Skip to content

Commit 7d3f565

Browse files
PuruVJPuruVJ
committed
Merge remote-tracking branch 'origin/master' into sites
2 parents ae2a089 + e875a76 commit 7d3f565

File tree

10 files changed

+59
-11
lines changed

10 files changed

+59
-11
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
# Svelte changelog
22

3+
## Unreleased
4+
5+
* Make `noreferrer` warning less zealous ([#6289](https://github.com/sveltejs/svelte/issues/6289))
6+
* `trusted-types` CSP compatibility for Web Components ([#8134](https://github.com/sveltejs/svelte/issues/8134))
7+
38
## 3.55.1
49

510
* Fix `draw` transition with delay showing a dot at the beginning of the path ([#6816](https://github.com/sveltejs/svelte/issues/6816))

‎LICENSE.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
Copyright (c) 2016-22 [these people](https://github.com/sveltejs/svelte/graphs/contributors)
1+
Copyright (c) 2016-23 [these people](https://github.com/sveltejs/svelte/graphs/contributors)
22

33
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
44

‎src/compiler/compile/nodes/Element.ts

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -621,22 +621,23 @@ export default class Element extends Node {
621621
const name_attribute = attribute_map.get('name');
622622
const target_attribute = attribute_map.get('target');
623623

624-
if (target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) {
624+
// links with target="_blank" should have noopener or noreferrer: https://developer.chrome.com/docs/lighthouse/best-practices/external-anchors-use-rel-noopener/
625+
// modern browsers add noopener by default, so we only need to check legacy browsers
626+
// legacy browsers don't support noopener so we only check for noreferrer there
627+
if (component.compile_options.legacy && target_attribute && target_attribute.get_static_value() === '_blank' && href_attribute) {
625628
const href_static_value = href_attribute.get_static_value() ? href_attribute.get_static_value().toLowerCase() : null;
626629

627630
if (href_static_value === null || href_static_value.match(/^(https?:)?\/\//i)) {
628631
const rel = attribute_map.get('rel');
629632
if (rel == null || rel.is_static) {
630633
const rel_values = rel ? rel.get_static_value().split(regex_any_repeated_whitespaces) : [];
631-
const expected_values = ['noreferrer'];
632-
expected_values.forEach(expected_value => {
633-
if (!rel || rel && rel_values.indexOf(expected_value) < 0) {
634+
if (!rel || !rel_values.includes('noreferrer')) {
634635
component.warn(this, {
635-
code: `security-anchor-rel-${expected_value}`,
636-
message: `Security: Anchor with "target=_blank" should have rel attribute containing the value "${expected_value}"`
636+
code: 'security-anchor-rel-noreferrer',
637+
message:
638+
'Security: Anchor with "target=_blank" should have rel attribute containing the value "noreferrer"'
637639
});
638-
}
639-
});
640+
}
640641
}
641642
}
642643
}

‎src/compiler/compile/render_dom/index.ts

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -531,7 +531,10 @@ export default function dom(
531531
constructor(options) {
532532
super();
533533
534-
${css.code && b`this.shadowRoot.innerHTML = \`<style>${css.code.replace(regex_backslashes, '\\\\')}${css_sourcemap_enabled && options.dev ? `\n/*# sourceMappingURL=${css.map.toUrl()} */` : ''}</style>\`;`}
534+
${css.code && b`
535+
const style = document.createElement('style');
536+
style.textContent = \`${css.code.replace(regex_backslashes, '\\\\')}${css_sourcemap_enabled && options.dev ? `\n/*# sourceMappingURL=${css.map.toUrl()} */` : ''}\`
537+
this.shadowRoot.appendChild(style)`}
535538
536539
@init(this, { target: this.shadowRoot, props: ${init_props}, customElement: true }, ${definition}, ${has_create_fragment ? 'create_fragment' : 'null'}, ${not_equal}, ${prop_indexes}, null, ${dirty});
537540

‎test/js/samples/css-shadow-dom-keyframes/expected.js

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,9 @@ function create_fragment(ctx) {
3434
class Component extends SvelteElement {
3535
constructor(options) {
3636
super();
37-
this.shadowRoot.innerHTML = `<style>div{animation:foo 1s}@keyframes foo{0%{opacity:0}100%{opacity:1}}</style>`;
37+
const style = document.createElement('style');
38+
style.textContent = `div{animation:foo 1s}@keyframes foo{0%{opacity:0}100%{opacity:1}}`;
39+
this.shadowRoot.appendChild(style);
3840

3941
init(
4042
this,

‎test/validator/samples/security-anchor-rel-noreferer-legacy/_config.js

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
export default {
2+
legacy: true
3+
};

‎test/validator/samples/security-anchor-rel-noreferrer/input.svelte renamed to ‎test/validator/samples/security-anchor-rel-noreferer-legacy/input.svelte

File renamed without changes.

