You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Usage of title via prop drilling not detected #467
This seems to be the case when prop drilling title into a component, unsure if because this specific scenario is overriding the type prop or something else.
Agreed, maybe another approach could be to throw warning on usage of title directly in Primer components? We'd still have problems detecting prop drilling for regular JSX elements, but it could give another layer of security.
@kendallgassner, In this example yeah! I think that the title prop should be removed from IconProps. I'm not entirely sure why it's present here, as it seems to be adding the native title attribute to the Button which doesn't seem correct.. This is what I'm thinking it looks like when rendered:
In this particular case I think cleaning up the Props and removing title: string was the right move! Even though title is still available in the React.HTMLAttributes<HTMLButtonElement> prop object I believe teams will feel less inclined to use it since it is no longer brought to their attention.
@andrefcdias do you feel like removing the hardcoded prop from the SectionHeader was enough? Or could you add a warning to the SectionHeader component since it is not a Primer component?
That and the awareness raised within my team should be more than enough because we own the component in question and the shared component that uses it. My original concern was more about this scenario being a possibility, which can go under the radar as it is not direct title usage.
I also like the idea of either omitting title from Primer components or adding warnings for the usage of it, to detect these harder to lint scenarios, but understand that this could impact the Developer Experience negatively.
We have some Primer components that use the prop name title; but the title prop in these components does not get used as a semantic title attribute in the rendered HTML element. It be nice to avoid using this prop name but I don't think we are likely to change these props name since it might require a major version bump?
We have some Primer components that use the prop name title; but the title prop in these components does not get used as a semantic title attribute in the rendered HTML element.
FYI, I've also seen this happen in some of the shared components
Definitely agree, I think it'd be beneficial for us to steer away from using HTML attributes as prop names when there's no direct connection. This would involve a breaking change for most components that currently do this, but I'd like to get the idea out there.
I also like the idea of either omitting title from Primer components or adding warnings for the usage of it, to detect these harder to lint scenarios, but understand that this could impact the Developer Experience negatively.
We could have a lint rule specific to Primer components in eslint-plugin-primer-react that warns users against using title. This would only be a temporary stopgap until we change the existing props that utilize HTML attributes for their names. I think the title usage in SectionHeader would still be an issue, as I don't believe we'd be able to determine usage via props passed with spread.
@kendallgassner, I forget if this was discussed already. Do you think this should be something eslint-plugin-primer-react should handle? The only difference from the rule in eslint-plugin-github is that it would now apply to Primer components, but other than that it would be the same. I'm thinking this could work, but might also be redundant.
eslint-plugin-github could only test against semantic HTML components because we didn't want to flag react components that might use the title attribute differently.
If we add the lint rule in eslint-plugin-primer-react we could expand are testing to not only flag semantic components but to also check against the primer specific components -- since we have more control of these components.
Thinking 🤔 though we would need to account for the as prop.
If we did test Primer specific components, would we want to ignore as usage and still throw a violation regardless of what value it might have? I'm wondering, are there cases where title might be appropriate outside of iframe?
Definitely agree, I think it'd be beneficial for us to steer away from using HTML attributes as prop names when there's no direct connection. This would involve a breaking change for most components that currently do this, but I'd like to get the idea out there.
Revisiting this discussion... @TylerJDev I 100% agree and would fully support this!
Is there a tracking issue or discussion I could reference? :)
Activity
kendallgassner commentedon Jul 20, 2023
This could be challenging because the
jst-ast-utilfunction we use to grab thetitleattribute only checks the direct keys.theerebuss commentedon Jul 21, 2023
Agreed, maybe another approach could be to throw warning on usage of
titledirectly in Primer components? We'd still have problems detecting prop drilling for regular JSX elements, but it could give another layer of security.kendallgassner commentedon Jul 21, 2023
cc. @TylerJDev I wonder if we can just omit the title props from this Primer component?
TylerJDev commentedon Jul 27, 2023
@kendallgassner, In this example yeah! I think that the title prop should be removed from
IconProps. I'm not entirely sure why it's present here, as it seems to be adding the nativetitleattribute to theButtonwhich doesn't seem correct.. This is what I'm thinking it looks like when rendered:We'd definitely want to remove it in this instance. I don't think this is tied to Primer though. I'm wondering, is this a shared component?
theerebuss commentedon Jul 27, 2023
This particular instance was already fixed in https://github.com/github/github/pull/281501 ✅
SectionHeaderis just a shared component used for the metadata sections.kendallgassner commentedon Jul 27, 2023
In this particular case I think cleaning up the Props and removing
title: stringwas the right move! Even thoughtitleis still available in theReact.HTMLAttributes<HTMLButtonElement>prop object I believe teams will feel less inclined to use it since it is no longer brought to their attention.@andrefcdias do you feel like removing the hardcoded prop from the
SectionHeaderwas enough? Or could you add a warning to theSectionHeadercomponent since it is not a Primer component?theerebuss commentedon Jul 28, 2023
That and the awareness raised within my team should be more than enough because we own the component in question and the shared component that uses it. My original concern was more about this scenario being a possibility, which can go under the radar as it is not direct
titleusage.I also like the idea of either omitting
titlefrom Primer components or adding warnings for the usage of it, to detect these harder to lint scenarios, but understand that this could impact the Developer Experience negatively.kendallgassner commentedon Jul 28, 2023
@TylerJDev thoughts here?
We have some Primer components that use the prop name
title; but thetitleprop in these components does not get used as a semantic title attribute in the rendered HTML element. It be nice to avoid using this prop name but I don't think we are likely to change these props name since it might require amajorversion bump?theerebuss commentedon Jul 31, 2023
FYI, I've also seen this happen in some of the shared components
TylerJDev commentedon Jul 31, 2023
Definitely agree, I think it'd be beneficial for us to steer away from using HTML attributes as prop names when there's no direct connection. This would involve a breaking change for most components that currently do this, but I'd like to get the idea out there.
We could have a lint rule specific to Primer components in
eslint-plugin-primer-reactthat warns users against usingtitle. This would only be a temporary stopgap until we change the existing props that utilize HTML attributes for their names. I think the title usage inSectionHeaderwould still be an issue, as I don't believe we'd be able to determine usage via props passed with spread.@kendallgassner, I forget if this was discussed already. Do you think this should be something
eslint-plugin-primer-reactshould handle? The only difference from the rule ineslint-plugin-githubis that it would now apply to Primer components, but other than that it would be the same. I'm thinking this could work, but might also be redundant.kendallgassner commentedon Jul 31, 2023
eslint-plugin-githubcould only test against semantic HTML components because we didn't want to flag react components that might use thetitleattribute differently.If we add the lint rule in
eslint-plugin-primer-reactwe could expand are testing to not only flag semantic components but to also check against the primer specific components -- since we have more control of these components.Thinking 🤔 though we would need to account for the
asprop.TylerJDev commentedon Aug 1, 2023
If we did test Primer specific components, would we want to ignore
asusage and still throw a violation regardless of what value it might have? I'm wondering, are there cases wheretitlemight be appropriate outside ofiframe?kendallgassner commentedon Aug 8, 2023
And I can't think of a case where we would want a Primer component with
as=iframeexcept maybeBox.khiga8 commentedon Mar 6, 2024
Revisiting this discussion... @TylerJDev I 100% agree and would fully support this!
Is there a tracking issue or discussion I could reference? :)
byt3n33dl3 commentedon Oct 14, 2024
Agreed, maybe another approach 🧛🏻