From 79fa5b36a1b0d90407d1bf6b1d6b2504427f3f96 Mon Sep 17 00:00:00 2001 From: Gabriel Francisco Date: Fri, 27 Jan 2023 13:22:52 -0300 Subject: [PATCH 01/47] Update license year (#8227) --- LICENSE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/LICENSE.md b/LICENSE.md index cd8f94f4ca..aa74406768 100644 --- a/LICENSE.md +++ b/LICENSE.md @@ -1,4 +1,4 @@ -Copyright (c) 2016-22 [these people](https://github.com/sveltejs/svelte/graphs/contributors) +Copyright (c) 2016-23 [these people](https://github.com/sveltejs/svelte/graphs/contributors) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: From 4f42daeff78a98877d58dff49b6e05b3a4ae0f73 Mon Sep 17 00:00:00 2001 From: Jay Harris Date: Sat, 28 Jan 2023 13:25:04 +1300 Subject: [PATCH 02/47] feat: `trusted-types` CSP compatibility for Web Components (#8135) --- src/compiler/compile/render_dom/index.ts | 5 ++++- test/js/samples/css-shadow-dom-keyframes/expected.js | 4 +++- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/src/compiler/compile/render_dom/index.ts b/src/compiler/compile/render_dom/index.ts index 44155f8464..58b7a8317b 100644 --- a/src/compiler/compile/render_dom/index.ts +++ b/src/compiler/compile/render_dom/index.ts @@ -531,7 +531,10 @@ export default function dom( constructor(options) { super(); - ${css.code && b`this.shadowRoot.innerHTML = \`\`;`} + ${css.code && b` + const style = document.createElement('style'); + style.textContent = \`${css.code.replace(regex_backslashes, '\\\\')}${css_sourcemap_enabled && options.dev ? `\n/*# sourceMappingURL=${css.map.toUrl()} */` : ''}\` + this.shadowRoot.appendChild(style)`} @init(this, { target: this.shadowRoot, props: ${init_props}, customElement: true }, ${definition}, ${has_create_fragment ? 'create_fragment' : 'null'}, ${not_equal}, ${prop_indexes}, null, ${dirty}); diff --git a/test/js/samples/css-shadow-dom-keyframes/expected.js b/test/js/samples/css-shadow-dom-keyframes/expected.js index 5d65949488..ba7ca9a667 100644 --- a/test/js/samples/css-shadow-dom-keyframes/expected.js +++ b/test/js/samples/css-shadow-dom-keyframes/expected.js @@ -34,7 +34,9 @@ function create_fragment(ctx) { class Component extends SvelteElement { constructor(options) { super(); - this.shadowRoot.innerHTML = ``; + const style = document.createElement('style'); + style.textContent = `div{animation:foo 1s}@keyframes foo{0%{opacity:0}100%{opacity:1}}`; + this.shadowRoot.appendChild(style); init( this, From eb90a15c2959d0d02ee27b4920dc1f197b77b70a Mon Sep 17 00:00:00 2001 From: Ben McCann <322311+benmccann@users.noreply.github.com> Date: Fri, 27 Jan 2023 16:27:19 -0800 Subject: [PATCH 03/47] update changelog --- CHANGELOG.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index ce1e2a2621..865ed07b53 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Svelte changelog +## Unreleased + +* `trusted-types` CSP compatibility for Web Components ([#8134](https://github.com/sveltejs/svelte/issues/8134)) + ## 3.55.1 * Fix `draw` transition with delay showing a dot at the beginning of the path ([#6816](https://github.com/sveltejs/svelte/issues/6816)) From 34ae6aaf1f3279e2c0f0515f64db59d31ecb46f9 Mon Sep 17 00:00:00 2001 From: Ben McCann <322311+benmccann@users.noreply.github.com> Date: Sat, 28 Jan 2023 08:50:14 -0800 Subject: [PATCH 04/47] fix: make `noreferrer` warning less zealous (#8230) Co-authored-by: Yuichiro Yamashita --- src/compiler/compile/nodes/Element.ts | 17 +++++----- .../_config.js | 3 ++ .../input.svelte | 0 .../warnings.json | 0 .../input.svelte | 33 +++++++++++++++++++ .../warnings.json | 1 + 6 files changed, 46 insertions(+), 8 deletions(-) create mode 100644 test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js rename test/validator/samples/{security-anchor-rel-noreferrer => security-anchor-rel-noreferer-legacy}/input.svelte (100%) rename test/validator/samples/{security-anchor-rel-noreferrer => security-anchor-rel-noreferer-legacy}/warnings.json (100%) create mode 100644 test/validator/samples/security-anchor-rel-noreferer/input.svelte create mode 100644 test/validator/samples/security-anchor-rel-noreferer/warnings.json diff --git a/src/compiler/compile/nodes/Element.ts b/src/compiler/compile/nodes/Element.ts index 06ef1ba9c1..0d3e8a01bd 100644 --- a/src/compiler/compile/nodes/Element.ts +++ b/src/compiler/compile/nodes/Element.ts @@ -621,22 +621,23 @@ export default class Element extends Node { const name_attribute = attribute_map.get('name'); const target_attribute = attribute_map.get('target'); - if (target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) { + // links with target="_blank" should have noopener or noreferrer: https://developer.chrome.com/docs/lighthouse/best-practices/external-anchors-use-rel-noopener/ + // modern browsers add noopener by default, so we only need to check legacy browsers + // legacy browsers don't support noopener so we only check for noreferrer there + if (component.compile_options.legacy && target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) { const href_static_value = href_attribute.get_static_value() ? href_attribute.get_static_value().toLowerCase() : null; if (href_static_value === null || href_static_value.match(/^(https?:)?\/\//i)) { const rel = attribute_map.get('rel'); if (rel == null || rel.is_static) { const rel_values = rel ? rel.get_static_value().split(regex_any_repeated_whitespaces) : []; - const expected_values = ['noreferrer']; - expected_values.forEach(expected_value => { - if (!rel || rel && rel_values.indexOf(expected_value) < 0) { + if (!rel || !rel_values.includes('noreferrer')) { component.warn(this, { - code: `security-anchor-rel-${expected_value}`, - message: `Security: Anchor with "target=_blank" should have rel attribute containing the value "${expected_value}"` + code: 'security-anchor-rel-noreferrer', + message: + 'Security: Anchor with "target=_blank" should have rel attribute containing the value "noreferrer"' }); - } - }); + } } } } diff --git a/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js b/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js new file mode 100644 index 0000000000..52f59c8767 --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js @@ -0,0 +1,3 @@ +export default { + legacy: true +}; diff --git a/test/validator/samples/security-anchor-rel-noreferrer/input.svelte b/test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte similarity index 100% rename from test/validator/samples/security-anchor-rel-noreferrer/input.svelte rename to test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte diff --git a/test/validator/samples/security-anchor-rel-noreferrer/warnings.json b/test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json similarity index 100% rename from test/validator/samples/security-anchor-rel-noreferrer/warnings.json rename to test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json diff --git a/test/validator/samples/security-anchor-rel-noreferer/input.svelte b/test/validator/samples/security-anchor-rel-noreferer/input.svelte new file mode 100644 index 0000000000..f5361e5cfe --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer/input.svelte @@ -0,0 +1,33 @@ +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +svelte website (invalid) +Same host (valid) +Same host (valid) +Same host (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) +svelte website (valid) + +svelte website (valid) diff --git a/test/validator/samples/security-anchor-rel-noreferer/warnings.json b/test/validator/samples/security-anchor-rel-noreferer/warnings.json new file mode 100644 index 0000000000..fe51488c70 --- /dev/null +++ b/test/validator/samples/security-anchor-rel-noreferer/warnings.json @@ -0,0 +1 @@ +[] From e875a76ad1675c21aea0911a8b32c8ad3abc070b Mon Sep 17 00:00:00 2001 From: Ben McCann <322311+benmccann@users.noreply.github.com> Date: Sat, 28 Jan 2023 08:51:35 -0800 Subject: [PATCH 05/47] update changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 865ed07b53..fba777ad9c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,7 @@ ## Unreleased +* Make `noreferrer` warning less zealous ([#6289](https://github.com/sveltejs/svelte/issues/6289)) * `trusted-types` CSP compatibility for Web Components ([#8134](https://github.com/sveltejs/svelte/issues/8134)) ## 3.55.1 From cb972ecdba92326e67c6cc37f672c58b88fdc3a5 Mon Sep 17 00:00:00 2001 From: Tim McCabe Date: Sun, 5 Feb 2023 06:23:43 -0500 Subject: [PATCH 06/47] [chore] fix `a11y-no-nointeractive-tabindex` typo (#8252) --- .../input.svelte | 0 .../warnings.json | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename test/validator/samples/{a11y-no-nointeractive-tabindex => a11y-no-noninteractive-tabindex}/input.svelte (100%) rename test/validator/samples/{a11y-no-nointeractive-tabindex => a11y-no-noninteractive-tabindex}/warnings.json (100%) diff --git a/test/validator/samples/a11y-no-nointeractive-tabindex/input.svelte b/test/validator/samples/a11y-no-noninteractive-tabindex/input.svelte similarity index 100% rename from test/validator/samples/a11y-no-nointeractive-tabindex/input.svelte rename to test/validator/samples/a11y-no-noninteractive-tabindex/input.svelte diff --git a/test/validator/samples/a11y-no-nointeractive-tabindex/warnings.json b/test/validator/samples/a11y-no-noninteractive-tabindex/warnings.json similarity index 100% rename from test/validator/samples/a11y-no-nointeractive-tabindex/warnings.json rename to test/validator/samples/a11y-no-noninteractive-tabindex/warnings.json From 6ac24f1d5c9174b161bb6e27743c84c0a117ea7f Mon Sep 17 00:00:00 2001 From: Satvik Date: Sun, 5 Feb 2023 07:00:54 -0500 Subject: [PATCH 07/47] [docs] add missing semicolon (#8190) --- site/content/docs/02-component-format.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/docs/02-component-format.md b/site/content/docs/02-component-format.md index 268444ab7d..d9f7a35662 100644 --- a/site/content/docs/02-component-format.md +++ b/site/content/docs/02-component-format.md @@ -147,7 +147,7 @@ Any top-level statement (i.e. not inside a block or a function) can be made reac ```sv From d9253963f79d2066edd164580a684cd066042638 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Feb 2023 09:05:19 -0800 Subject: [PATCH 13/47] Bump qs from 6.5.2 to 6.5.3 (#8090) Bumps [qs](https://github.com/ljharb/qs) from 6.5.2 to 6.5.3. - [Release notes](https://github.com/ljharb/qs/releases) - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.5.2...v6.5.3) --- updated-dependencies: - dependency-name: qs dependency-type: indirect ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- package-lock.json | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/package-lock.json b/package-lock.json index f993cad461..5ab035cd2e 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4138,9 +4138,9 @@ } }, "node_modules/qs": { - "version": "6.5.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz", - "integrity": "sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==", + "version": "6.5.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.3.tgz", + "integrity": "sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==", "dev": true, "engines": { "node": ">=0.6" @@ -8432,9 +8432,9 @@ } }, "qs": { - "version": "6.5.2", - "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.2.tgz", - "integrity": "sha512-N5ZAX4/LxJmF+7wN74pUD6qAh9/wnvdQcjq9TZjevvXzSUo7bfmw91saqMjzGS2xq91/odN2dW/WOl7qQHNDGA==", + "version": "6.5.3", + "resolved": "https://registry.npmjs.org/qs/-/qs-6.5.3.tgz", + "integrity": "sha512-qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==", "dev": true }, "queue-microtask": { From acba4b72e23c90939ca8c39a22aca185d588aa1b Mon Sep 17 00:00:00 2001 From: James Scott-Brown Date: Tue, 14 Feb 2023 18:04:49 +0000 Subject: [PATCH 14/47] docs: clarify bindings for `` value binding corresponds to the `value` property on the selected ` --- -A `` element behaves similarly to a checkbox group. The bound variable is an array with an entry corresponding to the `value` property of each selected `