Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Warn for javascript: URLs in DOM sinks #15047

Merged
merged 11 commits into from Mar 11, 2019
Merged

Warn for javascript: URLs in DOM sinks #15047

merged 11 commits into from Mar 11, 2019

Commits on Mar 11, 2019

  1. Allow framesets

    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    d56a22f View commit details
    Browse the repository at this point in the history

  2. Allow <html> to be used in integration tests 

    Full document renders requires server rendering so the client path
just uses the hydration path in this case to simplify writing these tests.
    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    38a27cb View commit details
    Browse the repository at this point in the history

  3. Prevent javascript protocol URLs

    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    968e0a0 View commit details
    Browse the repository at this point in the history

  4. Just warn when disableJavaScriptURLs is false 

    This avoids a breaking change.
    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    3c7e4d4 View commit details
    Browse the repository at this point in the history

  5. Detect leading and intermediate characters and test mixed case 

    These are considered valid javascript urls by browser so they must be
included in the filter.

This is an exact match according to the spec but maybe we should include
a super set to be safer?
    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    8f89a99 View commit details
    Browse the repository at this point in the history

  6. Test updates to ensure we have coverage there too

    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    b9af765 View commit details
    Browse the repository at this point in the history

  7. Fix toString invocation and Flow types 

    Right now we invoke toString twice when we hydrate (three times
with the flag off). Ideally we should only do it once even in this case
but the code structure doesn't really allow for that right now.
    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    138f834 View commit details
    Browse the repository at this point in the history

  8. s/itRejects/itRejectsRendering

    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    8d9b293 View commit details
    Browse the repository at this point in the history

  9. Dedupe warning and add the unsafe URL to the warning message

    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    38d6287 View commit details
    Browse the repository at this point in the history

  10. Add test that fails if g is added to the sanitizer 

    This only affects the prod version since the warning is deduped anyway.
    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    be4f5c8 View commit details
    Browse the repository at this point in the history

  11. Fix prod test

    @sebmarkbage
    sebmarkbage committed Mar 11, 2019
    Copy the full SHA
    c8979c0 View commit details
    Browse the repository at this point in the history