Google Closure Library

repository·master·Indexed 26 days ago

https://github.com/google/closure-library

A collection of JavaScript utilities and components. The library includes the google-closure-deps package for managing dependency graphs and parsing Closure files (including ES6 modules), as well as CLI tools like closure-make-deps and get-js-version. It provides APIs for IndexedDB lookups (goog.db.Index), filesystem operations (goog.fs.Entry), and Node.js bootstrapping. Note: This project has been archived and is no longer actively maintained for modern JavaScript development.

Tokens: 5.8K
Snippets: 14
Records: 43
Agent score: 89%

What's inside google-closure-library

Avoid global declarations and loose types
master
To prevent global scope pollution, global functions and var declarations are not allowed. Use goog.provide or goog.module for top-level namespaces. Additionally, use loose types like ? (unknown), * (all), Object, and Function sparingly to maintain type safety. Using ? as a this type is strictly forbidden.
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Install google-closure-deps
master
Install the google-closure-deps package via npm. To use the command line interface (CLI) tools from any directory, install the package globally.
https://github.com/google/closure-library/blob/master/closure-deps/README.md
Set up an HTML file for uncompiled development
master
To run your application in a development environment using the Closure debug loader, your HTML file must follow this loading order:
1. Load base.js from the Closure library (defines goog.require).
2. Load your generated deps.js (provides dependency mapping).
3. Call goog.require('your_module_name') to trigger the evaluation of your code.
```
<!DOCTYPE html>
<meta charset="UTF-8">
<script src="node_modules/google-closure-library/closure/goog/base.js"></script>
<script src="deps.js"></script>
<div>Content to be rendered below</div>
<script>
  goog.require('hello');
</script>
```
https://github.com/google/closure-library/blob/master/doc/develop/get-started.md
Generate a deps.js file using closure-make-deps
master
Use the closure-make-deps tool to create a deps.js file. This file maps the dependency tree for uncompiled code, allowing the Closure debug loader to find necessary files.
When running the command:
- Use -f <file> to include your source files.
- Include the Closure library's own deps.js file to help the tool resolve namespaces like goog.dom.
- Use --closure-path to point to the library's goog directory.
- For larger projects, consider using --root to include directories and --exclude to skip node_modules/.
```
$(npm bin)/closure-make-deps \
  -f hello.js \
  -f node_modules/google-closure-library/closure/goog/deps.js \
  --closure-path node_modules/google-closure-library/closure/goog \
  > deps.js
```
https://github.com/google/closure-library/blob/master/doc/develop/get-started.md
Avoid setting Script element content
master
Setting the content of a <script> element and then appending it to the document is disallowed because it is functionally equivalent to eval() and prone to XSS.
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Use safe wrappers for innerHTML and outerHTML
master
Direct assignment of non-constant values to innerHTML or outerHTML is banned to prevent XSS. Use the goog.dom.safe.setInnerHtml wrapper instead. Note that reading these properties is permitted.
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Throw only Error objects
master
To ensure stack traces are available for debugging, do not throw strings or plain objects. Always throw an instance of Error or pass the object to the Error constructor.
```
// Bad
throw 'message';
throw myObject;

// Good
throw new Error('message');
throw new Error(myObject);
```
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Use safe wrappers for Document.prototype.write
master
Direct calls to Document.prototype.write are banned due to XSS risks and performance issues. If you must write to a new window (like a popup or iframe), use the goog.dom.safe.documentWrite wrapper or render a Strict Soy template using goog.soy.Renderer.prototype.renderElement.
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Compile your application with Closure Compiler
master
For production, use google-closure-compiler to create a single-file, optimized bundle. This process performs type checking, dead code removal, and identifier shortening.
1. Install the compiler: npm install --save-dev google-closure-compiler.
2. Run the compiler with the following flags:
  --js: Your source file.
  --js: The Closure library source files (e.g., node_modules/google-closure-library/**/*.js).
  --dependency_mode=PRUNE: Tells the compiler to only include dependencies required by the entry point.
  --entry_point=goog:<module_name>: The namespace of your entry point.
  --js_output_file: The name of the resulting bundle.
3. In your production HTML, replace the base.js and deps.js scripts with a single <script> tag pointing to your compiled file.
```
# 1. Install
npm install --save-dev google-closure-compiler

# 2. Compile
$(npm bin)/google-closure-compiler \
  --js hello.js \
  --js node_modules/google-closure-library/**/*.js \
  --dependency_mode=PRUNE \
  --entry_point=goog:hello \
  --js_output_file hello_compiled.js
```
https://github.com/google/closure-library/blob/master/doc/develop/get-started.md
Create typed elements using goog.dom
master
To ensure conformance rules can correctly identify dangerous properties (like script.src), avoid using document.createElement('script') which returns a generic Element. Instead, use goog.dom.createElement or goog.dom.createDom with goog.dom.TagName to ensure the returned type is specific (e.g., HTMLScriptElement).
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Use TrustedResourceUrl for sensitive URL properties
master
To prevent loading code from untrusted domains, do not assign non-constant strings to properties like Base.href or Script.src. Use safe wrapper functions that require a TrustedResourceUrl, such as goog.dom.safe.setScriptSrc.
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md
Use safe wrappers for Location.href and Window.location
master
Direct assignment to Location.prototype.href or Window.prototype.location is banned. Use goog.dom.safe.setLocationHref. If you pass a string, it is sanitized; if you pass a goog.html.SafeUrl, it is assigned without further sanitization. Note that reading these properties is permitted.
https://github.com/google/closure-library/blob/master/doc/develop/conformance_rules.md