {
+    this.debug('%s\t%s %s %j', pattern, i, re, c)
+
+    // skip over any that are escaped.
+    if (escaping && reSpecials[c]) {
+      re += '\\' + c
+      escaping = false
+      continue
+    }
+
+    switch (c) {
+      case '/':
+        // completely not allowed, even escaped.
+        // Should already be path-split by now.
+        return false
+
+      case '\\':
+        clearStateChar()
+        escaping = true
+      continue
+
+      // the various stateChar values
+      // for the "extglob" stuff.
+      case '?':
+      case '*':
+      case '+':
+      case '@':
+      case '!':
+        this.debug('%s\t%s %s %j <-- stateChar', pattern, i, re, c)
+
+        // all of those are literals inside a class, except that
+        // the glob [!a] means [^a] in regexp
+        if (inClass) {
+          this.debug('  in class')
+          if (c === '!' && i === classStart + 1) c = '^'
+          re += c
+          continue
+        }
+
+        // if we already have a stateChar, then it means
+        // that there was something like ** or +? in there.
+        // Handle the stateChar, then proceed with this one.
+        self.debug('call clearStateChar %j', stateChar)
+        clearStateChar()
+        stateChar = c
+        // if extglob is disabled, then +(asdf|foo) isn't a thing.
+        // just clear the statechar *now*, rather than even diving into
+        // the patternList stuff.
+        if (options.noext) clearStateChar()
+      continue
+
+      case '(':
+        if (inClass) {
+          re += '('
+          continue
+        }
+
+        if (!stateChar) {
+          re += '\\('
+          continue
+        }
+
+        plType = stateChar
+        patternListStack.push({
+          type: plType,
+          start: i - 1,
+          reStart: re.length
+        })
+        // negation is (?:(?!js)[^/]*)
+        re += stateChar === '!' ? '(?:(?!(?:' : '(?:'
+        this.debug('plType %j %j', stateChar, re)
+        stateChar = false
+      continue
+
+      case ')':
+        if (inClass || !patternListStack.length) {
+          re += '\\)'
+          continue
+        }
+
+        clearStateChar()
+        hasMagic = true
+        re += ')'
+        var pl = patternListStack.pop()
+        plType = pl.type
+        // negation is (?:(?!js)[^/]*)
+        // The others are (?:<pattern>)<type>
+        switch (plType) {
+          case '!':
+            negativeLists.push(pl)
+            re += ')[^/]*?)'
+            pl.reEnd = re.length
+            break
+          case '?':
+          case '+':
+          case '*':
+            re += plType
+            break
+          case '@': break // the default anyway
+        }
+      continue
+
+      case '|':
+        if (inClass || !patternListStack.length || escaping) {
+          re += '\\|'
+          escaping = false
+          continue
+        }
+
+        clearStateChar()
+        re += '|'
+      continue
+
+      // these are mostly the same in regexp and glob
+      case '[':
+        // swallow any state-tracking char before the [
+        clearStateChar()
+
+        if (inClass) {
+          re += '\\' + c
+          continue
+        }
+
+        inClass = true
+        classStart = i
+        reClassStart = re.length
+        re += c
+      continue
+
+      case ']':
+        //  a right bracket shall lose its special
+        //  meaning and represent itself in
+        //  a bracket expression if it occurs
+        //  first in the list.  -- POSIX.2 2.8.3.2
+        if (i === classStart + 1 || !inClass) {
+          re += '\\' + c
+          escaping = false
+          continue
+        }
+
+        // handle the case where we left a class open.
+        // "[z-a]" is valid, equivalent to "\[z-a\]"
+        if (inClass) {
+          // split where the last [ was, make sure we don't have
+          // an invalid re. if so, re-walk the contents of the
+          // would-be class to re-translate any characters that
+          // were passed through as-is
+          // TODO: It would probably be faster to determine this
+          // without a try/catch and a new RegExp, but it's tricky
+          // to do safely.  For now, this is safe and works.
+          var cs = pattern.substring(classStart + 1, i)
+          try {
+            RegExp('[' + cs + ']')
+          } catch (er) {
+            // not a valid class!
+            var sp = this.parse(cs, SUBPARSE)
+            re = re.substr(0, reClassStart) + '\\[' + sp[0] + '\\]'
+            hasMagic = hasMagic || sp[1]
+            inClass = false
+            continue
+          }
+        }
+
+        // finish up the class.
+        hasMagic = true
+        inClass = false
+        re += c
+      continue
+
+      default:
+        // swallow any state char that wasn't consumed
+        clearStateChar()
+
+        if (escaping) {
+          // no need
+          escaping = false
+        } else if (reSpecials[c]
+          && !(c === '^' && inClass)) {
+          re += '\\'
+        }
+
+        re += c
+
+    } // switch
+  } // for
+
+  // handle the case where we left a class open.
+  // "[abc" is valid, equivalent to "\[abc"
+  if (inClass) {
+    // split where the last [ was, and escape it
+    // this is a huge pita.  We now have to re-walk
+    // the contents of the would-be class to re-translate
+    // any characters that were passed through as-is
+    cs = pattern.substr(classStart + 1)
+    sp = this.parse(cs, SUBPARSE)
+    re = re.substr(0, reClassStart) + '\\[' + sp[0]
+    hasMagic = hasMagic || sp[1]
+  }
+
+  // handle the case where we had a +( thing at the *end*
+  // of the pattern.
+  // each pattern list stack adds 3 chars, and we need to go through
+  // and escape any | chars that were passed through as-is for the regexp.
+  // Go through and escape them, taking care not to double-escape any
+  // | chars that were already escaped.
+  for (pl = patternListStack.pop(); pl; pl = patternListStack.pop()) {
+    var tail = re.slice(pl.reStart + 3)
+    // maybe some even number of \, then maybe 1 \, followed by a |
+    tail = tail.replace(/((?:\\{2})*)(\\?)\|/g, function (_, $1, $2) {
+      if (!$2) {
+        // the | isn't already escaped, so escape it.
+        $2 = '\\'
+      }
+
+      // need to escape all those slashes *again*, without escaping the
+      // one that we need for escaping the | character.  As it works out,
+      // escaping an even number of slashes can be done by simply repeating
+      // it exactly after itself.  That's why this trick works.
+      //
+      // I am sorry that you have to see this.
+      return $1 + $1 + $2 + '|'
+    })
+
+    this.debug('tail=%j\n   %s', tail, tail)
+    var t = pl.type === '*' ? star
+      : pl.type === '?' ? qmark
+      : '\\' + pl.type
+
+    hasMagic = true
+    re = re.slice(0, pl.reStart) + t + '\\(' + tail
+  }
+
+  // handle trailing things that only matter at the very end.
+  clearStateChar()
+  if (escaping) {
+    // trailing \\
+    re += '\\\\'
+  }
+
+  // only need to apply the nodot start if the re starts with
+  // something that could conceivably capture a dot
+  var addPatternStart = false
+  switch (re.charAt(0)) {
+    case '.':
+    case '[':
+    case '(': addPatternStart = true
+  }
+
+  // Hack to work around lack of negative lookbehind in JS
+  // A pattern like: *.!(x).!(y|z) needs to ensure that a name
+  // like 'a.xyz.yz' doesn't match.  So, the first negative
+  // lookahead, has to look ALL the way ahead, to the end of
+  // the pattern.
+  for (var n = negativeLists.length - 1; n > -1; n--) {
+    var nl = negativeLists[n]
+
+    var nlBefore = re.slice(0, nl.reStart)
+    var nlFirst = re.slice(nl.reStart, nl.reEnd - 8)
+    var nlLast = re.slice(nl.reEnd - 8, nl.reEnd)
+    var nlAfter = re.slice(nl.reEnd)
+
+    nlLast += nlAfter
+
+    // Handle nested stuff like *(*.js|!(*.json)), where open parens
+    // mean that we should *not* include the ) in the bit that is considered
+    // "after" the negated section.
+    var openParensBefore = nlBefore.split('(').length - 1
+    var cleanAfter = nlAfter
+    for (i = 0; i < openParensBefore; i++) {
+      cleanAfter = cleanAfter.replace(/\)[+*?]?/, '')
+    }
+    nlAfter = cleanAfter
+
+    var dollar = ''
+    if (nlAfter === '' && isSub !== SUBPARSE) {
+      dollar = '$'
+    }
+    var newRe = nlBefore + nlFirst + nlAfter + dollar + nlLast
+    re = newRe
+  }
+
+  // if the re is not "" at this point, then we need to make sure
+  // it doesn't match against an empty path part.
+  // Otherwise a/* will match a/, which it should not.
+  if (re !== '' && hasMagic) {
+    re = '(?=.)' + re
+  }
+
+  if (addPatternStart) {
+    re = patternStart + re
+  }
+
+  // parsing just a piece of a larger pattern.
+  if (isSub === SUBPARSE) {
+    return [re, hasMagic]
+  }
+
+  // skip the regexp for non-magical patterns
+  // unescape anything in it, though, so that it'll be
+  // an exact match against a file etc.
+  if (!hasMagic) {
+    return globUnescape(pattern)
+  }
+
+  var flags = options.nocase ? 'i' : ''
+  var regExp = new RegExp('^' + re + '$', flags)
+
+  regExp._glob = pattern
+  regExp._src = re
+
+  return regExp
+}
+
+minimatch.makeRe = function (pattern, options) {
+  return new Minimatch(pattern, options || {}).makeRe()
+}
+
+Minimatch.prototype.makeRe = makeRe
+function makeRe () {
+  if (this.regexp || this.regexp === false) return this.regexp
+
+  // at this point, this.set is a 2d array of partial
+  // pattern strings, or "**".
+  //
+  // It's better to use .match().  This function shouldn't
+  // be used, really, but it's pretty convenient sometimes,
+  // when you just want to work with a regex.
+  var set = this.set
+
+  if (!set.length) {
+    this.regexp = false
+    return this.regexp
+  }
+  var options = this.options
+
+  var twoStar = options.noglobstar ? star
+    : options.dot ? twoStarDot
+    : twoStarNoDot
+  var flags = options.nocase ? 'i' : ''
+
+  var re = set.map(function (pattern) {
+    return pattern.map(function (p) {
+      return (p === GLOBSTAR) ? twoStar
+      : (typeof p === 'string') ? regExpEscape(p)
+      : p._src
+    }).join('\\\/')
+  }).join('|')
+
+  // must match entire pattern
+  // ending in a * or ** will make it less strict.
+  re = '^(?:' + re + ')$'
+
+  // can match anything, as long as it's not this.
+  if (this.negate) re = '^(?!' + re + ').*$'
+
+  try {
+    this.regexp = new RegExp(re, flags)
+  } catch (ex) {
+    this.regexp = false
+  }
+  return this.regexp
+}
+
+minimatch.match = function (list, pattern, options) {
+  options = options || {}
+  var mm = new Minimatch(pattern, options)
+  list = list.filter(function (f) {
+    return mm.match(f)
+  })
+  if (mm.options.nonull && !list.length) {
+    list.push(pattern)
+  }
+  return list
+}
+
+Minimatch.prototype.match = match
+function match (f, partial) {
+  this.debug('match', f, this.pattern)
+  // short-circuit in the case of busted things.
+  // comments, etc.
+  if (this.comment) return false
+  if (this.empty) return f === ''
+
+  if (f === '/' && partial) return true
+
+  var options = this.options
+
+  // windows: need to use /, not \
+  if (path.sep !== '/') {
+    f = f.split(path.sep).join('/')
+  }
+
+  // treat the test path as a set of pathparts.
+  f = f.split(slashSplit)
+  this.debug(this.pattern, 'split', f)
+
+  // just ONE of the pattern sets in this.set needs to match
+  // in order for it to be valid.  If negating, then just one
+  // match means that we have failed.
+  // Either way, return on the first hit.
+
+  var set = this.set
+  this.debug(this.pattern, 'set', set)
+
+  // Find the basename of the path by looking for the last non-empty segment
+  var filename
+  var i
+  for (i = f.length - 1; i >= 0; i--) {
+    filename = f[i]
+    if (filename) break
+  }
+
+  for (i = 0; i < set.length; i++) {
+    var pattern = set[i]
+    var file = f
+    if (options.matchBase && pattern.length === 1) {
+      file = [filename]
+    }
+    var hit = this.matchOne(file, pattern, partial)
+    if (hit) {
+      if (options.flipNegate) return true
+      return !this.negate
+    }
+  }
+
+  // didn't get any hits.  this is success if it's a negative
+  // pattern, failure otherwise.
+  if (options.flipNegate) return false
+  return this.negate
+}
+
+// set partial to true to test if, for example,
+// "/a/b" matches the start of "/*/b/*/d"
+// Partial means, if you run out of file before you run
+// out of pattern, then that's fine, as long as all
+// the parts match.
+Minimatch.prototype.matchOne = function (file, pattern, partial) {
+  var options = this.options
+
+  this.debug('matchOne',
+    { 'this': this, file: file, pattern: pattern })
+
+  this.debug('matchOne', file.length, pattern.length)
+
+  for (var fi = 0,
+      pi = 0,
+      fl = file.length,
+      pl = pattern.length
+      ; (fi < fl) && (pi < pl)
+      ; fi++, pi++) {
+    this.debug('matchOne loop')
+    var p = pattern[pi]
+    var f = file[fi]
+
+    this.debug(pattern, p, f)
+
+    // should be impossible.
+    // some invalid regexp stuff in the set.
+    if (p === false) return false
+
+    if (p === GLOBSTAR) {
+      this.debug('GLOBSTAR', [pattern, p, f])
+
+      // "**"
+      // a/**/b/**/c would match the following:
+      // a/b/x/y/z/c
+      // a/x/y/z/b/c
+      // a/b/x/b/x/c
+      // a/b/c
+      // To do this, take the rest of the pattern after
+      // the **, and see if it would match the file remainder.
+      // If so, return success.
+      // If not, the ** "swallows" a segment, and try again.
+      // This is recursively awful.
+      //
+      // a/**/b/**/c matching a/b/x/y/z/c
+      // - a matches a
+      // - doublestar
+      //   - matchOne(b/x/y/z/c, b/**/c)
+      //     - b matches b
+      //     - doublestar
+      //       - matchOne(x/y/z/c, c) -> no
+      //       - matchOne(y/z/c, c) -> no
+      //       - matchOne(z/c, c) -> no
+      //       - matchOne(c, c) yes, hit
+      var fr = fi
+      var pr = pi + 1
+      if (pr === pl) {
+        this.debug('** at the end')
+        // a ** at the end will just swallow the rest.
+        // We have found a match.
+        // however, it will not swallow /.x, unless
+        // options.dot is set.
+        // . and .. are *never* matched by **, for explosively
+        // exponential reasons.
+        for (; fi < fl; fi++) {
+          if (file[fi] === '.' || file[fi] === '..' ||
+            (!options.dot && file[fi].charAt(0) === '.')) return false
+        }
+        return true
+      }
+
+      // ok, let's see if we can swallow whatever we can.
+      while (fr < fl) {
+        var swallowee = file[fr]
+
+        this.debug('\nglobstar while', file, fr, pattern, pr, swallowee)
+
+        // XXX remove this slice.  Just pass the start index.
+        if (this.matchOne(file.slice(fr), pattern.slice(pr), partial)) {
+          this.debug('globstar found match!', fr, fl, swallowee)
+          // found a match.
+          return true
+        } else {
+          // can't swallow "." or ".." ever.
+          // can only swallow ".foo" when explicitly asked.
+          if (swallowee === '.' || swallowee === '..' ||
+            (!options.dot && swallowee.charAt(0) === '.')) {
+            this.debug('dot detected!', file, fr, pattern, pr)
+            break
+          }
+
+          // ** swallows a segment, and continue.
+          this.debug('globstar swallow a segment, and continue')
+          fr++
+        }
+      }
+
+      // no match was found.
+      // However, in partial mode, we can't say this is necessarily over.
+      // If there's more *pattern* left, then
+      if (partial) {
+        // ran out of file
+        this.debug('\n>>> no match, partial?', file, fr, pattern, pr)
+        if (fr === fl) return true
+      }
+      return false
+    }
+
+    // something other than **
+    // non-magic patterns just have to match exactly
+    // patterns with magic have been turned into regexps.
+    var hit
+    if (typeof p === 'string') {
+      if (options.nocase) {
+        hit = f.toLowerCase() === p.toLowerCase()
+      } else {
+        hit = f === p
+      }
+      this.debug('string match', p, f, hit)
+    } else {
+      hit = f.match(p)
+      this.debug('pattern match', p, f, hit)
+    }
+
+    if (!hit) return false
+  }
+
+  // Note: ending in / means that we'll get a final ""
+  // at the end of the pattern.  This can only match a
+  // corresponding "" at the end of the file.
+  // If the file ends in /, then it can only match a
+  // a pattern that ends in /, unless the pattern just
+  // doesn't have any more for it. But, a/b/ should *not*
+  // match "a/b/*", even though "" matches against the
+  // [^/]*? pattern, except in partial mode, where it might
+  // simply not be reached yet.
+  // However, a/b/ should still satisfy a/*
+
+  // now either we fell off the end of the pattern, or we're done.
+  if (fi === fl && pi === pl) {
+    // ran out of pattern and filename at the same time.
+    // an exact hit!
+    return true
+  } else if (fi === fl) {
+    // ran out of file, but still had pattern left.
+    // this is ok if we're doing the match as part of
+    // a glob fs traversal.
+    return partial
+  } else if (pi === pl) {
+    // ran out of pattern, still have file left.
+    // this is only acceptable if we're on the very last
+    // empty segment of a file with a trailing slash.
+    // a/* should match a/b/
+    var emptyFileEnd = (fi === fl - 1) && (file[fi] === '')
+    return emptyFileEnd
+  }
+
+  // should be unreachable.
+  throw new Error('wtf?')
+}
+
+// replace stuff like \* with *
+function globUnescape (s) {
+  return s.replace(/\\(.)/g, '$1')
+}
+
+function regExpEscape (s) {
+  return s.replace(/[-[\]{}()*+?.,\\^$|#\s]/g, '\\$&')
+}

samples/client/petstore-security-test/javascript/node_modules/jshint/node_modules/minimatch/package.json

