Add an additional security brand check to StaticValues #2642
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🦋 Changeset detectedLatest commit: 05ee1db The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
📊 Tachometer Benchmark ResultsSummarynop-update
render
update
update-reflect
Resultslit-element-list
render
update
update-reflect
lit-html-kitchen-sink
render
update
nop-update
lit-html-repeat
render
update
lit-html-template-heavy
render
update
reactive-element-list
render
update
update-reflect
|
AndrewJakubowicz
approved these changes
Mar 15, 2022
packages/lit-html/src/static.ts
Outdated
| ['_$litStatic$']: value, | ||
| r: /_/, |
There was a problem hiding this comment.
It's clever that this is short, but using a RegExp is maybe a little obscure? Also typeof x === {aLiteral} is hghly optimized in JS VMs.
What about:
const staticBrand = Symbol();
export const unsafeStatic = (value: string): StaticValue => ({
['_$litStatic$']: value,
r: staticBrand,
});Then:
if ((typeof (value as Partial<StaticValue>)?.r !== 'symbol')) {There was a problem hiding this comment.
IE11 doesn't have native Symbol, right, so typeof Symbol() === 'symbol' can't work, can it? https://caniuse.com/mdn-javascript_builtins_symbol
There was a problem hiding this comment.
We already require the Symbol polyfill.
Symbol.for() might be good like you mentioned before too, then you can do (value as Partial<StaticValue>)?.r === staticBrand
There was a problem hiding this comment.
Since these are each brand new instances of RegExp, and not a shared value, I'm assuming you're just trying to guard against JSON injections. In that case, you can take advantage of constructor: undefined to get the same benefits without needing an object (or a instanceof check, which is very slow). JSON cannot inject an undefined value, and a non-undefined constructor is present on all objects, so value.constructor === undefined guarantees the value was not constructed from JSON.
There was a problem hiding this comment.
That's a really cool trick @jridgewell! Ended up going with Symbol.for('') for clarity and to avoid hitting VM optimization edge cases.
There was a problem hiding this comment.
Oh, erp, didn't push all my changes, should be there now
AndrewJakubowicz
approved these changes
Mar 23, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Similar to #2307