Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

core(legacy-javascript): use third-party-web for scoring #10849

Merged
merged 3 commits into from
May 27, 2020
Merged

Conversation

connorjclark
Copy link
Collaborator

part of #10369

Still an informative audit, so no real change here.

@patrickhulce you mentioned having to write a isThirdParty function for a couple things. where do you want to put this fn?

@connorjclark connorjclark requested a review from patrickhulce May 27, 2020 02:46
@connorjclark connorjclark requested a review from a team as a code owner May 27, 2020 02:46
@patrickhulce
Copy link
Collaborator

where do you want to put this fn?

I think it makes sense living in lib/, alternative is a computed artifact for each URL but that feels a bit too much don't you think?

Copy link
Collaborator

@patrickhulce patrickhulce left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

impl looks great to me, definitely cleaner to have the main entity piece part of the isThirdParty function 👍

const artifacts = createArtifacts([
{
code: 'String.prototype.repeat = function() {}',
url: 'https://www.googletagmanager.com/a.js',
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would be nice to ensure the main entity logic is getting exercised too

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see us re-testing this particular logic over and over again ... maybe just one test in the lib that this fn will move to?

and just assume that usage within audits is OK (treat like a dependency, for example we don't test that the URL class works as expected in every test)

Copy link
Collaborator

@patrickhulce patrickhulce May 27, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make the mainEntity a required argument, and you've got a deal :) Oh lol it's already required I just had it wrong in my head. Carry on! :)

making it required+typechecking solves exactly my concern, and agreed it would like testing URL at that point.

@patrickhulce
Copy link
Collaborator

Sorry for my confusion on the required argument part @connorjclark :)

WDYT about?

I think it makes sense living in lib/, alternative is a computed artifact for each URL but that feels a bit too much don't you think?

@connorjclark
Copy link
Collaborator Author

let's go with lib

Copy link
Collaborator

@patrickhulce patrickhulce left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! thanks for the cleanup to lib too 🎉

@patrickhulce patrickhulce merged commit 03f00c7 into master May 27, 2020
@patrickhulce patrickhulce deleted the legacy-3p branch May 27, 2020 17:51
* @param {string} url
* @param {ThirdPartyEntity | undefined} mainDocumentEntity
*/
function isFirstParty(url, mainDocumentEntity) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we can rename this? It isn't really a first party check, it's more of a "not a known majorish third party" check. As an example, up in legacy-javascript.js, URL.rootDomainsMatch(row.url, mainResource.url) is being replaced with a thirdPartyWeb.isFirstParty(row.url, mainDocumentEntity);, which is a better choice for that check but also potentially a very different set of results, depending on the test page.

(removing and doing a if (!thirdPartyWeb.isThirdParty()) up above also seems very clear in its intention if we don't want to bikeshed on names)

describe('third party web', () => {
it('basic', () => {
expect(thirdPartyWeb.isThirdParty('https://www.example.com', undefined)).toBe(false);
expect(thirdPartyWeb.isFirstParty('https://www.example.com', undefined)).toBe(true);
Copy link
Member

@brendankenny brendankenny May 27, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe this is a better example of where the naming gets weird. Just reading this in isolation, I would have no idea why https://www.example.com was determined to be first party :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants