HomePhabricator

* (bug 28626) Validate JavaScript files and pages loaded via ResourceLoader…

Description

  • (bug 28626) Validate JavaScript files and pages loaded via ResourceLoader before minification, protecting separate modules from interference

This is possibly not perfect but seems to serve for a start; follows up on r91591 that adds JSMin+ to use it in some unit tests. May want to adjust some related bits.

  • $wgResourceLoaderValidateJs on by default (can be disabled)
  • when loading a JS file through ResourceLoaderFileModule or ResourceLoaderWikiModule, parse it using JSMinPlus's JSParser class. If the parser throws an exception, the JS code of the offending file will be replaced by a JS exception throw listing the file or page name, line number (in original form), and description of the error from the parser.
  • parsing results are cached based on md5 of content to avoid re-parsing identical text
  • for JS pages loaded via direct load.php request, the parse error is thrown and visible in the JS console/error log

Issues:

  • the primary use case for this is when a single load.php request implements multiple modules via mw.loader.implement() -- the loader catches the exception and skips on to the next module (good) but doesn't re-throw the exception for the JS console. It does log to console if present, but it'll only show up as a regular debug message, not an error. This can suppress visibility of errors in a module that's loaded together with other modules (such as a gadget).
  • have not done performance testing on the JSParser
  • have not done thorough unit testing with the JSParser

Details

Provenance
brionAuthored on
Parents
rSVN91607: I think this is the correct implementation of extend function
Branches
Unknown
Tags
Unknown
ChangeId
None