Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@open-wc/scoped-elements
Advanced tools
Part of Open Web Components
Open Web Components provides a set of defaults, recommendations and tools to help facilitate your web component project. Our recommendations include: developing, linting, testing, building, tooling, demoing, publishing and automating.
:::warning
This is an experimental feature, use it at your own risk and be sure to understand its limitations.
No big applications are using scoped-elements
yet - so there is no proof yet if it works in production.
This page focuses on in depth explanations as it should help foster a discussion on scoping.
:::
Complex Web Component applications are often developed by several teams across organizations. In that scenario it is common that shared component libraries are used by teams to create an homogeneous look and feel or just to avoid creating the same components multiple times, but as those libraries evolve problems between different versions of the same library may appear, as teams may not be able to evolve and update their code at the same velocity. This causes bottlenecks in software delivery that should be managed by the teams and complex build systems, to try and alleviate the problem.
Scoped Custom Element Registries is a proposal that will solve this problem, but until it is ready or a polyfill becomes available, we have to scope custom element tag names if we want to use different versions of those custom elements in our code. This package allows you to forget about how custom elements are defined, registered and scopes their tag names if it is necessary, and avoids the name collision problem.
npm i --save @open-wc/scoped-elements
Consider the following setup
Two possible solutions come to mind:
@open-wc/scoped-elements
; see the "fixed" example with-scope [code] running with nested dependencies.The simplified app has the following dependencies
which leads to the following node_modules tree
├── node_modules
│ ├── feature-a
│ ├── feature-b
│ ├── page-a
│ └── page-b
│ └── node_modules
│ └── feature-a
├── demo-app.js
└── index.html
To demonstrate, we made three demos:
before-nesting [code] In this demo, everything works fine as Page A and B both are using the same version of Feature A
no-scope [code] Feature A version 1.x and 2.x are imported via self registering entry points which leads to the following error message, because the feature-a
component tries to register multiple times:
Uncaught DOMException: Failed to execute 'define' on 'CustomElementRegistry': the name "feature-a" has already been used with this registry
at [...]/node_modules/page-b/node_modules/feature-a/feature-a.js:3:16
with-scope [code] This example successfully fixes the problem by using ScopedElementsMixin
on both Page A and Page B.
ScopedElementsMixin
is mixed into your LitElement and via static get scopedElements()
you define the tags and classes you wanna use in your elements template.
Under the hood it changes your template so <my-button>${this.text}</my-button>
becomes <my-button-2748>${this.text}</my-button-2748>
.
Every auto-defined scoped elements gets a random* 4 digit number suffix. This suffix changes every time to make sure developers are not inclined to use it the generated tag name as a styling hook. Additionally the suffix allows scoped-elements and traditional self-defined elements to coexist, avoiding name collision.
* it is actually a global counter that gets initialized with a random starting number on load
Import ScopedElementsMixin
from @open-wc/scoped-elements
.
import { ScopedElementsMixin } from '@open-wc/scoped-elements';
Import the classes of the components you want to use.
import MyButton from './MyButton.js';
import MyPanel from './MyPanel.js';
Apply ScopedElementsMixin
and define the tags you want to use for your
components.
class MyElement extends ScopedElementsMixin(LitElement) {
static get scopedElements() {
return {
'my-button': MyButton,
'my-panel': MyPanel,
};
}
}
Use your components in your html.
render() {
return html`
<my-panel class="panel">
<my-button>${this.text}</my-button>
</my-panel>
`;
}
import { css, LitElement } from 'lit-element';
import { ScopedElementsMixin } from '@open-wc/scoped-elements';
import MyButton from './MyButton.js';
import MyPanel from './MyPanel.js';
export class MyElement extends ScopedElementsMixin(LitElement) {
static get scopedElements() {
return {
'my-button': MyButton,
'my-panel': MyPanel,
};
}
static get styles() {
return css`
.panel {
padding: 10px;
background-color: grey;
}
`;
}
static get properties() {
return {
text: String,
};
}
render() {
return html`
<my-panel class="panel">
<my-button>${this.text}</my-button>
</my-panel}>
`;
}
}
Components imported via npm SHOULD NOT be self registering components. If a shared component (installed from npm) does not offer an export to the class alone, without the registration side effect, then this component may not be used. E.g. every component that calls customElement.define
.
export class MyEl { ... }
customElement.define('my-el', MyEl);
Or uses the customElement
typescript decorator
@customElement('my-el')
export class MyEl { ... }
Only side effects free class exports may be used
export class MyEl { ... }
Every component that uses sub components should use scoped-elements
. Any import to a self registering component can potentially result in a browser exception - completely breaking the whole application.
Imported elements should be fully side effect free (not only element registration)
Currently, only lit-element
is supported (though other elements/rendering engines could be incorporated in the future).
You can not use tag selectors in css, but you could use an id, a class name or even a property instead.
🚫 my-panel {
width: 300px;
}
✅ .panel {
width: 300px;
}
You can not use tag names using javascript querySelectors, but you could use an id, a class name or even a property instead.
🚫 this.shadowRoot.querySelector('my-panel');
✅ this.shadowRoot.querySelector('.panel');
Using scoped-elements
may result in a performance degradation of up to 8%.
Loading of duplicate/similar source code (most breaking releases are not a total rewrite) should always be a temporary solution.
Often, temporary solutions tend to become more permanent. Be sure to focus on keeping the lifecycle of nested dependencies short.
We are using Tachometer to measure the performance penalty of using the scoped elements feature. The chosen test application is a slight variation of the Polymer Shop Application.
This is an example of the results obtained running the performance test.
⠋ Auto-sample 560 (timeout in 16m27s)
┌─────────────┬───────────────┐
│ Version │ <none> │
├─────────────┼───────────────┤
│ Browser │ chrome │
│ │ 80.0.3987.106 │
├─────────────┼───────────────┤
│ Sample size │ 610 │
└─────────────┴───────────────┘
┌─────────────────────────────┬────────────┬─────────────────────┬─────────────────┬──────────────────────────┐
│ Benchmark │ Bytes │ Avg time │ vs lit-element │ vs scoped-elements-mixin │
├─────────────────────────────┼────────────┼─────────────────────┼─────────────────┼──────────────────────────┤
│ lit-element │ 281.24 KiB │ 285.72ms - 286.69ms │ │ faster │
│ │ │ │ - │ 2% - 2% │
│ │ │ │ │ 5.68ms - 7.1ms │
├─────────────────────────────┼────────────┼─────────────────────┼─────────────────┼──────────────────────────┤
│ scoped-elements-mixin │ 283.21 KiB │ 292.08ms - 293.11ms │ slower │ │
│ │ │ │ 2% - 2% │ - │
│ │ │ │ 5.68ms - 7.10ms │ │
└─────────────────────────────┴────────────┴─────────────────────┴─────────────────┴──────────────────────────┘
This package was initially inspired by carehtml and we would like to thank @bashmish for his work on it.
FAQs
Allows to auto define custom elements scoping them
The npm package @open-wc/scoped-elements receives a total of 58,350 weekly downloads. As such, @open-wc/scoped-elements popularity was classified as popular.
We found that @open-wc/scoped-elements demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.