Enabled web worker when loading data. #1006
Conversation
nilscb
added
bug
| // Serve the worker as a local url. See: https://deck.gl/docs/developer-guide/loading-data#loaders-and-web-workers | ||
| const blob = new Blob([WORKER_SCRIPT], { type: "text/plain" }); | ||
| const url = window.URL.createObjectURL(blob); |
There was a problem hiding this comment.
This would require script-src blob: in CSP, which is equivalent to allowing unsafe-eval, as confirmed by https://www.w3.org/TR/CSP2/#source-list-guid-matching:
Especially for the default-src and script-src directives, policy authors should be aware that allowing "data:" URLs is equivalent to unsafe-inline and allowing "blob:" or "filesystem:" URLs is equivalent to unsafe-eval.
For deployed applications that want tight security settings, we could perhaps offer the component consumer to provide a url where the web worker script is hosted, and if not provided we do as done here (create a blob: url for script usage)?
Codecov Report
@@ Coverage Diff @@
## master #1006 +/- ##
==========================================
- Coverage 38.59% 38.57% -0.03%
==========================================
Files 138 139 +1
Lines 6374 6380 +6
Branches 1576 1580 +4
==========================================
+ Hits 2460 2461 +1
- Misses 3882 3887 +5
Partials 32 32
📣 Codecov can now indicate which changes are the most critical in Pull Requests. Learn more |
| @@ -0,0 +1,1261 @@ | |||
| // Serve the worker as a local url. | |||
| // See: https://deck.gl/docs/developer-guide/loading-data#loaders-and-web-workers | |||
| // This is from the script terrain-worker.js but as a string. Some symbols are escaped. | |||
There was a problem hiding this comment.
According to https://deck.gl/docs/developer-guide/loading-data#loaders-and-web-workers, there exist bundles in node_modules/@loaders.gl/<module>/dist/<name>-loader.worker.js. Should we instead of comitting the terrain worker script to our code base, instead include it in the bundle through raw-loader in webpack (or assets/source in webpack 5) - https://v4.webpack.js.org/loaders/raw-loader/?
Pros: Reduces the amount of code we "own", and perhaps makes it easier to stay in sync with any @loaders.gl bumps we do in package.json (since they then stays in sync).
Con: You have to escape necessary symbols automatically, do the escapes you had to do @nilscb follow a pattern that is easy to automate? Why was it necessary to escape some symbols from the worker bundle?
There was a problem hiding this comment.
I had to escape some symbols in the script because I use the script as an inlined string. If you refer to the script as a stadard extern URL it needs not to be chenaged in any way.
There was a problem hiding this comment.
And also we are not ablde/allowed to use raw-loader in webpack 5. (Håvard would know more. I will remove the script from example data.
react/src/lib/components/DeckGLMap/storybook/DeckGLMap.stories.jsx
Outdated
Show resolved
Hide resolved
| @@ -419,6 +419,31 @@ Axes.args = { | |||
| }, | |||
| }; | |||
|
|
|||
| // Example using externally web worker script for loading map mesh. | |||
There was a problem hiding this comment.
We should move this story to the map3DLayer.stories.tsx
No description provided.