Introduce sandboxed iframe mode.#1042
Conversation
|
As this is only for |
b3378fd to
0e0a7b1
Compare
|
You can create a new constant for AMP only additions, and use replacement to filter them out during the compilation process. Or, you can create a custom plugin for removing the logic (see how debug is removed from evaluators). |
|
@kristoferbaxter: was just about to push when you commented that. I was worried that a const wouldn't be enough to DCE the entire import, but it looks like it worked! before after |
kristoferbaxter
left a comment
There was a problem hiding this comment.
Looks good to me, thanks for ensuring this is specific to the AMP output too.
Added some comments and nits to consider.
| const messageListeners: any = []; | ||
| env.window.addEventListener = (type: string, listener: any) => messageListeners.push(listener); | ||
|
|
||
| global.fetch = (blob: any) => |
There was a problem hiding this comment.
Believe globals are cleaned up automatically, but can we verify?
There was a problem hiding this comment.
In ava 3.x we are safe. may need to change things when we upgrade to 4.x.
I'll do the migration asap, with keeping the isolation intact
https://github.com/avajs/ava/blob/main/docs/01-writing-tests.md#test-isolation
background
The primary use-case of
worker-domis to power<amp-script>. With the current mechanisms in place, it acts well for 1p (mostly trusted) scripts.amp-scriptnow has a new use case to allow less-trusted 3p scripts to run on the page without a CSP, and for this we need a stronger security boundary.The goal of this PR is to enable a "sandboxed" mode by creating the Worker within a sandboxed iframe instead of within the main frame.
design
When starting up,
worker-domwill create an iframe instead of a WebWorker. This iframe needs to perform a handshaking process and then essentially act as a proxy between the subframe Worker and the main frame. To make implementation as simple as possible, I've created a class calledIframeWorkerthat presents almost the exact same API surface as a standard Worker.The iframe must follow a specific contract:
{type: 'iframe-ready'}{type: 'init-worker', code: string}, create a Worker with the specified code.{type: 'postMessage', message: string}to the subframe Worker.{type: 'onmessage' | 'onerror', message: string }In order to take advantage of this feature, consumers will need to use the new option in the
upgradeElementAPI calledsandboxed. The option may remain undefined to men off, or be an object with the keyiframeUrl. The specified iframe must follow the contract described above. An example is provided in the demo folder.hosting the iframe
Depending on whether we want to release this for non-AMP mode as well, we could also have a default value for
iframeUrlthat points to a Github Pages hosted iframe.note: There is some drift in our src code alignment inprettierand I've extracted that to a small separate PR: #1041