@firebase/database 1.0.6-canary.9cd3c1eca → 1.0.6-canary.f58d48cd4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1251,7 +1251,7 @@ WebSocketConnection.responsesRequiredToBeHealthy = 2;
1251
1251
  WebSocketConnection.healthyTimeout = 30000;
1252
1252
 
1253
1253
  const name = "@firebase/database";
1254
- const version = "1.0.6-canary.9cd3c1eca";
1254
+ const version = "1.0.6-canary.f58d48cd4";
1255
1255
 
1256
1256
  /**
1257
1257
  * @license
@@ -1861,6 +1861,8 @@ class FirebaseIFrameScriptHolder {
1861
1861
  const iframeContents = '<html><body>' + script + '</body></html>';
1862
1862
  try {
1863
1863
  this.myIFrame.doc.open();
1864
+ // TODO: Do not use document.write, since it can lead to XSS. Instead, use the safevalues
1865
+ // library to sanitize the HTML in the iframeContents.
1864
1866
  this.myIFrame.doc.write(iframeContents);
1865
1867
  this.myIFrame.doc.close();
1866
1868
  }
@@ -2083,6 +2085,10 @@ class FirebaseIFrameScriptHolder {
2083
2085
  const newScript = this.myIFrame.doc.createElement('script');
2084
2086
  newScript.type = 'text/javascript';
2085
2087
  newScript.async = true;
2088
+ // TODO: We cannot assign an arbitrary URL to a script attached to the DOM, since it is
2089
+ // at risk of XSS. We should use the safevalues library to create a safeScriptEl, and
2090
+ // assign a sanitized trustedResourceURL to it. Since the URL must be a template string
2091
+ // literal, this could require some heavy refactoring.
2086
2092
  newScript.src = url;
2087
2093
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
2088
2094
  newScript.onload = newScript.onreadystatechange =