Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

♻️ Allow dynamically setting 3p bootstrap script #32573

Merged
merged 1 commit into from
Feb 12, 2021

Conversation

powerivq
Copy link
Contributor

This PR gets rid of the hard coded integration.js/f.js, and replace it with a URL that is assigned by AMP runtime. In addition, it moves script calls from HTML to the Javascript.

The risk here is that some 3p script might depend on draw3p() being ran within the container div or a specific script tag, but I see no sign any 3p integration actually does that. Tested several ads and 3p (facebook and twitter extensions) and all worked fine.

Pulling in @dvoytenko do you see this being a problems with this?

@lgtm-com
Copy link

lgtm-com bot commented Feb 10, 2021

This pull request introduces 2 alerts when merging a318d6f into f0cdb5f - view on LGTM.com

new alerts:

  • 1 for Client-side cross-site scripting
  • 1 for DOM text reinterpreted as HTML

@lgtm-com
Copy link

lgtm-com bot commented Feb 10, 2021

This pull request introduces 2 alerts when merging b110cd9 into f0cdb5f - view on LGTM.com

new alerts:

  • 1 for Client-side cross-site scripting
  • 1 for DOM text reinterpreted as HTML

@@ -926,3 +926,8 @@ function lightweightErrorReport(e, isCanary) {
'&s=' +
encodeURIComponent(e.stack || '');
}

window.draw3p();
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  1. How do you assure that this code is executed after <div id="c"> has been parsed?
  2. Does draw3p ever execute document.write today?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right. I switched it to document.write so script is loaded synchronously.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I meant something different. Does the draw3p() contents ever use document.write()? It's very strategically placed there inside the specific <div id="c"> and that makes me think that it's aimed to enable document.write.

Copy link
Contributor Author

@powerivq powerivq Feb 11, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, document.write is being used. I changed this also to load the js w/ document.write so that document.write is still available during draw3p(). The previous version did break the document.write call.

@@ -2,12 +2,14 @@
<head>
<meta charset="utf-8">
<meta name="robots" content="noindex">
<script src="./integration.js"></script>
<script>
var s = document.createElement('script');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might need some protection from exceptions.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sense. Added.

@powerivq powerivq force-pushed the vendor-on branch 8 times, most recently from fbd8bdf to 010fa9c Compare February 11, 2021 07:00
@lgtm-com
Copy link

lgtm-com bot commented Feb 11, 2021

This pull request introduces 3 alerts when merging 010fa9c into 494c865 - view on LGTM.com

new alerts:

  • 1 for Call to eval-like DOM function
  • 1 for Client-side cross-site scripting
  • 1 for DOM text reinterpreted as HTML

@ampproject ampproject deleted a comment from lgtm-com bot Feb 11, 2021
@ampproject ampproject deleted a comment from lgtm-com bot Feb 11, 2021
@ampproject ampproject deleted a comment from lgtm-com bot Feb 11, 2021
@ampproject ampproject deleted a comment from lgtm-com bot Feb 11, 2021
@lgtm-com
Copy link

lgtm-com bot commented Feb 11, 2021

This pull request introduces 1 alert when merging b32560d into 432c6f4 - view on LGTM.com

new alerts:

  • 1 for Call to eval-like DOM function

@powerivq powerivq force-pushed the vendor-on branch 2 times, most recently from 90b5bae to cd2c647 Compare February 11, 2021 09:16
@lgtm-com
Copy link

lgtm-com bot commented Feb 11, 2021

This pull request introduces 3 alerts when merging cd2c647 into 432c6f4 - view on LGTM.com

new alerts:

  • 1 for Call to eval-like DOM function
  • 1 for Client-side cross-site scripting
  • 1 for DOM text reinterpreted as HTML

@lgtm-com
Copy link

lgtm-com bot commented Feb 11, 2021

This pull request introduces 3 alerts when merging 76a5981 into 432c6f4 - view on LGTM.com

new alerts:

  • 1 for Call to eval-like DOM function
  • 1 for Client-side cross-site scripting
  • 1 for DOM text reinterpreted as HTML

@powerivq powerivq requested a review from lannka February 11, 2021 19:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants