v13.0.0-34 -- distribution files

examples/monaco/index.html

@@ -14,10 +14,7 @@
       }
     </style>
     <script src="../bower_components/yjs/y.js"></script>
-    <script src="../bower_components/y-array/y-array.js"></script>
-    <script src="../bower_components/y-text/y-text.js"></script>
     <script src="../bower_components/y-websockets-client/y-websockets-client.js"></script>
-    <script src="../bower_components/y-memory/y-memory.js"></script>
     <script src="../node_modules/monaco-editor/min/vs/loader.js"></script>
     <script src="./index.js"></script>
   </body>

package.json

@@ -1,6 +1,6 @@
 {
   "name": "yjs",
-  "version": "13.0.0-32",
+  "version": "13.0.0-34",
   "description": "A framework for real-time p2p shared editing on any data",
   "main": "./y.node.js",
   "browser": "./y.js",
@@ -15,7 +15,8 @@
     "postpublish": "tag-dist-files --overwrite-existing-tag"
   },
   "files": [
-    "y.*"
+    "y.*",
+    "src/*"
   ],
   "standard": {
     "ignore": [

src/Type/y-xml/YXmlElement.js

@@ -34,16 +34,15 @@ export default class YXmlElement extends YXmlFragment {
     } else {
       // tag is already set in constructor
       // set attributes
-      let attrNames = []
+      let attributes = new Map()
       for (let i = 0; i < dom.attributes.length; i++) {
-        attrNames.push(dom.attributes[i].name)
-      }
-      attrNames = this._domFilter(dom, attrNames)
-      for (let i = 0; i < attrNames.length; i++) {
-        let attrName = attrNames[i]
-        let attrValue = dom.getAttribute(attrName)
-        this.setAttribute(attrName, attrValue)
+        let attr = dom.attributes[i]
+        attributes.set(attr.name, attr.value)
       }
+      attributes = this._domFilter(dom, attributes)
+      attributes.forEach((value, name) => {
+        this.setAttribute(name, value)
+      })
       this.insertDomElements(0, Array.prototype.slice.call(dom.childNodes), _document)
       this._bindToDom(dom, _document)
       return dom
@@ -104,7 +103,9 @@ export default class YXmlElement extends YXmlFragment {
   getAttributes () {
     const obj = {}
     for (let [key, value] of this._map) {
-      obj[key] = value._content[0]
+      if (!value._deleted) {
+        obj[key] = value._content[0]
+      }
     }
     return obj
   }

src/Type/y-xml/YXmlFragment.js

@@ -15,7 +15,7 @@ function domToYXml (parent, doms, _document) {
     if (d._yxml != null && d._yxml !== false) {
       d._yxml._unbindFromDom()
     }
-    if (parent._domFilter(d, []) !== null) {
+    if (parent._domFilter(d.nodeName, new Map()) !== null) {
       let type
       if (d.nodeType === d.TEXT_NODE) {
         type = new YXmlText(d)
@@ -203,6 +203,52 @@ export default class YXmlFragment extends YArray {
     }
     this._y.on('beforeTransaction', beforeTransactionSelectionFixer)
     this._y.on('afterTransaction', afterTransactionSelectionFixer)
+    const applyFilter = (type) => {
+      if (type._deleted) {
+        return
+      }
+      // check if type is a child of this
+      let isChild = false
+      let p = type
+      while (p !== this._y) {
+        if (p === this) {
+          isChild = true
+          break
+        }
+        p = p._parent
+      }
+      if (!isChild) {
+        return
+      }
+      // filter attributes
+      let attributes = new Map()
+      if (type.getAttributes !== undefined) {
+        let attrs = type.getAttributes()
+        for (let key in attrs) {
+          attributes.set(key, attrs[key])
+        }
+      }
+      let result = this._domFilter(type.nodeName, new Map(attributes))
+      if (result === null) {
+        type._delete(this._y)
+      } else {
+        attributes.forEach((value, key) => {
+          if (!result.has(key)) {
+            type.removeAttribute(key)
+          }
+        })
+      }
+    }
+    this._y.on('beforeObserverCalls', function (y, transaction) {
+      // apply dom filter to new and changed types
+      transaction.changedTypes.forEach(function (subs, type) {
+        if (subs.size > 1 || !subs.has(null)) {
+          // only apply changes on attributes
+          applyFilter(type)
+        }
+      })
+      transaction.newTypes.forEach(applyFilter)
+    })
     // Apply Y.Xml events to dom
     this.observeDeep(events => {
       reflectChangesOnDom.call(this, events, _document)
@@ -240,10 +286,15 @@ export default class YXmlFragment extends YArray {
                   }
                   break
                 case 'attributes':
+                  if (yxml.constructor === YXmlFragment) {
+                    break
+                  }
                   let name = mutation.attributeName
+                  let val = dom.getAttribute(name)
                   // check if filter accepts attribute
-                  if (this._domFilter(dom, [name]).length > 0 && yxml.constructor !== YXmlFragment) {
-                    var val = dom.getAttribute(name)
+                  let attributes = new Map()
+                  attributes.set(name, val)
+                  if (this._domFilter(dom.nodeName, attributes).size > 0 && yxml.constructor !== YXmlFragment) {
                     if (yxml.getAttribute(name) !== val) {
                       if (val == null) {
                         yxml.removeAttribute(name)

src/Type/y-xml/selection.js

@@ -46,17 +46,25 @@ export function afterTransactionSelectionFixer (y, transaction, remote) {
   if (from !== null) {
     let sel = fromRelativePosition(fromY, from)
     if (sel !== null) {
-      shouldUpdate = true
-      anchorNode = sel.type.getDom()
-      anchorOffset = sel.offset
+      let node = sel.type.getDom()
+      let offset = sel.offset
+      if (node !== anchorNode || offset !== anchorOffset) {
+        anchorNode = node
+        anchorOffset = offset
+        shouldUpdate = true
+      }
     }
   }
   if (to !== null) {
     let sel = fromRelativePosition(toY, to)
     if (sel !== null) {
-      focusNode = sel.type.getDom()
-      focusOffset = sel.offset
-      shouldUpdate = true
+      let node = sel.type.getDom()
+      let offset = sel.offset
+      if (node !== focusNode || offset !== focusOffset) {
+        focusNode = node
+        focusOffset = offset
+        shouldUpdate = true
+      }
     }
   }
   if (shouldUpdate) {

src/Y.js

@@ -54,6 +54,7 @@ export default class Y extends NamedEventHandler {
       console.error(e)
     }
     if (initialCall) {
+      this.emit('beforeObserverCalls', this, this._transaction, remote)
       const transaction = this._transaction
       this._transaction = null
       // emit change events on changed types
@@ -94,17 +95,10 @@ export default class Y extends NamedEventHandler {
   define (name, TypeConstructor) {
     let id = new RootID(name, TypeConstructor)
     let type = this.os.get(id)
-    if (type === null) {
-      type = new TypeConstructor()
-      type._id = id
-      type._parent = this
-      type._integrate(this)
-      if (this.share[name] !== undefined) {
-        throw new Error('Type is already defined with a different constructor!')
-      }
-    }
     if (this.share[name] === undefined) {
       this.share[name] = type
+    } else if (this.share[name] !== type) {
+      throw new Error('Type is already defined with a different constructor')
     }
     return type
   }

test/y-xml.tests.js

@@ -230,8 +230,8 @@ test('filter node', async function xml14 (t) {
   var { users, xml0, xml1 } = await initArrays(t, { users: 3 })
   let dom0 = xml0.getDom()
   let dom1 = xml1.getDom()
-  let domFilter = (node, attrs) => {
-    if (node.nodeName === 'H1') {
+  let domFilter = (nodeName, attrs) => {
+    if (nodeName === 'H1') {
       return null
     } else {
       return attrs
@@ -251,8 +251,9 @@ test('filter attribute', async function xml15 (t) {
   var { users, xml0, xml1 } = await initArrays(t, { users: 3 })
   let dom0 = xml0.getDom()
   let dom1 = xml1.getDom()
-  let domFilter = (node, attrs) => {
-    return attrs.filter(name => name !== 'hidden')
+  let domFilter = (nodeName, attrs) => {
+    attrs.delete('hidden')
+    return attrs
   }
   xml0.setDomFilter(domFilter)
   xml1.setDomFilter(domFilter)
@@ -303,6 +304,51 @@ test('treeWalker', async function xml17 (t) {
   await compareUsers(t, users)
 })
 
+/**
+ * The expected behavior is that changes on your own dom (e.g. malicious attributes) persist.
+ * Yjs should just ignore them, never propagate those attributes.
+ * Incoming changes that contain malicious attributes should be deleted.
+ */
+test('Filtering remote changes', async function xmlFilteringRemote (t) {
+  var { users, xml0, xml1 } = await initArrays(t, { users: 3 })
+  xml0.setDomFilter(function (nodeName, attributes) {
+    attributes.delete('malicious')
+    if (nodeName === 'HIDEME') {
+      return null
+    } else if (attributes.has('isHidden')) {
+      return null
+    } else {
+      return attributes
+    }
+  })
+  // make sure that dom filters are active
+  // TODO: do not rely on .getDom for domFilters
+  xml0.getDom()
+  xml1.getDom()
+  let paragraph = new Y.XmlElement('p')
+  let hideMe = new Y.XmlElement('hideMe')
+  let span = new Y.XmlElement('span')
+  span.setAttribute('malicious', 'alert("give me money")')
+  let tag = new Y.XmlElement('tag')
+  tag.setAttribute('isHidden', 'true')
+  paragraph.insert(0, [hideMe, span, tag])
+  xml0.insert(0, [paragraph])
+  let tag2 = new Y.XmlElement('tag')
+  tag2.setAttribute('isHidden', 'true')
+  paragraph.insert(0, [tag2])
+  await flushAll(t, users)
+  // check dom
+  paragraph.getDom().setAttribute('malicious', 'true')
+  span.getDom().setAttribute('malicious', 'true')
+  console.log(xml0.toString())
+  // check incoming attributes
+  xml1.get(0).get(0).setAttribute('malicious', 'true')
+  xml1.insert(0, [new Y.XmlElement('hideMe')])
+  await flushAll(t, users)
+
+  await compareUsers(t, users)
+})
+
 // TODO: move elements
 var xmlTransactions = [
   function attributeChange (t, user, chance) {

tests-lib/helper.js

@@ -153,12 +153,12 @@ export async function initArrays (t, opts) {
     result['array' + i] = y.define('array', Y.Array)
     result['map' + i] = y.define('map', Y.Map)
     result['xml' + i] = y.define('xml', Y.XmlElement)
-    y.get('xml').setDomFilter(function (d, attrs) {
-      if (d.nodeName === 'HIDDEN') {
+    y.get('xml').setDomFilter(function (nodeName, attrs) {
+      if (nodeName === 'HIDDEN') {
         return null
-      } else {
-        return attrs.filter(a => a !== 'hidden')
       }
+      attrs.delete('hidden')
+      return attrs
     })
     y.on('afterTransaction', function () {
       for (let missing of y._missingStructs.values()) {

y.node.js

@@ -1,7 +1,7 @@
 
 /**
  * yjs - A framework for real-time p2p shared editing on any data
- * @version v13.0.0-32
+ * @version v13.0.0-34
  * @license MIT
  */
 
@@ -2995,17 +2995,25 @@ function afterTransactionSelectionFixer (y, transaction, remote) {
   if (from !== null) {
     let sel = fromRelativePosition(fromY, from);
     if (sel !== null) {
-      shouldUpdate = true;
-      anchorNode = sel.type.getDom();
-      anchorOffset = sel.offset;
+      let node = sel.type.getDom();
+      let offset = sel.offset;
+      if (node !== anchorNode || offset !== anchorOffset) {
+        anchorNode = node;
+        anchorOffset = offset;
+        shouldUpdate = true;
+      }
     }
   }
   if (to !== null) {
     let sel = fromRelativePosition(toY, to);
     if (sel !== null) {
-      focusNode = sel.type.getDom();
-      focusOffset = sel.offset;
-      shouldUpdate = true;
+      let node = sel.type.getDom();
+      let offset = sel.offset;
+      if (node !== focusNode || offset !== focusOffset) {
+        focusNode = node;
+        focusOffset = offset;
+        shouldUpdate = true;
+      }
     }
   }
   if (shouldUpdate) {
@@ -3784,7 +3792,7 @@ function domToYXml (parent, doms, _document) {
     if (d._yxml != null && d._yxml !== false) {
       d._yxml._unbindFromDom();
     }
-    if (parent._domFilter(d, []) !== null) {
+    if (parent._domFilter(d.nodeName, new Map()) !== null) {
       let type;
       if (d.nodeType === d.TEXT_NODE) {
         type = new YXmlText(d);
@@ -3972,6 +3980,52 @@ class YXmlFragment extends YArray {
     }
     this._y.on('beforeTransaction', beforeTransactionSelectionFixer);
     this._y.on('afterTransaction', afterTransactionSelectionFixer);
+    const applyFilter = (type) => {
+      if (type._deleted) {
+        return
+      }
+      // check if type is a child of this
+      let isChild = false;
+      let p = type;
+      while (p !== this._y) {
+        if (p === this) {
+          isChild = true;
+          break
+        }
+        p = p._parent;
+      }
+      if (!isChild) {
+        return
+      }
+      // filter attributes
+      let attributes = new Map();
+      if (type.getAttributes !== undefined) {
+        let attrs = type.getAttributes();
+        for (let key in attrs) {
+          attributes.set(key, attrs[key]);
+        }
+      }
+      let result = this._domFilter(type.nodeName, new Map(attributes));
+      if (result === null) {
+        type._delete(this._y);
+      } else {
+        attributes.forEach((value, key) => {
+          if (!result.has(key)) {
+            type.removeAttribute(key);
+          }
+        });
+      }
+    };
+    this._y.on('beforeObserverCalls', function (y, transaction) {
+      // apply dom filter to new and changed types
+      transaction.changedTypes.forEach(function (subs, type) {
+        if (subs.size > 1 || !subs.has(null)) {
+          // only apply changes on attributes
+          applyFilter(type);
+        }
+      });
+      transaction.newTypes.forEach(applyFilter);
+    });
     // Apply Y.Xml events to dom
     this.observeDeep(events => {
       reflectChangesOnDom.call(this, events, _document);
@@ -4009,10 +4063,15 @@ class YXmlFragment extends YArray {
                   }
                   break
                 case 'attributes':
+                  if (yxml.constructor === YXmlFragment) {
+                    break
+                  }
                   let name = mutation.attributeName;
+                  let val = dom.getAttribute(name);
                   // check if filter accepts attribute
-                  if (this._domFilter(dom, [name]).length > 0 && yxml.constructor !== YXmlFragment) {
-                    var val = dom.getAttribute(name);
+                  let attributes = new Map();
+                  attributes.set(name, val);
+                  if (this._domFilter(dom.nodeName, attributes).size > 0 && yxml.constructor !== YXmlFragment) {
                     if (yxml.getAttribute(name) !== val) {
                       if (val == null) {
                         yxml.removeAttribute(name);
@@ -4083,16 +4142,15 @@ class YXmlElement extends YXmlFragment {
     } else {
       // tag is already set in constructor
       // set attributes
-      let attrNames = [];
+      let attributes = new Map();
       for (let i = 0; i < dom.attributes.length; i++) {
-        attrNames.push(dom.attributes[i].name);
-      }
-      attrNames = this._domFilter(dom, attrNames);
-      for (let i = 0; i < attrNames.length; i++) {
-        let attrName = attrNames[i];
-        let attrValue = dom.getAttribute(attrName);
-        this.setAttribute(attrName, attrValue);
+        let attr = dom.attributes[i];
+        attributes.set(attr.name, attr.value);
       }
+      attributes = this._domFilter(dom, attributes);
+      attributes.forEach((value, name) => {
+        this.setAttribute(name, value);
+      });
       this.insertDomElements(0, Array.prototype.slice.call(dom.childNodes), _document);
       this._bindToDom(dom, _document);
       return dom
@@ -4153,7 +4211,9 @@ class YXmlElement extends YXmlFragment {
   getAttributes () {
     const obj = {};
     for (let [key, value] of this._map) {
-      obj[key] = value._content[0];
+      if (!value._deleted) {
+        obj[key] = value._content[0];
+      }
     }
     return obj
   }
@@ -5447,6 +5507,7 @@ class Y$1 extends NamedEventHandler {
       console.error(e);
     }
     if (initialCall) {
+      this.emit('beforeObserverCalls', this, this._transaction, remote);
       const transaction = this._transaction;
       this._transaction = null;
       // emit change events on changed types
@@ -5487,17 +5548,10 @@ class Y$1 extends NamedEventHandler {
   define (name, TypeConstructor) {
     let id = new RootID(name, TypeConstructor);
     let type = this.os.get(id);
-    if (type === null) {
-      type = new TypeConstructor();
-      type._id = id;
-      type._parent = this;
-      type._integrate(this);
-      if (this.share[name] !== undefined) {
-        throw new Error('Type is already defined with a different constructor!')
-      }
-    }
     if (this.share[name] === undefined) {
       this.share[name] = type;
+    } else if (this.share[name] !== type) {
+      throw new Error('Type is already defined with a different constructor')
     }
     return type
   }

y.test.js

@@ -1,8 +1,8 @@
 (function (global, factory) {
-	typeof exports === 'object' && typeof module !== 'undefined' ? factory() :
-	typeof define === 'function' && define.amd ? define(factory) :
-	(factory());
-}(this, (function () { 'use strict';
+	typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
+	typeof define === 'function' && define.amd ? define(['exports'], factory) :
+	(factory((global['y-tests'] = {})));
+}(this, (function (exports) { 'use strict';
 
 class N {
   // A created node is always red!
@@ -3769,7 +3769,7 @@ function domToYXml (parent, doms, _document) {
     if (d._yxml != null && d._yxml !== false) {
       d._yxml._unbindFromDom();
     }
-    if (parent._domFilter(d, []) !== null) {
+    if (parent._domFilter(d.nodeName, new Map()) !== null) {
       let type;
       if (d.nodeType === d.TEXT_NODE) {
         type = new YXmlText(d);
@@ -3957,6 +3957,52 @@ class YXmlFragment extends YArray {
     }
     this._y.on('beforeTransaction', beforeTransactionSelectionFixer);
     this._y.on('afterTransaction', afterTransactionSelectionFixer);
+    const applyFilter = (type) => {
+      if (type._deleted) {
+        return
+      }
+      // check if type is a child of this
+      let isChild = false;
+      let p = type;
+      while (p !== this._y) {
+        if (p === this) {
+          isChild = true;
+          break
+        }
+        p = p._parent;
+      }
+      if (!isChild) {
+        return
+      }
+      // filter attributes
+      let attributes = new Map();
+      if (type.getAttributes !== undefined) {
+        let attrs = type.getAttributes();
+        for (let key in attrs) {
+          attributes.set(key, attrs[key]);
+        }
+      }
+      let result = this._domFilter(type.nodeName, new Map(attributes));
+      if (result === null) {
+        type._delete(this._y);
+      } else {
+        attributes.forEach((value, key) => {
+          if (!result.has(key)) {
+            type.removeAttribute(key);
+          }
+        });
+      }
+    };
+    this._y.on('beforeObserverCalls', function (y, transaction) {
+      // apply dom filter to new and changed types
+      transaction.changedTypes.forEach(function (subs, type) {
+        if (subs.size > 1 || !subs.has(null)) {
+          // only apply changes on attributes
+          applyFilter(type);
+        }
+      });
+      transaction.newTypes.forEach(applyFilter);
+    });
     // Apply Y.Xml events to dom
     this.observeDeep(events => {
       reflectChangesOnDom.call(this, events, _document);
@@ -3994,10 +4040,15 @@ class YXmlFragment extends YArray {
                   }
                   break
                 case 'attributes':
+                  if (yxml.constructor === YXmlFragment) {
+                    break
+                  }
                   let name = mutation.attributeName;
+                  let val = dom.getAttribute(name);
                   // check if filter accepts attribute
-                  if (this._domFilter(dom, [name]).length > 0 && this.constructor !== YXmlFragment) {
-                    var val = dom.getAttribute(name);
+                  let attributes = new Map();
+                  attributes.set(name, val);
+                  if (this._domFilter(dom.nodeName, attributes).size > 0 && yxml.constructor !== YXmlFragment) {
                     if (yxml.getAttribute(name) !== val) {
                       if (val == null) {
                         yxml.removeAttribute(name);
@@ -4068,16 +4119,15 @@ class YXmlElement extends YXmlFragment {
     } else {
       // tag is already set in constructor
       // set attributes
-      let attrNames = [];
+      let attributes = new Map();
       for (let i = 0; i < dom.attributes.length; i++) {
-        attrNames.push(dom.attributes[i].name);
-      }
-      attrNames = this._domFilter(dom, attrNames);
-      for (let i = 0; i < attrNames.length; i++) {
-        let attrName = attrNames[i];
-        let attrValue = dom.getAttribute(attrName);
-        this.setAttribute(attrName, attrValue);
+        let attr = dom.attributes[i];
+        attributes.set(attr.name, attr.value);
       }
+      attributes = this._domFilter(dom, attributes);
+      attributes.forEach((value, name) => {
+        this.setAttribute(name, value);
+      });
       this.insertDomElements(0, Array.prototype.slice.call(dom.childNodes), _document);
       this._bindToDom(dom, _document);
       return dom
@@ -4138,7 +4188,9 @@ class YXmlElement extends YXmlFragment {
   getAttributes () {
     const obj = {};
     for (let [key, value] of this._map) {
-      obj[key] = value._content[0];
+      if (!value._deleted) {
+        obj[key] = value._content[0];
+      }
     }
     return obj
   }
@@ -4524,7 +4576,7 @@ var y = d * 365.25;
  * @api public
  */
 
-var index = function(val, options) {
+var ms = function(val, options) {
   options = options || {};
   var type = typeof val;
   if (type === 'string' && val.length > 0) {
@@ -4666,7 +4718,7 @@ exports.coerce = coerce;
 exports.disable = disable;
 exports.enable = enable;
 exports.enabled = enabled;
-exports.humanize = index;
+exports.humanize = ms;
 
 /**
  * The currently active debug mode names, and names to skip.
@@ -4725,8 +4777,8 @@ function createDebug(namespace) {
 
     // set `diff` timestamp
     var curr = +new Date();
-    var ms = curr - (prevTime || curr);
-    self.diff = ms;
+    var ms$$1 = curr - (prevTime || curr);
+    self.diff = ms$$1;
     self.prev = prevTime;
     self.curr = curr;
     prevTime = curr;
@@ -4745,19 +4797,19 @@ function createDebug(namespace) {
     }
 
     // apply any `formatters` transformations
-    var index$$1 = 0;
+    var index = 0;
     args[0] = args[0].replace(/%([a-zA-Z%])/g, function(match, format) {
       // if we encounter an escaped % then don't increase the array index
       if (match === '%%') return match;
-      index$$1++;
+      index++;
       var formatter = exports.formatters[format];
       if ('function' === typeof formatter) {
-        var val = args[index$$1];
+        var val = args[index];
         match = formatter.call(self, val);
 
         // now we need to remove `args[index]` since it's inlined in the `format`
-        args.splice(index$$1, 1);
-        index$$1--;
+        args.splice(index, 1);
+        index--;
       }
       return match;
     });
@@ -5432,6 +5484,7 @@ class Y$2 extends NamedEventHandler {
       console.error(e);
     }
     if (initialCall) {
+      this.emit('beforeObserverCalls', this, this._transaction, remote);
       const transaction = this._transaction;
       this._transaction = null;
       // emit change events on changed types
@@ -5472,17 +5525,10 @@ class Y$2 extends NamedEventHandler {
   define (name, TypeConstructor) {
     let id = new RootID(name, TypeConstructor);
     let type = this.os.get(id);
-    if (type === null) {
-      type = new TypeConstructor();
-      type._id = id;
-      type._parent = this;
-      type._integrate(this);
-      if (this.share[name] !== undefined) {
-        throw new Error('Type is already defined with a different constructor!')
-      }
-    }
     if (this.share[name] === undefined) {
       this.share[name] = type;
+    } else if (this.share[name] !== type) {
+      throw new Error('Type is already defined with a different constructor')
     }
     return type
   }
@@ -5726,7 +5772,7 @@ if (typeof Y !== 'undefined') {
 }
 
 var chance_1 = createCommonjsModule(function (module, exports) {
-//  Chance.js 1.0.10
+//  Chance.js 1.0.12
 //  http://chancejs.com
 //  (c) 2013 Victor Quinn
 //  Chance may be freely distributed or modified under the MIT license.
@@ -5791,7 +5837,7 @@ var chance_1 = createCommonjsModule(function (module, exports) {
         return this;
     }
 
-    Chance.prototype.VERSION = "1.0.10";
+    Chance.prototype.VERSION = "1.0.12";
 
     // Random helper functions
     function initOptions(options, defaults) {
@@ -6010,6 +6056,16 @@ var chance_1 = createCommonjsModule(function (module, exports) {
 		return integer.toString(16);
     };
 
+    Chance.prototype.letter = function(options) {
+        options = initOptions(options, {casing: 'lower'});
+        var pool = "abcdefghijklmnopqrstuvwxyz";
+        var letter = this.character({pool: pool});
+        if (options.casing === 'upper') {
+            letter = letter.toUpperCase();
+        }
+        return letter;
+    };
+
     /**
      *  Return a random string
      *
@@ -6952,8 +7008,25 @@ var chance_1 = createCommonjsModule(function (module, exports) {
         return this.word({length: options.length}) + '@' + (options.domain || this.domain());
     };
 
+    /**
+     * #Description:
+     * ===============================================
+     * Generate a random Facebook id, aka fbid.
+     *
+     * NOTE: At the moment (Sep 2017), Facebook ids are
+     * "numeric strings" of length 16.
+     * However, Facebook Graph API documentation states that
+     * "it is extremely likely to change over time".
+     * @see https://developers.facebook.com/docs/graph-api/overview/
+     *
+     * #Examples:
+     * ===============================================
+     * chance.fbid() => '1000035231661304'
+     *
+     * @return [string] facebook id
+     */
     Chance.prototype.fbid = function () {
-        return parseInt('10000' + this.natural({max: 100000000000}), 10);
+        return '10000' + this.string({pool: "1234567890", length: 11});
     };
 
     Chance.prototype.google_analytics = function () {
@@ -7794,8 +7867,72 @@ var chance_1 = createCommonjsModule(function (module, exports) {
 
     // -- End Regional
 
+    // -- Music --
+
+    Chance.prototype.note = function(options) {
+      // choices for 'notes' option:
+      // flatKey - chromatic scale with flat notes (default)
+      // sharpKey - chromatic scale with sharp notes
+      // flats - just flat notes
+      // sharps - just sharp notes
+      // naturals - just natural notes
+      // all - naturals, sharps and flats
+      options = initOptions(options, { notes : 'flatKey'});
+      var scales = {
+        naturals: ['C', 'D', 'E', 'F', 'G', 'A', 'B'],
+        flats: ['D♭', 'E♭', 'G♭', 'A♭', 'B♭'],
+        sharps: ['C♯', 'D♯', 'F♯', 'G♯', 'A♯']
+      };
+      scales.all = scales.naturals.concat(scales.flats.concat(scales.sharps));
+      scales.flatKey = scales.naturals.concat(scales.flats);
+      scales.sharpKey = scales.naturals.concat(scales.sharps);
+      return this.pickone(scales[options.notes]);
+    };
+
+    Chance.prototype.midi_note = function(options) {
+      var min = 0;
+      var max = 127;
+      options = initOptions(options, { min : min, max : max });
+      return this.integer({min: options.min, max: options.max});
+    };
+
+    Chance.prototype.chord_quality = function(options) {
+      options = initOptions(options, { jazz: true });
+      var chord_qualities = ['maj', 'min', 'aug', 'dim'];
+      if (options.jazz){
+        chord_qualities = [
+          'maj7',
+          'min7',
+          '7',
+          'sus',
+          'dim',
+          'ø'
+        ];
+      }
+      return this.pickone(chord_qualities);
+    };
+
+    Chance.prototype.chord = function (options) {
+      options = initOptions(options);
+      return this.note(options) + this.chord_quality(options);
+    };
+
+    Chance.prototype.tempo = function (options) {
+      var min = 40;
+      var max = 320;
+      options = initOptions(options, {min: min, max: max});
+      return this.integer({min: options.min, max: options.max});
+    };
+
+    // -- End Music
+
     // -- Miscellaneous --
 
+    // Coin - Flip, flip, flipadelphia
+    Chance.prototype.coin = function(options) {
+      return this.bool() ? "heads" : "tails";
+    };
+
     // Dice - For all the board game geeks out there, myself included ;)
     function diceFn (range) {
         return function () {
@@ -13142,12 +13279,12 @@ async function initArrays (t, opts) {
     result['array' + i] = y.define('array', Y$1.Array);
     result['map' + i] = y.define('map', Y$1.Map);
     result['xml' + i] = y.define('xml', Y$1.XmlElement);
-    y.get('xml').setDomFilter(function (d, attrs) {
-      if (d.nodeName === 'HIDDEN') {
+    y.get('xml').setDomFilter(function (nodeName, attrs) {
+      if (nodeName === 'HIDDEN') {
         return null
-      } else {
-        return attrs.filter(a => a !== 'hidden')
       }
+      attrs.delete('hidden');
+      return attrs
     });
     y.on('afterTransaction', function () {
       for (let missing of y._missingStructs.values()) {
@@ -13263,7 +13400,7 @@ async function applyRandomTests (t, mods, iterations) {
   return initInformation
 }
 
-var index$1$1 = function (str) {
+var index$1 = function (str) {
 	return encodeURIComponent(str).replace(/[!'()*]/g, function (c) {
 		return '%' + c.charCodeAt(0).toString(16).toUpperCase();
 	});
@@ -13449,7 +13586,7 @@ function parserForArrayFormat(opts) {
 
 function encode(value, opts) {
 	if (opts.encode) {
-		return opts.strict ? index$1$1(value) : encodeURIComponent(value);
+		return opts.strict ? index$1(value) : encodeURIComponent(value);
 	}
 
 	return value;
@@ -13561,7 +13698,7 @@ var stringify = function (obj, opts) {
 	}).join('&') : '';
 };
 
-var index$2 = {
+var index = {
 	extract: extract,
 	parse: parse$1,
 	stringify: stringify
@@ -13576,7 +13713,7 @@ const browserSupport =
 
 function createTestLink (params) {
   if (typeof location !== 'undefined') {
-    var query = index$2.parse(location.search);
+    var query = index.parse(location.search);
     delete query.test;
     delete query.seed;
     delete query.args;
@@ -13586,7 +13723,7 @@ function createTestLink (params) {
         query[name] = params[name];
       }
     }
-    return location.protocol + '//' + location.host + location.pathname + '?' + index$2.stringify(query) + location.hash
+    return location.protocol + '//' + location.host + location.pathname + '?' + index.stringify(query) + location.hash
   }
 }
 
@@ -13597,7 +13734,7 @@ class TestHandler {
     this.repeatingRun = 0;
     this.tests = {};
     if (typeof location !== 'undefined') {
-      this.opts = index$2.parse(location.search);
+      this.opts = index.parse(location.search);
       if (this.opts.case != null) {
         this.opts.case = Number(this.opts.case);
       }
@@ -13738,7 +13875,7 @@ function createCommonjsModule$1(fn, module) {
 	return module = { exports: {} }, fn(module, module.exports), module.exports;
 }
 
