Provide regl-based traces in the strict bundle #6083
Conversation
…cluded them exclusively in the strict build.
yujin-wu
force-pushed
the
regl-build-setup
branch
from
1799925
to
ac4f861
Compare
|
So some background:
Some iffy parts:
|
yujin-wu
force-pushed
the
regl-build-setup
branch
from
f9ea4cd
to
b137e09
Compare
| "cibuild": "npm run empty-dist && npm run preprocess && node tasks/cibundle.js", | ||
| "watch": "node tasks/watch.js", | ||
| "lint": "eslint --version && eslint .", | ||
| "lint-fix": "eslint . --fix || true", | ||
| "log-new-func": "eslint --no-ignore --no-eslintrc --no-inline-config --rule '{no-new-func: error}' dist/plotly.js 2>&1 | ./tasks/show_eval_lines.sh", | ||
| "no-new-func": "eslint --no-ignore --no-eslintrc --no-inline-config --rule '{no-new-func: error}' $(find dist -type f -iname '*.js' | grep -v plotly-gl2d* | grep -v plotly-with-meta.* | grep -v plotly.js | grep -v plotly.min.js)", | ||
| "no-new-func": "eslint --no-ignore --no-eslintrc --no-inline-config --rule '{no-new-func: error}' $(find dist -type f -iname '*.js' | grep -v plotly-gl2d* | grep -v plotly-with-meta.* | grep -v plotly.js | grep -v plotly.min.js | grep -v plotly-strict.js | grep -v plotly-strict.min.js)", |
There was a problem hiding this comment.
Why those strict bundles are excluded from this test?
Please revert this change.
Thank you.
There was a problem hiding this comment.
Hmm... so the Function.apply(...) ends up in the strict bundle but it never get called?
@alexcjohnson what's your suggestion here?
There was a problem hiding this comment.
Yes indeed that's the reason. I admit it was hackier to exclude it here because ironically it is the whole point of the check.
To remove reference to it we would have to make a second build of regl right? Say, regl-strict? If the intention of the check is to catch mistakes then can this be an exception?
There was a problem hiding this comment.
Yes, that makes sense. Let's leave this as is for now, but make an issue to come back to it with a second build of regl that can only be used with precompiled functions and does not include the codegen code at all, simply throwing an error if a matching precompiled function isn't included. For anyone that uses this in a CSP-restricted environment an error is what would happen anyway if for some reason we tried to generate a missing function, so that code is merely wasted bytes, not a vulnerability.
src/traces/parcoords-strict/index.js
Outdated
| var index = require('../parcoords/index'); | ||
|
|
||
| index.plot = require('../parcoords/plot-strict'); | ||
|
|
There was a problem hiding this comment.
Let's duplicate parcoords/index content here and then replace plot with plot-strict in this file.
That way the content of parcoords/plot.js won't be included in the bundle.
On another note - wondering can't we move this index into the parcoords folder and name it index-strict instead?
There was a problem hiding this comment.
wondering can't we move this index into the parcoords folder and name it index-strict instead?
A bunch of build stuff relies on traces having their own folders and I didn't want to mess around with that too much
That way the content of parcoords/plot.js won't be included in the bundle.
plot-strict is just a wrapper around plot after all and plot would need to be in both bundles.
Co-authored-by: Mojtaba Samimi <33888540+archmoj@users.noreply.github.com>
Co-authored-by: Alex Johnson <johnson.alex.c@gmail.com>
archmoj
changed the title
|
Thanks @yujin-wu for the remarkable contribution! 🎖️ 🏅 🥇 |
Issue
Regl traces (splom, scattergl, scatterpolargl, parcoords) are not CSP compliant.
cc: #897
Changes
npm run regl-codegenTODO blocking