W3C home > Mailing lists > Public > whatwg@whatwg.org > July 2011

[whatwg] Iframe Sandbox Attribute - allow-plugins?

From: Julian Reschke <julian.reschke@gmx.de>
Date: Thu, 14 Jul 2011 10:16:18 +0200
Message-ID: <4E1EA5D2.4060702@gmx.de>
On 2011-07-14 08:22, Jonas Sicking wrote:
> On Wed, Jul 13, 2011 at 9:49 PM, Anne van Kesteren<annevk at opera.com>  wrote:
>>
>> On Wed, 13 Jul 2011 23:13:05 +0200, Julian Reschke<julian.reschke at gmx.de>  wrote:
>>>
>>> Yes, but we can *define* the flag in HTML and write down what it means with respect to plugin APIs.
>>
>> It seems much better to wait until it can actually be implemented.
>
> Especially since it's not at all clear to me that a specific opt-in
> mechanism is at all needed once we have the appropriate plugin APIs
> implemented. And those APIs are needed anyway if we want to allow
> plugins in any form in the sandbox.

"When the attribute is set, the content is treated as being from a 
unique origin, forms and scripts are disabled, links are prevented from 
targeting other browsing contexts, and plugins are disabled."

A browser negotiating something with plugins using that API and enabling 
them despite @sandbox would violate the above requirement, no?
Received on Thursday, 14 July 2011 01:16:18 UTC

This archive was generated by hypermail 2.4.0 : Wednesday, 22 January 2020 16:59:34 UTC