Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(template-compiler): restrict srcdoc attribute on all iframe element #1137

Merged
merged 1 commit into from
Mar 27, 2019

Conversation

pmdartus
Copy link
Member

Details

This PR restrict the usage of the srcdoc on iframe elements regardless of the element namespace. This change should be revisited once #1136 is fixed.

Does this PR introduce a breaking change?

  • Yes
  • No

Very very low chance of breakage, because this change only affects iframe element created in the MathML namespace.

@salesforce-best-lwc-internal
Copy link

Benchmark results

Base commit: b32da03 | Target commit: 492b8c1

lwc-engine-benchmark

table-append-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/append/1k duration 151.45 (±5.35 ms) 155.25 (±4.70 ms) +3.8ms (2.5%) 👎
table-clear-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/clear/1k duration 10.60 (±0.60 ms) 10.85 (±0.70 ms) +0.3ms (2.4%) 👌
table-create-10k metric base(b32da03) target(492b8c1) trend
benchmark-table/create/10k duration 897.10 (±8.20 ms) 886.40 (±4.95 ms) -10.7ms (1.2%) 👍
table-create-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/create/1k duration 120.60 (±2.50 ms) 118.40 (±2.90 ms) -2.2ms (1.8%) 👍
table-update-10th-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/update-10th/1k duration 75.40 (±3.10 ms) 74.60 (±1.35 ms) -0.8ms (1.1%) 👍
tablecmp-append-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/append/1k duration 224.40 (±8.30 ms) 223.60 (±9.50 ms) -0.8ms (0.4%) 👌
tablecmp-clear-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/clear/1k duration 5.60 (±0.80 ms) 5.95 (±1.05 ms) +0.3ms (6.2%) 👌
tablecmp-create-10k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/create/10k duration 1775.70 (±11.75 ms) 1763.05 (±11.95 ms) -12.6ms (0.7%) 👍
tablecmp-create-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/create/1k duration 209.35 (±5.30 ms) 208.80 (±7.30 ms) -0.6ms (0.3%) 👌
tablecmp-update-10th-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/update-10th/1k duration 69.05 (±4.85 ms) 68.75 (±4.35 ms) -0.3ms (0.4%) 👌
wc-append-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/append/1k duration 231.90 (±16.00 ms) 235.15 (±18.90 ms) +3.3ms (1.4%) 👌
wc-clear-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/clear/1k duration 10.65 (±1.55 ms) 11.55 (±1.75 ms) +0.9ms (8.5%) 👌
wc-create-10k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/create/10k duration 1872.40 (±14.30 ms) 1896.15 (±15.35 ms) +23.8ms (1.3%) 👎
wc-create-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/create/1k duration 220.30 (±5.25 ms) 213.90 (±5.95 ms) -6.4ms (2.9%) 👍
wc-update-10th-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/update-10th/1k duration 70.45 (±5.55 ms) 67.80 (±4.50 ms) -2.6ms (3.8%) 👌

@pmdartus pmdartus requested review from diervo and apapko March 26, 2019 12:50
@salesforce-best-lwc-internal
Copy link

Benchmark results

Base commit: b32da03 | Target commit: 492b8c1

lwc-engine-benchmark

table-append-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/append/1k duration 151.45 (±5.35 ms) 148.45 (±4.95 ms) -3.0ms (2.0%) 👍
table-clear-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/clear/1k duration 10.60 (±0.60 ms) 11.10 (±0.50 ms) +0.5ms (4.7%) 👌
table-create-10k metric base(b32da03) target(492b8c1) trend
benchmark-table/create/10k duration 897.10 (±8.20 ms) 881.30 (±6.25 ms) -15.8ms (1.8%) 👍
table-create-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/create/1k duration 120.60 (±2.50 ms) 117.90 (±3.45 ms) -2.7ms (2.2%) 👍
table-update-10th-1k metric base(b32da03) target(492b8c1) trend
benchmark-table/update-10th/1k duration 75.40 (±3.10 ms) 74.75 (±2.00 ms) -0.7ms (0.9%) 👌
tablecmp-append-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/append/1k duration 224.40 (±8.30 ms) 230.40 (±16.05 ms) +6.0ms (2.7%) 👌
tablecmp-clear-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/clear/1k duration 5.60 (±0.80 ms) 5.90 (±0.90 ms) +0.3ms (5.4%) 👌
tablecmp-create-10k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/create/10k duration 1775.70 (±11.75 ms) 1780.65 (±10.65 ms) +5.0ms (0.3%) 👎
tablecmp-create-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/create/1k duration 209.35 (±5.30 ms) 208.25 (±5.50 ms) -1.1ms (0.5%) 👌
tablecmp-update-10th-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-component/update-10th/1k duration 69.05 (±4.85 ms) 67.60 (±3.85 ms) -1.5ms (2.1%) 👌
wc-append-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/append/1k duration 231.90 (±16.00 ms) 237.50 (±16.95 ms) +5.6ms (2.4%) 👌
wc-clear-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/clear/1k duration 10.65 (±1.55 ms) 10.50 (±1.80 ms) -0.1ms (1.4%) 👌
wc-create-10k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/create/10k duration 1872.40 (±14.30 ms) 1879.20 (±13.45 ms) +6.8ms (0.4%) 👎
wc-create-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/create/1k duration 220.30 (±5.25 ms) 217.50 (±4.65 ms) -2.8ms (1.3%) 👌
wc-update-10th-1k metric base(b32da03) target(492b8c1) trend
benchmark-table-wc/update-10th/1k duration 70.45 (±5.55 ms) 69.20 (±5.60 ms) -1.2ms (1.8%) 👌

Copy link
Contributor

@caridy caridy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, we should definitely restrict this. Few questions about the compatibility of this one:

  • this is a security fix (we should be ok breaking folks here if that's what they are using) /cc @Gr8Gatsby
  • locker was not protecting this one (interesting to see if there are similar features that it is not protecting) cc @jfparadis
  • how are we going to proceed with this one considering that it is a breaking change. /cc @bkusumo

@pmdartus pmdartus merged commit 3aff1a5 into master Mar 27, 2019
@pmdartus pmdartus deleted the pmdartus/restrict-src-doc branch March 27, 2019 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants