I tried your patch and it worked for loading embedded resources within a page, but I still could not type data:text/plain,Hello%20world! into the address bar and get anything back. Do you have plans to make the address bar work too?
-Alex
Hi Alex,
On 10/06/15 02:32, Alex Henrie wrote:
I tried your patch and it worked for loading embedded resources within a page, but I still could not type data:text/plain,Hello%20world! into the address bar and get anything back. Do you have plans to make the address bar work too?
For that to work, we'd need monikers to work with data: URLs. I quickly checked that pluggable protocol is not registered on Windows, but maybe it's handled some other way. The first thing to try would be checking if CreateURLMoniker works with data: URLs.
Cheersm Jacek
I haven't looked into the address bar thing yet. It would be nice to have, but I think the main use of data: URIs is in embedded resources.
As a new contributor, I'm also reluctant to put effort into non-trivial patches until the promised "no patch left unreviewed" system is in place.
Joachim
Am Dienstag, 06. Oktober 2015 schrieb Jacek Caban:
Hi Alex,
On 10/06/15 02:32, Alex Henrie wrote:
I tried your patch and it worked for loading embedded resources within a page, but I still could not type data:text/plain,Hello%20world! into the address bar and get anything back. Do you have plans to make the address bar work too?
For that to work, we'd need monikers to work with data: URLs. I quickly checked that pluggable protocol is not registered on Windows, but maybe it's handled some other way. The first thing to try would be checking if CreateURLMoniker works with data: URLs.
Cheersm Jacek
Hello Joachim,
On 10/06/2015 08:06 PM, Joachim Priesner wrote:
I haven't looked into the address bar thing yet. It would be nice to have, but I think the main use of data: URIs is in embedded resources.
As a new contributor, I'm also reluctant to put effort into non-trivial patches until the promised "no patch left unreviewed" system is in place.
part of the review system is already in place: Check the MAINTAINERS file if the DLL in question has a maintainer. If yes than it is his responsibility to review the patch. The patch reviewers queue is for patches to components without a maintainer.
bye michael
Am Dienstag, 06. Oktober 2015 schrieb Jacek Caban:
Hi Alex,
On 10/06/15 02:32, Alex Henrie wrote:
I tried your patch and it worked for loading embedded resources within a page, but I still could not type data:text/plain,Hello%20world! into the address bar and get anything back. Do you have plans to make the address bar work too?
For that to work, we'd need monikers to work with data: URLs. I quickly checked that pluggable protocol is not registered on Windows, but maybe it's handled some other way. The first thing to try would be checking if CreateURLMoniker works with data: URLs.
Am Mittwoch, 07. Oktober 2015 schrieb Michael Stefaniuc:
part of the review system is already in place: Check the MAINTAINERS file if the DLL in question has a maintainer. If yes than it is his responsibility to review the patch.
That is great news (which I somehow missed), thanks.
Alex' question touched an interesting point. https://msdn.microsoft.com/en-us/library/jj710206%28v=vs.85%29.aspx states that "Data URIs cannot be used for navigation, for scripting, or to populate frame or iframe elements."
So pasting data URIs in the address bar should actually not work at all (which I confirmed with IE11), on the other hand things like <iframe src="data:,A%20brief%20note"></iframe> also should not work, which they currently do with this patch because Gecko allows it.
Should I try to update this patch to exclude frame/iframe elements, or is this not considered a problem because we can assume Gecko handles such things in a secure manner?
Joachim
On 10/08/15 00:13, Joachim Priesner wrote:
Am Mittwoch, 07. Oktober 2015 schrieb Michael Stefaniuc:
part of the review system is already in place: Check the MAINTAINERS file if the DLL in question has a maintainer. If yes than it is his responsibility to review the patch.
That is great news (which I somehow missed), thanks.
Alex' question touched an interesting point. https://msdn.microsoft.com/en-us/library/jj710206%28v=vs.85%29.aspx states that "Data URIs cannot be used for navigation, for scripting, or to populate frame or iframe elements."
So pasting data URIs in the address bar should actually not work at all (which I confirmed with IE11), on the other hand things like <iframe src="data:,A%20brief%20note"></iframe> also should not work, which they currently do with this patch because Gecko allows it.
Should I try to update this patch to exclude frame/iframe elements, or is this not considered a problem because we can assume Gecko handles such things in a secure manner?
I don't think there is security concern here, so unless we find a real problem, it's fine as it is.
Cheers, Jacek
-
Alex Henrie -
Jacek Caban -
Joachim Priesner -
Michael Stefaniuc