Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace Envelope mechanizm from object to string based to avoid infinite React rerendering #29

Merged
merged 1 commit into from
Feb 13, 2024

Conversation

weizman
Copy link
Member

@weizman weizman commented Feb 13, 2024

In addition to minor lift-ups, this PR mainly focuses on a problem introduced at #26.

  • At Address React internals processing leakage #26 we follow @naugtur's envelop idea from feat: wrap payload in envelope #23 where we export a util function to help developers pass a unique object reference (aka token) to map to the secret instead of the secret itself, so that we don't leak the actual secret text to React internals at any point (because those leak it to the global object which compromises LavaDome completely)
  • Problem with this approach is that since the token is a new object, an identical secret text maps out to two different tokens, thus forcing React to rerender over and over even though the secret text is the same
  • This PR replaces the mechanizm of object-based tokens with string based tokens, by leveraging builtin crypto.randomUUID API, so that it's easier and more efficient to map secrets to token, especially when the secrets might already be familiar to the internals of LavaDomeReact

@weizman weizman marked this pull request as ready for review February 13, 2024 14:29
@weizman weizman changed the title poc Replace Envelope mechanizm from object based to string based to avoid infinite React rerendering Feb 13, 2024
@weizman weizman changed the title Replace Envelope mechanizm from object based to string based to avoid infinite React rerendering Replace Envelope mechanizm from object to string based to avoid infinite React rerendering Feb 13, 2024
@weizman weizman merged commit 5e83386 into main Feb 13, 2024
@weizman weizman deleted the weizman/defend-against-react-props-fix branch February 13, 2024 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant