v13.0.0-33 -- distribution files

examples/monaco/index.html

@@ -14,10 +14,7 @@
       }
     </style>
     <script src="../bower_components/yjs/y.js"></script>
-    <script src="../bower_components/y-array/y-array.js"></script>
-    <script src="../bower_components/y-text/y-text.js"></script>
     <script src="../bower_components/y-websockets-client/y-websockets-client.js"></script>
-    <script src="../bower_components/y-memory/y-memory.js"></script>
     <script src="../node_modules/monaco-editor/min/vs/loader.js"></script>
     <script src="./index.js"></script>
   </body>

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "yjs",
-  "version": "13.0.0-30",
+  "version": "13.0.0-32",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "yjs",
-  "version": "13.0.0-30",
+  "version": "13.0.0-33",
   "description": "A framework for real-time p2p shared editing on any data",
   "main": "./y.node.js",
   "browser": "./y.js",
@@ -15,7 +15,8 @@
     "postpublish": "tag-dist-files --overwrite-existing-tag"
   },
   "files": [
-    "y.*"
+    "y.*",
+    "src/*"
   ],
   "standard": {
     "ignore": [

src/Type/y-xml/YXmlElement.js

@@ -5,7 +5,7 @@ import YMap from '../YMap.js'
 import YXmlFragment from './YXmlFragment.js'
 
 export default class YXmlElement extends YXmlFragment {
-  constructor (arg1, arg2) {
+  constructor (arg1, arg2, _document) {
     super()
     this.nodeName = null
     this._scrollElement = null
@@ -13,7 +13,7 @@ export default class YXmlElement extends YXmlFragment {
       this.nodeName = arg1.toUpperCase()
     } else if (arg1 != null && arg1.nodeType != null && arg1.nodeType === arg1.ELEMENT_NODE) {
       this.nodeName = arg1.nodeName
-      this._setDom(arg1)
+      this._setDom(arg1, _document)
     } else {
       this.nodeName = 'UNDEFINED'
     }
@@ -26,28 +26,25 @@ export default class YXmlElement extends YXmlFragment {
     struct.nodeName = this.nodeName
     return struct
   }
-  _setDom (dom) {
+  _setDom (dom, _document) {
     if (this._dom != null) {
       throw new Error('Only call this method if you know what you are doing ;)')
     } else if (dom._yxml != null) { // TODO do i need to check this? - no.. but for dev purps..
       throw new Error('Already bound to an YXml type')
     } else {
-      this._dom = dom
-      dom._yxml = this
       // tag is already set in constructor
       // set attributes
-      let attrNames = []
+      let attributes = new Map()
       for (let i = 0; i < dom.attributes.length; i++) {
-        attrNames.push(dom.attributes[i].name)
+        let attr = dom.attributes[i]
+        attributes.set(attr.name, attr.value)
       }
-      attrNames = this._domFilter(dom, attrNames)
+      attributes = this._domFilter(dom, attributes)
-      for (let i = 0; i < attrNames.length; i++) {
+      attributes.forEach((value, name) => {
-        let attrName = attrNames[i]
+        this.setAttribute(name, value)
-        let attrValue = dom.getAttribute(attrName)
+      })
-        this.setAttribute(attrName, attrValue)
+      this.insertDomElements(0, Array.prototype.slice.call(dom.childNodes), _document)
-      }
+      this._bindToDom(dom, _document)
-      this.insertDomElements(0, Array.prototype.slice.call(dom.childNodes))
-      this._bindToDom(dom)
       return dom
     }
   }
@@ -106,7 +103,9 @@ export default class YXmlElement extends YXmlFragment {
   getAttributes () {
     const obj = {}
     for (let [key, value] of this._map) {
-      obj[key] = value._content[0]
+      if (!value._deleted) {
+        obj[key] = value._content[0]
+      }
     }
     return obj
   }
@@ -115,7 +114,6 @@ export default class YXmlElement extends YXmlFragment {
     let dom = this._dom
     if (dom == null) {
       dom = _document.createElement(this.nodeName)
-      this._dom = dom
       dom._yxml = this
       let attrs = this.getAttributes()
       for (let key in attrs) {
@@ -124,7 +122,7 @@ export default class YXmlElement extends YXmlFragment {
       this.forEach(yxml => {
         dom.appendChild(yxml.getDom(_document))
       })
-      this._bindToDom(dom)
+      this._bindToDom(dom, _document)
     }
     return dom
   }

src/Type/y-xml/YXmlFragment.js

@@ -9,18 +9,18 @@ import YXmlEvent from './YXmlEvent.js'
 import { logID } from '../../MessageHandler/messageToString.js'
 import diff from 'fast-diff'
 
-function domToYXml (parent, doms) {
+function domToYXml (parent, doms, _document) {
   const types = []
   doms.forEach(d => {
     if (d._yxml != null && d._yxml !== false) {
       d._yxml._unbindFromDom()
     }
-    if (parent._domFilter(d, []) !== null) {
+    if (parent._domFilter(d.nodeName, new Map()) !== null) {
       let type
       if (d.nodeType === d.TEXT_NODE) {
         type = new YXmlText(d)
       } else if (d.nodeType === d.ELEMENT_NODE) {
-        type = new YXmlFragment._YXmlElement(d, parent._domFilter)
+        type = new YXmlFragment._YXmlElement(d, parent._domFilter, _document)
       } else {
         throw new Error('Unsupported node!')
       }
@@ -98,7 +98,9 @@ export default class YXmlFragment extends YArray {
         } catch (e) {
           console.error(e)
         }
-        this._domObserver.takeRecords()
+        if (this._domObserver !== null) {
+          this._domObserver.takeRecords()
+        }
         token = true
       }
     }
@@ -162,113 +164,167 @@ export default class YXmlFragment extends YArray {
       this._dom = null
     }
   }
-  insertDomElementsAfter (prev, doms) {
+  insertDomElementsAfter (prev, doms, _document) {
-    const types = domToYXml(this, doms)
+    const types = domToYXml(this, doms, _document)
     this.insertAfter(prev, types)
     return types
   }
-  insertDomElements (pos, doms) {
+  insertDomElements (pos, doms, _document) {
-    const types = domToYXml(this, doms)
+    const types = domToYXml(this, doms, _document)
     this.insert(pos, types)
     return types
   }
   getDom () {
     return this._dom
   }
-  bindToDom (dom) {
+  bindToDom (dom, _document) {
     if (this._dom != null) {
       this._unbindFromDom()
     }
     if (dom._yxml != null) {
       dom._yxml._unbindFromDom()
     }
-    if (MutationObserver == null) {
-      throw new Error('Not able to bind to a DOM element, because MutationObserver is not available!')
-    }
     dom.innerHTML = ''
-    this._dom = dom
-    dom._yxml = this
     this.forEach(t => {
-      dom.insertBefore(t.getDom(), null)
+      dom.insertBefore(t.getDom(_document), null)
     })
-    this._bindToDom(dom)
+    this._bindToDom(dom, _document)
   }
   // binds to a dom element
   // Only call if dom and YXml are isomorph
-  _bindToDom (dom) {
+  _bindToDom (dom, _document) {
-    if (this._parent === null || this._parent._dom != null || typeof MutationObserver === 'undefined') {
+    _document = _document || document
-      // only bind if parent did not already bind
+    this._dom = dom
+    dom._yxml = this
+    // TODO: refine this..
+    if ((this.constructor !== YXmlFragment && this._parent !== this._y) || this._parent === null) {
+      // TODO: only top level YXmlFragment can bind. Also allow YXmlElements..
       return
     }
-    this._y.on('beforeTransaction', () => {
-      this._domObserverListener(this._domObserver.takeRecords())
-    })
     this._y.on('beforeTransaction', beforeTransactionSelectionFixer)
     this._y.on('afterTransaction', afterTransactionSelectionFixer)
-    // Apply Y.Xml events to dom
+    const applyFilter = (type) => {
-    this.observeDeep(reflectChangesOnDom.bind(this))
+      if (type._deleted) {
-    // Apply Dom changes on Y.Xml
+        return
-    this._domObserverListener = mutations => {
+      }
-      this._mutualExclude(() => {
+      // check if type is a child of this
-        this._y.transact(() => {
+      let isChild = false
-          let diffChildren = new Set()
+      let p = type
-          mutations.forEach(mutation => {
+      while (p !== this._y) {
-            const dom = mutation.target
+        if (p === this) {
-            const yxml = dom._yxml
+          isChild = true
-            if (yxml == null) {
+          break
-              // dom element is filtered
+        }
-              return
+        p = p._parent
-            }
+      }
-            switch (mutation.type) {
+      if (!isChild) {
-              case 'characterData':
+        return
-                var diffs = diff(yxml.toString(), dom.nodeValue)
+      }
-                var pos = 0
+      // filter attributes
-                for (var i = 0; i < diffs.length; i++) {
+      let attributes = new Map()
-                  var d = diffs[i]
+      if (type.getAttributes !== undefined) {
-                  if (d[0] === 0) { // EQUAL
+        let attrs = type.getAttributes()
-                    pos += d[1].length
+        for (let key in attrs) {
-                  } else if (d[0] === -1) { // DELETE
+          attributes.set(key, attrs[key])
-                    yxml.delete(pos, d[1].length)
+        }
-                  } else { // INSERT
+      }
