Re: [Edbrowse-dev] Amazon can of worms

[Adam Thompson <arthompson1990@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 2300 bytes --]

On Mon, Apr 21, 2014 at 12:48:22AM +0000, Karl Dahlke wrote:
> Ok remember when I said amazon.com had its javascript in its home page,
> in modest pieces? No such luck.
> I found this snip of code that tries to execute
> but doesn't, because I don't have it implemented.
> 
>   var scriptElem = document.createElement('script');
>   scriptElem.src = "http://z-ecx.images-amazon.com/images/G/01/s9-campaigns/s9-multipack-min._V366882549_.js";
>   document.getElementsByTagName('head')[0].appendChild(scriptElem);
> 
> I am fairly certain this pulls in and executes javascript code dynamically.

Yep, that's my understanding as well.

> But when?
> When the src attribute is assigned?
> When the script object is placed in the head section?
> Or when that piece of javascript returns?
> 
> I really hope it's the latter.
> Otherwise all sorts of code has to be reentrant.
> I could stack up, actually fifo up, any such js urls and execute them
> after the invoking js returns.
> Not too hard to do, but it means I am missing entire swaths of js code
> in amazon.com, probably in the dog vomit category,
> which probably spends 90% of its time doing visual effects,
> and can I really afford to spend the next 4 months trying to figure it out?

I think in this case it is expected that the script element is placed (and thus
executed) in the DOM just as it would be if it was done in the html.
This basically means (I think) that we need to put the element in with the src
attribute then continue parsing all the script tags including the new addition.
This is slightly different from just running through the urls as there may be
(and probably are in some cases) script elements between where this bit of dynamic
weirdness is ran and where the script sits in the DOM.
This could mean that things it relies on aren't defined yet etc,
hence why if we support this we need to do it properly.

> It does confirm something though: as I keep going I keep finding little
> objects and methods that I just don't have implemented,
> and they don't usually entail the big rewrite, they are more like enhancements,
> but there are so many of them!

Agreed, though proper element creation support like this is going to be a bit
non-trivial I suspect.

Cheers,
Adam.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]