[whatwg] Seeking clarification on sandboxed iframes and plugins (Flash, etc.)

2014-12-02 Thread James M. Greene
I have recently begun receiving issue reports about my JavaScript library, ZeroClipboard, not working in some common developer websites such as JSFiddle, CodePen, etc. The common thread here is that the problematic sites all host their snippets within sandboxed iframes... but ZeroClipboard relies

Re: [whatwg] Seeking clarification on sandboxed iframes and plugins (Flash, etc.)

2014-12-02 Thread James M. Greene
and implemented more widely. Sincerely, James Greene On Tue, Dec 2, 2014 at 9:49 AM, Boris Zbarsky bzbar...@mit.edu wrote: On 12/2/14, 7:46 AM, James M. Greene wrote: 1. Is there any existing way or guidance for browser vendors on how to confirm that a plugin can be secured and thus allowed

Re: [whatwg] Seeking clarification on sandboxed iframes and plugins (Flash, etc.)

2014-12-02 Thread James M. Greene
/etc., eh? :) Sincerely, James Greene On Tue, Dec 2, 2014 at 11:04 AM, Boris Zbarsky bzbar...@mit.edu wrote: On 12/2/14, 8:01 AM, James M. Greene wrote: So, it sounds like sandboxed iframes will probably /never/ support plugin instantiation -- even if such a plugin were hosted

Re: [whatwg] Confusion about node1.replace(node2)

2015-01-10 Thread James M. Greene
I have to agree with Glen on this one. Using `node1.replace(node2);` makes me expect that `node1` will be replacing by `node2`. jQuery is famous (and sometimes infamous, depending on who you talk to) for its API brevity and yet we still chose longer names[1] for these scenarios: `replaceWith` and

Re: [whatwg] Clarification for window.opener.location.href

2015-01-06 Thread James M. Greene
Yes, if we do it with window.open(), then it's possible to set opener to null. However, if you click on a link with target=_blank, window.opener is set as well. Not if you use rel=nofollow, per spec. The spec doesn't mention that `rel=nofollow` should null out `window.opener`. That

Re: [whatwg] Unicode - ASCII copy/paste fallback

2015-02-13 Thread James M. Greene
In this case, you can use Unicode escape values by preceding them with a slash: .rarr:after { content: \2192; } This is specified in the CSS 2.1 spec: http://www.w3.org/TR/CSS2/syndata.html#characters Personally, I probably would've just started on StackOverflow with this question (e.g. [1])

Re: [whatwg] Unicode - ASCII copy/paste fallback

2015-02-13 Thread James M. Greene
Sorry, David Mathias. Hasty 6:00am reply here before my brain and eyes fully woke up! Interesting question. Personally, I would expect and desire the CSS-generated content to be copied. Sincerely, James M. Greene On Feb 13, 2015 6:24 AM, David Sheets kosmo...@gmail.com wrote: On Fri, Feb

Re: [whatwg] Unicode - ASCII copy/paste fallback

2015-02-13 Thread James M. Greene
To expand on my own comment: Personally, I would expect and desire the CSS-generated content to be copied. ...because THAT is what the user sees, per the browser rendering. I'm surprised that neither Firefox nor Chrome exhibits that behavior. Sincerely, James M. Greene On Feb 13, 2015 6:30

Re: [whatwg] Supporting feature tests of untestable features

2015-04-01 Thread James M. Greene
supported in none. Sincerely, James M. Greene On Apr 1, 2015 3:36 AM, Roger Hågensen rh_wha...@skuldwyrm.no wrote: On 2015-04-01 06:57, Kyle Simpson wrote: There are features being added to the DOM/web platform, or at least under consideration, that do not have reasonable feature tests

Re: [whatwg] Supporting feature tests of untestable features

2015-04-01 Thread James M. Greene
. For example, Chrome has implemented the paste feature of the Clipboard API nearly completely but has NOT implemented the copy or cut features. Sincerely, James Greene On Wed, Apr 1, 2015 at 8:07 AM, Boris Zbarsky bzbar...@mit.edu wrote: On 4/1/15 8:27 AM, James M. Greene wrote: We had

Re: [whatwg] Supporting feature tests of untestable features

2015-04-01 Thread James M. Greene
P.S. If you want to get involved, here is a link to the archive of the most recent email thread about feature detection for the Clipboard API: https://lists.w3.org/Archives/Public/public-webapps/2015JanMar/0592.html Sincerely, James Greene On Wed, Apr 1, 2015 at 9:04 AM, James M. Greene

Re: [whatwg] Proposal: Two changes to iframe@sandbox

2015-05-11 Thread James M. Greene
1. Block modal dialogs from inside sandboxed frames. That is: * `alert(...)` would return without popping up a dialog. * `confirm(...)` would return `false` without popping up a dialog. * `prompt(...)` would return `null` without popping up a dialog. * `print(...)` would return without

Re: [whatwg] `iframe[@sandbox]`: "sandblaster" JS library for analysis/modification

2015-09-30 Thread James M. Greene
On Wed, Sep 30, 2015 at 10:51 AM, Mike West <mk...@google.com> wrote: > On Wed, Sep 30, 2015 at 4:56 PM, James M. Greene <james.m.gre...@gmail.com > > wrote: >> >> *and* potentially modifying/dismantling >> iframe sandboxes. >> > > Are you abl

[whatwg] `iframe[@sandbox]`: "sandblaster" JS library for analysis/modification

2015-09-30 Thread James M. Greene
*I should've shared this a long time ago but better late than never* Last winter, I was dealing with some confusion surrounding `iframe` sandboxing [when I wasn't aware it existed] on code playground sites (JSFiddle, JSBin, CodePen, etc.). While investigating, I ended up creating a JS