Use single webpack build + embed only used locales in the HTML file

[fbarl]

Changes

• Use a single Webpack build instead of per-locale which significantly decreases building time, but almost doubles the resulting bundle.js size - resolves speed up multi-language build #2342
• Don't import locales in helpers/translation.js which clears up bundle.js of all the locales data (reducing back its size) but doesn't provide the locales info in the JS
• Instead, let server.js and generate-index.js embed max 2 locales in the rendered HTML files (the current locale + english as a fallback), slightly increasing their size (still keeping them < 100kB)

Tested

• Ran ./mobileapp/generate-index.js and verified that the HTMLs get generated
• docker-compose build && docker-compose up works also with changing the languages
• docker-compose run ... web npm run watch && yarn start works also with changing the languages

Checklist

• Try sanitizing the locales embedded in the HTML to prevent potential XSS attacks

Ideas for the Future

• Instead of embedding locales in the HTML, it would be great if we coud load them async from the frontend - implementing this at the moment (before fully transitioning to React) would be somewhat dirty and perhaps not worth the effort, but it would be cool if we could eventually:
  • Manage locale as a variable in the Redux state instead of the Express server
  • Switch between languages without having to reload the whole page
  • Keep our HTMLs neat and clean

[corradio]

Awesome!!

[fbarl]

@corradio Since all our locales data is static and it goes through the PR review process (+ we already use dangerouslySetInnerHTML elsewhere in the code), I won't tackle the potential XSS vulnerability issue here.

However if you think that's still something we should address soon, I'll open a separate issue for it and merge this PR as is.

[corradio]

ok noted. Let's not address this right now.

…

On Tue, Apr 14, 2020 at 7:56 PM Filip Barl ***@***.***> wrote: @corradio <https://github.com/corradio> Since all our locales data is static and it goes through the PR review process (+ we already use dangerouslySetInnerHTML elsewhere in the code), I won't tackle the potential XSS vulnerability issue here. However if you think that's still something we should address soon, I'll open a separate issue for it and merge this PR as is. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2369 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAMUIKAA5FORJSFOHV4W6ZTRMSPWLANCNFSM4ME4Q7XQ> .

-- Olivier Corradi Founder, CEO <https://www.linkedin.com/in/oliviercorradi> <https://twitter.com/corradio> tmrow.com