@@ -0,0 +1,88 @@
+{
+  "_args": [
+    [
+      "minimatch@2.0.x",
+      "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript/node_modules/jshint"
+    ]
+  ],
+  "_from": "minimatch@>=2.0.0 <2.1.0",
+  "_id": "minimatch@2.0.10",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/jshint/minimatch",
+  "_nodeVersion": "2.2.1",
+  "_npmUser": {
+    "email": "isaacs@npmjs.com",
+    "name": "isaacs"
+  },
+  "_npmVersion": "3.1.0",
+  "_phantomChildren": {},
+  "_requested": {
+    "name": "minimatch",
+    "raw": "minimatch@2.0.x",
+    "rawSpec": "2.0.x",
+    "scope": null,
+    "spec": ">=2.0.0 <2.1.0",
+    "type": "range"
+  },
+  "_requiredBy": [
+    "/jshint"
+  ],
+  "_resolved": "https://registry.npmjs.org/minimatch/-/minimatch-2.0.10.tgz",
+  "_shasum": "8d087c39c6b38c001b97fca7ce6d0e1e80afbac7",
+  "_shrinkwrap": null,
+  "_spec": "minimatch@2.0.x",
+  "_where": "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript/node_modules/jshint",
+  "author": {
+    "email": "i@izs.me",
+    "name": "Isaac Z. Schlueter",
+    "url": "http://blog.izs.me"
+  },
+  "bugs": {
+    "url": "https://github.com/isaacs/minimatch/issues"
+  },
+  "dependencies": {
+    "brace-expansion": "^1.0.0"
+  },
+  "deprecated": "Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue",
+  "description": "a glob matcher in javascript",
+  "devDependencies": {
+    "browserify": "^9.0.3",
+    "standard": "^3.7.2",
+    "tap": "^1.2.0"
+  },
+  "directories": {},
+  "dist": {
+    "shasum": "8d087c39c6b38c001b97fca7ce6d0e1e80afbac7",
+    "tarball": "https://registry.npmjs.org/minimatch/-/minimatch-2.0.10.tgz"
+  },
+  "engines": {
+    "node": "*"
+  },
+  "files": [
+    "browser.js",
+    "minimatch.js"
+  ],
+  "gitHead": "6afb85f0c324b321f76a38df81891e562693e257",
+  "homepage": "https://github.com/isaacs/minimatch#readme",
+  "license": "ISC",
+  "main": "minimatch.js",
+  "maintainers": [
+    {
+      "name": "isaacs",
+      "email": "i@izs.me"
+    }
+  ],
+  "name": "minimatch",
+  "optionalDependencies": {},
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/isaacs/minimatch.git"
+  },
+  "scripts": {
+    "posttest": "standard minimatch.js test/*.js",
+    "prepublish": "browserify -o browser.js -e minimatch.js -s minimatch --bare",
+    "test": "tap test/*.js"
+  },
+  "version": "2.0.10"
+}

samples/client/petstore-security-test/javascript/node_modules/jshint/package.json

@@ -0,0 +1,132 @@
+{
+  "_args": [
+    [
+      "jshint",
+      "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript"
+    ]
+  ],
+  "_from": "jshint@*",
+  "_id": "jshint@2.9.2",
+  "_inCache": true,
+  "_installable": true,
+  "_location": "/jshint",
+  "_nodeVersion": "5.3.0",
+  "_npmOperationalInternal": {
+    "host": "packages-16-east.internal.npmjs.com",
+    "tmp": "tmp/jshint-2.9.2.tgz_1461106429823_0.9580952741671354"
+  },
+  "_npmUser": {
+    "email": "mike@mikepennisi.com",
+    "name": "jugglinmike"
+  },
+  "_npmVersion": "3.3.12",
+  "_phantomChildren": {
+    "brace-expansion": "1.1.5"
+  },
+  "_requested": {
+    "name": "jshint",
+    "raw": "jshint",
+    "rawSpec": "",
+    "scope": null,
+    "spec": "*",
+    "type": "range"
+  },
+  "_requiredBy": [
+    "#USER"
+  ],
+  "_resolved": "https://registry.npmjs.org/jshint/-/jshint-2.9.2.tgz",
+  "_shasum": "0b12d75f8eafb0823b7bf8efbb265b3262401619",
+  "_shrinkwrap": null,
+  "_spec": "jshint",
+  "_where": "/Users/williamcheng/Code/may2016/swagger-codegen/samples/client/petstore-security-test/javascript",
+  "author": {
+    "email": "anton@kovalyov.net",
+    "name": "Anton Kovalyov",
+    "url": "http://anton.kovalyov.net/"
+  },
+  "bin": {
+    "jshint": "./bin/jshint"
+  },
+  "bugs": {
+    "url": "https://github.com/jshint/jshint/issues"
+  },
+  "dependencies": {
+    "cli": "0.6.x",
+    "console-browserify": "1.1.x",
+    "exit": "0.1.x",
+    "htmlparser2": "3.8.x",
+    "lodash": "3.7.x",
+    "minimatch": "2.0.x",
+    "shelljs": "0.3.x",
+    "strip-json-comments": "1.0.x"
+  },
+  "description": "Static analysis tool for JavaScript",
+  "devDependencies": {
+    "browserify": "9.x",
+    "conventional-changelog": "0.4.x",
+    "conventional-github-releaser": "0.4.x",
+    "coveralls": "2.11.x",
+    "istanbul": "0.3.x",
+    "jscs": "1.11.x",
+    "jshint": "2.6.x",
+    "mock-stdin": "0.3.x",
+    "nodeunit": "0.9.x",
+    "phantom": "~0.7.2",
+    "phantomjs": "1.9.13",
+    "regenerate": "1.2.x",
+    "sinon": "1.12.x",
+    "unicode-6.3.0": "0.1.x"
+  },
+  "directories": {},
+  "dist": {
+    "shasum": "0b12d75f8eafb0823b7bf8efbb265b3262401619",
+    "tarball": "https://registry.npmjs.org/jshint/-/jshint-2.9.2.tgz"
+  },
+  "files": [
+    "bin",
+    "data",
+    "dist",
+    "src"
+  ],
+  "gitHead": "b554ffe61eabf6e3e3a2876a3a377271da308811",
+  "homepage": "http://jshint.com/",
+  "license": "(MIT AND JSON)",
+  "main": "./src/jshint.js",
+  "maintainers": [
+    {
+      "name": "antonkovalyov",
+      "email": "anton@kovalyov.net"
+    },
+    {
+      "name": "rwaldron",
+      "email": "waldron.rick@gmail.com"
+    },
+    {
+      "name": "jugglinmike",
+      "email": "mike@mikepennisi.com"
+    }
+  ],
+  "name": "jshint",
+  "optionalDependencies": {},
+  "preferGlobal": true,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jshint/jshint.git"
+  },
+  "scripts": {
+    "browser-test-server": "node tests/helpers/browser/server",
+    "build": "node bin/build",
+    "changelog": "conventional-changelog -p jshint -i CHANGELOG.md -w",
+    "coverage": "istanbul -- cover ./node_modules/.bin/nodeunit tests/unit",
+    "data": "node scripts/generate-identifier-data",
+    "github-release": "conventional-github-releaser -p jshint",
+    "pretest": "jshint src && jscs src",
+    "test": "npm run test-node && npm run test-browser",
+    "test-browser": "node tests/browser",
+    "test-cli": "nodeunit tests/cli.js",
+    "test-node": "npm run test-unit && npm run test-cli && npm run test-regression",
+    "test-regression": "nodeunit tests/regression",
+    "test-unit": "nodeunit tests/unit"
+  },
+  "version": "2.9.2"
+}

samples/client/petstore-security-test/javascript/node_modules/jshint/src/cli.js

@@ -0,0 +1,771 @@
+"use strict";
+
+var _                 = require("lodash");
+var fs                = require("fs");
+var cli               = require("cli");
+var path              = require("path");
+var shjs              = require("shelljs");
+var minimatch         = require("minimatch");
+var htmlparser        = require("htmlparser2");
+var exit              = require("exit");
+var stripJsonComments = require("strip-json-comments");
+var JSHINT            = require("./jshint.js").JSHINT;
+var defReporter       = require("./reporters/default").reporter;
+
+var OPTIONS = {
+  "config": ["c", "Custom configuration file", "string", false ],
+  "reporter": ["reporter", "Custom reporter (<PATH>|jslint|checkstyle|unix)", "string", undefined ],
+  "prereq": [
+    "prereq",
+    "Comma-separate list of prerequisite (paths). E.g. files which include" +
+    "definitions of global variabls used throughout your project",
+    "string",
+    null
+  ],
+  "exclude": ["exclude",
+    "Exclude files matching the given filename pattern (same as .jshintignore)", "string", null],
+  "exclude-path": ["exclude-path", "Pass in a custom jshintignore file path", "string", null],
+  "filename": ["filename",
+    "Pass in a filename when using STDIN to emulate config lookup for that file name",
+    "string", null],
+  "verbose": ["verbose", "Show message codes"],
+  "show-non-errors": ["show-non-errors", "Show additional data generated by jshint"],
+  "extra-ext": ["e",
+    "Comma-separated list of file extensions to use (default is .js)", "string", ""],
+
+  "extract": [
+    "extract",
+    "Extract inline scripts contained in HTML (auto|always|never, default to never)",
+    "string",
+    "never"
+  ],
+
+  // Deprecated options.
+  "jslint-reporter": [
+    "jslint-reporter",
+    deprecated("Use a jslint compatible reporter", "--reporter=jslint")
+  ],
+
+  "checkstyle-reporter": [
+    "checkstyle-reporter",
+    deprecated("Use a CheckStyle compatible XML reporter", "--reporter=checkstyle")
+  ]
+};
+
+/**
+ * Returns the same text but with a deprecation notice.
+ * Useful for options descriptions.
+ *
+ * @param {string} text
+ * @param {string} alt (optional) Alternative command to include in the
+ *                 deprecation notice.
+ *
+ * @returns {string}
+ */
+function deprecated(text, alt) {
+  if (!alt) {
+    return text + " (DEPRECATED)";
+  }
+
+  return text + " (DEPRECATED, use " + alt + " instead)";
+}
+
+/**
+ * Tries to find a configuration file in either project directory
+ * or in the home directory. Configuration files are named
+ * '.jshintrc'.
+ *
+ * @param {string} file path to the file to be linted
+ * @returns {string} a path to the config file
+ */
+function findConfig(file) {
+  var dir  = path.dirname(path.resolve(file));
+  var envs = getHomeDir();
+  var proj = findFile(".jshintrc", dir);
+  var home;
+
+  if (proj)
+    return proj;
+
+  else if (envs) {
+    home = path.normalize(path.join(envs, ".jshintrc"));
+
+    if (shjs.test("-e", home))
+      return home;
+  }
+
+  return null;
+}
+
+function getHomeDir() {
+  var homePath = "";
+  var environment = global.process.env;
+  var paths = [
+    environment.USERPROFILE,
+    environment.HOME,
+    environment.HOMEPATH,
+    environment.HOMEDRIVE + environment.HOMEPATH
+  ];
+
+  while (paths.length) {
+    homePath = paths.shift();
+    if (fs.existsSync(homePath)) {
+      return homePath;
+    }
+  }
+}
+
+/**
+ * Tries to find JSHint configuration within a package.json file
+ * (if any). It search in the current directory and then goes up
+ * all the way to the root just like findFile.
+ *
+ * @param   {string} file path to the file to be linted
+ * @returns {object} config object
+ */
+function loadNpmConfig(file) {
+  var dir = path.dirname(path.resolve(file));
+  var fp  = findFile("package.json", dir);
+
+  if (!fp)
+    return null;
+
+  try {
+    return require(fp).jshintConfig;
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Tries to import a reporter file and returns its reference.
+ *
+ * @param {string} fp a path to the reporter file
+ * @returns {object} imported module for the reporter or 'null'
+ *                   if a module cannot be imported.
+ */
+function loadReporter(fp) {
+  try {
+    return require(fp).reporter;
+  } catch (err) {
+    return null;
+  }
+}
+
+// Storage for memoized results from find file
+// Should prevent lots of directory traversal &
+// lookups when liniting an entire project
+var findFileResults = {};
+
+/**
+ * Searches for a file with a specified name starting with
+ * 'dir' and going all the way up either until it finds the file
+ * or hits the root.
+ *
+ * @param {string} name filename to search for (e.g. .jshintrc)
+ * @param {string} dir  directory to start search from (default:
+ *                      current working directory)
+ *
+ * @returns {string} normalized filename
+ */
+function findFile(name, cwd) {
+  cwd = cwd || process.cwd();
+
+  var filename = path.normalize(path.join(cwd, name));
+  if (findFileResults[filename] !== undefined) {
+    return findFileResults[filename];
+  }
+
+  var parent = path.resolve(cwd, "../");
+
+  if (shjs.test("-e", filename)) {
+    findFileResults[filename] = filename;
+    return filename;
+  }
+
+  if (cwd === parent) {
+    findFileResults[filename] = null;
+    return null;
+  }
+
+  return findFile(name, parent);
+}
+
+/**
+ * Loads a list of files that have to be skipped. JSHint assumes that
+ * the list is located in a file called '.jshintignore'.
+ *
+ * @return {array} a list of files to ignore.
+ */
+function loadIgnores(params) {
+  var file = findFile(params.excludePath || ".jshintignore", params.cwd) || "";
+
+  if (!file && !params.exclude) {
+    return [];
+  }
+
+  var lines = (file ? shjs.cat(file) : "").split("\n");
+  var exclude = params.exclude || "";
+  lines.unshift.apply(lines, exclude.split(","));
+
+  return lines
+    .filter(function(line) {
+      return !!line.trim();
+    })
+    .map(function(line) {
+      if (line[0] === "!")
+        return "!" + path.resolve(path.dirname(file), line.substr(1).trim());
+
+      return path.join(path.dirname(file), line.trim());
+    });
+}
+
+/**
+ * Checks whether we should ignore a file or not.
+ *
+ * @param {string} fp       a path to a file
+ * @param {array}  patterns a list of patterns for files to ignore
+ *
+ * @return {boolean} 'true' if file should be ignored, 'false' otherwise.
+ */
+function isIgnored(fp, patterns) {
+  return patterns.some(function(ip) {
+    if (minimatch(path.resolve(fp), ip, { nocase: true })) {
+      return true;
+    }
+
+    if (path.resolve(fp) === ip) {
+      return true;
+    }
+
+    if (shjs.test("-d", fp) && ip.match(/^[^\/]*\/?$/) &&
+      fp.match(new RegExp("^" + ip + ".*"))) {
+      return true;
+    }
+  });
+}
+
+/**
+ * Extract JS code from a given source code. The source code my be either HTML
+ * code or JS code. In the latter case, no extraction will be done unless
+ * 'always' is given.
+ *
+ * @param {string} code a piece of code
+ * @param {string} when 'always' will extract the JS code, no matter what.
+ * 'never' won't do anything. 'auto' will check if the code looks like HTML
+ * before extracting it.
+ *
+ * @return {string} the extracted code
+ */
+function extract(code, when) {
+  // A JS file won't start with a less-than character, whereas a HTML file
+  // should always start with that.
+  if (when !== "always" && (when !== "auto" || !/^\s*</.test(code)))
+    return code;
+
+  var inscript = false;
+  var index = 0;
+  var js = [];
+  var startOffset;
+
+  // Test if current tag is a valid <script> tag.
+  function onopen(name, attrs) {
+    if (name !== "script")
+      return;
+
+    if (attrs.type && !/text\/javascript/.test(attrs.type.toLowerCase()))
+      return;
+
+    // Mark that we're inside a <script> a tag and push all new lines
+    // in between the last </script> tag and this <script> tag to preserve
+    // location information.
+    inscript = true;
+    js.push.apply(js, code.slice(index, parser.endIndex).match(/\r\n|\n|\r/g));
+    startOffset = null;
+  }
+
+  function onclose(name) {
+    if (name !== "script" || !inscript)
+      return;
+
+    inscript = false;
+    index = parser.startIndex;
+    startOffset = null;
+  }
+
+  function ontext(data) {
+    if (!inscript)
+      return;
+
+    var lines = data.split(/\r\n|\n|\r/);
+
+    if (!startOffset) {
+      lines.some(function(line) {
+        if (!line) return;
+        startOffset = /^(\s*)/.exec(line)[1];
+        return true;
+      });
+    }
+
+    // check for startOffset again to remove leading white space from first line
+    if (startOffset) {
+      lines = lines.map(function(line) {
+        return line.replace(startOffset, "");
+      });
+      data = lines.join("\n");
+    }
+
+    js.push(data); // Collect JavaScript code.
+  }
+
+  var parser = new htmlparser.Parser({ onopentag: onopen, onclosetag: onclose, ontext: ontext });
+  parser.parseComplete(code);
+
+  return js.join("");
+}
+
+/**
+ * Crude version of source maps: extract how much JavaSscript in HTML
+ * was shifted based on first JS line. For example if first js line
+ * is offset by 4 spaces, each line in this js fragment will have offset 4
+ * to restore the original column.
+ *
+ * @param {string} code a piece of code
+ * @param {string} when 'always' will extract the JS code, no matter what.
+ * 'never' won't do anything. 'auto' will check if the code looks like HTML
+ * before extracting it.
+ *
+ * @return {Array} extracted offsets
+ */
+function extractOffsets(code, when) {
+  // A JS file won't start with a less-than character, whereas a HTML file
+  // should always start with that.
+  if (when !== "always" && (when !== "auto" || !/^\s*</.test(code)))
+    return;
+
+  var inscript = false;
+  var index = 0;
+  var lineCounter = 0;
+  var startOffset;
+  var offsets = [];
+
+  // Test if current tag is a valid <script> tag.
+  function onopen(name, attrs) {
+    if (name !== "script")
+      return;
+
+    if (attrs.type && !/text\/javascript/.test(attrs.type.toLowerCase()))
+      return;
+
+    // Mark that we're inside a <script> a tag and push all new lines
+    // in between the last </script> tag and this <script> tag to preserve
+    // location information.
+    inscript = true;
+    var fragment = code.slice(index, parser.endIndex);
+    var n = (fragment.match(/\r\n|\n|\r/g) || []).length;
+    lineCounter += n;
+    startOffset = null;
+  }
+
+  function onclose(name) {
+    if (name !== "script" || !inscript)
+      return;
+
+    inscript = false;
+    index = parser.startIndex;
+    startOffset = null;
+  }
+
+  function ontext(data) {
+    if (!inscript)
+      return;
+
+    var lines = data.split(/\r\n|\n|\r/);
+
+    if (!startOffset) {
+      lines.some(function(line) {
+        if (!line) return;
+        startOffset = /^(\s*)/.exec(line)[1];
+        return true;
+      });
+    }
+
+    // check for startOffset again to remove leading white space from first line
+    lines.forEach(function() {
+      lineCounter += 1;
+      if (startOffset) {
+        offsets[lineCounter] = startOffset.length;
+      } else {
+        offsets[lineCounter] = 0;
+      }
+    });
+  }
+
+  var parser = new htmlparser.Parser({ onopentag: onopen, onclosetag: onclose, ontext: ontext });
+  parser.parseComplete(code);
+  return offsets;
+}
+
+/**
+ * Recursively gather all files that need to be linted,
+ * excluding those that user asked to ignore.
+ *
+ * @param {string} fp      a path to a file or directory to lint
+ * @param {array}  files   a pointer to an array that stores a list of files
+ * @param {array}  ignores a list of patterns for files to ignore
+ * @param {array}  ext     a list of non-dot-js extensions to lint
+ */
+function collect(fp, files, ignores, ext) {
+  if (ignores && isIgnored(fp, ignores)) {
+    return;
+  }
+
+  if (!shjs.test("-e", fp)) {
+    cli.error("Can't open " + fp);
+    return;
+  }
+
+  if (shjs.test("-d", fp)) {
+    shjs.ls(fp).forEach(function(item) {
+      var itempath = path.join(fp, item);
+      if (shjs.test("-d", itempath) || item.match(ext)) {
+        collect(itempath, files, ignores, ext);
+      }
+    });
+
+    return;
+  }
+
+  files.push(fp);
+}
+
+/**
+ * Runs JSHint against provided file and saves the result
+ *
+ * @param {string} code    code that needs to be linted
+ * @param {object} results a pointer to an object with results
+ * @param {object} config  an object with JSHint configuration
+ * @param {object} data    a pointer to an object with extra data
+ * @param {string} file    (optional) file name that is being linted
+ */
+function lint(code, results, config, data, file) {
+  var globals;
+  var lintData;
+  var buffer = [];
+
+  config = config || {};
+  config = JSON.parse(JSON.stringify(config));
+
+  if (config.prereq) {
+    config.prereq.forEach(function(fp) {
+      fp = path.join(config.dirname, fp);
+      if (shjs.test("-e", fp))
+        buffer.push(shjs.cat(fp));
+    });
+    delete config.prereq;
+  }
+
+  if (config.globals) {
+    globals = config.globals;
+    delete config.globals;
+  }
+
+  if (config.overrides) {
+    if (file) {
+      _.each(config.overrides, function(options, pattern) {
+        if (minimatch(path.normalize(file), pattern, { nocase: true, matchBase: true })) {
+          if (options.globals) {
+            globals = _.extend(globals || {}, options.globals);
+            delete options.globals;
+          }
+          _.extend(config, options);
+        }
+      });
+    }
+
+    delete config.overrides;
+  }
+
+  delete config.dirname;
+
+  buffer.push(code);
+  buffer = buffer.join("\n");
+  buffer = buffer.replace(/^\uFEFF/, ""); // Remove potential Unicode BOM.
+
+  if (!JSHINT(buffer, config, globals)) {
+    JSHINT.errors.forEach(function(err) {
+      if (err) {
+        results.push({ file: file || "stdin", error: err });
+      }
+    });
+  }
+
+  lintData = JSHINT.data();
+
+  if (lintData) {
+    lintData.file = file || "stdin";
+    data.push(lintData);
+  }
+}
+
+var exports = {
+  extract: extract,
+  exit: exit,
+
+  /**
+   * Returns a configuration file or nothing, if it can't be found.
+   */
+  getConfig: function(fp) {
+    return loadNpmConfig(fp) || exports.loadConfig(findConfig(fp));
+  },
+
+  /**
+   * Loads and parses a configuration file.
+   *
+   * @param {string} fp a path to the config file
+   * @returns {object} config object
+   */
+  loadConfig: function(fp) {
+    if (!fp) {
+      return {};
+    }
+
+    if (!shjs.test("-e", fp)) {
+      cli.error("Can't find config file: " + fp);
+      exports.exit(1);
+    }
+
+    try {
+      var config = JSON.parse(stripJsonComments(shjs.cat(fp)));
+      config.dirname = path.dirname(fp);
+
+      if (config['extends']) {
+        var baseConfig = exports.loadConfig(path.resolve(config.dirname, config['extends']));
+        config = _.merge({}, baseConfig, config, function(a, b) {
+          if (_.isArray(a)) {
+            return a.concat(b);
+          }
+        });
+        delete config['extends'];
+      }
+
+      return config;
+    } catch (err) {
+      cli.error("Can't parse config file: " + fp + "\nError:" + err);
+      exports.exit(1);
+    }
+  },
+
+  /**
+   * Gathers all files that need to be linted
+   *
+   * @param {object} post-processed options from 'interpret':
+   *                   args     - CLI arguments
+   *                   ignores  - A list of files/dirs to ignore (defaults to .jshintignores)
+   *                   extensions - A list of non-dot-js extensions to check
+   */
+  gather: function(opts) {
+    var files = [];
+
+    var reg = new RegExp("\\.(js" +
+      (!opts.extensions ? "" : "|" +
+        opts.extensions.replace(/,/g, "|").replace(/[\. ]/g, "")) + ")$");
+
+    var ignores = !opts.ignores ? loadIgnores({ cwd: opts.cwd }) :
+                                  opts.ignores.map(function(target) {
+                                    return path.resolve(target);
+                                  });
+
+    opts.args.forEach(function(target) {
+      collect(target, files, ignores, reg);
+    });
+
+    return files;
+  },
+
+  /**
+   * Gathers all files that need to be linted, lints them, sends them to
+   * a reporter and returns the overall result.
+   *
+   * @param {object} post-processed options from 'interpret':
+   *                 args     - CLI arguments
+   *                 config   - Configuration object
+   *                 reporter - Reporter function
+   *                 ignores  - A list of files/dirs to ignore
+   *                 extensions - A list of non-dot-js extensions to check
+   * @param {function} cb a callback to call when function is finished
+   *                   asynchronously.
+   *
+   * @returns {bool} 'true' if all files passed, 'false' otherwise and 'null'
+   *                 when function will be finished asynchronously.
+   */
+  run: function(opts, cb) {
+    var files = exports.gather(opts);
+    var results = [];
+    var data = [];
+
+    function mergeCLIPrereq(config) {
+      if (opts.prereq) {
+        config.prereq = (config.prereq || []).concat(opts.prereq.split(/\s*,\s*/));
+      }
+    }
+
+    if (opts.useStdin) {
+      cli.withStdin(function(code) {
+        var config = opts.config;
+        var filename;
+
+        // There is an if(filename) check in the lint() function called below.
+        // passing a filename of undefined is the same as calling the function
+        // without a filename.  If there is no opts.filename, filename remains
+        // undefined and lint() is effectively called with 4 parameters.
+        if (opts.filename) {
+          filename = path.resolve(opts.filename);
+        }
+
+        if (filename && !config) {
+          config = exports.getConfig(filename);
+        }
+
+        config = config || {};
+
+        mergeCLIPrereq(config);
+
+        lint(extract(code, opts.extract), results, config, data, filename);
+        (opts.reporter || defReporter)(results, data, { verbose: opts.verbose });
+        cb(results.length === 0);
+      });
+
+      return null;
+    }
+
+    files.forEach(function(file) {
+      var config = opts.config || exports.getConfig(file);
+      var code;
+      var errors = [];
+
+      try {
+        code = shjs.cat(file);
+      } catch (err) {
+        cli.error("Can't open " + file);
+        exports.exit(1);
+      }
+
+      mergeCLIPrereq(config);
+
+      lint(extract(code, opts.extract), errors, config, data, file);
+
+      if (errors.length) {
+        var offsets = extractOffsets(code, opts.extract);
+        if (offsets && offsets.length) {
+          errors.forEach(function(errorInfo) {
+            var line = errorInfo.error.line;
+            if (line >= 0 && line < offsets.length && offsets[line]) {
+              errorInfo.error.character += offsets[line];
+            }
+          });
+        }
+
+        results = results.concat(errors);
+      }
+    });
+
+    (opts.reporter || defReporter)(results, data, { verbose: opts.verbose });
+    return results.length === 0;
+  },
+
+  /**
+   * Helper exposed for testing.
+   * Used to determine is stdout has any buffered output before exiting the program
+   */
+  getBufferSize: function() {
+    return process.stdout.bufferSize;
+  },
+
+  /**
+   * Main entrance function. Parses arguments and calls 'run' when
+   * its done. This function is called from bin/jshint file.
+   *
+   * @param {object} args, arguments in the process.argv format.
+   */
+  interpret: function(args) {
+    cli.setArgv(args);
+    cli.options = {};
+
+    cli.enable("version", "glob", "help");
+    cli.setApp(path.resolve(__dirname + "/../package.json"));
+
+    var options = cli.parse(OPTIONS);
+    // Use config file if specified
+    var config;
+    if (options.config) {
+      config = exports.loadConfig(options.config);
+    }
+
+    switch (true) {
+    // JSLint reporter
+    case options.reporter === "jslint":
+    case options["jslint-reporter"]:
+      options.reporter = "./reporters/jslint_xml.js";
+      break;
+
+    // CheckStyle (XML) reporter
+    case options.reporter === "checkstyle":
+    case options["checkstyle-reporter"]:
+      options.reporter = "./reporters/checkstyle.js";
+      break;
+
+    // Unix reporter
+    case options.reporter === "unix":
+      options.reporter = "./reporters/unix.js";
+      break;
+
+    // Reporter that displays additional JSHint data
+    case options["show-non-errors"]:
+      options.reporter = "./reporters/non_error.js";
+      break;
+
+    // Custom reporter
+    case options.reporter !== undefined:
+      options.reporter = path.resolve(process.cwd(), options.reporter);
+    }
+
+    var reporter;
+    if (options.reporter) {
+      reporter = loadReporter(options.reporter);
+
+      if (reporter === null) {
+        cli.error("Can't load reporter file: " + options.reporter);
+        exports.exit(1);
+      }
+    }
+
+    // This is a hack. exports.run is both sync and async function
+    // because I needed stdin support (and cli.withStdin is async)
+    // and was too lazy to change tests.
+
+    function done(passed) {
+      /*jshint eqnull:true */
+
+      if (passed == null)
+        return;
+
+      exports.exit(passed ? 0 : 2);
+    }
+
+    done(exports.run({
+      args:       cli.args,
+      config:     config,
+      reporter:   reporter,
+      ignores:    loadIgnores({ exclude: options.exclude, excludePath: options["exclude-path"] }),
+      extensions: options["extra-ext"],
+      verbose:    options.verbose,
+      extract:    options.extract,
+      filename:   options.filename,
+      prereq:     options.prereq,
+      useStdin:   { "-": true, "/dev/stdin": true }[args[args.length - 1]]
+    }, done));
+  }
+};
+
+module.exports = exports;

samples/client/petstore-security-test/javascript/node_modules/jshint/src/messages.js

@@ -0,0 +1,245 @@
+"use strict";
+
+var _ = require("lodash");
+
+var errors = {
+  // JSHint options
+  E001: "Bad option: '{a}'.",
+  E002: "Bad option value.",
+
+  // JSHint input
+  E003: "Expected a JSON value.",
+  E004: "Input is neither a string nor an array of strings.",
+  E005: "Input is empty.",
+  E006: "Unexpected early end of program.",
+
+  // Strict mode
+  E007: "Missing \"use strict\" statement.",
+  E008: "Strict violation.",
+  E009: "Option 'validthis' can't be used in a global scope.",
+  E010: "'with' is not allowed in strict mode.",
+
+  // Constants
+  E011: "'{a}' has already been declared.",
+  E012: "const '{a}' is initialized to 'undefined'.",
+  E013: "Attempting to override '{a}' which is a constant.",
+
+  // Regular expressions
+  E014: "A regular expression literal can be confused with '/='.",
+  E015: "Unclosed regular expression.",
+  E016: "Invalid regular expression.",
+
+  // Tokens
+  E017: "Unclosed comment.",
+  E018: "Unbegun comment.",
+  E019: "Unmatched '{a}'.",
+  E020: "Expected '{a}' to match '{b}' from line {c} and instead saw '{d}'.",
+  E021: "Expected '{a}' and instead saw '{b}'.",
+  E022: "Line breaking error '{a}'.",
+  E023: "Missing '{a}'.",
+  E024: "Unexpected '{a}'.",
+  E025: "Missing ':' on a case clause.",
+  E026: "Missing '}' to match '{' from line {a}.",
+  E027: "Missing ']' to match '[' from line {a}.",
+  E028: "Illegal comma.",
+  E029: "Unclosed string.",
+
+  // Everything else
+  E030: "Expected an identifier and instead saw '{a}'.",
+  E031: "Bad assignment.", // FIXME: Rephrase
+  E032: "Expected a small integer or 'false' and instead saw '{a}'.",
+  E033: "Expected an operator and instead saw '{a}'.",
+  E034: "get/set are ES5 features.",
+  E035: "Missing property name.",
+  E036: "Expected to see a statement and instead saw a block.",
+  E037: null,
+  E038: null,
+  E039: "Function declarations are not invocable. Wrap the whole function invocation in parens.",
+  E040: "Each value should have its own case label.",
+  E041: "Unrecoverable syntax error.",
+  E042: "Stopping.",
+  E043: "Too many errors.",
+  E044: null,
+  E045: "Invalid for each loop.",
+  E046: "A yield statement shall be within a generator function (with syntax: `function*`)",
+  E047: null,
+  E048: "{a} declaration not directly within block.",
+  E049: "A {a} cannot be named '{b}'.",
+  E050: "Mozilla requires the yield expression to be parenthesized here.",
+  E051: null,
+  E052: "Unclosed template literal.",
+  E053: "Export declaration must be in global scope.",
+  E054: "Class properties must be methods. Expected '(' but instead saw '{a}'.",
+  E055: "The '{a}' option cannot be set after any executable code.",
+  E056: "'{a}' was used before it was declared, which is illegal for '{b}' variables.",
+  E057: "Invalid meta property: '{a}.{b}'.",
+  E058: "Missing semicolon.",
+  E059: "Incompatible values for the '{a}' and '{b}' linting options."
+};
+
+var warnings = {
+  W001: "'hasOwnProperty' is a really bad name.",
+  W002: "Value of '{a}' may be overwritten in IE 8 and earlier.",
+  W003: "'{a}' was used before it was defined.",
+  W004: "'{a}' is already defined.",
+  W005: "A dot following a number can be confused with a decimal point.",
+  W006: "Confusing minuses.",
+  W007: "Confusing plusses.",
+  W008: "A leading decimal point can be confused with a dot: '{a}'.",
+  W009: "The array literal notation [] is preferable.",
+  W010: "The object literal notation {} is preferable.",
+  W011: null,
+  W012: null,
+  W013: null,
+  W014: "Bad line breaking before '{a}'.",
+  W015: null,
+  W016: "Unexpected use of '{a}'.",
+  W017: "Bad operand.",
+  W018: "Confusing use of '{a}'.",
+  W019: "Use the isNaN function to compare with NaN.",
+  W020: "Read only.",
+  W021: "Reassignment of '{a}', which is is a {b}. " +
+    "Use 'var' or 'let' to declare bindings that may change.",
+  W022: "Do not assign to the exception parameter.",
+  W023: "Expected an identifier in an assignment and instead saw a function invocation.",
+  W024: "Expected an identifier and instead saw '{a}' (a reserved word).",
+  W025: "Missing name in function declaration.",
+  W026: "Inner functions should be listed at the top of the outer function.",
+  W027: "Unreachable '{a}' after '{b}'.",
+  W028: "Label '{a}' on {b} statement.",
+  W030: "Expected an assignment or function call and instead saw an expression.",
+  W031: "Do not use 'new' for side effects.",
+  W032: "Unnecessary semicolon.",
+  W033: "Missing semicolon.",
+  W034: "Unnecessary directive \"{a}\".",
+  W035: "Empty block.",
+  W036: "Unexpected /*member '{a}'.",
+  W037: "'{a}' is a statement label.",
+  W038: "'{a}' used out of scope.",
+  W039: "'{a}' is not allowed.",
+  W040: "Possible strict violation.",
+  W041: "Use '{a}' to compare with '{b}'.",
+  W042: "Avoid EOL escaping.",
+  W043: "Bad escaping of EOL. Use option multistr if needed.",
+  W044: "Bad or unnecessary escaping.", /* TODO(caitp): remove W044 */
+  W045: "Bad number '{a}'.",
+  W046: "Don't use extra leading zeros '{a}'.",
+  W047: "A trailing decimal point can be confused with a dot: '{a}'.",
+  W048: "Unexpected control character in regular expression.",
+  W049: "Unexpected escaped character '{a}' in regular expression.",
+  W050: "JavaScript URL.",
+  W051: "Variables should not be deleted.",
+  W052: "Unexpected '{a}'.",
+  W053: "Do not use {a} as a constructor.",
+  W054: "The Function constructor is a form of eval.",
+  W055: "A constructor name should start with an uppercase letter.",
+  W056: "Bad constructor.",
+  W057: "Weird construction. Is 'new' necessary?",
+  W058: "Missing '()' invoking a constructor.",
+  W059: "Avoid arguments.{a}.",
+  W060: "document.write can be a form of eval.",
+  W061: "eval can be harmful.",
+  W062: "Wrap an immediate function invocation in parens " +
+    "to assist the reader in understanding that the expression " +
+    "is the result of a function, and not the function itself.",
+  W063: "Math is not a function.",
+  W064: "Missing 'new' prefix when invoking a constructor.",
+  W065: "Missing radix parameter.",
+  W066: "Implied eval. Consider passing a function instead of a string.",
+  W067: "Bad invocation.",
+  W068: "Wrapping non-IIFE function literals in parens is unnecessary.",
+  W069: "['{a}'] is better written in dot notation.",
+  W070: "Extra comma. (it breaks older versions of IE)",
+  W071: "This function has too many statements. ({a})",
+  W072: "This function has too many parameters. ({a})",
+  W073: "Blocks are nested too deeply. ({a})",
+  W074: "This function's cyclomatic complexity is too high. ({a})",
+  W075: "Duplicate {a} '{b}'.",
+  W076: "Unexpected parameter '{a}' in get {b} function.",
+  W077: "Expected a single parameter in set {a} function.",
+  W078: "Setter is defined without getter.",
+  W079: "Redefinition of '{a}'.",
+  W080: "It's not necessary to initialize '{a}' to 'undefined'.",
+  W081: null,
+  W082: "Function declarations should not be placed in blocks. " +
+    "Use a function expression or move the statement to the top of " +
+    "the outer function.",
+  W083: "Don't make functions within a loop.",
+  W084: "Expected a conditional expression and instead saw an assignment.",
+  W085: "Don't use 'with'.",
+  W086: "Expected a 'break' statement before '{a}'.",
+  W087: "Forgotten 'debugger' statement?",
+  W088: "Creating global 'for' variable. Should be 'for (var {a} ...'.",
+  W089: "The body of a for in should be wrapped in an if statement to filter " +
+    "unwanted properties from the prototype.",
+  W090: "'{a}' is not a statement label.",
+  W091: null,
+  W093: "Did you mean to return a conditional instead of an assignment?",
+  W094: "Unexpected comma.",
+  W095: "Expected a string and instead saw {a}.",
+  W096: "The '{a}' key may produce unexpected results.",
+  W097: "Use the function form of \"use strict\".",
+  W098: "'{a}' is defined but never used.",
+  W099: null,
+  W100: "This character may get silently deleted by one or more browsers.",
+  W101: "Line is too long.",
+  W102: null,
+  W103: "The '{a}' property is deprecated.",
+  W104: "'{a}' is available in ES{b} (use 'esversion: {b}') or Mozilla JS extensions (use moz).",
+  W105: "Unexpected {a} in '{b}'.",
+  W106: "Identifier '{a}' is not in camel case.",
+  W107: "Script URL.",
+  W108: "Strings must use doublequote.",
+  W109: "Strings must use singlequote.",
+  W110: "Mixed double and single quotes.",
+  W112: "Unclosed string.",
+  W113: "Control character in string: {a}.",
+  W114: "Avoid {a}.",
+  W115: "Octal literals are not allowed in strict mode.",
+  W116: "Expected '{a}' and instead saw '{b}'.",
+  W117: "'{a}' is not defined.",
+  W118: "'{a}' is only available in Mozilla JavaScript extensions (use moz option).",
+  W119: "'{a}' is only available in ES{b} (use 'esversion: {b}').",
+  W120: "You might be leaking a variable ({a}) here.",
+  W121: "Extending prototype of native object: '{a}'.",
+  W122: "Invalid typeof value '{a}'",
+  W123: "'{a}' is already defined in outer scope.",
+  W124: "A generator function shall contain a yield statement.",
+  W125: "This line contains non-breaking spaces: http://jshint.com/docs/options/#nonbsp",
+  W126: "Unnecessary grouping operator.",
+  W127: "Unexpected use of a comma operator.",
+  W128: "Empty array elements require elision=true.",
+  W129: "'{a}' is defined in a future version of JavaScript. Use a " +
+    "different variable name to avoid migration issues.",
+  W130: "Invalid element after rest element.",
+  W131: "Invalid parameter after rest parameter.",
+  W132: "`var` declarations are forbidden. Use `let` or `const` instead.",
+  W133: "Invalid for-{a} loop left-hand-side: {b}.",
+  W134: "The '{a}' option is only available when linting ECMAScript {b} code.",
+  W135: "{a} may not be supported by non-browser environments.",
+  W136: "'{a}' must be in function scope.",
+  W137: "Empty destructuring.",
+  W138: "Regular parameters should not come after default parameters."
+};
+
+var info = {
+  I001: "Comma warnings can be turned off with 'laxcomma'.",
+  I002: null,
+  I003: "ES5 option is now set per default"
+};
+
+exports.errors = {};
+exports.warnings = {};
+exports.info = {};
+
+_.each(errors, function(desc, code) {
+  exports.errors[code] = { code: code, desc: desc };
+});
+
+_.each(warnings, function(desc, code) {
+  exports.warnings[code] = { code: code, desc: desc };
+});
+
+_.each(info, function(desc, code) {
+  exports.info[code] = { code: code, desc: desc };
+});

samples/client/petstore-security-test/javascript/node_modules/jshint/src/name-stack.js

@@ -0,0 +1,74 @@
+"use strict";
+
+function NameStack() {
+  this._stack = [];
+}
+
+Object.defineProperty(NameStack.prototype, "length", {
+  get: function() {
+    return this._stack.length;
+  }
+});
+
+/**
+ * Create a new entry in the stack. Useful for tracking names across
+ * expressions.
+ */
+NameStack.prototype.push = function() {
+  this._stack.push(null);
+};
+
+/**
+ * Discard the most recently-created name on the stack.
+ */
+NameStack.prototype.pop = function() {
+  this._stack.pop();
+};
+
+/**
+ * Update the most recent name on the top of the stack.
+ *
+ * @param {object} token The token to consider as the source for the most
+ *                       recent name.
+ */
+NameStack.prototype.set = function(token) {
+  this._stack[this.length - 1] = token;
+};
+
+/**
+ * Generate a string representation of the most recent name.
+ *
+ * @returns {string}
+ */
+NameStack.prototype.infer = function() {
+  var nameToken = this._stack[this.length - 1];
+  var prefix = "";
+  var type;
+
+  // During expected operation, the topmost entry on the stack will only
+  // reflect the current function's name when the function is declared without
+  // the `function` keyword (i.e. for in-line accessor methods). In other
+  // cases, the `function` expression itself will introduce an empty entry on
+  // the top of the stack, and this should be ignored.
+  if (!nameToken || nameToken.type === "class") {
+    nameToken = this._stack[this.length - 2];
+  }
+
+  if (!nameToken) {
+    return "(empty)";
+  }
+
+  type = nameToken.type;
+
+  if (type !== "(string)" && type !== "(number)" && type !== "(identifier)" && type !== "default") {
+    return "(expression)";
+  }
+
+  if (nameToken.accessorType) {
+    prefix = nameToken.accessorType + " ";
+  }
+
+  return prefix + nameToken.value;
+};
+
+module.exports = NameStack;

samples/client/petstore-security-test/javascript/node_modules/jshint/src/platforms/rhino.js

@@ -0,0 +1,115 @@
+/*jshint boss: true, rhino: true, unused: true, undef: true, quotmark: double */
+/*global JSHINT, readFully */
+
+(function(args) {
+  "use strict";
+
+  var filenames = [];
+  var flags     = {};
+  var opts      = {};
+  var globals   = {};
+  var retval    = 0;
+  var readf     = (typeof readFully === "function" ? readFully : readFile);
+
+  var optstr; // arg1=val1,arg2=val2,...
+  var predef; // global1=true,global2,global3,...
+
+  args.forEach(function(arg) {
+    if (arg.indexOf("--") === 0) {
+      // Configuration Flags might be boolean or will be split into name and value
+      if (arg.indexOf("=") > -1) {
+        var o = arg.split("=");
+        flags[o[0].slice(2)] = o[1];
+      } else {
+        flags[arg.slice(2)] = true;
+      }
+
+      return;
+    } else if (arg.indexOf("=") > -1) {
+      // usual rhino configuration, like "boss=true,browser=true"
+      if (!optstr) {
+        // First time it's the options.
+        optstr = arg;
+      } else {
+        predef = arg;
+      }
+
+      return;
+    }
+
+    if (optstr) {
+      predef = arg;
+      return;
+    }
+
+    filenames.push(arg);
+  });
+
+  if (filenames.length === 0) {
+    print("Usage: jshint.js file.js");
+    quit(1);
+  }
+
+  // If a config flag has been provided, try and load that
+  if ("config" in flags) {
+    var cfgFileContent;
+    try {
+      cfgFileContent = readf(flags.config);
+    } catch (e) {
+      print("Could not read config file " + flags.config);
+      quit(1);
+    }
+
+    opts = JSON.parse(cfgFileContent);
+  }
+
+  if (optstr) {
+    optstr.split(",").forEach(function(arg) {
+      var o = arg.split("=");
+      if (o[0] === "indent") {
+        opts[o[0]] = parseInt(o[1], 10);
+      } else {
+        opts[o[0]] = (function(ov) {
+          switch (ov) {
+          case "true":
+            return true;
+          case "false":
+            return false;
+          default:
+            return ov;
+          }
+        }(o[1]));
+      }
+    });
+  }
+
+  globals = opts.globals || {};
+  delete(opts.globals);
+
+  if (predef) {
+    predef.split(",").forEach(function(arg) {
+      var global = arg.split("=");
+      globals[global[0]] = global[1] === "true" ? true : false;
+    });
+  }
+
+  filenames.forEach(function(name) {
+    var input = readf(name);
+
+    if (!input) {
+      print("jshint: Couldn't open file " + name);
+      quit(1);
+    }
+
+    if (!JSHINT(input, opts, globals)) {
+      for (var i = 0, err; err = JSHINT.errors[i]; i += 1) {
+        print(err.reason + " (" + name + ":" + err.line + ":" + err.character + ")");
+        print("> " + (err.evidence || "").replace(/^\s*(\S*(\s+\S+)*)\s*$/, "$1"));
+        print("");
+      }
+      retval = 2;
+    }
+  });
+
+  quit(retval);
+}(arguments));

samples/client/petstore-security-test/javascript/node_modules/jshint/src/reg.js

@@ -0,0 +1,38 @@
+/*
+ * Regular expressions. Some of these are stupidly long.
+ */
+
+/*jshint maxlen:1000 */
+
+"use strict";
+
+// Unsafe comment or string (ax)
+exports.unsafeString =
+  /@cc|<\/?|script|\]\s*\]|<\s*!|&lt/i;
+
+// Unsafe characters that are silently deleted by one or more browsers (cx)
+exports.unsafeChars =
+  /[\u0000-\u001f\u007f-\u009f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/;
+
+// Characters in strings that need escaping (nx and nxg)
+exports.needEsc =
+  /[\u0000-\u001f&<"\/\\\u007f-\u009f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/;
+
+exports.needEscGlobal =
+  /[\u0000-\u001f&<"\/\\\u007f-\u009f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;
+
+// Star slash (lx)
+exports.starSlash = /\*\//;
+
+// Identifier (ix)
+exports.identifier = /^([a-zA-Z_$][a-zA-Z0-9_$]*)$/;
+
+// JavaScript URL (jx)
+exports.javascriptURL = /^(?:javascript|jscript|ecmascript|vbscript|livescript)\s*:/i;
+
+// Catches /* falls through */ comments (ft)
+exports.fallsThrough = /^\s*falls?\sthrough\s*$/;
+
+// very conservative rule (eg: only one space between the start of the comment and the first character)
+// to relax the maxlen option
+exports.maxlenException = /^(?:(?:\/\/|\/\*|\*) ?)?[^ ]+$/;

samples/client/petstore-security-test/javascript/node_modules/jshint/src/reporters/checkstyle.js

@@ -0,0 +1,94 @@
+// Author: Boy Baukema
+// http://github.com/relaxnow
+module.exports =
+{
+  reporter: function(results, data, opts) {
+    "use strict";
+
+    var files = {},
+      out = [],
+      pairs = {
+        "&": "&",
+        '"': """,
+        "'": "'",
+        "<": "&lt;",
+        ">": "&gt;"
+      },
+      fileName, i, issue, errorMessage;
+
+    opts = opts || {};
+
+    function encode(s) {
+      for (var r in pairs) {
+        if (typeof(s) !== "undefined") {
+          s = s.replace(new RegExp(r, "g"), pairs[r]);
+        }
+      }
+      return s || "";
+    }
+
+    results.forEach(function(result) {
+      // Register the file
+      result.file = result.file.replace(/^\.\//, '');
+      if (!files[result.file]) {
+        files[result.file] = [];
+      }
+
+      // Create the error message
+      errorMessage = result.error.reason;
+      if (opts.verbose) {
+        errorMessage += ' (' + result.error.code + ')';
+      }
+
+      var typeNo = result.error.code;
+      var severity = '';
+      switch (typeNo[0]) {
+        case 'I':
+          severity = 'info';
+          break;
+        case 'W':
+          severity = 'warning';
+          break;
+        case 'E':
+          severity = 'error';
+          break;
+      }
+
+      // Add the error
+      files[result.file].push({
+        severity: severity,
+        line: result.error.line,
+        column: result.error.character,
+        message: errorMessage,
+        source: 'jshint.' + result.error.code
+      });
+    });
+
+
+    out.push("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
+    out.push("<checkstyle version=\"4.3\">");
+
+    for (fileName in files) {
+      if (files.hasOwnProperty(fileName)) {
+        out.push("\t<file name=\"" + fileName + "\">");
+        for (i = 0; i < files[fileName].length; i++) {
+          issue = files[fileName][i];
+          out.push(
+            "\t\t<error " +
+              "line=\"" + issue.line + "\" " +
+              "column=\"" + issue.column + "\" " +
+              "severity=\"" + issue.severity + "\" " +
+              "message=\"" + encode(issue.message) + "\" " +
+              "source=\"" + encode(issue.source) + "\" " +
+              "/>"
+          );
+        }
+        out.push("\t</file>");
+      }
+    }
+
+    out.push("</checkstyle>");
+
+    console.log(out.join("\n"));
+  }
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/src/reporters/default.js

@@ -0,0 +1,34 @@
+"use strict";
+
+module.exports = {
+  reporter: function(results, data, opts) {
+    var len = results.length;
+    var str = '';
+    var prevfile;
+
+    opts = opts || {};
+
+    results.forEach(function(result) {
+      var file = result.file;
+      var error = result.error;
+
+      if (prevfile && prevfile !== file) {
+        str += "\n";
+      }
+      prevfile = file;
+
+      str += file  + ': line ' + error.line + ', col ' +
+        error.character + ', ' + error.reason;
+
+      if (opts.verbose) {
+        str += ' (' + error.code + ')';
+      }
+
+      str += '\n';
+    });
+
+    if (str) {
+      console.log(str + "\n" + len + ' error' + ((len === 1) ? '' : 's'));
+    }
+  }
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/src/reporters/jslint_xml.js

@@ -0,0 +1,56 @@
+module.exports =
+{
+  reporter: function(results) {
+    "use strict";
+
+    var files = {},
+    out = [],
+    pairs = {
+      "&": "&",
+      '"': """,
+      "'": "'",
+      "<": "&lt;",
+      ">": "&gt;"
+    },
+    file, i, issue;
+
+    function encode(s) {
+      for (var r in pairs) {
+        if (typeof(s) !== "undefined") {
+          s = s.replace(new RegExp(r, "g"), pairs[r]);
+        }
+      }
+      return s || "";
+    }
+
+
+    results.forEach(function(result) {
+      result.file = result.file.replace(/^\.\//, '');
+      if (!files[result.file]) {
+        files[result.file] = [];
+      }
+      files[result.file].push(result.error);
+    });
+
+    out.push("<?xml version=\"1.0\" encoding=\"utf-8\"?>");
+    out.push("<jslint>");
+
+    for (file in files) {
+      out.push("\t<file name=\"" + file + "\">");
+      for (i = 0; i < files[file].length; i++) {
+        issue = files[file][i];
+        out.push("\t\t<issue line=\"" + issue.line +
+          "\" char=\"" + issue.character +
+          "\" reason=\"" + encode(issue.reason) +
+          "\" evidence=\"" + encode(issue.evidence) +
+          (issue.code ? "\" severity=\"" + encode(issue.code.charAt(0)) : "") +
+          "\" />");
+      }
+      out.push("\t</file>");
+    }
+
+    out.push("</jslint>");
+
+    console.log(out.join("\n") + "\n");
+  }
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/src/reporters/non_error.js

@@ -0,0 +1,52 @@
+"use strict";
+
+module.exports = {
+  reporter: function(results, data, opts) {
+    var len = results.length,
+      str = '',
+      file, error, globals, unuseds;
+
+    results.forEach(function(result) {
+      file = result.file;
+      error = result.error;
+      str += file  + ': line ' + error.line + ', col ' +
+        error.character + ', ' + error.reason;
+
+      // Add the error code if the --verbose option is set
+      if (opts.verbose) {
+        str += ' (' + error.code + ')';
+      }
+
+      str += '\n';
+    });
+
+    str += len > 0 ? ("\n" + len + ' error' + ((len === 1) ? '' : 's')) : "";
+
+    data.forEach(function(data) {
+      file = data.file;
+      globals = data.implieds;
+      unuseds = data.unused;
+
+      if (globals || unuseds) {
+        str += '\n\n' + file  + ' :\n';
+      }
+
+      if (globals) {
+        str += '\tImplied globals:\n';
+        globals.forEach(function(global) {
+          str += '\t\t' + global.name  + ': ' + global.line + '\n';
+        });
+      }
+      if (unuseds) {
+        str += '\tUnused Variables:\n\t\t';
+        unuseds.forEach(function(unused) {
+          str += unused.name + '(' + unused.line + '), ';
+        });
+      }
+    });
+
+    if (str) {
+      console.log(str + "\n");
+    }
+  }
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/src/reporters/unix.js

@@ -0,0 +1,37 @@
+"use strict";
+
+// Reporter that respects Unix output conventions
+// frequently employed by preprocessors and compilers.
+// The format is "FILENAME:LINE:COL: MESSAGE".
+
+module.exports = {
+  reporter: function(results, data, opts) {
+    var len = results.length;
+    var str = "";
+    var prevfile;
+
+    opts = opts || {};
+
+    results.forEach(function(result) {
+      var file = result.file;
+      var error = result.error;
+
+      if (prevfile && prevfile !== file) {
+        str += "\n";
+      }
+      prevfile = file;
+
+      str += file + ":" + error.line + ":" + error.character + ": " + error.reason;
+
+      if (opts.verbose) {
+        str += " (" + error.code + ")";
+      }
+
+      str += "\n";
+    });
+
+    if (str) {
+      console.log(str + "\n" + len + " error" + ((len === 1) ? "" : "s"));
+    }
+  }
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/src/scope-manager.js

@@ -0,0 +1,857 @@
+"use strict";
+
+var _      = require("lodash");
+var events = require("events");
+
+// Used to denote membership in lookup tables (a primitive value such as `true`
+// would be silently rejected for the property name "__proto__" in some
+// environments)
+var marker = {};
+
+/**
+ * Creates a scope manager that handles variables and labels, storing usages
+ * and resolving when variables are used and undefined
+ */
+var scopeManager = function(state, predefined, exported, declared) {
+
+  var _current;
+  var _scopeStack = [];
+
+  function _newScope(type) {
+    _current = {
+      "(labels)": Object.create(null),
+      "(usages)": Object.create(null),
+      "(breakLabels)": Object.create(null),
+      "(parent)": _current,
+      "(type)": type,
+      "(params)": (type === "functionparams" || type === "catchparams") ? [] : null
+    };
+    _scopeStack.push(_current);
+  }
+
+  _newScope("global");
+  _current["(predefined)"] = predefined;
+
+  var _currentFunctBody = _current; // this is the block after the params = function
+
+  var usedPredefinedAndGlobals = Object.create(null);
+  var impliedGlobals = Object.create(null);
+  var unuseds = [];
+  var emitter = new events.EventEmitter();
+
+  function warning(code, token) {
+    emitter.emit("warning", {
+      code: code,
+      token: token,
+      data: _.slice(arguments, 2)
+    });
+  }
+
+  function error(code, token) {
+    emitter.emit("warning", {
+      code: code,
+      token: token,
+      data: _.slice(arguments, 2)
+    });
+  }
+
+  function _setupUsages(labelName) {
+    if (!_current["(usages)"][labelName]) {
+      _current["(usages)"][labelName] = {
+        "(modified)": [],
+        "(reassigned)": [],
+        "(tokens)": []
+      };
+    }
+  }
+
+  var _getUnusedOption = function(unused_opt) {
+    if (unused_opt === undefined) {
+      unused_opt = state.option.unused;
+    }
+
+    if (unused_opt === true) {
+      unused_opt = "last-param";
+    }
+
+    return unused_opt;
+  };
+
+  var _warnUnused = function(name, tkn, type, unused_opt) {
+    var line = tkn.line;
+    var chr  = tkn.from;
+    var raw_name = tkn.raw_text || name;
+
+    unused_opt = _getUnusedOption(unused_opt);
+
+    var warnable_types = {
+      "vars": ["var"],
+      "last-param": ["var", "param"],
+      "strict": ["var", "param", "last-param"]
+    };
+
+    if (unused_opt) {
+      if (warnable_types[unused_opt] && warnable_types[unused_opt].indexOf(type) !== -1) {
+        warning("W098", { line: line, from: chr }, raw_name);
+      }
+    }
+
+    // inconsistent - see gh-1894
+    if (unused_opt || type === "var") {
+      unuseds.push({
+        name: name,
+        line: line,
+        character: chr
+      });
+    }
+  };
+
+  /**
+   * Checks the current scope for unused identifiers
+   */
+  function _checkForUnused() {
+    // function params are handled specially
+    // assume that parameters are the only thing declared in the param scope
+    if (_current["(type)"] === "functionparams") {
+      _checkParams();
+      return;
+    }
+    var curentLabels = _current["(labels)"];
+    for (var labelName in curentLabels) {
+      if (curentLabels[labelName]) {
+        if (curentLabels[labelName]["(type)"] !== "exception" &&
+          curentLabels[labelName]["(unused)"]) {
+          _warnUnused(labelName, curentLabels[labelName]["(token)"], "var");
+        }
+      }
+    }
+  }
+
+  /**
+   * Checks the current scope for unused parameters
+   * Must be called in a function parameter scope
+   */
+  function _checkParams() {
+    var params = _current["(params)"];
+
+    if (!params) {
+      return;
+    }
+
+    var param = params.pop();
+    var unused_opt;
+
+    while (param) {
+      var label = _current["(labels)"][param];
+
+      unused_opt = _getUnusedOption(state.funct["(unusedOption)"]);
+
+      // 'undefined' is a special case for (function(window, undefined) { ... })();
+      // patterns.
+      if (param === "undefined")
+        return;
+
+      if (label["(unused)"]) {
+        _warnUnused(param, label["(token)"], "param", state.funct["(unusedOption)"]);
+      } else if (unused_opt === "last-param") {
+        return;
+      }
+
+      param = params.pop();
+    }
+  }
+
+  /**
+   * Finds the relevant label's scope, searching from nearest outwards
+   * @returns {Object} the scope the label was found in
+   */
+  function _getLabel(labelName) {
+    for (var i = _scopeStack.length - 1 ; i >= 0; --i) {
+      var scopeLabels = _scopeStack[i]["(labels)"];
+      if (scopeLabels[labelName]) {
+        return scopeLabels;
+      }
+    }
+  }
+
+  function usedSoFarInCurrentFunction(labelName) {
+    // used so far in this whole function and any sub functions
+    for (var i = _scopeStack.length - 1; i >= 0; i--) {
+      var current = _scopeStack[i];
+      if (current["(usages)"][labelName]) {
+        return current["(usages)"][labelName];
+      }
+      if (current === _currentFunctBody) {
+        break;
+      }
+    }
+    return false;
+  }
+
+  function _checkOuterShadow(labelName, token) {
+
+    // only check if shadow is outer
+    if (state.option.shadow !== "outer") {
+      return;
+    }
+
+    var isGlobal = _currentFunctBody["(type)"] === "global",
+      isNewFunction = _current["(type)"] === "functionparams";
+
+    var outsideCurrentFunction = !isGlobal;
+    for (var i = 0; i < _scopeStack.length; i++) {
+      var stackItem = _scopeStack[i];
+
+      if (!isNewFunction && _scopeStack[i + 1] === _currentFunctBody) {
+        outsideCurrentFunction = false;
+      }
+      if (outsideCurrentFunction && stackItem["(labels)"][labelName]) {
+        warning("W123", token, labelName);
+      }
+      if (stackItem["(breakLabels)"][labelName]) {
+        warning("W123", token, labelName);
+      }
+    }
+  }
+
+  function _latedefWarning(type, labelName, token) {
+    if (state.option.latedef) {
+      // if either latedef is strict and this is a function
+      //    or this is not a function
+      if ((state.option.latedef === true && type === "function") ||
+        type !== "function") {
+        warning("W003", token, labelName);
+      }
+    }
+  }
+
+  var scopeManagerInst = {
+
+    on: function(names, listener) {
+      names.split(" ").forEach(function(name) {
+        emitter.on(name, listener);
+      });
+    },
+
+    isPredefined: function(labelName) {
+      return !this.has(labelName) && _.has(_scopeStack[0]["(predefined)"], labelName);
+    },
+
+    /**
+     * Tell the manager we are entering a new block of code
+     * @param {string} [type] - The type of the block. Valid values are
+     *                          "functionparams", "catchparams" and
+     *                          "functionouter"
+     */
+    stack: function(type) {
+      var previousScope = _current;
+      _newScope(type);
+
+      if (!type && previousScope["(type)"] === "functionparams") {
+
+        _current["(isFuncBody)"] = true;
+        _current["(context)"] = _currentFunctBody;
+        _currentFunctBody = _current;
+      }
+    },
+
+    unstack: function() {
+      // jshint proto: true
+      var subScope = _scopeStack.length > 1 ? _scopeStack[_scopeStack.length - 2] : null;
+      var isUnstackingFunctionBody = _current === _currentFunctBody,
+        isUnstackingFunctionParams = _current["(type)"] === "functionparams",
+        isUnstackingFunctionOuter = _current["(type)"] === "functionouter";
+
+      var i, j;
+      var currentUsages = _current["(usages)"];
+      var currentLabels = _current["(labels)"];
+      var usedLabelNameList = Object.keys(currentUsages);
+
+      if (currentUsages.__proto__ && usedLabelNameList.indexOf("__proto__") === -1) {
+        usedLabelNameList.push("__proto__");
+      }
+
+      for (i = 0; i < usedLabelNameList.length; i++) {
+        var usedLabelName = usedLabelNameList[i];
+
+        var usage = currentUsages[usedLabelName];
+        var usedLabel = currentLabels[usedLabelName];
+        if (usedLabel) {
+          var usedLabelType = usedLabel["(type)"];
+
+          if (usedLabel["(useOutsideOfScope)"] && !state.option.funcscope) {
+            var usedTokens = usage["(tokens)"];
+            if (usedTokens) {
+              for (j = 0; j < usedTokens.length; j++) {
+                // Keep the consistency of https://github.com/jshint/jshint/issues/2409
+                if (usedLabel["(function)"] === usedTokens[j]["(function)"]) {
+                  error("W038", usedTokens[j], usedLabelName);
+                }
+              }
+            }
+          }
+
+          // mark the label used
+          _current["(labels)"][usedLabelName]["(unused)"] = false;
+
+          // check for modifying a const
+          if (usedLabelType === "const" && usage["(modified)"]) {
+            for (j = 0; j < usage["(modified)"].length; j++) {
+              error("E013", usage["(modified)"][j], usedLabelName);
+            }
+          }
+
+          // check for re-assigning a function declaration
+          if ((usedLabelType === "function" || usedLabelType === "class") &&
+              usage["(reassigned)"]) {
+            for (j = 0; j < usage["(reassigned)"].length; j++) {
+              if (!usage["(reassigned)"][j].ignoreW021) {
+                warning("W021", usage["(reassigned)"][j], usedLabelName, usedLabelType);
+              }
+            }
+          }
+          continue;
+        }
+
+        if (isUnstackingFunctionOuter) {
+          state.funct["(isCapturing)"] = true;
+        }
+
+        if (subScope) {
+          // not exiting the global scope, so copy the usage down in case its an out of scope usage
+          if (!subScope["(usages)"][usedLabelName]) {
+            subScope["(usages)"][usedLabelName] = usage;
+            if (isUnstackingFunctionBody) {
+              subScope["(usages)"][usedLabelName]["(onlyUsedSubFunction)"] = true;
+            }
+          } else {
+            var subScopeUsage = subScope["(usages)"][usedLabelName];
+            subScopeUsage["(modified)"] = subScopeUsage["(modified)"].concat(usage["(modified)"]);
+            subScopeUsage["(tokens)"] = subScopeUsage["(tokens)"].concat(usage["(tokens)"]);
+            subScopeUsage["(reassigned)"] =
+              subScopeUsage["(reassigned)"].concat(usage["(reassigned)"]);
+          }
+        } else {
+          // this is exiting global scope, so we finalise everything here - we are at the end of the file
+          if (typeof _current["(predefined)"][usedLabelName] === "boolean") {
+
+            // remove the declared token, so we know it is used
+            delete declared[usedLabelName];
+
+            // note it as used so it can be reported
+            usedPredefinedAndGlobals[usedLabelName] = marker;
+
+            // check for re-assigning a read-only (set to false) predefined
+            if (_current["(predefined)"][usedLabelName] === false && usage["(reassigned)"]) {
+              for (j = 0; j < usage["(reassigned)"].length; j++) {
+                if (!usage["(reassigned)"][j].ignoreW020) {
+                  warning("W020", usage["(reassigned)"][j]);
+                }
+              }
+            }
+          }
+          else {
+            // label usage is not predefined and we have not found a declaration
+            // so report as undeclared
+            if (usage["(tokens)"]) {
+              for (j = 0; j < usage["(tokens)"].length; j++) {
+                var undefinedToken = usage["(tokens)"][j];
+                // if its not a forgiven undefined (e.g. typof x)
+                if (!undefinedToken.forgiveUndef) {
+                  // if undef is on and undef was on when the token was defined
+                  if (state.option.undef && !undefinedToken.ignoreUndef) {
+                    warning("W117", undefinedToken, usedLabelName);
+                  }
+                  if (impliedGlobals[usedLabelName]) {
+                    impliedGlobals[usedLabelName].line.push(undefinedToken.line);
+                  } else {
+                    impliedGlobals[usedLabelName] = {
+                      name: usedLabelName,
+                      line: [undefinedToken.line]
+                    };
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+
+      // if exiting the global scope, we can warn about declared globals that haven't been used yet
+      if (!subScope) {
+        Object.keys(declared)
+          .forEach(function(labelNotUsed) {
+            _warnUnused(labelNotUsed, declared[labelNotUsed], "var");
+          });
+      }
+
+      // If this is not a function boundary, transfer function-scoped labels to
+      // the parent block (a rough simulation of variable hoisting). Previously
+      // existing labels in the parent block should take precedence so that things and stuff.
+      if (subScope && !isUnstackingFunctionBody &&
+        !isUnstackingFunctionParams && !isUnstackingFunctionOuter) {
+        var labelNames = Object.keys(currentLabels);
+        for (i = 0; i < labelNames.length; i++) {
+
+          var defLabelName = labelNames[i];
+          var defLabel = currentLabels[defLabelName];
+
+          if (!defLabel["(blockscoped)"] && defLabel["(type)"] !== "exception") {
+            var shadowed = subScope["(labels)"][defLabelName];
+
+            // Do not overwrite a label if it exists in the parent scope
+            // because it is shared by adjacent blocks. Copy the `unused`
+            // property so that any references found within the current block
+            // are counted toward that higher-level declaration.
+            if (shadowed) {
+              shadowed["(unused)"] &= defLabel["(unused)"];
+
+            // "Hoist" the variable to the parent block, decorating the label
+            // so that future references, though technically valid, can be
+            // reported as "out-of-scope" in the absence of the `funcscope`
+            // option.
+            } else {
+              defLabel["(useOutsideOfScope)"] =
+                // Do not warn about out-of-scope usages in the global scope
+                _currentFunctBody["(type)"] !== "global" &&
+                // When a higher scope contains a binding for the label, the
+                // label is a re-declaration and should not prompt "used
+                // out-of-scope" warnings.
+                !this.funct.has(defLabelName, { excludeCurrent: true });
+
+              subScope["(labels)"][defLabelName] = defLabel;
+            }
+
+            delete currentLabels[defLabelName];
+          }
+        }
+      }
+
+      _checkForUnused();
+
+      _scopeStack.pop();
+      if (isUnstackingFunctionBody) {
+        _currentFunctBody = _scopeStack[_.findLastIndex(_scopeStack, function(scope) {
+          // if function or if global (which is at the bottom so it will only return true if we call back)
+          return scope["(isFuncBody)"] || scope["(type)"] === "global";
+        })];
+      }
+
+      _current = subScope;
+    },
+
+    /**
+     * Add a param to the current scope
+     * @param {string} labelName
+     * @param {Token} token
+     * @param {string} [type="param"] param type
+     */
+    addParam: function(labelName, token, type) {
+      type = type || "param";
+
+      if (type === "exception") {
+        // if defined in the current function
+        var previouslyDefinedLabelType = this.funct.labeltype(labelName);
+        if (previouslyDefinedLabelType && previouslyDefinedLabelType !== "exception") {
+          // and has not been used yet in the current function scope
+          if (!state.option.node) {
+            warning("W002", state.tokens.next, labelName);
+          }
+        }
+      }
+
+      // The variable was declared in the current scope
+      if (_.has(_current["(labels)"], labelName)) {
+        _current["(labels)"][labelName].duplicated = true;
+
+      // The variable was declared in an outer scope
+      } else {
+        // if this scope has the variable defined, it's a re-definition error
+        _checkOuterShadow(labelName, token, type);
+
+        _current["(labels)"][labelName] = {
+          "(type)" : type,
+          "(token)": token,
+          "(unused)": true };
+
+        _current["(params)"].push(labelName);
+      }
+
+      if (_.has(_current["(usages)"], labelName)) {
+        var usage = _current["(usages)"][labelName];
+        // if its in a sub function it is not necessarily an error, just latedef
+        if (usage["(onlyUsedSubFunction)"]) {
+          _latedefWarning(type, labelName, token);
+        } else {
+          // this is a clear illegal usage for block scoped variables
+          warning("E056", token, labelName, type);
+        }
+      }
+    },
+
+    validateParams: function() {
+      // This method only concerns errors for function parameters
+      if (_currentFunctBody["(type)"] === "global") {
+        return;
+      }
+
+      var isStrict = state.isStrict();
+      var currentFunctParamScope = _currentFunctBody["(parent)"];
+
+      if (!currentFunctParamScope["(params)"]) {
+        return;
+      }
+
+      currentFunctParamScope["(params)"].forEach(function(labelName) {
+        var label = currentFunctParamScope["(labels)"][labelName];
+
+        if (label && label.duplicated) {
+          if (isStrict) {
+            warning("E011", label["(token)"], labelName);
+          } else if (state.option.shadow !== true) {
+            warning("W004", label["(token)"], labelName);
+          }
+        }
+      });
+    },
+
+    getUsedOrDefinedGlobals: function() {
+      // jshint proto: true
+      var list = Object.keys(usedPredefinedAndGlobals);
+
+      // If `__proto__` is used as a global variable name, its entry in the
+      // lookup table may not be enumerated by `Object.keys` (depending on the
+      // environment).
+      if (usedPredefinedAndGlobals.__proto__ === marker &&
+        list.indexOf("__proto__") === -1) {
+        list.push("__proto__");
+      }
+
+      return list;
+    },
+
+    /**
+     * Gets an array of implied globals
+     * @returns {Array.<{ name: string, line: Array.<number>}>}
+     */
+    getImpliedGlobals: function() {
+      // jshint proto: true
+      var values = _.values(impliedGlobals);
+      var hasProto = false;
+
+      // If `__proto__` is an implied global variable, its entry in the lookup
+      // table may not be enumerated by `_.values` (depending on the
+      // environment).
+      if (impliedGlobals.__proto__) {
+        hasProto = values.some(function(value) {
+          return value.name === "__proto__";
+        });
+
+        if (!hasProto) {
+          values.push(impliedGlobals.__proto__);
+        }
+      }
+
+      return values;
+    },
+
+    /**
+     * Returns a list of unused variables
+     * @returns {Array}
+     */
+    getUnuseds: function() {
+      return unuseds;
+    },
+
+    has: function(labelName) {
+      return Boolean(_getLabel(labelName));
+    },
+
+    labeltype: function(labelName) {
+      // returns a labels type or null if not present
+      var scopeLabels = _getLabel(labelName);
+      if (scopeLabels) {
+        return scopeLabels[labelName]["(type)"];
+      }
+      return null;
+    },
+
+    /**
+     * for the exported options, indicating a variable is used outside the file
+     */
+    addExported: function(labelName) {
+      var globalLabels = _scopeStack[0]["(labels)"];
+      if (_.has(declared, labelName)) {
+        // remove the declared token, so we know it is used
+        delete declared[labelName];
+      } else if (_.has(globalLabels, labelName)) {
+        globalLabels[labelName]["(unused)"] = false;
+      } else {
+        for (var i = 1; i < _scopeStack.length; i++) {
+          var scope = _scopeStack[i];
+          // if `scope.(type)` is not defined, it is a block scope
+          if (!scope["(type)"]) {
+            if (_.has(scope["(labels)"], labelName) &&
+                !scope["(labels)"][labelName]["(blockscoped)"]) {
+              scope["(labels)"][labelName]["(unused)"] = false;
+              return;
+            }
+          } else {
+            break;
+          }
+        }
+        exported[labelName] = true;
+      }
+    },
+
+    /**
+     * Mark an indentifier as es6 module exported
+     */
+    setExported: function(labelName, token) {
+      this.block.use(labelName, token);
+    },
+
+    /**
+     * adds an indentifier to the relevant current scope and creates warnings/errors as necessary
+     * @param {string} labelName
+     * @param {Object} opts
+     * @param {String} opts.type - the type of the label e.g. "param", "var", "let, "const", "function"
+     * @param {Token} opts.token - the token pointing at the declaration
+     */
+    addlabel: function(labelName, opts) {
+
+      var type  = opts.type;
+      var token = opts.token;
+      var isblockscoped = type === "let" || type === "const" || type === "class";
+      var isexported    = (isblockscoped ? _current : _currentFunctBody)["(type)"] === "global" &&
+                          _.has(exported, labelName);
+
+      // outer shadow check (inner is only on non-block scoped)
+      _checkOuterShadow(labelName, token, type);
+
+      // if is block scoped (let or const)
+      if (isblockscoped) {
+
+        var declaredInCurrentScope = _current["(labels)"][labelName];
+        // for block scoped variables, params are seen in the current scope as the root function
+        // scope, so check these too.
+        if (!declaredInCurrentScope && _current === _currentFunctBody &&
+          _current["(type)"] !== "global") {
+          declaredInCurrentScope = !!_currentFunctBody["(parent)"]["(labels)"][labelName];
+        }
+
+        // if its not already defined (which is an error, so ignore) and is used in TDZ
+        if (!declaredInCurrentScope && _current["(usages)"][labelName]) {
+          var usage = _current["(usages)"][labelName];
+          // if its in a sub function it is not necessarily an error, just latedef
+          if (usage["(onlyUsedSubFunction)"]) {
+            _latedefWarning(type, labelName, token);
+          } else {
+            // this is a clear illegal usage for block scoped variables
+            warning("E056", token, labelName, type);
+          }
+        }
+
+        // if this scope has the variable defined, its a re-definition error
+        if (declaredInCurrentScope) {
+          warning("E011", token, labelName);
+        }
+        else if (state.option.shadow === "outer") {
+
+          // if shadow is outer, for block scope we want to detect any shadowing within this function
+          if (scopeManagerInst.funct.has(labelName)) {
+            warning("W004", token, labelName);
+          }
+        }
+
+        scopeManagerInst.block.add(labelName, type, token, !isexported);
+
+      } else {
+
+        var declaredInCurrentFunctionScope = scopeManagerInst.funct.has(labelName);
+
+        // check for late definition, ignore if already declared
+        if (!declaredInCurrentFunctionScope && usedSoFarInCurrentFunction(labelName)) {
+          _latedefWarning(type, labelName, token);
+        }
+
+        // defining with a var or a function when a block scope variable of the same name
+        // is in scope is an error
+        if (scopeManagerInst.funct.has(labelName, { onlyBlockscoped: true })) {
+          warning("E011", token, labelName);
+        } else if (state.option.shadow !== true) {
+          // now since we didn't get any block scope variables, test for var/function
+          // shadowing
+          if (declaredInCurrentFunctionScope && labelName !== "__proto__") {
+
+            // see https://github.com/jshint/jshint/issues/2400
+            if (_currentFunctBody["(type)"] !== "global") {
+              warning("W004", token, labelName);
+            }
+          }
+        }
+
+        scopeManagerInst.funct.add(labelName, type, token, !isexported);
+
+        if (_currentFunctBody["(type)"] === "global" && !state.impliedClosure()) {
+          usedPredefinedAndGlobals[labelName] = marker;
+        }
+      }
+    },
+
+    funct: {
+      /**
+       * Returns the label type given certain options
+       * @param labelName
+       * @param {Object=} options
+       * @param {Boolean=} options.onlyBlockscoped - only include block scoped labels
+       * @param {Boolean=} options.excludeParams - exclude the param scope
+       * @param {Boolean=} options.excludeCurrent - exclude the current scope
+       * @returns {String}
+       */
+      labeltype: function(labelName, options) {
+        var onlyBlockscoped = options && options.onlyBlockscoped;
+        var excludeParams = options && options.excludeParams;
+        var currentScopeIndex = _scopeStack.length - (options && options.excludeCurrent ? 2 : 1);
+        for (var i = currentScopeIndex; i >= 0; i--) {
+          var current = _scopeStack[i];
+          if (current["(labels)"][labelName] &&
+            (!onlyBlockscoped || current["(labels)"][labelName]["(blockscoped)"])) {
+            return current["(labels)"][labelName]["(type)"];
+          }
+          var scopeCheck = excludeParams ? _scopeStack[ i - 1 ] : current;
+          if (scopeCheck && scopeCheck["(type)"] === "functionparams") {
+            return null;
+          }
+        }
+        return null;
+      },
+      /**
+       * Returns if a break label exists in the function scope
+       * @param {string} labelName
+       * @returns {boolean}
+       */
+      hasBreakLabel: function(labelName) {
+        for (var i = _scopeStack.length - 1; i >= 0; i--) {
+          var current = _scopeStack[i];
+
+          if (current["(breakLabels)"][labelName]) {
+            return true;
+          }
+          if (current["(type)"] === "functionparams") {
+            return false;
+          }
+        }
+        return false;
+      },
+      /**
+       * Returns if the label is in the current function scope
+       * See scopeManager.funct.labelType for options
+       */
+      has: function(labelName, options) {
+        return Boolean(this.labeltype(labelName, options));
+      },
+
+      /**
+       * Adds a new function scoped variable
+       * see block.add for block scoped
+       */
+      add: function(labelName, type, tok, unused) {
+        _current["(labels)"][labelName] = {
+          "(type)" : type,
+          "(token)": tok,
+          "(blockscoped)": false,
+          "(function)": _currentFunctBody,
+          "(unused)": unused };
+      }
+    },
+
+    block: {
+
+      /**
+       * is the current block global?
+       * @returns Boolean
+       */
+      isGlobal: function() {
+        return _current["(type)"] === "global";
+      },
+
+      use: function(labelName, token) {
+
+        // if resolves to current function params, then do not store usage just resolve
+        // this is because function(a) { var a; a = a; } will resolve to the param, not
+        // to the unset var
+        // first check the param is used
+        var paramScope = _currentFunctBody["(parent)"];
+        if (paramScope && paramScope["(labels)"][labelName] &&
+          paramScope["(labels)"][labelName]["(type)"] === "param") {
+
+          // then check its not declared by a block scope variable
+          if (!scopeManagerInst.funct.has(labelName,
+                { excludeParams: true, onlyBlockscoped: true })) {
+            paramScope["(labels)"][labelName]["(unused)"] = false;
+          }
+        }
+
+        if (token && (state.ignored.W117 || state.option.undef === false)) {
+          token.ignoreUndef = true;
+        }
+
+        _setupUsages(labelName);
+
+        _current["(usages)"][labelName]["(onlyUsedSubFunction)"] = false;
+
+        if (token) {
+          token["(function)"] = _currentFunctBody;
+          _current["(usages)"][labelName]["(tokens)"].push(token);
+        }
+      },
+
+      reassign: function(labelName, token) {
+        token.ignoreW020 = state.ignored.W020;
+        token.ignoreW021 = state.ignored.W021;
+
+        this.modify(labelName, token);
+
+        _current["(usages)"][labelName]["(reassigned)"].push(token);
+      },
+
+      modify: function(labelName, token) {
+
+        _setupUsages(labelName);
+
+        _current["(usages)"][labelName]["(onlyUsedSubFunction)"] = false;
+        _current["(usages)"][labelName]["(modified)"].push(token);
+      },
+
+      /**
+       * Adds a new variable
+       */
+      add: function(labelName, type, tok, unused) {
+        _current["(labels)"][labelName] = {
+          "(type)" : type,
+          "(token)": tok,
+          "(blockscoped)": true,
+          "(unused)": unused };
+      },
+
+      addBreakLabel: function(labelName, opts) {
+        var token = opts.token;
+        if (scopeManagerInst.funct.hasBreakLabel(labelName)) {
+          warning("E011", token, labelName);
+        }
+        else if (state.option.shadow === "outer") {
+          if (scopeManagerInst.funct.has(labelName)) {
+            warning("W004", token, labelName);
+          } else {
+            _checkOuterShadow(labelName, token);
+          }
+        }
+        _current["(breakLabels)"][labelName] = token;
+      }
+    }
+  };
+  return scopeManagerInst;
+};
+
+module.exports = scopeManager;

