Skip to content

fix(play): tag runner postMessages with uuid for isolation - #437

Open
caugner wants to merge 2 commits into
mainfrom
436-play-runner-uuid-isolation
Open

caugner wants to merge 2 commits into
mainfrom
436-play-runner-uuid-isolation

Conversation

@caugner

@caugner caugner commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Description

Tag every message the mirrored Playground runner (cloud-function/src/internal/play/index.js) posts to its parent with a uuid read from the runner URL's uuid query param: the console proxy (all three postMessage branches) and the ready message now post { uuid, typ, ... }. Matches fred's vendor/yari/libs/play/index.js, from which this file is vendored.

Motivation

Let a parent hosting multiple runners filter incoming messages by uuid so runners can't cross-talk. This copy has never had it (git log -S uuid on the file is empty), unlike fred's.

Additional details

Backward-compatible: the consumer is the parent frame (in fred, components/play-runner/element.js), not this repo. Its _onMessage falls back to deriving the uuid from the origin subdomain when a message omits uuid, so a parent that doesn't set the query param keeps working unchanged; one that sets it gets exact per-runner filtering.

Related issues and pull requests

Part of #436.
Ports mdn/fred#150.

@caugner
caugner force-pushed the 436-play-runner-uuid-isolation branch from a2739c0 to 3e7f0ba Compare July 17, 2026 13:55
@caugner caugner changed the title feat(play): tag runner postMessages with uuid for isolation fix(play): tag runner postMessages with uuid for isolation Jul 17, 2026
@caugner
caugner added this pull request to stack #516 September 9, 2026 14:12
@caugner
caugner force-pushed the 436-play-runner-uuid-isolation branch from 3e7f0ba to 188a9cb Compare September 9, 2026 14:31
@caugner
caugner removed this pull request from stack #516 September 9, 2026 14:38
@caugner
caugner added this pull request to stack #517 September 9, 2026 14:39
@caugner
caugner marked this pull request as ready for review September 14, 2026 15:49
@caugner
caugner requested a review from a team as a code owner September 14, 2026 15:49
@caugner
caugner requested a review from LeoMcA September 14, 2026 15:49
Read the `uuid` query param in the runner and include it in every
`postMessage` the runner sends to its parent frame: the `console` proxy
(all three branches) and the `ready` message now post
`{ uuid, typ, ... }` instead of `{ typ, ... }`.

This mirrors `mdn/fred`'s copy of the same file
(`vendor/yari/libs/play/index.js`), from which `src/internal/play` is
vendored. Tagging messages with a `uuid` lets a parent hosting multiple
runners on one page filter incoming messages so the runners cannot
cross-talk.

Backward-compatible: a parent that does not set the `uuid` query param
yields `uuid: undefined`, and fred's parent falls back to deriving the
value from the origin subdomain, preserving existing behavior.
Assert that the rendered runner reads `uuid` from `location.search` and
includes it in the `ready` and all three `console` messages, so a future
sync from `mdn/fred` cannot silently drop the field.
@caugner
caugner force-pushed the 436-play-runner-uuid-isolation branch from 188a9cb to d663c70 Compare September 14, 2026 15:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants