Idea: Loading large code snippets from arbitrary urls

[Nemo157]

First, some context: I'm writing a blog post on which I want to provide playground links for all code snippets. Using gist.github.com for this sort of use case would be very annoying to keep up to date when I change the snippets. I have been successfully using urls with embedded code, but finally hit 414 Request-URI Too Large with this snippet.

My first thought on a way to support this usecase was extending play.rust-lang.org to load code from arbitrary urls instead of only supporting gist.github.com. For example it could take a link like

https://play.rust-lang.org/?version=nightly&edition=2018&file=https%3A%2F%2Fnemo157.com%2Ffoo.rs

and load the specified file client-side.

As far as I can tell there should be no additional security issues with this. The code would just be performing a fetch for the file and loading the content into the text box, any potential attack would be the same as when it's loading from a gist.

I'm willing to implement this, just wanted to get feedback on whether you'd accept this approach/have other ideas on a way to support my usecase before spending time on it.

[shepmaster]

but finally hit 414 Request-URI Too Large with this snippet

Heh, I'm glad my warning actually is valid.

no additional security issues with this

I can't think of anything obvious for the playground's user or the playground itself, but I wonder about the target of the URL. It's potentially an inefficient way of helping launch a DDOS.

[Nemo157]

It's potentially an inefficient way of helping launch a DDOS.

As long as loading the page only attempts to hit the URL once it doesn't seem any worse than someone just linking directly to the target and pretending it's a playground link.

[shepmaster]

Some discussion has brought up CORS / Same-Origin concerns; do you happen to know if loading an arbitrary page / your specific page via fetch would hit any issues there? Feels like it.

[Stargateur]

Using gist.github.com for this sort of use case would be very annoying to keep up to date when I change the snippets.

@Nemo157 You can't edit the gist ? What would be the difference with an arbitrary url ? That doesn't solve your initial problem.

[Nemo157]

@Stargateur My playground snippets are already part of my blog repo, including automated testing. Pushing the changes to them into gists (6 individual gists for this one post) would be a real pain.

[Nemo157]

@shepmaster that’s just a concern for the server hosting the file rather than the playground, they need to send allow origin headers back (now that I think about it I’m not sure what github pages does, I’ll check whether it will actually work with them as a host).

[Nemo157]

Looks like using it with github pages should be fine:

> curl -sI https://rust-lang-nursery.github.io/futures-rs/ | grep -i access-control
access-control-allow-origin: *