Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider removing usage of google/protobuf/wrappers and using an in-repo protocol for that #268

Closed
ChALkeR opened this issue Aug 5, 2020 · 2 comments

Comments

@ChALkeR
Copy link
Contributor

ChALkeR commented Aug 5, 2020

Currently, this library uses one proto file not present in the repo itself: google/protobuf/wrappers.
That protocol is completely trivial: https://github.com/protocolbuffers/protobuf/blob/master/src/google/protobuf/wrappers.proto

It's used directly as google-protobuf/google/protobuf/wrappers_pb.js in a number of places here, but there is a problem with that -- that file has been compiled in commonjs mode instead of commonjs_strict, which brings the same issues with globals pollution and CSP incompatibility. protocolbuffers/protobuf-javascript#25 is related.

protocolbuffers/protobuf#267 is related, and even after the fixes mentioned in protocolbuffers/protobuf#267, it would be still blocked against this one if wrappers.proto is not also recompiled in commonjs_strict mode.

A possible solution would be to replace all direct usage of that compiled js file with a proto file inside this repo, compiled in the same mode as all the other proto files. Perhaps even a subset of that file if not all imports are used.

@ChALkeR ChALkeR changed the title Consider removing usage of google/protobuf/wrappers and using a in-repo protocol for that Consider removing usage of google/protobuf/wrappers and using an in-repo protocol for that Aug 5, 2020
@mehcode
Copy link
Contributor

mehcode commented Aug 13, 2020

It's a little unfortunate that the google provided library isn't compiled in strict mode but I agree a trivial fix is to inline the proto source.

@mehcode
Copy link
Contributor

mehcode commented Sep 2, 2020

Done in develop

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants