Valdi Web sync - #148
Conversation
…ical-color-palettes # Conflicts: # valdi/src/valdi/runtime/Attributes/AttributesBindingContextImpl.cpp # valdi/src/valdi/runtime/Context/ViewNode.cpp # valdi/src/valdi/runtime/Context/ViewNode.hpp # valdi/src/valdi/runtime/JavaScript/Modules/AttributedTextNativeModuleFactory.cpp # valdi/test/runtime/ViewNode_tests.cpp
…pi-versioning # Conflicts: # compiler/compiler/Compiler/Sources/Processors/NativeCodeGenerationManager.swift
…0814-valdi-web # Conflicts: # valdi/src/valdi/runtime/Context/ViewNode.cpp # valdi/src/valdi/runtime/Context/ViewNode.hpp # valdi/test/runtime/AttributeProcessors_tests.cpp
# Conflicts: # src/valdi_modules/src/valdi/web_renderer/src/ValdiWebRuntime.ts # valdi/src/valdi/runtime/Context/ViewNode.cpp # valdi/src/valdi/runtime/JavaScript/JavaScriptRuntime.cpp # valdi/src/valdi/runtime/JavaScript/Modules/AttributedTextNativeModuleFactory.cpp # valdi/src/valdi/runtime/Resources/ThemableAsset.cpp # valdi/test/integration/Runtime_tests.cpp # valdi/test/runtime/AttributeProcessors_tests.cpp
Sensitive Files Detected🔧 Build rules — Affects build rules for all Valdi consumers. This is an automated notice. A maintainer will review after import. |
github-actions
Bot
added
area/runtime
📊 PR Size: size/XLTotal changes: 55434 lines (414 files) Top files changed:
...and 404 more files Size calculated as additions + deletions. Labels: XS (<10), S (<50), M (<250), L (<1000), XL (1000+) |
![semgrep-code-snapchat[bot]](https://avatars.githubusercontent.com/u/40505220?s=60&v=4){kind=small}
| window.parent.postMessage( | ||
| { | ||
| channel: WEB_DEBUGGER_CHANNEL, | ||
| ...payload, | ||
| }, | ||
| '*', | ||
| ); |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
The target origin of the window.postMessage() API is set to "*". This could allow for information disclosure due to the possibility of any origin allowed to receive the message.
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by wildcard-postmessage-configuration.
You can view more details about this finding in the Semgrep AppSec Platform.
| relayCompilerEvents: boolean, | ||
| ): Promise<CommandResult> { | ||
| return new Promise((resolve, reject) => { | ||
| const child = spawn(command, { |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Untrusted input might be injected into a command executed by the application, which can lead to a command injection vulnerability. An attacker can execute arbitrary commands, potentially gaining complete control of the system. To prevent this vulnerability, avoid executing OS commands with user input. If this is unavoidable, validate and sanitize the user input, and use safe methods for executing the commands. For more information, see [Command injection prevention for JavaScript ] (https://semgrep.dev/docs/cheat-sheets/javascript-command-injection/).
Dataflow graph
flowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>npm_modules/cli/src/commands/hotreload.ts</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L340 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 340] client.query</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L340 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 340] targets</a>"]
v3["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L340 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 340] await</a>"]
v4["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L403 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 403] resolveHotreloadTarget</a>"]
v5["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L403 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 403] await</a>"]
v6["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L403 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 403] resolvedTarget</a>"]
v7["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L407 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 407] hotreloadResolvedTarget</a>"]
v8["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L267 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 267] resolvedTarget</a>"]
v9["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L283 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 283] await</a>"]
v10["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L283 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 283] buildOutputs</a>"]
v11["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L289 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 289] hotreloadCommand</a>"]
v12["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L311 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 311] buildHotreloadCommand</a>"]
v13["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L91 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 91] hotreloadCommand</a>"]
v14["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L310 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 310] runHotreloadWithCompilerEvents</a>"]
v15["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L148 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 148] command</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
v10 --> v11
v11 --> v12
v12 --> v13
v13 --> v14
v14 --> v15
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/Snapchat/Valdi/blob/08a94ae1ba4624b0d6f0d139eb27f2ea4a560068/npm_modules/cli/src/commands/hotreload.ts#L154 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 154] command</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
To resolve this comment:
🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by express-child-process.
You can view more details about this finding in the Semgrep AppSec Platform.
|
Semgrep found 15
This literal might contain a Snapchat internal reference that should not be committed to open-source repositories. Fix: Please replace / remove the string to avoid committing it to open-source repositories. |
|
| Test Suite | Result |
|---|---|
| macOS: C++ & Platform Tests | ✅ success |
| Valdi Smoke Tests | ❌ failure |
| API Surface Check | ✅ success |
| Snapshot Tests | ✅ success |
| valdi_web Integration Test | ❌ failure |
| Linux: Hotreload Smoke | ✅ success |
| Linux: Registry Validation | ❌ failure |
| Linux: Build & Export | ✅ success |
| Linux: Build Compiler | ✅ success |
| Linux: Module Tests | ✅ success |
| Linux: C++ Tests | ❌ failure |
Some tests failed. Please check the workflow logs for details.
🚀 Bazel remote cache is now enabled - future builds will be faster!
Workflow: Valdi CI
|
Pulled AYAB builds, all 11 Bazel test targets and 17 browser E2E workflows pass, and simulation works. The second consumer builds and its canonical Valdi/package verification passes with compatibility patches. These are the issues I hit: 1. External paths escape the collapsed output treeWith Valdi consumed through Bzlmod, The fallback returns that unchanged, so the collapse action writes outside its declared tree artifact. 2. Current Widgets still uses
|
2 participants
Description
This change syncs up most of the Valdi web implementation in the OpenAI fork back to upstream.
Includes a framework-level SSR prototype with a server DOM, HTML/CSS serialization, routing, streaming responses, and tests.
Type of Change
Testing
bazel test //...)Testing Details
Checklist
Related Issues
Additional Context