Commit Graph

18 Commits

Author SHA1 Message Date
Sebastian Markbåge 103378b1ea Warn for javascript: URLs in DOM sinks (#15047)
* Prevent javascript protocol URLs

* Just warn when disableJavaScriptURLs is false

This avoids a breaking change.

* Allow framesets

* Allow <html> to be used in integration tests

Full document renders requires server rendering so the client path
just uses the hydration path in this case to simplify writing these tests.

* Detect leading and intermediate characters and test mixed case

These are considered valid javascript urls by browser so they must be
included in the filter.

This is an exact match according to the spec but maybe we should include
a super set to be safer?

* Test updates to ensure we have coverage there too

* Fix toString invocation and Flow types

Right now we invoke toString twice when we hydrate (three times
with the flag off). Ideally we should only do it once even in this case
but the code structure doesn't really allow for that right now.

* s/itRejects/itRejectsRendering

* Dedupe warning and add the unsafe URL to the warning message

* Add test that fails if g is added to the sanitizer

This only affects the prod version since the warning is deduped anyway.

* Fix prod test
2019-03-11 16:39:49 -07:00
Héctor Ramos b87aabdfe1 Drop the year from Facebook copyright headers and the LICENSE file. (#13593) 2018-09-07 15:11:23 -07:00
Dan Abramov ff41519ec2 Sanitize unknown attribute names for SSR (#13302) 2018-08-01 20:23:10 +01:00
Dan Abramov 4c3470eef8 Refactor DOM attribute code (take two) (#11815)
* Harden tests around init/addition/update/removal of aliased attributes

I noticed some patterns weren't being tested.

* Call setValueForProperty() for null and undefined

The branching before the call is unnecessary because setValueForProperty() already
has an internal branch that delegates to deleteValueForProperty() for null and
undefined through the shouldIgnoreValue() check.

The goal is to start unifying these methods because their separation doesn't
reflect the current behavior (e.g. for unknown properties) anymore, and obscures
what actually happens with different inputs.

* Inline deleteValueForProperty() into setValueForProperty()

Now we don't read propertyInfo twice in this case.

I also dropped a few early returns. I added them a while ago when we had
Stack-only tracking of DOM operations, and some operations were being
counted twice because of how this code is structured. This isn't a problem
anymore (both because we don't track operations, and because I've just
inlined this method call).

* Inline deleteValueForAttribute() into setValueForAttribute()

The special cases for null and undefined already exist in setValueForAttribute().

* Delete some dead code

* Make setValueForAttribute() a branch of setValueForProperty()

Their naming is pretty confusing by now. For example setValueForProperty()
calls setValueForAttribute() when shouldSetAttribute() is false (!). I want
to refactor (as in, inline and then maybe factor it out differently) the relation
between them. For now, I'm consolidating the callers to use setValueForProperty().

* Make it more obvious where we skip and when we reset attributes

The naming of these methods is still very vague and conflicting in some cases.
Will need further work.

* Rewrite setValueForProperty() with early exits

This makes the flow clearer in my opinion.

* Move shouldIgnoreValue() into DOMProperty

It was previously duplicated.

It's also suspiciously similar in purpose to shouldTreatAttributeValueAsNull()
so I want to see if there is a way to unify them.

* Use more specific methods for testing validity

* Unify shouldTreatAttributeValueAsNull() and shouldIgnoreValue()

* Remove shouldSetAttribute()

Its naming was confusing and it was used all over the place instead of more specific checks.
Now that we only have one call site, we might as well inline and get rid of it.

* Remove unnecessary condition

* Remove another unnecessary condition

* Add Flow coverage

* Oops

* Fix lint (ESLint complains about Flow suppression)

* Fix treatment of Symbol/Function values on boolean attributes

They weren't being properly skipped because of the early return.
I added tests for this case.

* Avoid getPropertyInfo() calls

I think this PR looks worse on benchmarks because we have to read propertyInfo in different places.
Originally I tried to get rid of propertyInfo, but looks like it's important for performance after all.

So now I'm going into the opposite direction, and precompute propertyInfo as early as possible, and then just pass it around.
This way we can avoid extra lookups but keep functions nice and modular.

* Pass propertyInfo as argument to getValueForProperty()

It always exists because this function is only called for known properties.

* Make it clearer this branch is boolean-specific

I wrote this and then got confused myself.

* Memoize whether propertyInfo accepts boolean value

Since we run these checks for all booleans, might as well remember it.

* Fix a crash when numeric property is given a Symbol

* Record attribute table

The changes reflect that SSR doesn't crash with symbols anymore (and just warns, consistently with the client).

* Refactor attribute initialization

Instead of using flags, explicitly group similar attributes/properties.

* Optimization: we know built-in attributes are never invalid

* Use strict comparison

* Rename methods for clarity

* Lint nit

* Minor tweaks

* Document all the different attribute types
2017-12-10 16:58:38 +00:00
Dan Abramov d9869a4561 Revert "Refactor DOM attribute code (#11804)" (#11814)
This reverts commit 47783e878d.
2017-12-08 21:05:34 +00:00
Dan Abramov 47783e878d Refactor DOM attribute code (#11804)
* Harden tests around init/addition/update/removal of aliased attributes

I noticed some patterns weren't being tested.

* Call setValueForProperty() for null and undefined

The branching before the call is unnecessary because setValueForProperty() already
has an internal branch that delegates to deleteValueForProperty() for null and
undefined through the shouldIgnoreValue() check.

The goal is to start unifying these methods because their separation doesn't
reflect the current behavior (e.g. for unknown properties) anymore, and obscures
what actually happens with different inputs.

* Inline deleteValueForProperty() into setValueForProperty()

Now we don't read propertyInfo twice in this case.

I also dropped a few early returns. I added them a while ago when we had
Stack-only tracking of DOM operations, and some operations were being
counted twice because of how this code is structured. This isn't a problem
anymore (both because we don't track operations, and because I've just
inlined this method call).

* Inline deleteValueForAttribute() into setValueForAttribute()

The special cases for null and undefined already exist in setValueForAttribute().

* Delete some dead code

* Make setValueForAttribute() a branch of setValueForProperty()

Their naming is pretty confusing by now. For example setValueForProperty()
calls setValueForAttribute() when shouldSetAttribute() is false (!). I want
to refactor (as in, inline and then maybe factor it out differently) the relation
between them. For now, I'm consolidating the callers to use setValueForProperty().

* Make it more obvious where we skip and when we reset attributes

The naming of these methods is still very vague and conflicting in some cases.
Will need further work.

* Rewrite setValueForProperty() with early exits

This makes the flow clearer in my opinion.

* Move shouldIgnoreValue() into DOMProperty

It was previously duplicated.

It's also suspiciously similar in purpose to shouldTreatAttributeValueAsNull()
so I want to see if there is a way to unify them.

* Use more specific methods for testing validity

* Unify shouldTreatAttributeValueAsNull() and shouldIgnoreValue()

* Remove shouldSetAttribute()

Its naming was confusing and it was used all over the place instead of more specific checks.
Now that we only have one call site, we might as well inline and get rid of it.

* Remove unnecessary condition

* Remove another unnecessary condition

* Add Flow coverage

* Oops

* Fix lint (ESLint complains about Flow suppression)
2017-12-08 20:42:24 +00:00
Brandon Dail 6e258c1266 Move isAttributeNameSafe to DOMProperty (#11802) 2017-12-07 17:23:02 -08:00
Brandon Dail 5301c41417 Revert "Remove empty value for boolean attributes in SSR (#11708)" (#11798)
This reverts commit e0c3113743.
2017-12-07 22:06:20 +00:00
Raphael Amorim 37e4329bc8 Remove vars (#11766)
* react: convert packages/react

* react-reconciler: convert packages/react-reconciler

* react-noop-renderer: convert packages/react-noop-renderer

* react-dom: convert packages/react-dom/src/shared

* react-dom: convert packages/react-dom/src/server
2017-12-05 13:47:57 +00:00
Brandon Dail e0c3113743 Remove empty value for boolean attributes in SSR (#11708) 2017-11-29 09:59:56 -08:00
Jeremias Menichelli cafe352c1a Drop .textContent IE8 polyfill and rewrite escaping tests against public API (#11331)
* Rename escapeText util. Test quoteAttributeValueForBrowser through ReactDOMServer API

* Fix lint errors

* Prettier reformatting

* Change syntax to prevent prettier escape doble quote

* Name and description gardening. Add tests for escapeTextForBrowser. Add missing tests

* Improve script tag as text content test

* Update escapeTextForBrowser-test.js

* Update quoteAttributeValueForBrowser-test.js

* Simplify tests

* Move utilities to server folder
2017-11-23 22:41:28 +00:00
Clement Hoang 94f44aeba7 Update prettier to 1.8.1 (#10785)
* Change prettier dependency in package.json version 1.8.1

* Update yarn.lock

* Apply prettier changes

* Fix ReactDOMServerIntegration-test.js

* Fix test for ReactDOMComponent-test.js
2017-11-07 18:09:33 +00:00
Dan Abramov 92b7b172cc Use named exports in more places (#11457)
* Convert EventPlugin{Hub,Registry} to named exports

* Convert EventPluginUtils to named exports

* Convert EventPropagators to named exports

* Convert ReactControlledComponent to named exports

* Convert ReactGenericBatching to named exports

* Convert ReactDOMComponentTree to named exports

* Convert ReactNativeComponentTree to named exports

* Convert ReactNativeRTComponentTree to named exports

* Convert FallbackCompositionState to named exports

* Convert ReactEventEmitterMixin to named exports

* Convert ReactBrowserEventEmitter to named exports

* Convert ReactNativeEventEmitter to named exports

* Convert ReactDOMEventListener to named exports

* Convert DOMMarkupOperations to named exports

* Convert DOMProperty to named exports

* Add suppression for existing Flow violation

Flow didn't see it before.

* Update sizes
2017-11-05 11:58:36 +00:00
Dan Abramov 45c1ff348e Remove unnecessary 'use strict' in the source (#11433)
* Remove use strict from ES modules

* Delete unused file

This was unused since Stack.
2017-11-02 20:32:48 +00:00
Dan Abramov 21d0c11523 Convert the Source to ES Modules (#11389)
* Update transforms to handle ES modules

* Update Jest to handle ES modules

* Convert react package to ES modules

* Convert react-art package to ES Modules

* Convert react-call-return package to ES Modules

* Convert react-test-renderer package to ES Modules

* Convert react-cs-renderer package to ES Modules

* Convert react-rt-renderer package to ES Modules

* Convert react-noop-renderer package to ES Modules

* Convert react-dom/server to ES modules

* Convert react-dom/{client,events,test-utils} to ES modules

* Convert react-dom/shared to ES modules

* Convert react-native-renderer to ES modules

* Convert react-reconciler to ES modules

* Convert events to ES modules

* Convert shared to ES modules

* Remove CommonJS support from transforms

* Move ReactDOMFB entry point code into react-dom/src

This is clearer because we can use ES imports in it.

* Fix Rollup shim configuration to work with ESM

* Fix incorrect comment

* Exclude external imports without side effects

* Fix ReactDOM FB build

* Remove TODOs I don’t intend to fix yet
2017-11-02 19:50:03 +00:00
Dan Abramov 087c48bb36 Reorder imports (#11359)
* Reorder imports

* Record sizes
2017-10-25 21:07:54 +03:00
Dan Abramov 1eed302d34 Drop Haste (#11303)
* Use relative paths in packages/react

* Use relative paths in packages/react-art

* Use relative paths in packages/react-cs

* Use relative paths in other packages

* Fix as many issues as I can

This uncovered an interesting problem where ./b from package/src/a would resolve to a different instantiation of package/src/b in Jest.

Either this is a showstopper or we can solve it by completely fobbidding remaining /src/.

* Fix all tests

It seems we can't use relative requires in tests anymore. Otherwise Jest becomes confused between real file and symlink.
https://github.com/facebook/jest/issues/3830

This seems bad... Except that we already *don't* want people to create tests that import individual source files.
All existing cases of us doing so are actually TODOs waiting to be fixed.

So perhaps this requirement isn't too bad because it makes bad code looks bad.

Of course, if we go with this, we'll have to lint against relative requires in tests.
It also makes moving things more painful.

* Prettier

* Remove @providesModule

* Fix remaining Haste imports I missed earlier

* Fix up paths to reflect new flat structure

* Fix Flow

* Fix CJS and UMD builds

* Fix FB bundles

* Fix RN bundles

* Prettier

* Fix lint

* Fix warning printing and error codes

* Fix buggy return

* Fix lint and Flow

* Use Yarn on CI

* Unbreak Jest

* Fix lint

* Fix aliased originals getting included in DEV

Shouldn't affect correctness (they were ignored) but fixes DEV size regression.

* Record sizes

* Fix weird version in package.json

* Tweak bundle labels

* Get rid of output option by introducing react-dom/server.node

* Reconciler should depend on prop-types

* Update sizes last time
2017-10-25 02:55:00 +03:00
Dan Abramov 313611572b Reorganize code structure (#11288)
* Move files and tests to more meaningful places

* Fix the build

Now that we import reconciler via react-reconciler, I needed to make a few tweaks.

* Update sizes

* Move @preventMunge directive to FB header

* Revert unintentional change

* Fix Flow coverage

I forgot to @flow-ify those files. This uncovered some issues.

* Prettier, I love you but you're bringing me down
Prettier, I love you but you're bringing me down

Like a rat in a cage
Pulling minimum wage
Prettier, I love you but you're bringing me down

Prettier, you're safer and you're wasting my time
Our records all show you were filthy but fine
But they shuttered your stores
When you opened the doors
To the cops who were bored once they'd run out of crime

Prettier, you're perfect, oh, please don't change a thing
Your mild billionaire mayor's now convinced he's a king
So the boring collect
I mean all disrespect
In the neighborhood bars I'd once dreamt I would drink

Prettier, I love you but you're freaking me out
There's a ton of the twist but we're fresh out of shout
Like a death in the hall
That you hear through your wall
Prettier, I love you but you're freaking me out

Prettier, I love you but you're bringing me down
Prettier, I love you but you're bringing me down
Like a death of the heart
Jesus, where do I start?
But you're still the one pool where I'd happily drown

And oh! Take me off your mailing list
For kids who think it still exists
Yes, for those who think it still exists
Maybe I'm wrong and maybe you're right
Maybe I'm wrong and maybe you're right
Maybe you're right, maybe I'm wrong
And just maybe you're right

And oh! Maybe mother told you true
And there'll always be somebody there for you
And you'll never be alone
But maybe she's wrong and maybe I'm right
And just maybe she's wrong
Maybe she's wrong and maybe I'm right
And if so, here's this song!
2017-10-19 19:50:24 +01:00