Fossil SCM

Assorted minor improvements to the javascript.md doc.

wyoung 2020-08-20 04:17 js-policy-doc
Commit dc1bc21388dbe2d8bcb45b2aecdf300a20166d91a2faa13b5ec73379738e04f0
Parent 5648dcfc3d8452e…
1 file changed +54 -46
~ www/javascript.md
M www/javascript.md
+54 -46
--- www/javascript.md
+++ www/javascript.md
@@ -120,22 +120,19 @@
120120
 Fossil attempts to set two cookies on all web clients: a login session
121121
 cookie and a display preferences cookie. These cookies are restricted to
122122
 the Fossil instance, so even this limited data cannot leak between
123123
 Fossil instances or into other web sites.
124124
125
- There is some server-side event logging, but that is done entirely
126
- without JavaScript, so it’s off-topic here.
127
-
128125
 5. “**JavaScript is fundamentally insecure.**”
129126
130
- JavaScript is historically associated with some nefarious uses, but
131
- if we wish to have more features in Fossil, the alternative is to
132
- add more C code to the Fossil binary, a language with *far more*
133
- historical security problems associated with it.
127
+ JavaScript is certainly sometimes used for nefarious ends, but if we
128
+ wish to have more features in Fossil, the alternative is to add more
129
+ code to the Fossil binary, [most likely in C][fslpl], a language
130
+ implicated in [over 4× more security vulnerabilities][whmsl].
134131
135
- Does it not make sense to place as much trust in Fossil’s JavaScript
136
- code as in its C code?
132
+ Therefore, does it not make sense to place approximately four times
133
+ as much trust in Fossil’s JavaScript code as in its C code?
137134
138135
 The question is not whether JavaScript is itself evil, it is whether
139136
 its *authors* are evil. *Every byte* of JavaScript code used within
140137
 the Fossil UI is:
141138
@@ -207,11 +204,11 @@
207204
 between these two forces, the number of no-JS purists among Fossil’s
208205
 user base is still a tiny minority.
209206
210207
 9. <a id="block"></a>“**I block JavaScript entirely in my browser. That breaks Fossil.**”
211208
212
- First, see our philosophy statement above. Briefly, we intend that
209
+ First, see our philosophy statements above. Briefly, we intend that
213210
 there always be some other way to get any given result without using
214211
 JavaScript, developer interest willing.
215212
216213
 But second, it doesn’t have to be all-or-nothing. We recommend that
217214
 those interested in blocking problematic uses of JavaScript use
@@ -224,20 +221,20 @@
224221
 exclude other tools.
225222
226223
 The primary difference between these two for our purposes is that
227224
 NoScript lets you select scripts to run on a page on a case-by-case
228225
 basis, whereas uBlock Origin delegates those choices to a group of
229
- motivated volunteers who maintain whitelists and blacklists to control
230
- all of this; you can then override UBO’s stock rules as needed.
226
+ motivated volunteers who maintain allow/block lists to control all
227
+ of this; you can then override UBO’s stock rules as needed.
231228
232229
233230
 10. “**My browser doesn’t even *have* a JavaScript interpreter.**”
234231
235232
 The Fossil open source project has no full-time developers, and only
236233
 a few of these part-timers are responsible for the bulk of the code
237234
 in Fossil. If you want Fossil to support such niche use cases, then
238
- you will have to [get involved with its development][cg]; it’s
235
+ you will have to [get involved with its development][cg]: it’s
239236
 *your* uncommon itch.
240237
241238
 11. <a id="compat"></a>“**Fossil’s JavaScript code isn’t compatible with my browser.**”
242239
243240
 The Fossil project’s developers aim to remain compatible with
@@ -250,32 +247,39 @@
250247
251248
 We set this threshold based on the amount of time it typically takes for
252249
 new standards to propagate through the installed base.
253250
254251
 As of this writing, this means we are only using features defined in
255
- [ECMAScript 2015][es2015], colloquially called “JavaScript 6.” That is a
256
- sufficiently rich standard that it more than suffices for our purposes.
252
+ [ECMAScript 2015][es2015], colloquially called “JavaScript 6.” That
253
+ is a sufficiently rich standard that it more than suffices for our
254
+ purposes, and it is [widely deployed][es6dep]. The biggest single
255
+ outlier remaining is MSIE 11, and [even Microsoft is moving their
256
+ own products off of it][ie11x].
257257
258258
 [2cbsd]: https://fossil-scm.org/home/doc/trunk/COPYRIGHT-BSD2.txt
259259
 [ciu]: https://caniuse.com/
260260
 [cskin]: ./customskin.md
261261
 [dcsp]: ./defcsp.md
262262
 [es2015]: https://ecma-international.org/ecma-262/6.0/
263
+[es6dep]: https://caniuse.com/#feat=es6
263264
 [fcgi]: /help?cmd=cgi
264265
 [ffor]: https://fossil-scm.org/forum/
265266
 [flic]: /doc/trunk/COPYRIGHT-BSD2.txt
266267
 [fshome]: /doc/trunk/www/server/
268
+[fslpl]: /doc/trunk/www/fossil-v-git.wiki#portable
267269
 [fsrc]: https://fossil-scm.org/home/file/src
268270
 [fsrv]: /help?cmd=server
269271
 [hljs]: https://fossil-scm.org/forum/forumpost/9150bc22ca
272
+[ie11x]: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666
270273
 [ns]: https://noscript.net/
271274
 [pjs]: https://fossil-scm.org/forum/forumpost/1198651c6d
272275
 [s1]: https://blockmetry.com/blog/javascript-disabled
273276
 [s2]: https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/
274277
 [s3]: https://w3techs.com/technologies/overview/client_side_language/all
275278
 [ubo]: https://github.com/gorhill/uBlock/
276279
 [v8]: https://en.wikipedia.org/wiki/V8_(JavaScript_engine)
280
+[whmsl]: https://www.whitesourcesoftware.com/most-secure-programming-languages/
277281
278282
279283
 ----
280284
281285
 ## <a id="uses"></a>Places Where Fossil’s Web UI Uses JavaScript
@@ -313,12 +317,12 @@
313317
 [wt]: https://fossil-scm.org/fossil/timeline
314318
315319
316320
 ### <a id="wedit"></a>The New Wiki Editor
317321
318
-As of Fossil 2.12, the [Fossil wiki][fwt] document editor requires
319
-JavaScript for a few unavoidable reasons.
322
+The [new wiki editor][fwt] added in Fossil 2.12 has many new features, a
323
+few of which are impossible to get without use of JavaScript.
320324
321325
 First, it allows in-browser previews without losing client-side editor
322326
 state, such as where your cursor is. With the old editor, you had to
323327
 re-locate the place you were last editing on each preview, which would
324328
 reduce the incentive to use the preview function. In the new wiki
@@ -337,14 +341,10 @@
337341
 that there is a way for the app to restore its prior state from
338342
 persistent media when it’s restarted, giving the illusion that it was
339343
 never shut down in the first place. This feature of Fossil’s new wiki
340344
 editor provides that.
341345
342
-There are many other new features in the enhanced Fossil 2.12 wiki
343
-editor, but those are the ones that absolutely require JavaScript to
344
-work.
345
-
346346
 With this change, we lost the old WYSIWYG wiki editor, available since
347347
 Fossil version 1.24. It hadn’t been maintained for years, it was
348348
 disabled by default, and no one stepped up to defend its existence when
349349
 this new editor was created, replacing it. If someone rescues that
350350
 feature, merging it in with the new editor, it will doubtless require
@@ -358,11 +358,11 @@
358358
 desire, only because the person who wrote the new wiki editor didn’t
359359
 want to maintain three different editors. (New Ajaxy editor, old
360360
 script-free HTML form based editor, and the old WYSIWYG JavaScript-based
361361
 editor.) If someone wants to implement a `<noscript>` alternative to the
362362
 new wiki editor, we will likely accept that [contribution][cg] as long
363
-as it doensn’t interfere with the new editor. (The same goes for adding
363
+as it doesn’t interfere with the new editor. (The same goes for adding
364364
 a WYSIWYG mode to the new Ajaxy wiki editor.)
365365
366366
 _Workaround:_ You don’t have to use the browser-based wiki editor to
367367
 maintain your repository’s wiki at all. Fossil’s [`wiki` command][fwc]
368368
 lets you manipulate wiki documents from the command line. For example,
@@ -425,23 +425,26 @@
425425
426426
 When viewing source files, Fossil offers to show line numbers in some
427427
 cases. ([Example][mainc].) Toggling them on and off is currently handled
428428
 in JavaScript, rather than forcing a page-reload via a button click.
429429
430
-_Workaround:_ Edit the URL to give the “`ln`” query parameter per [the
431
-`/file` docs](/help?cmd=/file). Alternately, someone sufficiently
432
-interested could [provide a patch][cg] to add a `<noscript>` wrapped
433
-HTML button that would reload the page with this parameter
434
-included/excluded to implement the toggle via a server round-trip.
430
+_Workaround:_ Manually edit the URL to give the “`ln`” query parameter
431
+per [the `/file` docs](/help?cmd=/file).
432
+
433
+_Potential Better Workaround:_ Someone sufficiently interested could
434
+[provide a patch][cg] to add a `<noscript>` wrapped HTML button that
435
+would reload the page with this parameter included/excluded to implement
436
+the toggle via a server round-trip.
435437
436438
 As of Fossil 2.12, there is also a JavaScript-based interactive method
437439
 for selecting a range of lines by clicking the line numbers when they’re
438440
 visible, then copying the resulting URL to share your selection with
439441
 others.
440442
441
-_Workaround:_ These interactive features absolutely require JavaScript.
442
-The alternative is to manually edit the URL, per above.
443
+_Workaround:_ These interactive features would be difficult and
444
+expensive (in terms of network I/O) to implement without JavaScript. A
445
+far simpler alternative is to manually edit the URL, per above.
443446
444447
 [mainc]: https://fossil-scm.org/fossil/artifact?ln&name=87d67e745
445448
446449
447450
 ### <a id="sxsdiff"></a>Side-by-Side Diff Mode
@@ -487,12 +490,12 @@
487490
 similar, hovering over that check-in shows a tooltip with details about
488491
 the type of artifact the hash refers to and allows you to click to copy
489492
 the hash to the clipboard.
490493
491494
 _Graceful Fallback:_ When JavaScript is disabled, these tooltips simply
492
-don’t appear. You can then select and copy the hash using your browser,
493
-make “`fossil info`” queries on those hashes, etc.
495
+don’t appear, but you can still select and copy the hash using your
496
+platform’s “copy selected text” feature.
494497
495498
496499
 ### <a id="bots"></a>Anti-Bot Defenses
497500
498501
 Fossil has [anti-bot defenses][abd], and it has some JavaScript code
@@ -525,29 +528,34 @@
525528
526529
 ### <a id="clock"></a>Clock
527530
528531
 Some stock Fossil skins include JavaScript-based features such as the
529532
 current time of day. The Xekri skin includes this in its header, for
530
-example. A clock feature requires JavaScript not only to get the time
531
-and update inline on the page once a minute, but also so it displays *in
532
-the local time zone.*
533
-
534
-Since none of this code provides a necessary Fossil feature, the core
535
-developers are unlikely to try to make these features work better in the
536
-absence of JavaScript.
537
-
538
-However, we are willing to study patches to make this better. For
539
-example, the wall clock displays could include the page load time in the
540
-dynamically generated HTML shipped from the remote Fossil server, so
541
-that in the absence of JavaScript, you at least get the page generation
542
-time, expressed in the server’s time zone.
533
+example. A clock feature requires JavaScript to get the time on initial
534
+page load and then to update it once a minute.
535
+
536
+You may observe that the server could provide the current time when
537
+generating the page, but the client and server may not be in the same
538
+time zone, and there is no reliably-provided information from the client
539
+that would let the server give the page load time in the client’s local
540
+time zone. The server could only tell you *its* local time at page
541
+request time, not the client’s time. That still wouldn’t be a “clock,”
542
+since without client-side JavaScript code running, that part of the page
543
+couldn’t update once a second.
544
+
545
+_Potential Graceful Fallback:_ You may consider showing the server’s
546
+page generation time rather than the client’s wall clock time in the
547
+local time zone to be a useful fallback for the current feature, so [a
548
+patch to do this][cg] may well be accepted. Since this is not a
549
+*necessary* Fossil feature, an interested user is unlikely to get the
550
+core developers to do this work for them.
543551
544552
 ----
545553
546554
 ## <a id="future"></a>Future Plans for JavaScript in Fossil
547555
548
-As of mid-2020, the informal provisional plan is to increase the Fossil
556
+As of mid-2020, the informal provisional plan is to increase Fossil
549557
 UI's use of JavaScript considerably compared to its historically minimal
550558
 uses. To that end, a framework of Fossil-centric APIs is being developed
551559
 in conjunction with new features to consolidate Fossil's historical
552560
 hodge-podge of JavaScript snippets into a coherent code base.
553561
@@ -580,7 +588,7 @@
580588
 coding even when they really don't want to. 😉
581589
582590
 In all of this, Fossil's project lead understandably has the final
583591
 say-so in whether any given feature indeed gets merged into the mainline
584592
 trunk. Development of any given feature, no matter how much effort was
585
-involved, does not guaranty its eventual inclusion into the public
593
+involved, does not guarantee its eventual inclusion into the public
586594
 releases.
587595
--- www/javascript.md
+++ www/javascript.md
@@ -120,22 +120,19 @@
120 Fossil attempts to set two cookies on all web clients: a login session
121 cookie and a display preferences cookie. These cookies are restricted to
122 the Fossil instance, so even this limited data cannot leak between
123 Fossil instances or into other web sites.
124
125 There is some server-side event logging, but that is done entirely
126 without JavaScript, so it’s off-topic here.
127
128 5. “**JavaScript is fundamentally insecure.**”
129
130 JavaScript is historically associated with some nefarious uses, but
131 if we wish to have more features in Fossil, the alternative is to
132 add more C code to the Fossil binary, a language with *far more*
133 historical security problems associated with it.
134
135 Does it not make sense to place as much trust in Fossil’s JavaScript
136 code as in its C code?
137
138 The question is not whether JavaScript is itself evil, it is whether
139 its *authors* are evil. *Every byte* of JavaScript code used within
140 the Fossil UI is:
141
@@ -207,11 +204,11 @@
207 between these two forces, the number of no-JS purists among Fossil’s
208 user base is still a tiny minority.
209
210 9. <a id="block"></a>“**I block JavaScript entirely in my browser. That breaks Fossil.**”
211
212 First, see our philosophy statement above. Briefly, we intend that
213 there always be some other way to get any given result without using
214 JavaScript, developer interest willing.
215
216 But second, it doesn’t have to be all-or-nothing. We recommend that
217 those interested in blocking problematic uses of JavaScript use
@@ -224,20 +221,20 @@
224 exclude other tools.
225
226 The primary difference between these two for our purposes is that
227 NoScript lets you select scripts to run on a page on a case-by-case
228 basis, whereas uBlock Origin delegates those choices to a group of
229 motivated volunteers who maintain whitelists and blacklists to control
230 all of this; you can then override UBO’s stock rules as needed.
231
232
233 10. “**My browser doesn’t even *have* a JavaScript interpreter.**”
234
235 The Fossil open source project has no full-time developers, and only
236 a few of these part-timers are responsible for the bulk of the code
237 in Fossil. If you want Fossil to support such niche use cases, then
238 you will have to [get involved with its development][cg]; it’s
239 *your* uncommon itch.
240
241 11. <a id="compat"></a>“**Fossil’s JavaScript code isn’t compatible with my browser.**”
242
243 The Fossil project’s developers aim to remain compatible with
@@ -250,32 +247,39 @@
250
251 We set this threshold based on the amount of time it typically takes for
252 new standards to propagate through the installed base.
253
254 As of this writing, this means we are only using features defined in
255 [ECMAScript 2015][es2015], colloquially called “JavaScript 6.” That is a
256 sufficiently rich standard that it more than suffices for our purposes.
 
