Skip to content
This repository was archived by the owner on Feb 25, 2025. It is now read-only.

[web] Use TrustedTypes to load canvaskit (where available) #36608

Merged
merged 8 commits into from
Oct 19, 2022

Conversation

ditman
Copy link
Member

@ditman ditman commented Oct 5, 2022

Adds a small JS-Interop layer to use the TrustedTypes API from the flutter/engine code, and use it to download the CanvasKit JS.

Adds a test that runs the canvaskit_api tests with TT enabled.

Fixes flutter/flutter#112654

Testing

Pre-launch Checklist

  • I read the Contributor Guide and followed the process outlined there for submitting PRs.
  • I read the Tree Hygiene wiki page, which explains my responsibilities.
  • I read and followed the Flutter Style Guide and the C++, Objective-C, Java style guides.
  • I listed at least one issue that this PR fixes in the description above.
  • I added new tests to check the change I am making or feature I am adding, or Hixie said the PR is test-exempt. See testing the engine for instructions on
    writing and running engine tests.
  • I updated/added relevant documentation (doc comments with ///).
  • I signed the CLA.
  • All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

@flutter-dashboard flutter-dashboard bot added the platform-web Code specifically for the web engine label Oct 5, 2022
@ditman
Copy link
Member Author

ditman commented Oct 5, 2022

/cc @engelsdamien

Copy link
Contributor

@joshualitt joshualitt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The JS interop looks good!

@ditman ditman force-pushed the trusted_types_engine branch from 19d8958 to f7a3494 Compare October 18, 2022 23:37
@ditman ditman requested a review from yjbanov October 18, 2022 23:44
Copy link
Contributor

@yjbanov yjbanov left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

extension DomTrustedTypePolicyExtension on DomTrustedTypePolicy {
/// Creates a `TrustedScriptURL` for the given [input].
///
/// `input` is a string containing the data to be _sanitized_ by the policy.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the string expected to have a specific format? E.g. is it a URL? "data" and "input" do not convey that meaning.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is the string expected to have a specific format?

No, in the current version of the API, it can literally be anything that the "validation" function understands. It doesn't need to be a URL, it doesn't need to have special formatting... nothing.

input is the name used in MDN and the spec.

@ditman
Copy link
Member Author

ditman commented Oct 19, 2022

Marking this as "autosubmit", I think it's ready to go!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
autosubmit Merge PR when tree becomes green via auto submit App platform-web Code specifically for the web engine
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[web] use trusted types in the engine
3 participants