#3510: mark content script nonce on DOM #3718
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov Report
@@ Coverage Diff @@
## main #3718 +/- ##
==========================================
- Coverage 45.99% 45.99% -0.01%
==========================================
Files 829 829
Lines 24741 24746 +5
Branches 5188 5189 +1
==========================================
+ Hits 11380 11381 +1
- Misses 12435 12439 +4
Partials 926 926
Continue to review full report at Codecov.
|
fregante
reviewed
Jun 15, 2022
| const PIXIEBRIX_SYMBOL = Symbol.for("pixiebrix-content-script"); | ||
| const uuid = uuidv4(); | ||
| // Should set attribute as early as possible | ||
| document.documentElement.setAttribute(PIXIEBRIX_CONTENT_SCRIPT_NONCE, uuid); |
There was a problem hiding this comment.
Keep in mind that imports are executed before this code, so placing it up here doesn't make any difference.
In a future PR, I'd suggest to:
- Move all the code except the duplication checker out to contentScript2.js (example)
- Keep only the logic
if not yet loaded, import(contentScript2.js)here
This guarantees that no code is ever executed twice. It also makes the check faster since the new contentScript.js would be very light.
| @@ -39,9 +45,6 @@ import { initToaster } from "@/utils/notify"; | |||
| import { isConnectionError } from "@/errors/errorHelpers"; | |||
| import { showConnectionLost } from "@/contentScript/connection"; | |||
|
|
|||
| const PIXIEBRIX_SYMBOL = Symbol.for("pixiebrix-content-script"); | |||
| const uuid = uuidv4(); | |||
|
|
|||
| registerMessenger(); | |||
| registerExternalMessenger(); | |||
| registerBuiltinBlocks(); | |||
There was a problem hiding this comment.
Should all of these also be moved inside init?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Checklist