chore: partial revert for demo-render-signal origins - #35124
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
The updated default allowlist behavior should avoid unintentionally trusting insecure schemes for a public host, and the README removal drops the only documentation for an existing build-time configuration (DEMO_PARENT_ORIGINS).
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR adjusts the demo “render signal” runtime allowlist behavior and aligns related runtime tests/documentation in the demos tooling.
Changes:
- Updates the default
DEFAULT_ALLOWED_ORIGINSlist used to resolve a trustedpostMessagetarget origin. - Refactors/extends Jest runtime tests for allowed origins (including wildcard behavior) and updates expectations.
- Removes the README section describing the demo render signal behavior and configuration.
File summaries
| File | Description |
|---|---|
| apps/demos/utils/tests/server/demo-render-signal.runtime.test.js | Updates runtime allowlist tests (allowed/rejected origins and wildcard cases). |
| apps/demos/utils/server/demo-render-signal.runtime.js | Changes the default allowed origins used by resolveTargetOrigin()/signal(). |
| apps/demos/README.md | Removes the “Demo render signal” documentation section from the demos README. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 3
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
🟢 Approval recommended
The changes are small, coherent (runtime + tests updated together), and the updated tests cover the revised default allowlist and wildcard semantics.
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0 new
- Review effort level: Lite
There was a problem hiding this comment.
🟡 Changes recommended
The pinned-port test uses the same origin, bypassing the port-pattern matching path it should verify.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Balanced
There was a problem hiding this comment.
🔵 Needs a closer look
Restore the render-signal documentation and update its default-origin table.
Review details
Suppressed comments (1)
apps/demos/README.md:31
- The render-signal runtime still supports
DEMO_PARENT_ORIGINS, exact/wildcard origin matching, and silent message suppression for untrusted embedders, but this deletion removes the only documentation for configuring and diagnosing that behavior. Deployments using a non-default parent will now have no documented way to restore the signal. Please retain this section and update only the default-origin table tolocalhostandhttps://js.devexpress.com.
### Before Commiting Changes
- Files reviewed: 3/3 changed files
- Comments generated: 0 new
- Review effort level: Balanced
No description provided.