Half the JavaScript on a static FAQ page never runs, and much of it is framework server code

·4 views

A developer found that a prerendered FAQ page, which has no interactive elements, loads 19 JavaScript chunks, and about half of their code never executes in the browser. Using V8 precise coverage via the Chrome DevTools Protocol, they measured roughly 49 percent execution across repeated runs, with timing variations from idle work and router prefetches. Legal pages served as a control and showed a higher proportion of executed code because they contained mostly framework code. Two chunks containing about 98 KB of framework server-side rendering machinery, which the browser never uses, were identified by their string tables. The author attributes this to a single bundle graph where server and client code share modules, rather than to any bug in the app's own code.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Git's file transport should be restricted during recursive submodule fetches in CI

A Git superproject can define submodule URLs in its .gitmodules file, which Git may follow automatically during recursive clones or updates. Local file: URLs are a concern because they can reach the runner's filesystem, cached data, or other repositories present on the host. Such automatic fetches can run with the runner's local privileges, which can blur the separation between checking out the main project and fetching its dependencies. Git's protocol policy settings can restrict these transports, and the article recommends that the execution environment enforce them rather than relying on repository-local configuration. Teams should audit CI jobs that recurse submodules, pin expected submodule commits, and fail builds when submodule URLs change unexpectedly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Allowlisting git for AI agents can also enable code execution via config keys

Researchers at HiddenLayer showed that a compromised LLM gateway can inject a git command that begins with an approved prefix, so the agent runs it without prompting the user. The malicious command uses git's diff.external setting to pass .env contents through an external program. A separate Pillar Security disclosure found Codex CLI treated git show as safe, letting it write a diff.external entry into the repo config that later ran on git diff; OpenAI patched this in version 0.95.0. The article notes that approving a command prefix permits every configuration key that runs a program behind it, not just the intended read-only operations. Git's core.fsmonitor setting can similarly execute arbitrary commands during git status, which makes the risk broader than any single flag.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Missing Function Call Caused Recolouring Failure in a T-Shirt Design Lab

A developer running a small t-shirt design lab found two of their own artworks could not be recoloured and initially blamed the drawings themselves. One file had no fill colours at all, which displays differently across editors and browsers, and the other used two near-identical cream shades that caused the system to treat it as multicoloured. After fixing the duplicate colour, the problem persisted. Investigation revealed that the two upload routes handled colour normalisation differently. The admin library route skipped a necessary step, so some drawings were stored without the marker the editor needs to allow recolouring.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Autor cria bot pessoal no Telegram para resumos diários e lembretes sem SaaS

Um desenvolvedor relata ter montado um bot pessoal no Telegram que envia resumos matinais e lembretes pontuais, para reunir em um único canal informações espalhadas por diferentes apps. O processo começa com a criação do bot pelo BotFather, a obtenção do token e do chat_id, e um teste de envio via a API do Telegram. Como a Bot API não oferece agendamento nativo, o autor explica que o disparo das mensagens precisa ser controlado por um processo externo. Ele opta por um script em Python combinado com o cron do sistema, por ser leve e simples de depurar. A publicação enfatiza que a solução pode ser feita sem depender de serviços comerciais de terceiros.

0 comments Read more at DEV Community