jens/flipper
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Left some code comments

Browse Source 
Summary: Added some additional code comments as requested in earlier diffs

Reviewed By: passy

Differential Revision: D33361691

fbshipit-source-id: 2d1adc8830af58e6cb7bac4b283a5c0171cf749e
This commit is contained in:
Michel Weststrate
2022-01-04 09:05:09 -08:00
committed by Facebook GitHub Bot
parent d92c403dd2
commit ebc4752077
4 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
desktop/flipper-server/src/startBaseServer.tsx
View File

@@ -68,8 +68,16 @@ function addWebsocket(server: http.Server, config: Config) {
allowRequest(req, callback) {
const noOriginHeader = req.headers.origin === undefined;
if (noOriginHeader && req.headers.host === validHost) {
// no origin header? Either the request is not cross-origin,
// or the request is not originating from a browser, so should be OK to pass through
callback(null, true);
} else {
// for now we don't allow cross origin request, so that an arbitrary website cannot try to
// connect a socket to localhost:serverport, and try to use the all powerful Flipper APIs to read
// for example files.
// Potentially in the future we do want to allow this, e.g. if we want to connect to a local flipper-server
// directly from intern. But before that, we should either authenticate the request somehow,
// and discuss security impact and for example scope the files that can be read by Flipper.
console.warn(
`Refused sockect connection from cross domain request, origin: ${req.headers.origin}, host: ${req.headers.host}. Expected: ${validHost}`,
);

5
desktop/flipper-server/src/startWebServerDev.tsx
View File

@@ -108,6 +108,11 @@ export async function startWebServerDev(
if (moduleName === 'flipper') {
return MetroResolver.resolve(context, 'flipper-ui-core', ...rest);
}
// stubbed modules are modules that don't make sense outside a Node / Electron context,
// like fs, child_process etc etc.
// UI / plugins using these features should use the corresponding RenderHost api's instead
// Ideally we'd fail hard on those, but not all plugins are properly converted yet, and some
// libraries try to require them for feature detection (e.g. jsbase64)
if (stubModules.has(moduleName)) {
console.warn(
`Found a reference to built-in module '${moduleName}', which will be stubbed out. Referer: ${context.originModulePath}`,

5
desktop/scripts/build-utils.ts
View File

@@ -477,6 +477,11 @@ export async function buildBrowserBundle(outDir: string, dev: boolean) {
if (moduleName === 'flipper') {
return MetroResolver.resolve(context, 'flipper-ui-core', ...rest);
}
// stubbed modules are modules that don't make sense outside a Node / Electron context,
// like fs, child_process etc etc.
// UI / plugins using these features should use the corresponding RenderHost api's instead
// Ideally we'd fail hard on those, but not all plugins are properly converted yet, and some
// libraries try to require them for feature detection (e.g. jsbase64)
if (stubModules.has(moduleName)) {
console.warn(
`Found a reference to built-in module '${moduleName}', which will be stubbed out. Referer: ${context.originModulePath}`,

2
desktop/scripts/start-flipper-server-dev.ts
View File

@@ -145,6 +145,8 @@ async function startWatchChanges() {
try {
const watchman = new Watchman(path.resolve(__dirname, '..'));
await watchman.initialize();
// We only watch for changes that might affect the server.
// For UI changes, Metro / hot module reloading / fast refresh take care of the changes
await Promise.all(
[
'pkg',