Fix excessive attribution control rerendering #5673
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The lead-up
In one of my projects I noticed a weird flickering on the attribution control that seemed to be related to rapid data updates. Notably, it only occurred in Firefox and not in Chromium, so I started to investigate.
The issue
Since attribution strings can include untrusted HTML, PR #5057 introduces a bit of input sanitization to mitigate potential XSS attacks trough the
attribution
field. The attribution control includes a mechanism to suppress excessive re-renders, but #5057 introduced a bug: The suppression logic compares the cached sanitized result with the new unsanitized result. This will lead to excessive DOM updates if the sanitized attribution actually differs from the unsanitized one, for instance if it contains a©
HTML entity that gets transformed into a©
literal.The fix
This PR reverts some of the changes in #5057: The attribution control will cache the unsanitized input again instead of the sanitized result and only call the sanitizer directly when updating the DOM. This might even bring a minor performance improvement since the sanitizer will no longer be called on every update, but only if the unsanitized input has been changed.
Launch Checklist
CHANGELOG.md
under the## main
section.