-                    yxml.insert(pos, d[1])
+      let result = this._domFilter(type.nodeName, new Map(attributes))
-                    pos += d[1].length
+      if (result === null) {
-                  }
+        type._delete(this._y)
-                }
+      } else {
-                break
+        attributes.forEach((value, key) => {
-              case 'attributes':
+          if (!result.has(key)) {
-                let name = mutation.attributeName
+            type.removeAttribute(key)
-                // check if filter accepts attribute
-                if (this._domFilter(dom, [name]).length > 0 && this.constructor !== YXmlFragment) {
-                  var val = dom.getAttribute(name)
-                  if (yxml.getAttribute(name) !== val) {
-                    if (val == null) {
-                      yxml.removeAttribute(name)
-                    } else {
-                      yxml.setAttribute(name, val)
-                    }
-                  }
-                }
-                break
-              case 'childList':
-                diffChildren.add(mutation.target)
-                break
-            }
-          })
-          for (let dom of diffChildren) {
-            if (dom._yxml != null && dom._yxml !== false) {
-              applyChangesFromDom(dom)
-            }
           }
         })
+      }
+    }
+    this._y.on('beforeObserverCalls', function (y, transaction) {
+      // apply dom filter to new and changed types
+      transaction.changedTypes.forEach(function (subs, type) {
+        if (subs.size > 1 || !subs.has(null)) {
+          // only apply changes on attributes
+          applyFilter(type)
+        }
+      })
+      transaction.newTypes.forEach(applyFilter)
+    })
+    // Apply Y.Xml events to dom
+    this.observeDeep(events => {
+      reflectChangesOnDom.call(this, events, _document)
+    })
+    // Apply Dom changes on Y.Xml
+    if (typeof MutationObserver !== 'undefined') {
+      this._y.on('beforeTransaction', () => {
+        this._domObserverListener(this._domObserver.takeRecords())
+      })
+      this._domObserverListener = mutations => {
+        this._mutualExclude(() => {
+          this._y.transact(() => {
+            let diffChildren = new Set()
+            mutations.forEach(mutation => {
+              const dom = mutation.target
+              const yxml = dom._yxml
+              if (yxml == null) {
+                // dom element is filtered
+                return
+              }
+              switch (mutation.type) {
+                case 'characterData':
+                  var diffs = diff(yxml.toString(), dom.nodeValue)
+                  var pos = 0
+                  for (var i = 0; i < diffs.length; i++) {
+                    var d = diffs[i]
+                    if (d[0] === 0) { // EQUAL
+                      pos += d[1].length
+                    } else if (d[0] === -1) { // DELETE
+                      yxml.delete(pos, d[1].length)
+                    } else { // INSERT
+                      yxml.insert(pos, d[1])
+                      pos += d[1].length
+                    }
+                  }
+                  break
+                case 'attributes':
+                  if (yxml.constructor === YXmlFragment) {
+                    break
+                  }
+                  let name = mutation.attributeName
+                  let val = dom.getAttribute(name)
+                  // check if filter accepts attribute
+                  let attributes = new Map()
+                  attributes.set(name, val)
+                  if (this._domFilter(dom.nodeName, attributes).size > 0 && yxml.constructor !== YXmlFragment) {
+                    if (yxml.getAttribute(name) !== val) {
+                      if (val == null) {
+                        yxml.removeAttribute(name)
+                      } else {
+                        yxml.setAttribute(name, val)
+                      }
+                    }
+                  }
+                  break
+                case 'childList':
+                  diffChildren.add(mutation.target)
+                  break
+              }
+            })
+            for (let dom of diffChildren) {
+              if (dom._yxml != null && dom._yxml !== false) {
+                applyChangesFromDom(dom)
+              }
+            }
+          })
+        })
+      }
+      this._domObserver = new MutationObserver(this._domObserverListener)
+      this._domObserver.observe(dom, {
+        childList: true,
+        attributes: true,
+        characterData: true,
+        subtree: true
       })
     }
-    this._domObserver = new MutationObserver(this._domObserverListener)
-    this._domObserver.observe(dom, {
-      childList: true,
-      attributes: true,
-      characterData: true,
-      subtree: true
-    })
     return dom
   }
   _logString () {

src/Type/y-xml/utils.js

@@ -135,7 +135,7 @@ export function applyChangesFromDom (dom) {
   }
 }
 
-export function reflectChangesOnDom (events) {
+export function reflectChangesOnDom (events, _document) {
   // Make sure that no filtered attributes are applied to the structure
   // if they were, delete them
   /*
@@ -183,9 +183,9 @@ export function reflectChangesOnDom (events) {
           })
           if (event.childListChanged) {
             // create fragment of undeleted nodes
-            const fragment = document.createDocumentFragment()
+            const fragment = _document.createDocumentFragment()
             yxml.forEach(function (t) {
-              fragment.append(t.getDom())
+              fragment.appendChild(t.getDom(_document))
             })
             // remove remainding nodes
             let lastChild = dom.lastChild
@@ -194,7 +194,7 @@ export function reflectChangesOnDom (events) {
               lastChild = dom.lastChild
             }
             // insert fragment of undeleted nodes
-            dom.append(fragment)
+            dom.appendChild(fragment)
           }
         }
         /* TODO: smartscrolling

src/Y.js

@@ -54,6 +54,7 @@ export default class Y extends NamedEventHandler {
       console.error(e)
     }
     if (initialCall) {
+      this.emit('beforeObserverCalls', this, this._transaction, remote)
       const transaction = this._transaction
       this._transaction = null
       // emit change events on changed types
@@ -94,17 +95,10 @@ export default class Y extends NamedEventHandler {
   define (name, TypeConstructor) {
     let id = new RootID(name, TypeConstructor)
     let type = this.os.get(id)
-    if (type === null) {
-      type = new TypeConstructor()
-      type._id = id
-      type._parent = this
-      type._integrate(this)
-      if (this.share[name] !== undefined) {
-        throw new Error('Type is already defined with a different constructor!')
-      }
-    }
     if (this.share[name] === undefined) {
       this.share[name] = type
+    } else if (this.share[name] !== type) {
+      throw new Error('Type is already defined with a different constructor')
     }
     return type
   }