samples/client/petstore-security-test/javascript/node_modules/jshint/src/state.js

@@ -0,0 +1,150 @@
+"use strict";
+var NameStack = require("./name-stack.js");
+
+var state = {
+  syntax: {},
+
+  /**
+   * Determine if the code currently being linted is strict mode code.
+   *
+   * @returns {boolean}
+   */
+  isStrict: function() {
+    return this.directive["use strict"] || this.inClassBody ||
+      this.option.module || this.option.strict === "implied";
+  },
+
+  /**
+   * Determine if the current state warrants a warning for statements outside
+   * of strict mode code.
+   *
+   * While emitting warnings based on function scope would be more intuitive
+   * (and less noisy), JSHint observes statement-based semantics in order to
+   * preserve legacy behavior.
+   *
+   * This method does not take the state of the parser into account, making no
+   * distinction between global code and function code. Because the "missing
+   * 'use strict'" warning is *also* reported at function boundaries, this
+   * function interprets `strict` option values `true` and `undefined` as
+   * equivalent.
+   */
+  stmtMissingStrict: function() {
+    if (this.option.strict === "global") {
+      return true;
+    }
+
+    if (this.option.strict === false) {
+      return false;
+    }
+
+    if (this.option.globalstrict) {
+      return true;
+    }
+
+    return false;
+  },
+
+  allowsGlobalUsd: function() {
+    return this.option.strict === "global" || this.option.globalstrict ||
+      this.option.module || this.impliedClosure();
+  },
+
+  /**
+   * Determine if the current configuration describes an environment that is
+   * wrapped in an immediately-invoked function expression prior to evaluation.
+   *
+   * @returns {boolean}
+   */
+  impliedClosure: function() {
+    return this.option.node || this.option.phantom || this.option.browserify;
+  },
+
+  // Assumption: chronologically ES3 < ES5 < ES6 < Moz
+
+  inMoz: function() {
+    return this.option.moz;
+  },
+
+  /**
+   * @param {boolean} strict - When `true`, only consider ES6 when in
+   *                           "esversion: 6" code.
+   */
+  inES6: function(strict) {
+    if (strict) {
+      return this.esVersion === 6;
+    }
+    return this.option.moz || this.esVersion >= 6;
+  },
+
+  /**
+   * @param {boolean} strict - When `true`, return `true` only when
+   *                           esVersion is exactly 5
+   */
+  inES5: function(strict) {
+    if (strict) {
+      return (!this.esVersion || this.esVersion === 5) && !this.option.moz;
+    }
+    return !this.esVersion || this.esVersion >= 5 || this.option.moz;
+  },
+
+  /**
+   * Determine the current version of the input language by inspecting the
+   * value of all ECMAScript-version-related options. This logic is necessary
+   * to ensure compatibility with deprecated options `es3`, `es5`, and
+   * `esnext`, and it may be drastically simplified when those options are
+   * removed.
+   *
+   * @returns {string|null} - the name of any incompatible option detected,
+   *                          `null` otherwise
+   */
+  inferEsVersion: function() {
+    var badOpt = null;
+
+    if (this.option.esversion) {
+      if (this.option.es3) {
+        badOpt = "es3";
+      } else if (this.option.es5) {
+        badOpt = "es5";
+      } else if (this.option.esnext) {
+        badOpt = "esnext";
+      }
+
+      if (badOpt) {
+        return badOpt;
+      }
+
+      this.esVersion = this.option.esversion;
+    } else if (this.option.es3) {
+      this.esVersion = 3;
+    } else if (this.option.esnext) {
+      this.esVersion = 6;
+    }
+
+    return null;
+  },
+
+  reset: function() {
+    this.tokens = {
+      prev: null,
+      next: null,
+      curr: null
+    };
+
+    this.option = {};
+    this.esVersion = 5;
+    this.funct = null;
+    this.ignored = {};
+    this.directive = {};
+    this.jsonMode = false;
+    this.jsonWarnings = [];
+    this.lines = [];
+    this.tab = "";
+    this.cache = {}; // Node.JS doesn't have Map. Sniff.
+    this.ignoredLines = {};
+    this.forinifcheckneeded = false;
+    this.nameStack = new NameStack();
+    this.inClassBody = false;
+  }
+};
+
+exports.state = state;

samples/client/petstore-security-test/javascript/node_modules/jshint/src/style.js

@@ -0,0 +1,144 @@
+"use strict";
+
+exports.register = function(linter) {
+  // Check for properties named __proto__. This special property was
+  // deprecated and then re-introduced for ES6.
+
+  linter.on("Identifier", function style_scanProto(data) {
+    if (linter.getOption("proto")) {
+      return;
+    }
+
+    if (data.name === "__proto__") {
+      linter.warn("W103", {
+        line: data.line,
+        char: data.char,
+        data: [ data.name, "6" ]
+      });
+    }
+  });
+
+  // Check for properties named __iterator__. This is a special property
+  // available only in browsers with JavaScript 1.7 implementation, but
+  // it is deprecated for ES6
+
+  linter.on("Identifier", function style_scanIterator(data) {
+    if (linter.getOption("iterator")) {
+      return;
+    }
+
+    if (data.name === "__iterator__") {
+      linter.warn("W103", {
+        line: data.line,
+        char: data.char,
+        data: [ data.name ]
+      });
+    }
+  });
+
+  // Check that all identifiers are using camelCase notation.
+  // Exceptions: names like MY_VAR and _myVar.
+
+  linter.on("Identifier", function style_scanCamelCase(data) {
+    if (!linter.getOption("camelcase")) {
+      return;
+    }
+
+    if (data.name.replace(/^_+|_+$/g, "").indexOf("_") > -1 && !data.name.match(/^[A-Z0-9_]*$/)) {
+      linter.warn("W106", {
+        line: data.line,
+        char: data.char,
+        data: [ data.name ]
+      });
+    }
+  });
+
+  // Enforce consistency in style of quoting.
+
+  linter.on("String", function style_scanQuotes(data) {
+    var quotmark = linter.getOption("quotmark");
+    var code;
+
+    if (!quotmark) {
+      return;
+    }
+
+    // If quotmark is set to 'single' warn about all double-quotes.
+
+    if (quotmark === "single" && data.quote !== "'") {
+      code = "W109";
+    }
+
+    // If quotmark is set to 'double' warn about all single-quotes.
+
+    if (quotmark === "double" && data.quote !== "\"") {
+      code = "W108";
+    }
+
+    // If quotmark is set to true, remember the first quotation style
+    // and then warn about all others.
+
+    if (quotmark === true) {
+      if (!linter.getCache("quotmark")) {
+        linter.setCache("quotmark", data.quote);
+      }
+
+      if (linter.getCache("quotmark") !== data.quote) {
+        code = "W110";
+      }
+    }
+
+    if (code) {
+      linter.warn(code, {
+        line: data.line,
+        char: data.char,
+      });
+    }
+  });
+
+  linter.on("Number", function style_scanNumbers(data) {
+    if (data.value.charAt(0) === ".") {
+      // Warn about a leading decimal point.
+      linter.warn("W008", {
+        line: data.line,
+        char: data.char,
+        data: [ data.value ]
+      });
+    }
+
+    if (data.value.substr(data.value.length - 1) === ".") {
+      // Warn about a trailing decimal point.
+      linter.warn("W047", {
+        line: data.line,
+        char: data.char,
+        data: [ data.value ]
+      });
+    }
+
+    if (/^00+/.test(data.value)) {
+      // Multiple leading zeroes.
+      linter.warn("W046", {
+        line: data.line,
+        char: data.char,
+        data: [ data.value ]
+      });
+    }
+  });
+
+  // Warn about script URLs.
+
+  linter.on("String", function style_scanJavaScriptURLs(data) {
+    var re = /^(?:javascript|jscript|ecmascript|vbscript|livescript)\s*:/i;
+
+    if (linter.getOption("scripturl")) {
+      return;
+    }
+
+    if (re.test(data.value)) {
+      linter.warn("W107", {
+        line: data.line,
+        char: data.char
+      });
+    }
+  });
+};

