Remove onLoadErrorFn/onPropertyErrorFn, or make them easier to disable
niloc132 opened this issue · 0 comments
niloc132 commented
There are two undocumented hooks in the built-in linkers, allowing meta tags to contribute JS snippets to be eval'd at runtime and provide error handling functions.
- In CrossSiteIframeLinker and subtypes, users can disable this feature outright by specifying that
processMetasNull.js
should be loaded instead ofprocessMetas.js
by overriding getJsProcessMetas. A configuration property could be added to re-enable the old behavior - or even to specify the name of a global function to invoke, or to point at a js file to inline to define that function. - For the majority of other linkers, this property comes from SelectionScriptLinker.PROCESS_METAS_JS, a protected final field, but this could still have custom logic as described above added.
- In both of the above cases,
__PROCESS_METAS__
is the block to replace in the selection script template. - Finally, SingleScriptTemplate.js and HostedModeTemplate.js both include these directly, and they cannot be disabled without replacing those template scripts.
As discussed in the mailing list, CSP rules can prevent the eval() calls from running at all, but it should still be removed.
Additionally, HostedModeLinker is entirely unused (and not even registered as a linker that can be used in module files), and is probably safe to remove as part of #9923.