-
Notifications
You must be signed in to change notification settings - Fork 3.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
✨ Ads RTC: support amp-script fetching #33872
Conversation
This pull request introduces 1 alert when merging 78bd4f7 into d5de7fc - view on LGTM.com new alerts:
|
d8932bc
to
8d84f48
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for taking this on!
rtcFetch = Services.scriptForDocOrNull(element) | ||
.then((service) => { | ||
userAssert(service, 'AMP-SCRIPT is not installed.'); | ||
return service.fetch(url); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is probably me not understanding how amp script works, but how to we ensure they are using the no-dom
attr?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From a security/ux standpoint, I don't think we actually need it to be nodom
.
I.e. some pubs may want to have their amp-script perform both functions:
- As a normal amp-script
- As something that exports a fn for RTC
All the usual amp-script restrictions apply (no dom mutation without user activity, etc)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Going to followup on this to see if sandboxed
should imply nodom
* Ads RTC: support amp-script fetching. * flesh out example better. * revert unecessary diff * feedback from caleb
summary
Fixes #33581.
amp-script
.Blocked on ♻️ Extract AmpScriptService.fetch into its own fn. #33900