Performance and security improvements#176
Open
duncanplatt wants to merge 2 commits intophotodiode:masterfrom
Open
Performance and security improvements#176duncanplatt wants to merge 2 commits intophotodiode:masterfrom
duncanplatt wants to merge 2 commits intophotodiode:masterfrom
Conversation
Performance: - Fix onUpdated filter in view.js not being passed to addListener (comma expression instead of second argument), causing all tab updates to fire the handler instead of only filtered properties - Replace busy-wait polling loops in addon.tabs.js and addon.tabs.events.js with exponential backoff (5ms–160ms), preventing tight spinning on the sessions API and eliminating potential infinite hangs - Add tabs.warmup() on tab thumbnail hover to pre-render GPU resources for faster tab switching (Firefox 61+, with feature detection) - Replace (new Date).getTime() with Date.now() to avoid unnecessary object allocation Security: - Add explicit content_security_policy to manifest.json - Remove unused cookies permission from manifest.json - Fix undeclared variable in addon.tabGroups.js remove() that caused the tab-removal verification to fail silently under strict mode - Validate sender.id in background message handler to reject messages from external extensions - Add try/catch around JSON.parse when loading backup files to prevent crashes on malformed input - Add try/catch around decodeURI in tab tooltips to handle malformed percent-encoded URLs gracefully Also adds undefined guards in activated() to prevent calling toggleVisibleTabs with an undefined groupId (which would hide all tabs) and setActiveId (which would trigger a lock leak in the mutex).
The strict sender.id !== browser.runtime.id check rejected messages from the options page when embedded in about:addons, breaking backup save/load and interval settings. Loosen to only reject messages where sender.id is explicitly set to a different extension's ID.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Performance
onUpdatedevent filter not being applied — the property filterobject was outside the
addListener()parentheses (comma expression),so every tab update fired the handler instead of only the six listed
properties
whileloopsthat spun on
getTabValue/getActiveIdwith no delay now use boundedretries (5ms→10ms→20ms…) with timeouts, eliminating CPU spinning and
potential infinite hangs
tabs.warmup()on tab hover — pre-renders GPU resources when theuser hovers a thumbnail, making subsequent tab switches faster
(new Date).getTime()withDate.now()across the codebaseSecurity
content_security_policyto manifest.json (matchesFirefox default but makes the policy explicit)
cookiespermission — reduces attack surfacetabvariable inremove()— missingconstcaused astrict-mode ReferenceError that silently broke the "were tabs actually
closed?" verification
messages from external extensions via
sender.idcheckJSON.parse(backup restore) anddecodeURI(tab tooltips) to prevent crashes on malformed input
Test plan
feels responsive
tabGroups API) if possible