Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(ui-shell): change the way to generate unique ID #4291

Merged
merged 2 commits into from
Oct 11, 2019

Conversation

asudoh
Copy link
Contributor

@asudoh asudoh commented Oct 10, 2019

Closes #4288.

Changelog

Changed

  • Unique ID generation logic in vanilla UI shell code from Math.random() to sequence number to address the presumable concern with security.

Testing / Reviewing

Testing should make sure our vanilla product switcher is not broken.

@netlify
Copy link

netlify bot commented Oct 10, 2019

Deploy preview for carbon-elements ready!

Built with commit b4aef68

https://deploy-preview-4291--carbon-elements.netlify.com

@netlify
Copy link

netlify bot commented Oct 10, 2019

Deploy preview for the-carbon-components ready!

Built with commit b4aef68

https://deploy-preview-4291--the-carbon-components.netlify.com

@netlify
Copy link

netlify bot commented Oct 10, 2019

Deploy preview for carbon-components-react failed.

Built with commit b4aef68

https://app.netlify.com/sites/carbon-components-react/deploys/5da110234398e500081892b0

Copy link
Member

@emyarod emyarod left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this only resolves the insecure usage of Math.random report right? are we reopening the ticket to address the other issues? on a side note I get stuck in a redirect loop after logging into ASoC to see the original issues

launcher.id = `__carbon-product-switcher-launcher-${Math.random()
.toString(36)
.substr(2)}`;
launcher.id = `__carbon-product-switcher-launcher-${seq++}`;
Copy link
Contributor

@elizabethsjudd elizabethsjudd Oct 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI, ids must start with a letter in order to be valid HTML. If this is an id that get's added to the HTML I would suggest removing the underscores.

Copy link
Contributor

@joshblack joshblack Oct 10, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it more-so that it was a requirement in HTML4? And they suggest doing it for backwards compat

https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/id

Note: Using characters except ASCII letters, digits, '_', '-' and '.' may cause compatibility problems, as they weren't allowed in HTML 4. Though this restriction has been lifted in HTML5, an ID should start with a letter for compatibility.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Given the point seems for older browsers probably we'd go for it as-is for now.

@asudoh
Copy link
Contributor Author

asudoh commented Oct 10, 2019

@emyarod Updated the original issue; Seems that none of the reports actually affect their app. The random ID one (this PR) is just for pre-caution.

Copy link
Member

@emyarod emyarod left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

aside from the note about valid HTML IDs looks good to me, product switcher is functioning as expected

Copy link
Contributor

@abbeyhrt abbeyhrt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me! Thank you for clarifying on the original issue @asudoh !

@asudoh asudoh merged commit 38ce4f6 into carbon-design-system:master Oct 11, 2019
@asudoh asudoh deleted the ui-shell-unique-id branch October 11, 2019 23:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Got some security issues after scaned by AppScan on Cloud
5 participants