Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

core: remove uses of deprecated extendedInfo field #10779

Merged
merged 12 commits into from
Jun 29, 2020
Merged

Conversation

Beytoven
Copy link
Contributor

@Beytoven Beytoven commented May 14, 2020

This PR removes the remaining usage of 'extendedInfo' which has been deprecated for a while. For each of the audits, extendedInfo was moved into debugData if it hasn't been replicated in the audit details already.

Closes #10567

@Beytoven Beytoven requested a review from a team as a code owner May 14, 2020 01:09
@Beytoven Beytoven requested review from paulirish and removed request for a team May 14, 2020 01:09
Copy link
Member

@paulirish paulirish left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice stuff @Beytoven

i went through each use and verified that the data is either already in details or its worthwhile to expose in debugdata.

there's a few i'm not sure about so I left comments for folks to chime in on.

@@ -74,7 +74,9 @@ class InteractiveMetric extends Audit {
const timeInMs = metricResult.timing;
const isDesktop = artifacts.TestedAsMobileDevice === false;
const options = isDesktop ? context.options.desktop : context.options.mobile;
const extendedInfo = {
/** @type {LH.Audit.Details.DebugData} */
const debugData = {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we still need this? cc @patrickhulce

in samplejson it ends up with just timeinMs and timestamp which are both already in 'metrics' audit.

not sure if we want the optimisitic/pessimistic data tho.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, let's dump it! ✂️

/** @type {LH.Audit.Details.DebugData} */
const debugData = {
type: 'debugdata',
queryStringCount,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

do we still want this? original context: #3531 (comment)

cc @brendankenny @patrickhulce

given that it hasnt come up since then i'm prone to exclude it

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 to dropping

/** @type {LH.Audit.Details.DebugData} */
const debugData = {
type: 'debugdata',
totalCompletedRequests,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

original context: #2697

we added the network-requests audit since then so we don't need this any longer.

const debugData = {
type: 'debugdata',
jsLibs: libraryVulns,
vulnerabilityResults,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we don't need vulnerabilityResults here because its already in details.

/** @type {LH.Audit.Details.DebugData} */
const debugData = {
type: 'debugdata',
jsLibs: libraryVulns,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

from looking at the samplejson here's my understanding:

libraryVulns currently has all js-libs detects and there's an array of vulns attached to each. that array may be empty.

just enumerating all js-libs isn't neccessary cuz we now have the js-libraries audit which does the same.

but the results of this audit reduces 4 diff vulns into one entry, so (aside from this debugdata) we don't expose the 4 vulns individually.

        "debugData": {
          "type": "debugdata",
          "jsLibs": [
            {
              "name": "jQuery",
              "npmPkgName": "jquery",
              "version": "2.1.1",
              "vulns": [
                {
                  "severity": "Medium",
                  "numericSeverity": 2,
                  "library": "jQuery@2.1.1",
                  "url": "https://snyk.io/vuln/SNYK-JS-JQUERY-567880"
                },
                {
                  "severity": "Medium",
                  "numericSeverity": 2,
                  "library": "jQuery@2.1.1",
                  "url": "https://snyk.io/vuln/SNYK-JS-JQUERY-565129"
                },
                {
                  "severity": "Medium",
                  "numericSeverity": 2,
                  "library": "jQuery@2.1.1",
                  "url": "https://snyk.io/vuln/SNYK-JS-JQUERY-174006"
                },
                {
                  "severity": "Medium",
                  "numericSeverity": 2,
                  "library": "jQuery@2.1.1",
                  "url": "https://snyk.io/vuln/npm:jquery:20150627"
                }
              ],
              "highestSeverity": "Medium"
            },
            {
              "name": "jQuery (Fast path)",
              "npmPkgName": "jquery",
              "version": "",
              "vulns": []
            },
            {
              "name": "WordPress",
              "version": "",
              "vulns": []
            }
          ],

it seems reasonable that we keep exposing these vulns individually.

but i think we should do libraryVulns.filter(lib => lib.vulns.length)

and instead of jsLibs let's call it vulnerableLibs

beyond that I think this data structure works. (as opposed to not grouping vulns by their lib)

@@ -103,9 +103,6 @@ class AxeAudit extends Audit {

return {
score: Number(rule === undefined),
extendedInfo: {
value: rule,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we don't expose the full axe rule output otherwise.

but i think that's okay

here's a full "rule":

image

we'd miss out on their description & title and url.
and for each node we'd miss out on its specific impact and failureSummary

i think this is ok.

somewhat related: failureSummary tbh looks useful for our regular output. requires a bit more investigation.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should I add a note or TODO here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

and for each node we'd miss out on its specific impact and failureSummary

failureSummary becomes each node's explanation in the axe audit tables, e.g.

"node": {
"type": "node",
"selector": "h2",
"path": "3,HTML,1,BODY,5,DIV,0,H2",
"snippet": "<h2>Do better web tester page</h2>",
"explanation": "Fix any of the following:\n Element has insufficient color contrast of 1.32 (foreground color: #ffc0cb, background color: #eeeeee, font size: 18.0pt, font weight: bold). Expected contrast ratio of 3:1",
"nodeLabel": "Do better web tester page"
}

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(after #5402 asked us to put stuff back)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should I add a TODO or something to remind us to come back to this?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should I add a TODO or something to remind us to come back to this?

we've been happy with the current output since #5402, so how about let's leave as it is here and re-visit if someone asks for more or we have ideas for future reporting that needs more.

/** @type {string|undefined} */
let displayValue;
if (userTimings.length) {
debugData = {
type: 'debugdata',
userTimings,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looked at this one. i dont think there's any useful data in the raw userTimings obj that we want.

image

we can drop it.

lighthouse-core/audits/legacy-javascript.js Show resolved Hide resolved
Copy link
Collaborator

@patrickhulce patrickhulce left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From my perspective everything that's currently in extendedInfo can be dropped safely because everything is guaranteed to not be used by the external world, so there should be a good reason for reintroducing.

I know I had like a 3 month period where I forgot about this fact during reviews, so sorry to anyone I asked to put something into extendedInfo 😂

I'm not sure there's much

/** @type {LH.Audit.Details.DebugData} */
const debugData = {
type: 'debugdata',
queryStringCount,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 to dropping

@@ -74,7 +74,9 @@ class InteractiveMetric extends Audit {
const timeInMs = metricResult.timing;
const isDesktop = artifacts.TestedAsMobileDevice === false;
const options = isDesktop ? context.options.desktop : context.options.mobile;
const extendedInfo = {
/** @type {LH.Audit.Details.DebugData} */
const debugData = {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, let's dump it! ✂️

@brendankenny
Copy link
Member

From my perspective everything that's currently in extendedInfo can be dropped safely because everything is guaranteed to not be used by the external world, so there should be a good reason for reintroducing.

💯

I don't think we've ever deleted something from debugData, so let's only add stuff there when someone needs it for something. Given that no one's been missing these extendedInfos this whole time, I think we can default to ✂️ ✂️ for all of these

}
],
"highestSeverity": "Medium"
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even filtered this still seems mostly redundant. I guess you get to see the different severities per vulnerability, but the majority in our snyk db are medium anyways. Do we want just ['https://snyk.io/vuln/SNYK-JS-JQUERY-567880', 'https://snyk.io/vuln/SNYK-JS-JQUERY-565129', 'https://snyk.io/vuln/SNYK-JS-JQUERY-174006', 'https://snyk.io/vuln/npm:jquery:20150627'] out of this, which captures almost all of the unique additional data? The link we currently provide (https://snyk.io/vuln/npm:jquery?lh=2.1.1) does already have all that for interested parties...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@paulirish Thoughts?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there are two cases for use here:

a human or script looking at an individual LHR

  • most of the time you just want to know what you're using that's vulnerable and that you should upgrade
  • if you want to dig in, everything you'd want is already at the URL we provide for each library found (that page links off to all the vulnerabilities individually, severities, CVEs, etc)
  • if a tool really want to show all that detail in their own UI, snyk has both an API and local databases for library@version -> vulnerabilities :)

otoh, if one were to do an HTTP Archive query about vulnerable libraries, I'd imagine the things you'd want out of the LHR are, in decreasing order of likelihood of interest:

  • the vulnerable version of the library found in a page
  • the highest vulnerability level found (e.g. select results only from the pages with a High severity vulnerability)
  • the number of vulnerabilities found for that library

I can't imagine any circumstance in which you'd want the set of all vulnerability levels found for that library (['Medium', 'Medium', 'Medium', 'Medium']), for instance. What would you do with that?

I think this is another case of YAGNI. Regardless of possible scenarios, in practice no one has missed this extra info since extendedInfo went away, so let's add it back if and when someone has a real need for it. That also nicely avoids having to come up with which properties to keep and which to ditch and what shape object should they be put in, etc :)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds good. let's drop.

@@ -103,9 +103,6 @@ class AxeAudit extends Audit {

return {
score: Number(rule === undefined),
extendedInfo: {
value: rule,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should I add a TODO or something to remind us to come back to this?

we've been happy with the current output since #5402, so how about let's leave as it is here and re-visit if someone asks for more or we have ideas for future reporting that needs more.

@@ -41,28 +36,4 @@ describe('Performance: user-timings audit', () => {
assert.equal(auditResult.details.items[1].duration, undefined);
});
});

it('doesn\'t throw when user_timing events have a colon', () => {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it seems like this was maybe a regression test added at some point. Any reason to delete instead of switching over to checking items? (looks like the same name filter should work)

lighthouse-core/test/audits/user-timing-test.js Outdated Show resolved Hide resolved
}
],
"highestSeverity": "Medium"
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think there are two cases for use here:

a human or script looking at an individual LHR

  • most of the time you just want to know what you're using that's vulnerable and that you should upgrade
  • if you want to dig in, everything you'd want is already at the URL we provide for each library found (that page links off to all the vulnerabilities individually, severities, CVEs, etc)
  • if a tool really want to show all that detail in their own UI, snyk has both an API and local databases for library@version -> vulnerabilities :)

otoh, if one were to do an HTTP Archive query about vulnerable libraries, I'd imagine the things you'd want out of the LHR are, in decreasing order of likelihood of interest:

  • the vulnerable version of the library found in a page
  • the highest vulnerability level found (e.g. select results only from the pages with a High severity vulnerability)
  • the number of vulnerabilities found for that library

I can't imagine any circumstance in which you'd want the set of all vulnerability levels found for that library (['Medium', 'Medium', 'Medium', 'Medium']), for instance. What would you do with that?

I think this is another case of YAGNI. Regardless of possible scenarios, in practice no one has missed this extra info since extendedInfo went away, so let's add it back if and when someone has a real need for it. That also nicely avoids having to come up with which properties to keep and which to ditch and what shape object should they be put in, etc :)

@@ -226,15 +226,15 @@ class NoVulnerableLibrariesAudit extends Audit {
{key: 'highestSeverity', itemType: 'text', text: str_(UIStrings.columnSeverity)},
];
const details = Audit.makeTableDetails(headings, vulnerabilityResults, {});

/** @type {LH.Audit.Details.DebugData} */
const debugData = {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as discussed, let's drop.

}
],
"highestSeverity": "Medium"
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sounds good. let's drop.

Copy link
Member

@paulirish paulirish left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so we'll drop the vuln stuff.

got two conflicts to resolve, but they're both straightforward.

aside from that, we're LGTM

@@ -37,7 +37,7 @@ describe('Avoids front-end JavaScript libraries with known vulnerabilities', ()
});
assert.equal(auditResult.score, 0);
assert.equal(auditResult.details.items.length, 1);
assert.equal(auditResult.extendedInfo.jsLibs.length, 3);
assert.equal(auditResult.details.debugData.vulnerableLibs.length, 1);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(drop this and L93)

@paulirish paulirish assigned Beytoven and unassigned paulirish Jun 24, 2020
@Beytoven Beytoven merged commit 6159218 into master Jun 29, 2020
@Beytoven Beytoven deleted the remove-extended-info branch June 29, 2020 19:57
@brendankenny
Copy link
Member

So long extendedInfo 👋 👋

Added way back in #301 for audit results in the report, though the first use was in a commit predating the Lighthouse repo itself (d2545b0), back in the bigrig times.

@paullewis
Copy link
Contributor

@brendankenny Good times! sniff

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Remove unused extendedInfo field from audits
8 participants