 
 
257
258 [2cbsd]: https://fossil-scm.org/home/doc/trunk/COPYRIGHT-BSD2.txt
259 [ciu]: https://caniuse.com/
260 [cskin]: ./customskin.md
261 [dcsp]: ./defcsp.md
262 [es2015]: https://ecma-international.org/ecma-262/6.0/
 
263 [fcgi]: /help?cmd=cgi
264 [ffor]: https://fossil-scm.org/forum/
265 [flic]: /doc/trunk/COPYRIGHT-BSD2.txt
266 [fshome]: /doc/trunk/www/server/
 
267 [fsrc]: https://fossil-scm.org/home/file/src
268 [fsrv]: /help?cmd=server
269 [hljs]: https://fossil-scm.org/forum/forumpost/9150bc22ca
 
270 [ns]: https://noscript.net/
271 [pjs]: https://fossil-scm.org/forum/forumpost/1198651c6d
272 [s1]: https://blockmetry.com/blog/javascript-disabled
273 [s2]: https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/
274 [s3]: https://w3techs.com/technologies/overview/client_side_language/all
275 [ubo]: https://github.com/gorhill/uBlock/
276 [v8]: https://en.wikipedia.org/wiki/V8_(JavaScript_engine)
 
277
278
279 ----
280
281 ## <a id="uses"></a>Places Where Fossil’s Web UI Uses JavaScript
@@ -313,12 +317,12 @@
313 [wt]: https://fossil-scm.org/fossil/timeline
314
315
316 ### <a id="wedit"></a>The New Wiki Editor
317
318 As of Fossil 2.12, the [Fossil wiki][fwt] document editor requires
319 JavaScript for a few unavoidable reasons.
320
321 First, it allows in-browser previews without losing client-side editor
322 state, such as where your cursor is. With the old editor, you had to
323 re-locate the place you were last editing on each preview, which would
324 reduce the incentive to use the preview function. In the new wiki
@@ -337,14 +341,10 @@
337 that there is a way for the app to restore its prior state from
338 persistent media when it’s restarted, giving the illusion that it was
339 never shut down in the first place. This feature of Fossil’s new wiki
340 editor provides that.
341
342 There are many other new features in the enhanced Fossil 2.12 wiki
343 editor, but those are the ones that absolutely require JavaScript to
344 work.
345
346 With this change, we lost the old WYSIWYG wiki editor, available since
347 Fossil version 1.24. It hadn’t been maintained for years, it was
348 disabled by default, and no one stepped up to defend its existence when
349 this new editor was created, replacing it. If someone rescues that
350 feature, merging it in with the new editor, it will doubtless require
@@ -358,11 +358,11 @@
358 desire, only because the person who wrote the new wiki editor didn’t
359 want to maintain three different editors. (New Ajaxy editor, old
360 script-free HTML form based editor, and the old WYSIWYG JavaScript-based
361 editor.) If someone wants to implement a `<noscript>` alternative to the
362 new wiki editor, we will likely accept that [contribution][cg] as long
363 as it doensn’t interfere with the new editor. (The same goes for adding
364 a WYSIWYG mode to the new Ajaxy wiki editor.)
365
366 _Workaround:_ You don’t have to use the browser-based wiki editor to
367 maintain your repository’s wiki at all. Fossil’s [`wiki` command][fwc]
368 lets you manipulate wiki documents from the command line. For example,
@@ -425,23 +425,26 @@
425
426 When viewing source files, Fossil offers to show line numbers in some
427 cases. ([Example][mainc].) Toggling them on and off is currently handled
428 in JavaScript, rather than forcing a page-reload via a button click.
429
430 _Workaround:_ Edit the URL to give the “`ln`” query parameter per [the
431 `/file` docs](/help?cmd=/file). Alternately, someone sufficiently
432 interested could [provide a patch][cg] to add a `<noscript>` wrapped
433 HTML button that would reload the page with this parameter
434 included/excluded to implement the toggle via a server round-trip.
 
 
435
436 As of Fossil 2.12, there is also a JavaScript-based interactive method
437 for selecting a range of lines by clicking the line numbers when they’re
438 visible, then copying the resulting URL to share your selection with
439 others.
440
441 _Workaround:_ These interactive features absolutely require JavaScript.
442 The alternative is to manually edit the URL, per above.
 
443
444 [mainc]: https://fossil-scm.org/fossil/artifact?ln&name=87d67e745
445
446
447 ### <a id="sxsdiff"></a>Side-by-Side Diff Mode
@@ -487,12 +490,12 @@
487 similar, hovering over that check-in shows a tooltip with details about
488 the type of artifact the hash refers to and allows you to click to copy
489 the hash to the clipboard.
490
491 _Graceful Fallback:_ When JavaScript is disabled, these tooltips simply
492 don’t appear. You can then select and copy the hash using your browser,
493 make “`fossil info`” queries on those hashes, etc.
494
495
496 ### <a id="bots"></a>Anti-Bot Defenses
497
498 Fossil has [anti-bot defenses][abd], and it has some JavaScript code
@@ -525,29 +528,34 @@
525
526 ### <a id="clock"></a>Clock
527
528 Some stock Fossil skins include JavaScript-based features such as the
529 current time of day. The Xekri skin includes this in its header, for
530 example. A clock feature requires JavaScript not only to get the time
531 and update inline on the page once a minute, but also so it displays *in
532 the local time zone.*
533
534 Since none of this code provides a necessary Fossil feature, the core
535 developers are unlikely to try to make these features work better in the
536 absence of JavaScript.
537
538 However, we are willing to study patches to make this better. For
539 example, the wall clock displays could include the page load time in the
540 dynamically generated HTML shipped from the remote Fossil server, so
541 that in the absence of JavaScript, you at least get the page generation
542 time, expressed in the server’s time zone.
 
 
 
 
 
543
544 ----
545
546 ## <a id="future"></a>Future Plans for JavaScript in Fossil
547
548 As of mid-2020, the informal provisional plan is to increase the Fossil
549 UI's use of JavaScript considerably compared to its historically minimal
550 uses. To that end, a framework of Fossil-centric APIs is being developed
551 in conjunction with new features to consolidate Fossil's historical
552 hodge-podge of JavaScript snippets into a coherent code base.
553
@@ -580,7 +588,7 @@
580 coding even when they really don't want to. 😉
581
582 In all of this, Fossil's project lead understandably has the final
583 say-so in whether any given feature indeed gets merged into the mainline
584 trunk. Development of any given feature, no matter how much effort was
585 involved, does not guaranty its eventual inclusion into the public
586 releases.
587
--- www/javascript.md
+++ www/javascript.md
@@ -120,22 +120,19 @@
120 Fossil attempts to set two cookies on all web clients: a login session
121 cookie and a display preferences cookie. These cookies are restricted to
122 the Fossil instance, so even this limited data cannot leak between
123 Fossil instances or into other web sites.
124
 
 
 
125 5. “**JavaScript is fundamentally insecure.**”
126
127 JavaScript is certainly sometimes used for nefarious ends, but if we
128 wish to have more features in Fossil, the alternative is to add more
129 code to the Fossil binary, [most likely in C][fslpl], a language
130 implicated in [over 4× more security vulnerabilities][whmsl].
131
132 Therefore, does it not make sense to place approximately four times
133 as much trust in Fossil’s JavaScript code as in its C code?
134
135 The question is not whether JavaScript is itself evil, it is whether
136 its *authors* are evil. *Every byte* of JavaScript code used within
137 the Fossil UI is:
138
@@ -207,11 +204,11 @@
204 between these two forces, the number of no-JS purists among Fossil’s
205 user base is still a tiny minority.
206
207 9. <a id="block"></a>“**I block JavaScript entirely in my browser. That breaks Fossil.**”
208
209 First, see our philosophy statements above. Briefly, we intend that
210 there always be some other way to get any given result without using
211 JavaScript, developer interest willing.
212
213 But second, it doesn’t have to be all-or-nothing. We recommend that
214 those interested in blocking problematic uses of JavaScript use
@@ -224,20 +221,20 @@
221 exclude other tools.
222
223 The primary difference between these two for our purposes is that
224 NoScript lets you select scripts to run on a page on a case-by-case
225 basis, whereas uBlock Origin delegates those choices to a group of
226 motivated volunteers who maintain allow/block lists to control all
227 of this; you can then override UBO’s stock rules as needed.
228
229
230 10. “**My browser doesn’t even *have* a JavaScript interpreter.**”
231
232 The Fossil open source project has no full-time developers, and only
233 a few of these part-timers are responsible for the bulk of the code
234 in Fossil. If you want Fossil to support such niche use cases, then
235 you will have to [get involved with its development][cg]: it’s
236 *your* uncommon itch.
237
238 11. <a id="compat"></a>“**Fossil’s JavaScript code isn’t compatible with my browser.**”
239
240 The Fossil project’s developers aim to remain compatible with
@@ -250,32 +247,39 @@
247
248 We set this threshold based on the amount of time it typically takes for
249 new standards to propagate through the installed base.
250
251 As of this writing, this means we are only using features defined in
252 [ECMAScript 2015][es2015], colloquially called “JavaScript 6.” That
253 is a sufficiently rich standard that it more than suffices for our
254 purposes, and it is [widely deployed][es6dep]. The biggest single
255 outlier remaining is MSIE 11, and [even Microsoft is moving their
256 own products off of it][ie11x].
257
258 [2cbsd]: https://fossil-scm.org/home/doc/trunk/COPYRIGHT-BSD2.txt
259 [ciu]: https://caniuse.com/
260 [cskin]: ./customskin.md
261 [dcsp]: ./defcsp.md
262 [es2015]: https://ecma-international.org/ecma-262/6.0/
263 [es6dep]: https://caniuse.com/#feat=es6
264 [fcgi]: /help?cmd=cgi
265 [ffor]: https://fossil-scm.org/forum/
266 [flic]: /doc/trunk/COPYRIGHT-BSD2.txt
267 [fshome]: /doc/trunk/www/server/
268 [fslpl]: /doc/trunk/www/fossil-v-git.wiki#portable
269 [fsrc]: https://fossil-scm.org/home/file/src
270 [fsrv]: /help?cmd=server
271 [hljs]: https://fossil-scm.org/forum/forumpost/9150bc22ca
272 [ie11x]: https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666
273 [ns]: https://noscript.net/
274 [pjs]: https://fossil-scm.org/forum/forumpost/1198651c6d
275 [s1]: https://blockmetry.com/blog/javascript-disabled
276 [s2]: https://gds.blog.gov.uk/2013/10/21/how-many-people-are-missing-out-on-javascript-enhancement/
277 [s3]: https://w3techs.com/technologies/overview/client_side_language/all
278 [ubo]: https://github.com/gorhill/uBlock/
279 [v8]: https://en.wikipedia.org/wiki/V8_(JavaScript_engine)
280 [whmsl]: https://www.whitesourcesoftware.com/most-secure-programming-languages/
281
282
283 ----
284
285 ## <a id="uses"></a>Places Where Fossil’s Web UI Uses JavaScript
@@ -313,12 +317,12 @@
317 [wt]: https://fossil-scm.org/fossil/timeline
318
319
320 ### <a id="wedit"></a>The New Wiki Editor
321
322 The [new wiki editor][fwt] added in Fossil 2.12 has many new features, a
323 few of which are impossible to get without use of JavaScript.
324
325 First, it allows in-browser previews without losing client-side editor
326 state, such as where your cursor is. With the old editor, you had to
327 re-locate the place you were last editing on each preview, which would
328 reduce the incentive to use the preview function. In the new wiki
@@ -337,14 +341,10 @@
341 that there is a way for the app to restore its prior state from
342 persistent media when it’s restarted, giving the illusion that it was
343 never shut down in the first place. This feature of Fossil’s new wiki
344 editor provides that.
345
 
 
 
 
346 With this change, we lost the old WYSIWYG wiki editor, available since
347 Fossil version 1.24. It hadn’t been maintained for years, it was
348 disabled by default, and no one stepped up to defend its existence when
349 this new editor was created, replacing it. If someone rescues that
350 feature, merging it in with the new editor, it will doubtless require
@@ -358,11 +358,11 @@
358 desire, only because the person who wrote the new wiki editor didn’t
359 want to maintain three different editors. (New Ajaxy editor, old
360 script-free HTML form based editor, and the old WYSIWYG JavaScript-based
361 editor.) If someone wants to implement a `<noscript>` alternative to the
362 new wiki editor, we will likely accept that [contribution][cg] as long
363 as it doesn’t interfere with the new editor. (The same goes for adding
364 a WYSIWYG mode to the new Ajaxy wiki editor.)
365
366 _Workaround:_ You don’t have to use the browser-based wiki editor to
367 maintain your repository’s wiki at all. Fossil’s [`wiki` command][fwc]
368 lets you manipulate wiki documents from the command line. For example,
@@ -425,23 +425,26 @@
425
426 When viewing source files, Fossil offers to show line numbers in some
427 cases. ([Example][mainc].) Toggling them on and off is currently handled
428 in JavaScript, rather than forcing a page-reload via a button click.
429
430 _Workaround:_ Manually edit the URL to give the “`ln`” query parameter
431 per [the `/file` docs](/help?cmd=/file).
432
433 _Potential Better Workaround:_ Someone sufficiently interested could
434 [provide a patch][cg] to add a `<noscript>` wrapped HTML button that
435 would reload the page with this parameter included/excluded to implement
436 the toggle via a server round-trip.
437
438 As of Fossil 2.12, there is also a JavaScript-based interactive method
439 for selecting a range of lines by clicking the line numbers when they’re
440 visible, then copying the resulting URL to share your selection with
441 others.
442
443 _Workaround:_ These interactive features would be difficult and
444 expensive (in terms of network I/O) to implement without JavaScript. A
445 far simpler alternative is to manually edit the URL, per above.
446
447 [mainc]: https://fossil-scm.org/fossil/artifact?ln&name=87d67e745
448
449
450 ### <a id="sxsdiff"></a>Side-by-Side Diff Mode
@@ -487,12 +490,12 @@
490 similar, hovering over that check-in shows a tooltip with details about
491 the type of artifact the hash refers to and allows you to click to copy
492 the hash to the clipboard.
493
494 _Graceful Fallback:_ When JavaScript is disabled, these tooltips simply
495 don’t appear, but you can still select and copy the hash using your
496 platform’s “copy selected text” feature.
497
498
499 ### <a id="bots"></a>Anti-Bot Defenses
500
501 Fossil has [anti-bot defenses][abd], and it has some JavaScript code
@@ -525,29 +528,34 @@
528
529 ### <a id="clock"></a>Clock
530
531 Some stock Fossil skins include JavaScript-based features such as the
532 current time of day. The Xekri skin includes this in its header, for
533 example. A clock feature requires JavaScript to get the time on initial
534 page load and then to update it once a minute.
535
536 You may observe that the server could provide the current time when
537 generating the page, but the client and server may not be in the same
538 time zone, and there is no reliably-provided information from the client
539 that would let the server give the page load time in the client’s local
540 time zone. The server could only tell you *its* local time at page
541 request time, not the client’s time. That still wouldn’t be a “clock,”
542 since without client-side JavaScript code running, that part of the page
543 couldn’t update once a second.
544
545 _Potential Graceful Fallback:_ You may consider showing the server’s
546 page generation time rather than the client’s wall clock time in the
547 local time zone to be a useful fallback for the current feature, so [a
548 patch to do this][cg] may well be accepted. Since this is not a
549 *necessary* Fossil feature, an interested user is unlikely to get the
550 core developers to do this work for them.
551
552 ----
553
554 ## <a id="future"></a>Future Plans for JavaScript in Fossil
555
556 As of mid-2020, the informal provisional plan is to increase Fossil
557 UI's use of JavaScript considerably compared to its historically minimal
558 uses. To that end, a framework of Fossil-centric APIs is being developed
559 in conjunction with new features to consolidate Fossil's historical
560 hodge-podge of JavaScript snippets into a coherent code base.
561
@@ -580,7 +588,7 @@
588 coding even when they really don't want to. 😉
589
590 In all of this, Fossil's project lead understandably has the final
591 say-so in whether any given feature indeed gets merged into the mainline
592 trunk. Development of any given feature, no matter how much effort was
593 involved, does not guarantee its eventual inclusion into the public
594 releases.
595

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button