Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

removing flyout services #5921

Conversation

ayushrai206
Copy link
Member

Fixes #3141

Changes proposed in this pull request:

  • Simply deleting flyout services

@github-actions github-actions bot added reconciliation Related to the reconciliation operations and other features vulnerability Security vulnerability which needs fixing reconciliation API design when changing the reconciliation API is required to improve a workflow labels Jun 13, 2023
Copy link
Sponsor Member

@wetneb wetneb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I haven't tested it yet but there are a couple of places where I suspect you have been a tad zealous ^^ It's just guesswork on my side so I might be wrong though.

In any case it's definitely worth testing the suggest functionality thoroughly after your changes and making sure the visual appearance and functionality is preserved. Did you already do that on your side?

.fbs-flyout-images,
#fbs-topic-image {
background: #fff;
}
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here you are removing not just flyout styling, but also the styling on a lot of other elements: .fbs-pane, for instance, should likely stay. See the syntax for CSS selectors: there is a difference between .fbs-pane .fbs-flyout-pane (which could be removed entirely) and .fbs-pane, .fbs-flyout-pane (which should be simplified to just .fbs-pane).

.fbs-flyout-subtitle,
.fbs-topic-properties strong {
color: #666;
}
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar problem here (and in the rest of your CSS changes).

@@ -571,13 +487,13 @@ to inline Internet Explor fixes
*/

* html .fbs-list,
* html .fbs-list-icons { height: expression( this.scrollHeight > 410 ? "410" : "auto" ); /* sets max-height for IE */ }
* html .fbs-list-icons { height: expression( this.scrolllHeight > 410 ? "410" : "auto" ); /* sets max-height for IE */ }
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This change is probably a mistake.


if (!$.suggest.cache) {
$.suggest.cache = {};
}
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Those three lines above likely need to be kept, I think the cache is still used by the suggest service independently of the flyout.

},

_destroy: function() {
base._destroy.call(this);
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would likely keep this _destroy function since it might be doing things that are unrelated to the flyout functionality, and only remove the flyout-related code in it.

@@ -1163,15 +1073,6 @@
}
},

hide_all: function(e) {
this.pane.hide();
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as above

response_hook: function(response_data, cursor) {
if (this.flyoutpane) {
this.flyoutpane.hide();
}
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here, I suspect?

@@ -1712,15 +1415,7 @@
]
},

// CSS default class names
css: {
item_type: "fbs-item-type",
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this item_type flyout-related?

@@ -466,10 +466,6 @@ img {
display: none;
}

.fbs-pane, .fbs-flyout-pane {
z-index: 2000;
Copy link
Sponsor Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment about CSS rules.

@ayushrai206
Copy link
Member Author

I haven't tested it yet but there are a couple of places where I suspect you have been a tad zealous ^^ It's just guesswork on my side so I might be wrong though.

In any case it's definitely worth testing the suggest functionality thoroughly after your changes and making sure the visual appearance and functionality is preserved. Did you already do that on your side?

Hey, you are absolutely right! I have now taken care of all your feedback and tested the functionality from my end!
Thank you so much!

Copy link
Member

@elebitzero elebitzero left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @ayushrai206, externals\suggest is a 3rd party library. We should not be altering these files if at all possible:

  • externals/suggest/suggest-4.3a.js
  • externals/suggest/css/suggest-4_3.css

This is a 3rd party UI library. It is not included in package.json because it was already altered awhile ago with some bug fixes. We want to avoid making any other changes to these files.

Is there some other way to disable the flyout without modifying these files directly?

@wetneb
Copy link
Sponsor Member

wetneb commented Jun 15, 2023

I was also wondering about that… I am not sure to what extent this file is really an external library. I assume it's not maintained by another project (otherwise we would likely be pulling it from npm, no?) and we have already made edits to it, so I wonder if we shouldn't just treat it as an internal file. No strong feelings about this though.

In this particular case I think we can avoid making changes to it, by just making sure no flyout settings are passed to it when initializing it on input fields. We'd have to be sanitizing the suggest settings offered in the manifest.

@wetneb
Copy link
Sponsor Member

wetneb commented Aug 30, 2023

I'd propose to close this PR and do it again with the approach suggested by @elebitzero. The changes should be quite minimal: before initializing the suggest library, we would remove the flyout settings from it.

@tfmorris
Copy link
Member

tfmorris commented Aug 30, 2023

I agree with @elebitzero 's approach, but just to clarify the provenance of this file, it's a private fork of Freebase Suggest 4.3 which is no longer maintained by Google. While we control the fork, it's best to minimize changes when possible, as it appears to be in this case.

@ayushrai206 ayushrai206 closed this Sep 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
reconciliation API design when changing the reconciliation API is required to improve a workflow reconciliation Related to the reconciliation operations and other features vulnerability Security vulnerability which needs fixing
Projects
None yet
Development

Successfully merging this pull request may close these issues.

XSS vulnerability in suggest flyouts
4 participants