samples/client/petstore-security-test/javascript/node_modules/jshint/src/vars.js

@@ -0,0 +1,725 @@
+// jshint -W001
+
+"use strict";
+
+// Identifiers provided by the ECMAScript standard.
+
+exports.reservedVars = {
+  arguments : false,
+  NaN       : false
+};
+
+exports.ecmaIdentifiers = {
+  3: {
+    Array              : false,
+    Boolean            : false,
+    Date               : false,
+    decodeURI          : false,
+    decodeURIComponent : false,
+    encodeURI          : false,
+    encodeURIComponent : false,
+    Error              : false,
+    "eval"             : false,
+    EvalError          : false,
+    Function           : false,
+    hasOwnProperty     : false,
+    isFinite           : false,
+    isNaN              : false,
+    Math               : false,
+    Number             : false,
+    Object             : false,
+    parseInt           : false,
+    parseFloat         : false,
+    RangeError         : false,
+    ReferenceError     : false,
+    RegExp             : false,
+    String             : false,
+    SyntaxError        : false,
+    TypeError          : false,
+    URIError           : false
+  },
+  5: {
+    JSON               : false
+  },
+  6: {
+    Map                : false,
+    Promise            : false,
+    Proxy              : false,
+    Reflect            : false,
+    Set                : false,
+    Symbol             : false,
+    WeakMap            : false,
+    WeakSet            : false
+  }
+};
+
+// Global variables commonly provided by a web browser environment.
+
+exports.browser = {
+  Audio                : false,
+  Blob                 : false,
+  addEventListener     : false,
+  applicationCache     : false,
+  atob                 : false,
+  blur                 : false,
+  btoa                 : false,
+  cancelAnimationFrame : false,
+  CanvasGradient       : false,
+  CanvasPattern        : false,
+  CanvasRenderingContext2D: false,
+  CSS                  : false,
+  clearInterval        : false,
+  clearTimeout         : false,
+  close                : false,
+  closed               : false,
+  Comment              : false,
+  CompositionEvent     : false,
+  CustomEvent          : false,
+  DOMParser            : false,
+  defaultStatus        : false,
+  Document             : false,
+  document             : false,
+  DocumentFragment     : false,
+  Element              : false,
+  ElementTimeControl   : false,
+  Event                : false,
+  event                : false,
+  fetch                : false,
+  File                 : false,
+  FileList             : false,
+  FileReader           : false,
+  FormData             : false,
+  focus                : false,
+  frames               : false,
+  getComputedStyle     : false,
+  HTMLElement          : false,
+  HTMLAnchorElement    : false,
+  HTMLBaseElement      : false,
+  HTMLBlockquoteElement: false,
+  HTMLBodyElement      : false,
+  HTMLBRElement        : false,
+  HTMLButtonElement    : false,
+  HTMLCanvasElement    : false,
+  HTMLCollection       : false,
+  HTMLDirectoryElement : false,
+  HTMLDivElement       : false,
+  HTMLDListElement     : false,
+  HTMLFieldSetElement  : false,
+  HTMLFontElement      : false,
+  HTMLFormElement      : false,
+  HTMLFrameElement     : false,
+  HTMLFrameSetElement  : false,
+  HTMLHeadElement      : false,
+  HTMLHeadingElement   : false,
+  HTMLHRElement        : false,
+  HTMLHtmlElement      : false,
+  HTMLIFrameElement    : false,
+  HTMLImageElement     : false,
+  HTMLInputElement     : false,
+  HTMLIsIndexElement   : false,
+  HTMLLabelElement     : false,
+  HTMLLayerElement     : false,
+  HTMLLegendElement    : false,
+  HTMLLIElement        : false,
+  HTMLLinkElement      : false,
+  HTMLMapElement       : false,
+  HTMLMenuElement      : false,
+  HTMLMetaElement      : false,
+  HTMLModElement       : false,
+  HTMLObjectElement    : false,
+  HTMLOListElement     : false,
+  HTMLOptGroupElement  : false,
+  HTMLOptionElement    : false,
+  HTMLParagraphElement : false,
+  HTMLParamElement     : false,
+  HTMLPreElement       : false,
+  HTMLQuoteElement     : false,
+  HTMLScriptElement    : false,
+  HTMLSelectElement    : false,
+  HTMLStyleElement     : false,
+  HTMLTableCaptionElement: false,
+  HTMLTableCellElement : false,
+  HTMLTableColElement  : false,
+  HTMLTableElement     : false,
+  HTMLTableRowElement  : false,
+  HTMLTableSectionElement: false,
+  HTMLTemplateElement  : false,
+  HTMLTextAreaElement  : false,
+  HTMLTitleElement     : false,
+  HTMLUListElement     : false,
+  HTMLVideoElement     : false,
+  history              : false,
+  Image                : false,
+  Intl                 : false,
+  length               : false,
+  localStorage         : false,
+  location             : false,
+  matchMedia           : false,
+  MessageChannel       : false,
+  MessageEvent         : false,
+  MessagePort          : false,
+  MouseEvent           : false,
+  moveBy               : false,
+  moveTo               : false,
+  MutationObserver     : false,
+  name                 : false,
+  Node                 : false,
+  NodeFilter           : false,
+  NodeList             : false,
+  Notification         : false,
+  navigator            : false,
+  onbeforeunload       : true,
+  onblur               : true,
+  onerror              : true,
+  onfocus              : true,
+  onload               : true,
+  onresize             : true,
+  onunload             : true,
+  open                 : false,
+  openDatabase         : false,
+  opener               : false,
+  Option               : false,
+  parent               : false,
+  performance          : false,
+  print                : false,
+  Range                : false,
+  requestAnimationFrame : false,
+  removeEventListener  : false,
+  resizeBy             : false,
+  resizeTo             : false,
+  screen               : false,
+  scroll               : false,
+  scrollBy             : false,
+  scrollTo             : false,
+  sessionStorage       : false,
+  setInterval          : false,
+  setTimeout           : false,
+  SharedWorker         : false,
+  status               : false,
+  SVGAElement          : false,
+  SVGAltGlyphDefElement: false,
+  SVGAltGlyphElement   : false,
+  SVGAltGlyphItemElement: false,
+  SVGAngle             : false,
+  SVGAnimateColorElement: false,
+  SVGAnimateElement    : false,
+  SVGAnimateMotionElement: false,
+  SVGAnimateTransformElement: false,
+  SVGAnimatedAngle     : false,
+  SVGAnimatedBoolean   : false,
+  SVGAnimatedEnumeration: false,
+  SVGAnimatedInteger   : false,
+  SVGAnimatedLength    : false,
+  SVGAnimatedLengthList: false,
+  SVGAnimatedNumber    : false,
+  SVGAnimatedNumberList: false,
+  SVGAnimatedPathData  : false,
+  SVGAnimatedPoints    : false,
+  SVGAnimatedPreserveAspectRatio: false,
+  SVGAnimatedRect      : false,
+  SVGAnimatedString    : false,
+  SVGAnimatedTransformList: false,
+  SVGAnimationElement  : false,
+  SVGCSSRule           : false,
+  SVGCircleElement     : false,
+  SVGClipPathElement   : false,
+  SVGColor             : false,
+  SVGColorProfileElement: false,
+  SVGColorProfileRule  : false,
+  SVGComponentTransferFunctionElement: false,
+  SVGCursorElement     : false,
+  SVGDefsElement       : false,
+  SVGDescElement       : false,
+  SVGDocument          : false,
+  SVGElement           : false,
+  SVGElementInstance   : false,
+  SVGElementInstanceList: false,
+  SVGEllipseElement    : false,
+  SVGExternalResourcesRequired: false,
+  SVGFEBlendElement    : false,
+  SVGFEColorMatrixElement: false,
+  SVGFEComponentTransferElement: false,
+  SVGFECompositeElement: false,
+  SVGFEConvolveMatrixElement: false,
+  SVGFEDiffuseLightingElement: false,
+  SVGFEDisplacementMapElement: false,
+  SVGFEDistantLightElement: false,
+  SVGFEFloodElement    : false,
+  SVGFEFuncAElement    : false,
+  SVGFEFuncBElement    : false,
+  SVGFEFuncGElement    : false,
+  SVGFEFuncRElement    : false,
+  SVGFEGaussianBlurElement: false,
+  SVGFEImageElement    : false,
+  SVGFEMergeElement    : false,
+  SVGFEMergeNodeElement: false,
+  SVGFEMorphologyElement: false,
+  SVGFEOffsetElement   : false,
+  SVGFEPointLightElement: false,
+  SVGFESpecularLightingElement: false,
+  SVGFESpotLightElement: false,
+  SVGFETileElement     : false,
+  SVGFETurbulenceElement: false,
+  SVGFilterElement     : false,
+  SVGFilterPrimitiveStandardAttributes: false,
+  SVGFitToViewBox      : false,
+  SVGFontElement       : false,
+  SVGFontFaceElement   : false,
+  SVGFontFaceFormatElement: false,
+  SVGFontFaceNameElement: false,
+  SVGFontFaceSrcElement: false,
+  SVGFontFaceUriElement: false,
+  SVGForeignObjectElement: false,
+  SVGGElement          : false,
+  SVGGlyphElement      : false,
+  SVGGlyphRefElement   : false,
+  SVGGradientElement   : false,
+  SVGHKernElement      : false,
+  SVGICCColor          : false,
+  SVGImageElement      : false,
+  SVGLangSpace         : false,
+  SVGLength            : false,
+  SVGLengthList        : false,
+  SVGLineElement       : false,
+  SVGLinearGradientElement: false,
+  SVGLocatable         : false,
+  SVGMPathElement      : false,
+  SVGMarkerElement     : false,
+  SVGMaskElement       : false,
+  SVGMatrix            : false,
+  SVGMetadataElement   : false,
+  SVGMissingGlyphElement: false,
+  SVGNumber            : false,
+  SVGNumberList        : false,
+  SVGPaint             : false,
+  SVGPathElement       : false,
+  SVGPathSeg           : false,
+  SVGPathSegArcAbs     : false,
+  SVGPathSegArcRel     : false,
+  SVGPathSegClosePath  : false,
+  SVGPathSegCurvetoCubicAbs: false,
+  SVGPathSegCurvetoCubicRel: false,
+  SVGPathSegCurvetoCubicSmoothAbs: false,
+  SVGPathSegCurvetoCubicSmoothRel: false,
+  SVGPathSegCurvetoQuadraticAbs: false,
+  SVGPathSegCurvetoQuadraticRel: false,
+  SVGPathSegCurvetoQuadraticSmoothAbs: false,
+  SVGPathSegCurvetoQuadraticSmoothRel: false,
+  SVGPathSegLinetoAbs  : false,
+  SVGPathSegLinetoHorizontalAbs: false,
+  SVGPathSegLinetoHorizontalRel: false,
+  SVGPathSegLinetoRel  : false,
+  SVGPathSegLinetoVerticalAbs: false,
+  SVGPathSegLinetoVerticalRel: false,
+  SVGPathSegList       : false,
+  SVGPathSegMovetoAbs  : false,
+  SVGPathSegMovetoRel  : false,
+  SVGPatternElement    : false,
+  SVGPoint             : false,
+  SVGPointList         : false,
+  SVGPolygonElement    : false,
+  SVGPolylineElement   : false,
+  SVGPreserveAspectRatio: false,
+  SVGRadialGradientElement: false,
+  SVGRect              : false,
+  SVGRectElement       : false,
+  SVGRenderingIntent   : false,
+  SVGSVGElement        : false,
+  SVGScriptElement     : false,
+  SVGSetElement        : false,
+  SVGStopElement       : false,
+  SVGStringList        : false,
+  SVGStylable          : false,
+  SVGStyleElement      : false,
+  SVGSwitchElement     : false,
+  SVGSymbolElement     : false,
+  SVGTRefElement       : false,
+  SVGTSpanElement      : false,
+  SVGTests             : false,
+  SVGTextContentElement: false,
+  SVGTextElement       : false,
+  SVGTextPathElement   : false,
+  SVGTextPositioningElement: false,
+  SVGTitleElement      : false,
+  SVGTransform         : false,
+  SVGTransformList     : false,
+  SVGTransformable     : false,
+  SVGURIReference      : false,
+  SVGUnitTypes         : false,
+  SVGUseElement        : false,
+  SVGVKernElement      : false,
+  SVGViewElement       : false,
+  SVGViewSpec          : false,
+  SVGZoomAndPan        : false,
+  Text                 : false,
+  TextDecoder          : false,
+  TextEncoder          : false,
+  TimeEvent            : false,
+  top                  : false,
+  URL                  : false,
+  WebGLActiveInfo      : false,
+  WebGLBuffer          : false,
+  WebGLContextEvent    : false,
+  WebGLFramebuffer     : false,
+  WebGLProgram         : false,
+  WebGLRenderbuffer    : false,
+  WebGLRenderingContext: false,
+  WebGLShader          : false,
+  WebGLShaderPrecisionFormat: false,
+  WebGLTexture         : false,
+  WebGLUniformLocation : false,
+  WebSocket            : false,
+  window               : false,
+  Window               : false,
+  Worker               : false,
+  XDomainRequest       : false,
+  XMLHttpRequest       : false,
+  XMLSerializer        : false,
+  XPathEvaluator       : false,
+  XPathException       : false,
+  XPathExpression      : false,
+  XPathNamespace       : false,
+  XPathNSResolver      : false,
+  XPathResult          : false
+};
+
+exports.devel = {
+  alert  : false,
+  confirm: false,
+  console: false,
+  Debug  : false,
+  opera  : false,
+  prompt : false
+};
+
+exports.worker = {
+  importScripts  : true,
+  postMessage    : true,
+  self           : true,
+  FileReaderSync : true
+};
+
+// Widely adopted global names that are not part of ECMAScript standard
+exports.nonstandard = {
+  escape  : false,
+  unescape: false
+};
+
+// Globals provided by popular JavaScript environments.
+
+exports.couch = {
+  "require" : false,
+  respond   : false,
+  getRow    : false,
+  emit      : false,
+  send      : false,
+  start     : false,
+  sum       : false,
+  log       : false,
+  exports   : false,
+  module    : false,
+  provides  : false
+};
+
+exports.node = {
+  __filename    : false,
+  __dirname     : false,
+  GLOBAL        : false,
+  global        : false,
+  module        : false,
+  require       : false,
+
+  // These globals are writeable because Node allows the following
+  // usage pattern: var Buffer = require("buffer").Buffer;
+
+  Buffer        : true,
+  console       : true,
+  exports       : true,
+  process       : true,
+  setTimeout    : true,
+  clearTimeout  : true,
+  setInterval   : true,
+  clearInterval : true,
+  setImmediate  : true, // v0.9.1+
+  clearImmediate: true  // v0.9.1+
+};
+
+exports.browserify = {
+  __filename    : false,
+  __dirname     : false,
+  global        : false,
+  module        : false,
+  require       : false,
+  Buffer        : true,
+  exports       : true,
+  process       : true
+};
+
+exports.phantom = {
+  phantom      : true,
+  require      : true,
+  WebPage      : true,
+  console      : true, // in examples, but undocumented
+  exports      : true  // v1.7+
+};
+
+exports.qunit = {
+  asyncTest      : false,
+  deepEqual      : false,
+  equal          : false,
+  expect         : false,
+  module         : false,
+  notDeepEqual   : false,
+  notEqual       : false,
+  notOk          : false,
+  notPropEqual   : false,
+  notStrictEqual : false,
+  ok             : false,
+  propEqual      : false,
+  QUnit          : false,
+  raises         : false,
+  start          : false,
+  stop           : false,
+  strictEqual    : false,
+  test           : false,
+  "throws"       : false
+};
+
+exports.rhino = {
+  defineClass  : false,
+  deserialize  : false,
+  gc           : false,
+  help         : false,
+  importClass  : false,
+  importPackage: false,
+  "java"       : false,
+  load         : false,
+  loadClass    : false,
+  Packages     : false,
+  print        : false,
+  quit         : false,
+  readFile     : false,
+  readUrl      : false,
+  runCommand   : false,
+  seal         : false,
+  serialize    : false,
+  spawn        : false,
+  sync         : false,
+  toint32      : false,
+  version      : false
+};
+
+exports.shelljs = {
+  target       : false,
+  echo         : false,
+  exit         : false,
+  cd           : false,
+  pwd          : false,
+  ls           : false,
+  find         : false,
+  cp           : false,
+  rm           : false,
+  mv           : false,
+  mkdir        : false,
+  test         : false,
+  cat          : false,
+  sed          : false,
+  grep         : false,
+  which        : false,
+  dirs         : false,
+  pushd        : false,
+  popd         : false,
+  env          : false,
+  exec         : false,
+  chmod        : false,
+  config       : false,
+  error        : false,
+  tempdir      : false
+};
+
+exports.typed = {
+  ArrayBuffer         : false,
+  ArrayBufferView     : false,
+  DataView            : false,
+  Float32Array        : false,
+  Float64Array        : false,
+  Int16Array          : false,
+  Int32Array          : false,
+  Int8Array           : false,
+  Uint16Array         : false,
+  Uint32Array         : false,
+  Uint8Array          : false,
+  Uint8ClampedArray   : false
+};
+
+exports.wsh = {
+  ActiveXObject            : true,
+  Enumerator               : true,
+  GetObject                : true,
+  ScriptEngine             : true,
+  ScriptEngineBuildVersion : true,
+  ScriptEngineMajorVersion : true,
+  ScriptEngineMinorVersion : true,
+  VBArray                  : true,
+  WSH                      : true,
+  WScript                  : true,
+  XDomainRequest           : true
+};
+
+// Globals provided by popular JavaScript libraries.
+
+exports.dojo = {
+  dojo     : false,
+  dijit    : false,
+  dojox    : false,
+  define   : false,
+  "require": false
+};
+
+exports.jquery = {
+  "$"    : false,
+  jQuery : false
+};
+
+exports.mootools = {
+  "$"           : false,
+  "$$"          : false,
+  Asset         : false,
+  Browser       : false,
+  Chain         : false,
+  Class         : false,
+  Color         : false,
+  Cookie        : false,
+  Core          : false,
+  Document      : false,
+  DomReady      : false,
+  DOMEvent      : false,
+  DOMReady      : false,
+  Drag          : false,
+  Element       : false,
+  Elements      : false,
+  Event         : false,
+  Events        : false,
+  Fx            : false,
+  Group         : false,
+  Hash          : false,
+  HtmlTable     : false,
+  IFrame        : false,
+  IframeShim    : false,
+  InputValidator: false,
+  instanceOf    : false,
+  Keyboard      : false,
+  Locale        : false,
+  Mask          : false,
+  MooTools      : false,
+  Native        : false,
+  Options       : false,
+  OverText      : false,
+  Request       : false,
+  Scroller      : false,
+  Slick         : false,
+  Slider        : false,
+  Sortables     : false,
+  Spinner       : false,
+  Swiff         : false,
+  Tips          : false,
+  Type          : false,
+  typeOf        : false,
+  URI           : false,
+  Window        : false
+};
+
+exports.prototypejs = {
+  "$"               : false,
+  "$$"              : false,
+  "$A"              : false,
+  "$F"              : false,
+  "$H"              : false,
+  "$R"              : false,
+  "$break"          : false,
+  "$continue"       : false,
+  "$w"              : false,
+  Abstract          : false,
+  Ajax              : false,
+  Class             : false,
+  Enumerable        : false,
+  Element           : false,
+  Event             : false,
+  Field             : false,
+  Form              : false,
+  Hash              : false,
+  Insertion         : false,
+  ObjectRange       : false,
+  PeriodicalExecuter: false,
+  Position          : false,
+  Prototype         : false,
+  Selector          : false,
+  Template          : false,
+  Toggle            : false,
+  Try               : false,
+  Autocompleter     : false,
+  Builder           : false,
+  Control           : false,
+  Draggable         : false,
+  Draggables        : false,
+  Droppables        : false,
+  Effect            : false,
+  Sortable          : false,
+  SortableObserver  : false,
+  Sound             : false,
+  Scriptaculous     : false
+};
+
+exports.yui = {
+  YUI       : false,
+  Y         : false,
+  YUI_config: false
+};
+
+exports.mocha = {
+  // Global (for config etc.)
+  mocha       : false,
+  // BDD
+  describe    : false,
+  xdescribe   : false,
+  it          : false,
+  xit         : false,
+  context     : false,
+  xcontext    : false,
+  before      : false,
+  after       : false,
+  beforeEach  : false,
+  afterEach   : false,
+  // TDD
+  suite         : false,
+  test          : false,
+  setup         : false,
+  teardown      : false,
+  suiteSetup    : false,
+  suiteTeardown : false
+};
+
+exports.jasmine = {
+  jasmine     : false,
+  describe    : false,
+  xdescribe   : false,
+  it          : false,
+  xit         : false,
+  beforeEach  : false,
+  afterEach   : false,
+  setFixtures : false,
+  loadFixtures: false,
+  spyOn       : false,
+  expect      : false,
+  // Jasmine 1.3
+  runs        : false,
+  waitsFor    : false,
+  waits       : false,
+  // Jasmine 2.1
+  beforeAll   : false,
+  afterAll    : false,
+  fail        : false,
+  fdescribe   : false,
+  fit         : false,
+  pending     : false
+};