@firebase/database 1.0.6-canary.9cd3c1eca → 1.0.6-canary.f58d48cd4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -4,7 +4,7 @@ import { stringify, jsonEval, contains, assert, isNodeSdk, stringToByteArray, Sh
4
4
  import { Logger, LogLevel } from '@firebase/logger';
5
5
 
6
6
  const name = "@firebase/database";
7
- const version = "1.0.6-canary.9cd3c1eca";
7
+ const version = "1.0.6-canary.f58d48cd4";
8
8
 
9
9
  /**
10
10
  * @license
@@ -1509,6 +1509,8 @@ class FirebaseIFrameScriptHolder {
1509
1509
  const iframeContents = '<html><body>' + script + '</body></html>';
1510
1510
  try {
1511
1511
  this.myIFrame.doc.open();
1512
+ // TODO: Do not use document.write, since it can lead to XSS. Instead, use the safevalues
1513
+ // library to sanitize the HTML in the iframeContents.
1512
1514
  this.myIFrame.doc.write(iframeContents);
1513
1515
  this.myIFrame.doc.close();
1514
1516
  }
@@ -1731,6 +1733,10 @@ class FirebaseIFrameScriptHolder {
1731
1733
  const newScript = this.myIFrame.doc.createElement('script');
1732
1734
  newScript.type = 'text/javascript';
1733
1735
  newScript.async = true;
1736
+ // TODO: We cannot assign an arbitrary URL to a script attached to the DOM, since it is
1737
+ // at risk of XSS. We should use the safevalues library to create a safeScriptEl, and
1738
+ // assign a sanitized trustedResourceURL to it. Since the URL must be a template string
1739
+ // literal, this could require some heavy refactoring.
1734
1740
  newScript.src = url;
1735
1741
  // eslint-disable-next-line @typescript-eslint/no-explicit-any
1736
1742
  newScript.onload = newScript.onreadystatechange =