test/y-xml.tests.js

@@ -230,8 +230,8 @@ test('filter node', async function xml14 (t) {
   var { users, xml0, xml1 } = await initArrays(t, { users: 3 })
   let dom0 = xml0.getDom()
   let dom1 = xml1.getDom()
-  let domFilter = (node, attrs) => {
+  let domFilter = (nodeName, attrs) => {
-    if (node.nodeName === 'H1') {
+    if (nodeName === 'H1') {
       return null
     } else {
       return attrs
@@ -251,8 +251,9 @@ test('filter attribute', async function xml15 (t) {
   var { users, xml0, xml1 } = await initArrays(t, { users: 3 })
   let dom0 = xml0.getDom()
   let dom1 = xml1.getDom()
-  let domFilter = (node, attrs) => {
+  let domFilter = (nodeName, attrs) => {
-    return attrs.filter(name => name !== 'hidden')
+    attrs.delete('hidden')
+    return attrs
   }
   xml0.setDomFilter(domFilter)
   xml1.setDomFilter(domFilter)
@@ -303,6 +304,51 @@ test('treeWalker', async function xml17 (t) {
   await compareUsers(t, users)
 })
 
+/**
+ * The expected behavior is that changes on your own dom (e.g. malicious attributes) persist.
+ * Yjs should just ignore them, never propagate those attributes.
+ * Incoming changes that contain malicious attributes should be deleted.
+ */
+test('Filtering remote changes', async function xmlFilteringRemote (t) {
+  var { users, xml0, xml1 } = await initArrays(t, { users: 3 })
+  xml0.setDomFilter(function (nodeName, attributes) {
+    attributes.delete('malicious')
+    if (nodeName === 'HIDEME') {
+      return null
+    } else if (attributes.has('isHidden')) {
+      return null
+    } else {
+      return attributes
+    }
+  })
+  // make sure that dom filters are active
+  // TODO: do not rely on .getDom for domFilters
+  xml0.getDom()
+  xml1.getDom()
+  let paragraph = new Y.XmlElement('p')
+  let hideMe = new Y.XmlElement('hideMe')
+  let span = new Y.XmlElement('span')
+  span.setAttribute('malicious', 'alert("give me money")')
+  let tag = new Y.XmlElement('tag')
+  tag.setAttribute('isHidden', 'true')
+  paragraph.insert(0, [hideMe, span, tag])
+  xml0.insert(0, [paragraph])
+  let tag2 = new Y.XmlElement('tag')
+  tag2.setAttribute('isHidden', 'true')
+  paragraph.insert(0, [tag2])
+  await flushAll(t, users)
+  // check dom
+  paragraph.getDom().setAttribute('malicious', 'true')
+  span.getDom().setAttribute('malicious', 'true')
+  console.log(xml0.toString())
+  // check incoming attributes
+  xml1.get(0).get(0).setAttribute('malicious', 'true')
+  xml1.insert(0, [new Y.XmlElement('hideMe')])
+  await flushAll(t, users)
+
+  await compareUsers(t, users)
+})
+
 // TODO: move elements
 var xmlTransactions = [
   function attributeChange (t, user, chance) {

tests-lib/helper.js

@@ -153,12 +153,12 @@ export async function initArrays (t, opts) {
     result['array' + i] = y.define('array', Y.Array)
     result['map' + i] = y.define('map', Y.Map)
     result['xml' + i] = y.define('xml', Y.XmlElement)
-    y.get('xml', Y.Xml).setDomFilter(function (d, attrs) {
+    y.get('xml').setDomFilter(function (nodeName, attrs) {
-      if (d.nodeName === 'HIDDEN') {
+      if (nodeName === 'HIDDEN') {
         return null
-      } else {
-        return attrs.filter(a => a !== 'hidden')
       }
+      attrs.delete('hidden')
+      return attrs
     })
     y.on('afterTransaction', function () {
       for (let missing of y._missingStructs.values()) {