‎test/validator/samples/security-anchor-rel-noreferrer/warnings.json renamed to ‎test/validator/samples/security-anchor-rel-noreferer-legacy/warnings.json

File renamed without changes.

‎test/validator/samples/security-anchor-rel-noreferer/input.svelte

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<a href="https://svelte.dev" target="_blank">svelte website (invalid)</a>
2+
<a href="https://svelte.dev" target="_blank" rel="">svelte website (invalid)</a>
3+
<a href="https://svelte.dev" target="_blank" rel="noopener">svelte website (invalid)</a>
4+
<a href={'https://svelte.dev'} target="_blank">svelte website (invalid)</a>
5+
<a href={'https://svelte.dev'} target="_blank" rel="">svelte website (invalid)</a>
6+
<a href={'https://svelte.dev'} target="_blank" rel="noopener">svelte website (invalid)</a>
7+
<a href="//svelte.dev" target="_blank">svelte website (invalid)</a>
8+
<a href="//svelte.dev" target="_blank" rel="">svelte website (invalid)</a>
9+
<a href="//svelte.dev" target="_blank" rel="noopener">svelte website (invalid)</a>
10+
<a href="http://svelte.dev" target="_blank">svelte website (invalid)</a>
11+
<a href="http://svelte.dev" target="_blank" rel="">svelte website (invalid)</a>
12+
<a href="http://svelte.dev" target="_blank" rel="noopener">svelte website (invalid)</a>
13+
<a href="HTTP://svelte.dev" target="_blank">svelte website (invalid)</a>
14+
<a href="HTTP://svelte.dev" target="_blank" rel="">svelte website (invalid)</a>
15+
<a href="HTTP://svelte.dev" target="_blank" rel="noopener">svelte website (invalid)</a>
16+
<a href={'HTTPS://svelte.dev'} target="_blank">svelte website (invalid)</a>
17+
<a href={'HTTPS://svelte.dev'} target="_blank" rel="">svelte website (invalid)</a>
18+
<a href={'HTTPS://svelte.dev'} target="_blank" rel="noopener">svelte website (invalid)</a>
19+
<a href="same-host" target="_blank">Same host (valid)</a>
20+
<a href="same-host" target="_blank" rel="">Same host (valid)</a>
21+
<a href="same-host" target="_blank" rel="noopener">Same host (valid)</a>
22+
<a href="http://svelte.dev" target="_blank" rel="noreferrer">svelte website (valid)</a>
23+
<a href="http://svelte.dev" target="_blank" rel="noreferrer noopener">svelte website (valid)</a>
24+
<a href="HTTP://svelte.dev" target="_blank" rel="noreferrer">svelte website (valid)</a>
25+
<a href="HTTP://svelte.dev" target="_blank" rel="noreferrer noopener">svelte website (valid)</a>
26+
<a href="https://svelte.dev" target="_blank" rel="noreferrer">svelte website (valid)</a>
27+
<a href="https://svelte.dev" target="_blank" rel="noreferrer noopener">svelte website (valid)</a>
28+
<a href="HTTPS://svelte.dev" target="_blank" rel="noreferrer">svelte website (valid)</a>
29+
<a href="HTTPS://svelte.dev" target="_blank" rel="noreferrer noopener">svelte website (valid)</a>
30+
<a href="//svelte.dev" target="_blank" rel="noreferrer">svelte website (valid)</a>
31+
<a href="//svelte.dev" target="_blank" rel="noreferrer noopener">svelte website (valid)</a>
32+
<!-- dynamic rel value should not warn-->
33+
<a href="//svelte.dev" target="_blank" rel={`${Math.random()}`}>svelte website (valid)</a>

‎test/validator/samples/security-anchor-rel-noreferer/warnings.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
[]

0 commit comments

Comments
 (0)