-
-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Provide regl-based traces in the strict bundle #6083
Conversation
…cluded them exclusively in the strict build.
1799925
to
ac4f861
Compare
So some background:
Some iffy parts:
|
f9ea4cd
to
b137e09
Compare
"cibuild": "npm run empty-dist && npm run preprocess && node tasks/cibundle.js", | ||
"watch": "node tasks/watch.js", | ||
"lint": "eslint --version && eslint .", | ||
"lint-fix": "eslint . --fix || true", | ||
"log-new-func": "eslint --no-ignore --no-eslintrc --no-inline-config --rule '{no-new-func: error}' dist/plotly.js 2>&1 | ./tasks/show_eval_lines.sh", | ||
"no-new-func": "eslint --no-ignore --no-eslintrc --no-inline-config --rule '{no-new-func: error}' $(find dist -type f -iname '*.js' | grep -v plotly-gl2d* | grep -v plotly-with-meta.* | grep -v plotly.js | grep -v plotly.min.js)", | ||
"no-new-func": "eslint --no-ignore --no-eslintrc --no-inline-config --rule '{no-new-func: error}' $(find dist -type f -iname '*.js' | grep -v plotly-gl2d* | grep -v plotly-with-meta.* | grep -v plotly.js | grep -v plotly.min.js | grep -v plotly-strict.js | grep -v plotly-strict.min.js)", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why those strict
bundles are excluded from this test?
Please revert this change.
Thank you.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm... so the Function.apply(...)
ends up in the strict
bundle but it never get called?
@alexcjohnson what's your suggestion here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes indeed that's the reason. I admit it was hackier to exclude it here because ironically it is the whole point of the check.
To remove reference to it we would have to make a second build of regl right? Say, regl-strict? If the intention of the check is to catch mistakes then can this be an exception?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, that makes sense. Let's leave this as is for now, but make an issue to come back to it with a second build of regl that can only be used with precompiled functions and does not include the codegen code at all, simply throwing an error if a matching precompiled function isn't included. For anyone that uses this in a CSP-restricted environment an error is what would happen anyway if for some reason we tried to generate a missing function, so that code is merely wasted bytes, not a vulnerability.
src/traces/parcoords-strict/index.js
Outdated
var index = require('../parcoords/index'); | ||
|
||
index.plot = require('../parcoords/plot-strict'); | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's duplicate parcoords/index
content here and then replace plot
with plot-strict
in this file.
That way the content of parcoords/plot.js
won't be included in the bundle.
On another note - wondering can't we move this index into the parcoords
folder and name it index-strict
instead?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
wondering can't we move this index into the parcoords folder and name it index-strict instead?
A bunch of build stuff relies on traces having their own folders and I didn't want to mess around with that too much
That way the content of parcoords/plot.js won't be included in the bundle.
plot-strict is just a wrapper around plot after all and plot would need to be in both bundles.
Co-authored-by: Mojtaba Samimi <[email protected]>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @yujin-wu for the remarkable contribution! 🎖️ 🏅 🥇 |
Issue
Regl traces (splom, scattergl, scatterpolargl, parcoords) are not CSP compliant.
cc: #897
Changes
npm run regl-codegen
TODO blocking