@web/dev-server-core - npm Package Compare versions

Comparing version 0.3.16 to 0.3.17

CHANGELOG.md

 # @web/dev-server-core
 
+## 0.3.17
+
+### Patch Changes
+
+- b2c081d8: When serving content to an iframe within a csp restricted page, the websocket script may not be able to access the parent window.
+  Accessing it may result in an uncaught DOMException which we now handle.
+
 ## 0.3.16
@@ -4,0 +11,0 @@

dist/web-sockets/webSocketsPlugin.js

@@ -143,3 +143,12 @@ "use strict";
 function setupWebSocket() {
-  if (window.parent !== window && window.parent.__WDS_WEB_SOCKET__ !== undefined) {
+  let useParent = false;
+  try {
+    // if window is an iframe and accessing a cross origin frame is not allowed this will throw
+    // therefore we try/catch it here so it does not disable all web sockets
+    if (window.parent !== window && window.parent.__WDS_WEB_SOCKET__ !== undefined) {
+      useParent = true;
+    }
+  } catch(e) {}
+
+  if (useParent) {
     // get the websocket instance from the parent element if present
@@ -146,0 +155,0 @@ const info = window.parent.__WDS_WEB_SOCKET__;

package.json

 {
   "name": "@web/dev-server-core",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "publishConfig": {
@@ -5,0 +5,0 @@ "access": "public"

src/web-sockets/webSocketsPlugin.ts

@@ -145,3 +145,12 @@ import { Plugin } from '../plugins/Plugin';
 function setupWebSocket() {
-  if (window.parent !== window && window.parent.__WDS_WEB_SOCKET__ !== undefined) {
+  let useParent = false;
+  try {
+    // if window is an iframe and accessing a cross origin frame is not allowed this will throw
+    // therefore we try/catch it here so it does not disable all web sockets
+    if (window.parent !== window && window.parent.__WDS_WEB_SOCKET__ !== undefined) {
+      useParent = true;
+    }
+  } catch(e) {}
+
+  if (useParent) {
     // get the websocket instance from the parent element if present
@@ -148,0 +157,0 @@ const info = window.parent.__WDS_WEB_SOCKET__;

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

297874

0.27%

Lines of code

5662

0.28%

No dependency changes