Skip to content
This repository has been archived by the owner on Jan 17, 2023. It is now read-only.

Add all the add-on files for review #2471

Closed
wants to merge 4 commits into from
Closed

Conversation

ianb
Copy link
Contributor

@ianb ianb commented Mar 23, 2017

This is a PR specifically intended to review the entirety of the add-on code. This is not intended to be merged, only to collect comments

function uninstall(data, reason) {} // eslint-disable-line no-unused-vars

function getBoolPref(pref) {
return prefs.getPrefType(pref) && prefs.getBoolPref(pref);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can now pass a second argument to getBoolPref to specify a default if the pref doesn't exist.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was hoping we could keep Firefox 52 compatibility (for ESR), and @Standard8 mentioned that this was a 54 API change... except, if we distribute something for Firefox 52 is might be webextension/ only and then compatibility of bootstrap.js won't matter.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's fine then. You might also consider using Preferences.jsm which gives you the ability to do this even on 52 and earlier.

}

function handleStartup() {
AddonManager.getAddonByID(ADDON_ID).then((addon) => {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like you mostly do this to get the resource URI for the add-on? That is passed on the data object to startup already so you could just pass it through to here and not need this getAddonByID call which can cause a startup performance hit.


function stop(webExtension) {
webExtension.shutdown().then(() => {
EmbeddedExtensionManager.untrackEmbeddedExtension(webExtension);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like the shutdown call does this already.

}

if (msg.funcName === "getTelemetryPref") {
let enableTelemetry = getBoolPref(TELEMETRY_PREF);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This had me blinking for a moment as I thought you were turning telemetry on. Can you rename this variable to telemetryEnabled? I think that makes more sense.

Cu.import("resource://gre/modules/AddonManager.jsm");
Cu.import("resource://gre/modules/Console.jsm");
Cu.import("resource://gre/modules/Services.jsm");
const { EmbeddedExtensionManager } = Cu.import("resource://gre/modules/LegacyExtensionsUtils.jsm");
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you just use the exposed LegacyExtensionsUtils instead since you don't need the untrack call below?

@jaredhirsch
Copy link
Member

@Mossop Thanks for the feedback. I'll get a PR out today that addresses the points you mentioned above.

@jaredhirsch
Copy link
Member

I've landed the requested bootstrap.js changes in master, and cherry-picked that commit into this branch.

@jaredhirsch
Copy link
Member

jaredhirsch commented Mar 27, 2017

Question for reviewers: It looks like window.dump() is available to WebExtensions. Should we switch to that instead of console.* throughout?

edit: added MDN link

Copy link

@kmaglione kmaglione left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I need to review some of the UI and shared code in more detail, but these are my initial comments.

@@ -0,0 +1,12 @@
/* exported randomString */

window.randomString = function randomString(length, chars) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please don't add properties to window. Just function randomString() { ... } or var randomString = ... will do.

chars = chars || randomStringChars;
let result = "";
for (let i=0; i<length; i++) {
result += chars.charAt(Math.floor(Math.random() * chars.length));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: Please use array indexing rather than .charAt. chars[Math.floor(...)]

if (result.type === "success") {
return result.value;
} else if (result.type === "error") {
throw new Error(result.name);

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can throw this error (or equivalently reject this promise) directly from the parent side.

this.element.scrolling = "no";
this.updateElementSize();
this.element.onload = watchFunction(() => {
let parsedDom = (new DOMParser()).parseFromString(`

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a particular reason to do this rather than just assigning to documentElement.outerHTML?

let value;
if (elems.length > 1) {
value = [];
for (let i=0; i<elems.length; i++) {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: for (let elem of elems)

display: function (installHandlerOnDocument) {
return new Promise((resolve, reject) => {
if (! this.element) {
this.element = document.createElement("iframe");

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The contents of this iframe will be accessible to web content, which worries me. Can we load a web-accessible extension URL into them?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We took this approach from uBlock Origin's element picker. In general in my experiments it seemed like the content worker has no special ability to look into iframes, though I never specifically tried a moz-extension URL for the iframe; is that different?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I opened #2605 to investigate this. I'm not confident it's going to work, though it would be a security improvement if we could do it.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the iframe has a moz-extension: URL, your content script will be able to access its contents, since it has an expanded principal with a moz-extension: URL, but the content page won't.

/** This is a content script added to all screenshots.firefox.com pages, and allows the site to
communicate with the add-on */

window.sitehelper = (function () {

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd rather we use export helpers (exportFunction, cloneInto, ...) than custom events for this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I created #2573 for this – the refactoring worries me right now, so I'd like to save that work for later.

if (typeof detail == "object") {
// Note sending an object can lead to security problems, while a string
// is safe to transfer:
detail = JSON.stringify(detail);

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You would be better off with sendMessage than custom events, since messages are structured cloned by default. However, if you need to use custom events, you can use cloneInto to make the object accessible to content.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's switch to cloneInto and leave postMessage for now

shared/shot.js Outdated
are used as console.error() arguments. */
function assert(condition) {
if (! condition) {
console.error.apply(console, ["Failed assertion:"].concat(Array.prototype.slice.call(arguments, 1)));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

console.error("Failed assertion", ...args) along with ...args as a second argument to assert

for (let attr of this.REGULAR_ATTRS) {
var val = this[attr];
if (val && val.asJson) {
val = val.asJson();

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The toJSON method is the standard way of doing this, and is automatically called by JSON.stringify

@jaredhirsch
Copy link
Member

@kmaglione Thanks for the review! I'll get started addressing your feedback in the webextension-review-changes branch and ping you with any questions.

jaredhirsch added a commit that referenced this pull request Apr 4, 2017
jaredhirsch added a commit that referenced this pull request Apr 4, 2017
jaredhirsch added a commit that referenced this pull request Apr 6, 2017
jaredhirsch added a commit that referenced this pull request Apr 6, 2017
jaredhirsch added a commit that referenced this pull request Apr 6, 2017
Addresses selector/documentMetadata.js comment 1

#2471 (comment)
jaredhirsch added a commit that referenced this pull request Apr 6, 2017
Addresses selector/shooter.js comment 1

#2471 (comment)
jaredhirsch added a commit that referenced this pull request Apr 6, 2017
jaredhirsch added a commit that referenced this pull request Apr 7, 2017
jaredhirsch added a commit that referenced this pull request Apr 7, 2017
jaredhirsch added a commit that referenced this pull request Apr 7, 2017
Addresses selector/documentMetadata.js comment 1

#2471 (comment)
jaredhirsch added a commit that referenced this pull request Apr 7, 2017
Addresses selector/shooter.js comment 1

#2471 (comment)
jaredhirsch added a commit that referenced this pull request Apr 7, 2017
@ianb ianb mentioned this pull request Apr 7, 2017
3 tasks
ianb pushed a commit that referenced this pull request Apr 7, 2017
ianb pushed a commit that referenced this pull request Apr 7, 2017
ianb pushed a commit that referenced this pull request Apr 7, 2017
Addresses selector/documentMetadata.js comment 1

#2471 (comment)
ianb pushed a commit that referenced this pull request Apr 7, 2017
Addresses selector/shooter.js comment 1

#2471 (comment)
ianb pushed a commit that referenced this pull request Apr 7, 2017
jaredhirsch added a commit that referenced this pull request Apr 10, 2017
jaredhirsch added a commit that referenced this pull request Apr 10, 2017
jaredhirsch added a commit that referenced this pull request Apr 10, 2017
Addresses selector/documentMetadata.js comment 1

#2471 (comment)
jaredhirsch added a commit that referenced this pull request Apr 10, 2017
Addresses selector/shooter.js comment 1

#2471 (comment)
jaredhirsch added a commit that referenced this pull request Apr 10, 2017
jaredhirsch added a commit that referenced this pull request Apr 10, 2017
* Add strict mode statement to all files

Addresses review comment #2471 (comment)

* Do not assign properties to `window`.

Addresses review comment #2471 (comment)

* Use docElement.outerHTML, not DOMParser, to insert html page into iframe

Addresses comments 2 and 3 inside selector/ui.js

* Use for..of instead of for-loop

Addresses selector/documentMetadata.js comment 1

#2471 (comment)

* Replace IIFE with block scope, yay es6

Addresses selector/shooter.js comment 1

#2471 (comment)

* Use spread/rest operators to simplify assert() fn logic

Addresses shared/shot.js comment 1

#2471 (comment)

* WIP fixes to shared/shot

* Nit - replace let..in with let..of

* Nit: replace foo+"" with String(foo)

* nits related to catcher.js

* auth updates

* review changes to main.js

- add onActivated listener to ensure the button state is properly
  toggled when switching between tabs

* selectorLoader changes

TODO: investigate executeScript return value...

* last few review nits

* Revert "Use docElement.outerHTML, not DOMParser, to insert html page into iframe"

This reverts commit 224927a0b072d2bfb851e6b45ac0ed367ab6bb93.

* Use innerHTML: outerHTML throws a NoModificationAllowedError

* Please the linter

* Fix #2596, address review nit in randomString.js

* Remove space in deviceId generation

* Restore lastError handler for contextMenus.create

* Rename shot.js makeUuid to more accurate makeRandomId

* Fix #2603, abstract out sendToBootstrap error checking
* Add strict mode statement to all files

Addresses review comment #2471 (comment)

* Do not assign properties to `window`.

Addresses review comment #2471 (comment)

* Use docElement.outerHTML, not DOMParser, to insert html page into iframe

Addresses comments 2 and 3 inside selector/ui.js

* Use for..of instead of for-loop

Addresses selector/documentMetadata.js comment 1

#2471 (comment)

* Replace IIFE with block scope, yay es6

Addresses selector/shooter.js comment 1

#2471 (comment)

* Use spread/rest operators to simplify assert() fn logic

Addresses shared/shot.js comment 1

#2471 (comment)

* WIP fixes to shared/shot

* Nit - replace let..in with let..of

* Nit: replace foo+"" with String(foo)

* nits related to catcher.js

* auth updates

* review changes to main.js

- add onActivated listener to ensure the button state is properly
  toggled when switching between tabs

* selectorLoader changes

TODO: investigate executeScript return value...

* last few review nits

* Revert "Use docElement.outerHTML, not DOMParser, to insert html page into iframe"

This reverts commit 224927a0b072d2bfb851e6b45ac0ed367ab6bb93.

* Use innerHTML: outerHTML throws a NoModificationAllowedError

* Please the linter

* Fix #2596, address review nit in randomString.js

* Remove space in deviceId generation

* Restore lastError handler for contextMenus.create

* Rename shot.js makeUuid to more accurate makeRandomId

* Fix #2603, abstract out sendToBootstrap error checking
@ianb
Copy link
Contributor Author

ianb commented Apr 13, 2017

I'm going to close this PR – we've discussed all the comments, fixed a bunch, made followup bugs for all the rest. Thanks @kmaglione and @Mossop !

# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants