logue / vue-codemirror6

⌨️ @codemirror 6 component for @vuejs. Vue2 & Vue3 both supported.
https://logue.dev/vue-codemirror6/
MIT License
123 stars 16 forks source link

Possible Regression/Compromise in 1.2.x? #29

Closed BusterNeece closed 4 months ago

BusterNeece commented 5 months ago

Hello!

I use this library in my web application, which is distributed to users and self-hosted by them.

On a development environment, I've encountered no problems with the library, including with the latest version (1.2.3). In production, however, I am able to reliably reproduce an infinite loop that crashes any browser. We were previously on the last 1.1.x version, so it's possible that this issue was introduced in the 1.2.x version series.

I'm also somewhat concerned that there are no tagged releases here on GitHub for the 1.2.x version series, though there are corresponding commits. I'm also experiencing somewhat of a strange issue on the project's homepage, where every two or three refreshes the entire code section disappears from view. Together, this has me worried that the project has been compromised in some way.

I can try to produce logs, but documenting and logging infinite loop crashes is notoriously hard to do with client-side JavaScript, but I'll do my best. Just wanted to make the maintainers here aware of the issue.

logue commented 5 months ago

When I checked, the problem occurred with Vue 3.4 series.

As a temporary workaround, try downgrading Vue to 3.3 or updating vue-codemirror6 to 1.1.x.

logue commented 4 months ago

Fixed in current version

BusterNeece commented 4 months ago

@logue Thank you! Sorry for the ticket suggesting there may have been a compromise; I saw a release on NPM that I didn't see a corresponding release for here, and the error looked a lot like it was using excessive CPU, which might've been suspicious.