-var isBrowser = typeof index$2 !== 'undefined';
+var isBrowser = typeof index !== 'undefined';
 
 var environment = {
 	isBrowser: isBrowser
@@ -18287,8 +18424,8 @@ var stacktraceGps = createCommonjsModule$1(function (module, exports) {
      * @returns {String} original representation of the base64-encoded string.
      */
     function _atob(b64str) {
-        if (typeof index$2 !== 'undefined' && index$2.atob) {
-            return index$2.atob(b64str);
+        if (typeof index !== 'undefined' && index.atob) {
+            return index.atob(b64str);
         } else {
             throw new Error('You must supply a polyfill for window.atob in this environment');
         }
@@ -18798,7 +18935,7 @@ var stacktrace = createCommonjsModule$1(function (module, exports) {
 }));
 });
 
-index$2.stacktrace = stacktrace;
+index.stacktrace = stacktrace;
 
 function test (testDescription, ...args) {
   let location = stacktrace.getSync()[1];
@@ -19039,8 +19176,8 @@ test('filter node', async function xml14 (t) {
   var { users, xml0, xml1 } = await initArrays(t, { users: 3 });
   let dom0 = xml0.getDom();
   let dom1 = xml1.getDom();
-  let domFilter = (node, attrs) => {
-    if (node.nodeName === 'H1') {
+  let domFilter = (nodeName, attrs) => {
+    if (nodeName === 'H1') {
       return null
     } else {
       return attrs
@@ -19060,8 +19197,9 @@ test('filter attribute', async function xml15 (t) {
   var { users, xml0, xml1 } = await initArrays(t, { users: 3 });
   let dom0 = xml0.getDom();
   let dom1 = xml1.getDom();
-  let domFilter = (node, attrs) => {
-    return attrs.filter(name => name !== 'hidden')
+  let domFilter = (nodeName, attrs) => {
+    attrs.delete('hidden');
+    return attrs
   };
   xml0.setDomFilter(domFilter);
   xml1.setDomFilter(domFilter);
@@ -19112,6 +19250,51 @@ test('treeWalker', async function xml17 (t) {
   await compareUsers(t, users);
 });
 
+/**
+ * The expected behavior is that changes on your own dom (e.g. malicious attributes) persist.
+ * Yjs should just ignore them, never propagate those attributes.
+ * Incoming changes that contain malicious attributes should be deleted.
+ */
+test('Filtering remote changes', async function xmlFilteringRemote (t) {
+  var { users, xml0, xml1 } = await initArrays(t, { users: 3 });
+  xml0.setDomFilter(function (nodeName, attributes) {
+    attributes.delete('malicious');
+    if (nodeName === 'HIDEME') {
+      return null
+    } else if (attributes.has('isHidden')) {
+      return null
+    } else {
+      return attributes
+    }
+  });
+  // make sure that dom filters are active
+  // TODO: do not rely on .getDom for domFilters
+  xml0.getDom();
+  xml1.getDom();
+  let paragraph = new Y$1.XmlElement('p');
+  let hideMe = new Y$1.XmlElement('hideMe');
+  let span = new Y$1.XmlElement('span');
+  span.setAttribute('malicious', 'alert("give me money")');
+  let tag = new Y$1.XmlElement('tag');
+  tag.setAttribute('isHidden', 'true');
+  paragraph.insert(0, [hideMe, span, tag]);
+  xml0.insert(0, [paragraph]);
+  let tag2 = new Y$1.XmlElement('tag');
+  tag2.setAttribute('isHidden', 'true');
+  paragraph.insert(0, [tag2]);
+  await flushAll(t, users);
+  // check dom
+  paragraph.getDom().setAttribute('malicious', 'true');
+  span.getDom().setAttribute('malicious', 'true');
+  console.log(xml0.toString());
+  // check incoming attributes
+  xml1.get(0).get(0).setAttribute('malicious', 'true');
+  xml1.insert(0, [new Y$1.XmlElement('hideMe')]);
+  await flushAll(t, users);
+
+  await compareUsers(t, users);
+});
+
 // TODO: move elements
 var xmlTransactions = [
   function attributeChange (t, user, chance) {
@@ -19214,5 +19397,7 @@ test('y-xml: Random tests (1000)', async function xmlRandom1000 (t) {
   await applyRandomTests(t, xmlTransactions, 1000);
 });
 
+Object.defineProperty(exports, '__esModule', { value: true });
+
 })));
 //# sourceMappingURL=y.test.js.map