From 967e9f51ff649f776fa034db8aba23a5a1546294 Mon Sep 17 00:00:00 2001 From: Yuichiro Yamashita Date: Thu, 12 Jan 2023 11:11:14 +0900 Subject: [PATCH 1/8] chore: add Node18 for CI (#8078) --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e24f106477..1e0ce53864 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -46,7 +46,7 @@ jobs: timeout-minutes: 15 strategy: matrix: - node-version: [8, 10, 12, 14, 16] + node-version: [8, 10, 12, 14, 16, 18] os: [ubuntu-latest, windows-latest, macOS-latest] steps: - uses: actions/checkout@v3 From 79fa5b36a1b0d90407d1bf6b1d6b2504427f3f96 Mon Sep 17 00:00:00 2001 From: Gabriel Francisco Date: Fri, 27 Jan 2023 13:22:52 -0300 Subject: [PATCH 2/8] Update license year (#8227) --- LICENSE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE.md b/LICENSE.md index cd8f94f4ca..aa74406768 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -1,4 +1,4 @@ -Copyright (c) 2016-22 [these people](https://github.com/sveltejs/svelte/graphs/contributors) +Copyright (c) 2016-23 [these people](https://github.com/sveltejs/svelte/graphs/contributors) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: From 4f42daeff78a98877d58dff49b6e05b3a4ae0f73 Mon Sep 17 00:00:00 2001 From: Jay Harris Date: Sat, 28 Jan 2023 13:25:04 +1300 Subject: [PATCH 3/8] feat: `trusted-types` CSP compatibility for Web Components (#8135) --- src/compiler/compile/render_dom/index.ts | 5 ++++- test/js/samples/css-shadow-dom-keyframes/expected.js | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/compiler/compile/render_dom/index.ts b/src/compiler/compile/render_dom/index.ts index 44155f8464..58b7a8317b 100644 --- a/src/compiler/compile/render_dom/index.ts +++ b/src/compiler/compile/render_dom/index.ts @@ -531,7 +531,10 @@ export default function dom( constructor(options) { super(); - ${css.code && b`this.shadowRoot.innerHTML = \`\`;`} + ${css.code && b` + const style = document.createElement('style'); + style.textContent = \`${css.code.replace(regex_backslashes, '\\\\')}${css_sourcemap_enabled && options.dev ? `\n/*# sourceMappingURL=${css.map.toUrl()} */` : ''}\` + this.shadowRoot.appendChild(style)`} @init(this, { target: this.shadowRoot, props: ${init_props}, customElement: true }, ${definition}, ${has_create_fragment ? 'create_fragment' : 'null'}, ${not_equal}, ${prop_indexes}, null, ${dirty}); diff --git a/test/js/samples/css-shadow-dom-keyframes/expected.js b/test/js/samples/css-shadow-dom-keyframes/expected.js index 5d65949488..ba7ca9a667 100644 --- a/test/js/samples/css-shadow-dom-keyframes/expected.js +++ b/test/js/samples/css-shadow-dom-keyframes/expected.js @@ -34,7 +34,9 @@ function create_fragment(ctx) { class Component extends SvelteElement { constructor(options) { super(); - this.shadowRoot.innerHTML = ``; + const style = document.createElement('style'); + style.textContent = `div{animation:foo 1s}@keyframes foo{0%{opacity:0}100%{opacity:1}}`; + this.shadowRoot.appendChild(style); init( this, From eb90a15c2959d0d02ee27b4920dc1f197b77b70a Mon Sep 17 00:00:00 2001 From: Ben McCann <322311+benmccann@users.noreply.github.com> Date: Fri, 27 Jan 2023 16:27:19 -0800 Subject: [PATCH 4/8] update changelog --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ce1e2a2621..865ed07b53 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Svelte changelog +## Unreleased + +* `trusted-types` CSP compatibility for Web Components ([#8134](https://github.com/sveltejs/svelte/issues/8134)) + ## 3.55.1 * Fix `draw` transition with delay showing a dot at the beginning of the path ([#6816](https://github.com/sveltejs/svelte/issues/6816)) From 34ae6aaf1f3279e2c0f0515f64db59d31ecb46f9 Mon Sep 17 00:00:00 2001 From: Ben McCann <322311+benmccann@users.noreply.github.com> Date: Sat, 28 Jan 2023 08:50:14 -0800 Subject: [PATCH 5/8] fix: make `noreferrer` warning less zealous (#8230) Co-authored-by: Yuichiro Yamashita --- src/compiler/compile/nodes/Element.ts | 17 +++++----- .../_config.js | 3 ++ .../input.svelte | 0 .../warnings.json | 0 .../input.svelte | 33 +++++++++++++++++++ .../warnings.json | 1 + 6 files changed, 46 insertions(+), 8 deletions(-) create mode 100644 test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js rename test/validator/samples/{security-anchor-rel-noreferrer => security-anchor-rel-noreferer-legacy}/input.svelte (100%) rename test/validator/samples/{security-anchor-rel-noreferrer => security-anchor-rel-noreferer-legacy}/warnings.json (100%) create mode 100644 test/validator/samples/security-anchor-rel-noreferer/input.svelte create mode 100644 test/validator/samples/security-anchor-rel-noreferer/warnings.json diff --git a/src/compiler/compile/nodes/Element.ts b/src/compiler/compile/nodes/Element.ts index 06ef1ba9c1..0d3e8a01bd 100644 --- a/src/compiler/compile/nodes/Element.ts +++ b/src/compiler/compile/nodes/Element.ts @@ -621,22 +621,23 @@ export default class Element extends Node { const name_attribute = attribute_map.get('name'); const target_attribute = attribute_map.get('target'); - if (target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) { + // links with target="_blank" should have noopener or noreferrer: https://developer.chrome.com/docs/lighthouse/best-practices/external-anchors-use-rel-noopener/ + // modern browsers add noopener by default, so we only need to check legacy browsers + // legacy browsers don't support noopener so we only check for noreferrer there + if (component.compile_options.legacy && target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) { const href_static_value = href_attribute.get_static_value() ? href_attribute.get_static_value().toLowerCase() : null; if (href_static_value === null || href_static_value.match(/^(https?:)?\/\//i)) { const rel = attribute_map.get('rel'); if (rel == null || rel.is_static) { const rel_values = rel ? rel.get_static_value().split(regex_any_repeated_whitespaces) : []; - const expected_values = ['noreferrer']; - expected_values.forEach(expected_value => { - if (!rel || rel && rel_values.indexOf(expected_value) < 0) { + if (!rel || !rel_values.includes('noreferrer')) { component.warn(this, { - code: `security-anchor-rel-${expected_value}`, - message: `Security: Anchor with "target=_blank" should have rel attribute containing the value "${expected_value}"` + code: 'security-anchor-rel-noreferrer', + message: + 'Security: Anchor with "target=_blank" should have rel attribute containing the value "noreferrer"' }); - } - }); + } } } } diff --git a/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js b/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js new file mode 100644 index 0000000000..52f59c8767 --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js @@ -0,0 +1,3 @@ +export default { + legacy: true +}; diff --git a/test/validator/samples/security-anchor-rel-noreferrer/input.svelte b/test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte similarity index 100% rename from test/validator/samples/security-anchor-rel-noreferrer/input.svelte rename to test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte diff --git a/test/validator/samples/security-anchor-rel-noreferrer/warnings.json b/test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json similarity index 100% rename from test/validator/samples/security-anchor-rel-noreferrer/warnings.json rename to test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json diff --git a/test/validator/samples/security-anchor-rel-noreferer/input.svelte b/test/validator/samples/security-anchor-rel-noreferer/input.svelte new file mode 100644 index 0000000000..f5361e5cfe --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer/input.svelte @@ -0,0 +1,33 @@ +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +Same host (valid) +Same host (valid) +Same host (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) + +svelte website (valid) diff --git a/test/validator/samples/security-anchor-rel-noreferer/warnings.json b/test/validator/samples/security-anchor-rel-noreferer/warnings.json new file mode 100644 index 0000000000..fe51488c70 --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer/warnings.json @@ -0,0 +1 @@ +[] From e875a76ad1675c21aea0911a8b32c8ad3abc070b Mon Sep 17 00:00:00 2001 From: Ben McCann <322311+benmccann@users.noreply.github.com> Date: Sat, 28 Jan 2023 08:51:35 -0800 Subject: [PATCH 6/8] update changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 865ed07b53..fba777ad9c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +* Make `noreferrer` warning less zealous ([#6289](https://github.com/sveltejs/svelte/issues/6289)) * `trusted-types` CSP compatibility for Web Components ([#8134](https://github.com/sveltejs/svelte/issues/8134)) ## 3.55.1 From cb972ecdba92326e67c6cc37f672c58b88fdc3a5 Mon Sep 17 00:00:00 2001 From: Tim McCabe Date: Sun, 5 Feb 2023 06:23:43 -0500 Subject: [PATCH 7/8] [chore] fix `a11y-no-nointeractive-tabindex` typo (#8252) --- .../input.svelte | 0 .../warnings.json | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename test/validator/samples/{a11y-no-nointeractive-tabindex => a11y-no-noninteractive-tabindex}/input.svelte (100%) rename test/validator/samples/{a11y-no-nointeractive-tabindex => a11y-no-noninteractive-tabindex}/warnings.json (100%) diff --git a/test/validator/samples/a11y-no-nointeractive-tabindex/input.svelte b/test/validator/samples/a11y-no-noninteractive-tabindex/input.svelte similarity index 100% rename from test/validator/samples/a11y-no-nointeractive-tabindex/input.svelte rename to test/validator/samples/a11y-no-noninteractive-tabindex/input.svelte diff --git a/test/validator/samples/a11y-no-nointeractive-tabindex/warnings.json b/test/validator/samples/a11y-no-noninteractive-tabindex/warnings.json similarity index 100% rename from test/validator/samples/a11y-no-nointeractive-tabindex/warnings.json rename to test/validator/samples/a11y-no-noninteractive-tabindex/warnings.json From 6ac24f1d5c9174b161bb6e27743c84c0a117ea7f Mon Sep 17 00:00:00 2001 From: Satvik Date: Sun, 5 Feb 2023 07:00:54 -0500 Subject: [PATCH 8/8] [docs] add missing semicolon (#8190) --- site/content/docs/02-component-format.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/docs/02-component-format.md b/site/content/docs/02-component-format.md index 268444ab7d..d9f7a35662 100644 --- a/site/content/docs/02-component-format.md +++ b/site/content/docs/02-component-format.md @@ -147,7 +147,7 @@ Any top-level statement (i.e. not inside a block or a function) can be made reac ```sv