Skip to content

fix(build): remove obfuscated-looking code rejected by the Chrome Web Store - #575

Merged
sebastienfontaine merged 1 commit into
masterfrom
fix/replace-vuedraggable
Oct 17, 2026
Merged

sebastienfontaine merged 1 commit into
masterfrom
fix/replace-vuedraggable

Conversation

@sebastienfontaine

Copy link
Copy Markdown
Contributor

Problem

The 1.1.8 submission was rejected by the Chrome Web Store for obfuscated code ("Red Titanium", code readability requirements). Flagged snippet, in assets/options.html-*.js:

u = `>`, d = `<`, f = `prototype`, p = `script`, m = l(`IE_PROTO`), h = function() {}, g = function(e) { return d + p + u + e + d + `/` + p + u

This is core-js (Internet Explorer polyfills), shipped pre-bundled inside vuedraggable's dist files and minified by our build. vuedraggable 4.1.0 is unmaintained (last published 2023). We use it in one place: drag and drop to reorder rules.

Fix

  • Replace vuedraggable with vue-draggable-plus 0.6.1: maintained (2026), ESM, same SortableJS engine, no core-js. In TableRules.vue the rows are a plain v-for instead of the #item slot; onDragEnd is unchanged.
  • Stop minifying the build (build.minify: false): minification is allowed by the store, but this rejection shows reviewers may read minified code as obfuscated. The package now ships readable code with real names. JS goes from 333 KB to 629 KB, but the zip is smaller than 1.1.8 (297 KB vs 323 KB) since core-js is gone.

Checks

  • No IE_PROTO / core-js left in dist/. Scan for eval, new Function, document.write, atob: none (one String.fromCharCode in FileSaver's export, adding a BOM: readable and legitimate).
  • Real browser (Playwright, built extension): drag a rule to a new position → order updated and persisted after reload, no page error.
  • 258 tests, ESLint, Prettier, vue-tsc and build pass; npm audit: 0 vulnerabilities.

… Store

The 1.1.8 submission was rejected for obfuscated code: the flagged snippet
is core-js (IE polyfills) bundled inside vuedraggable, which is
unmaintained. Replace it with vue-draggable-plus (maintained, ESM, no
core-js) for the rules drag and drop, and stop minifying the build so
reviewers get readable code.
@github-actions

Copy link
Copy Markdown

📦 Extension Build Ready!

Version: 1.1.8

📥 Download Extension (tabee.zip)

Installation

  1. Download and extract the zip file
  2. Open Chrome → chrome://extensions/
  3. Enable "Developer mode" (top right)
  4. Click "Load unpacked" → Select the extracted folder

Status

  • ✅ All tests passed
  • ✅ Build successful
  • ✅ Ready for testing

🤖 Auto-generated by GitHub Actions

@github-actions

Copy link
Copy Markdown

Coverage Report

Status Category Percentage Covered / Total
🔵 Lines 59.24% 692 / 1168
🔵 Statements 59.55% 729 / 1224
🔵 Functions 66.35% 142 / 214
🔵 Branches 54.75% 351 / 641
File CoverageNo changed files found.
Generated in workflow #482 for commit 2b62411 by the Vitest Coverage Report Action

@sebastienfontaine
sebastienfontaine merged commit 37facba into master Oct 17, 2026
7 checks passed
@sebastienfontaine
sebastienfontaine deleted the fix/replace-vuedraggable branch October 17, 2026 10:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant