Skip to content

Error, License, Wasm, Json output #2

@bbb651

Description

@bbb651

This looks like a really cool project!

I actually couldn't get it to work (on public repositories), I get Failed to get custom diff. Showing original instead!, it seems like GitHub updated their Content-Security-Policy in a way that breaks the extension:

Content-Security-Policy: The page’s settings blocked the loading of a resource (connect-src) at https://us-central1-betterdiffs.cloudfunctions.net/getBetterDiff because it violates the following directive: “connect-src 'self' https://uploads.github.com/ https://www.githubstatus.com/ https://collector.github.com/ https://raw.githubusercontent.com/ https://api.github.com/ https://github-cloud.s3.amazonaws.com/ https://github-production-repository-file-5c1aeb.s3.amazonaws.com/ https://github-production-upload-manifest-file-7fdce7.s3.amazonaws.com/ https://github-production-user-asset-6210df.s3.amazonaws.com/ https://*.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com https://github.githubassets.com/ https://objects-origin.githubusercontent.com/ https://copilot-proxy.githubusercontent.com/ https://proxy.individual.githubcopilot.com/ https://proxy.business.githubcopilot.com/ https://proxy.enterprise.githubcopilot.com/ https://*.actions.githubusercontent.com wss://*.actions.githubusercontent.com https://productionresultssa0.blob.core.windows.net/ https://productionresultssa1.blob.core.windows.net/ https://productionresultssa2.blob.core.windows.net/ https://productionresultssa3.blob.core.windows.net/ https://productionresultssa4.blob.core.windows.net/ https://productionresultssa5.blob.core.windows.net/ https://productionresultssa6.blob.core.windows.net/ https://productionresultssa7.blob.core.windows.net/ https://productionresultssa8.blob.core.windows.net/ https://productionresultssa9.blob.core.windows.net/ https://productionresultssa10.blob.core.windows.net/ https://productionresultssa11.blob.core.windows.net/ https://productionresultssa12.blob.core.windows.net/ https://productionresultssa13.blob.core.windows.net/ https://productionresultssa14.blob.core.windows.net/ https://productionresultssa15.blob.core.windows.net/ https://productionresultssa16.blob.core.windows.net/ https://productionresultssa17.blob.core.windows.net/ https://productionresultssa18.blob.core.windows.net/ https://productionresultssa19.blob.core.windows.net/ https://github-production-repository-image-32fea6.s3.amazonaws.com/ https://github-production-release-asset-2e65be.s3.amazonaws.com/ https://insights.github.com/ wss://alive.github.com wss://alive-staging.github.com https://api.githubcopilot.com/ https://api.individual.githubcopilot.com/ https://api.business.githubcopilot.com/ https://api.enterprise.githubcopilot.com/” [files](https://github.com/Wilfred/difftastic/pull/936/files)

Also I noticed you're missing a LICENSE (which afaik makes it similar to ARR, though IANAL).

I think the extension would be much better if it run Difftastic through wasm, I personally don't feel comfortable running it on private repositories (even though it's open source and the privacy policy promises it won't keep data, it's impossible to truly know what actually happens on the server, if it gets compromised, etc.), see Wilfred/difftastic#927

I read through some of the code that converts ansi to html, if you didn't know Difftastic has a json mode:

DFT_UNSTABLE=yes DFT_DISPLAY=json difft before.js after.js

It seems easier to use that to reconstructs the diffs client side in React than converting it and sanitizing the output (server side isn't great either, it's less secure due to the potential to abuse server and browser parser differences, and it again puts more trust on the server giving it the ability to remotely inject JS into GitHub).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions