[GitHub] [wicket] svenmeier commented on issue #378: WICKET-6688 add RFC support (to avoid unsafe eval)

[GitBox]

svenmeier commented on issue #378: WICKET-6688 add RFC support (to avoid unsafe 
eval)
URL: https://github.com/apache/wicket/pull/378#issuecomment-526554217
 
 
   Thanks Andrew!
   
   Actually the header items performance isn't so bad if we compare it to 
eval():
   ```
   window.myNameSpace = {};
       window.myNameSpace.doSomething = function (){
         document.getElementById("myTestContainer").innerHTML = Date.now();
       };
   
       var cycles = 10000;
       var withDomStart = Date.now();
       for(var i = 0; i < cycles; i++) {
         var myScript = document.createElement("script");
         myScript.id = "myScr"+i;
         myScript.innerHTML = 'window.myNameSpace.doSomething(); 
document.getElementById("'+myScript.id+'").remove();';
         myScript.nonce = "4AEemGb0xJptoIGFP3Nd";
         document.head.appendChild(myScript);
       }
       var withDomTime = Date.now() - withDomStart;
       console.log("Execute with dom total, ms", withDomTime);
       console.log("Execute with dom average, ms", withDomTime/cycles);
   
       var withoutDomStart = Date.now();
       for(var i = 0; i < cycles; i++) {
         window.eval("window.myNameSpace.doSomething();");
       }
       var withoutDomTime = Date.now() - withoutDomStart;
       console.log("Execute without dom total, ms", withoutDomTime);
       console.log("Execute without dom average, ms", withoutDomTime/cycles);
       
       var withoutEvalStart = Date.now();
       for(var i = 0; i < cycles; i++) {
         window.myNameSpace.doSomething();
       }
       var withoutEvalTime = Date.now() - withoutEvalStart;
       console.log("Execute without eval total, ms", withoutEvalTime);
       console.log("Execute without eval average, ms", withoutEvalTime/cycles);
   ```
   The output:
   ```
   Execute with dom total, ms 2102
   Execute with dom average, ms 0.2102
   Execute without dom total, ms 1176
   Execute without dom average, ms 0.1176
   Execute without eval total, ms 49
   Execute without eval average, ms
   ```

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org


With regards,
Apache Git Services