Iframes do not respect preload or other plugin infrastructure

[carsonwright]

Operation System: macOS High Sierra
Beaker Version: 7011

This is functional via electron 2.0.0-beta-1

session.setPreloads()

Having beaker api and extensions be able to perform on the webview and the webview's iframes would make the browser much more extensible and usable.

If there are other ways that would work that would also be awesome!

Context (I mean by this that the preloads.js doesn't run in iframes for Beaker)

[pfrazee]

Ah excellent, I missed that new feature in Electron. I'll be sure to add this when we take the dive into v2.

[pfrazee]

Waiting on electron/electron#12505

[pfrazee]

Word on the street is that this isn't going to be easy to implement in Electron. The recent Electron feature doesn't add support for iframes or workers. This may be a long way off.

[carsonwright]

Thank you @pfrazee its interesting because previous PRs said it was, but I saw the referred to comments.
Thank you

[burtonator]

What's the status of this? Iframes are a big problem for realistic content rendering of web content.

[pfrazee]

Quick note on this: Electron should have the support I need. I think I can implement this but I'm unsure about how to handle permissions. I think if the site asks for write permissions while in an iframe, I'll have to auto-deny.

[andrewburgess]

@pfrazee is there any way to use the sandbox attribute? I'm not sure if it would be frowned upon to add browser specific values, but it might be beneficial for parent frames to restrict some of the Beaker specific APIs

There's also the experimental allow-storage-access-by-user-activation value, but I believe that's only available in Safari and Firefox at the moment. You might be able to see how they handle any prompts for write access though.

https://developer.mozilla.org/en-US/docs/Web/API/Storage_Access_API

[pfrazee]

@andrewburgess Thanks for the tips, I'll take a look. BTW was that you that submitted datcool to r/beakerbrowser?

[andrewburgess]

Yep, it's me!

[pfrazee]

Awesome, great site. I'm going to flair you for it

[brechtcs]

There might be a good case for supporting DatArchive and other Beaker APIs in same-origin (and non-sandboxed) iframes only. Going this route, I think the current permissions system would work alright without much changes.

[pfrazee]

Good point!

…

On Thu, Jun 20, 2019 at 8:57 AM Brecht Savelkoul ***@***.***> wrote: There might be a good case for supporting DatArchive and other Beaker APIs in same-origin (and non-sandboxed) iframes only. Going this route, I think the current permissions system would work alright without much changes. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#863?email_source=notifications&email_token=AAJWCUYNFFJAY7DGPHQFVPLP3OED5A5CNFSM4ETM3BOKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODYFPVFQ#issuecomment-504035990>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAJWCU42O25TDE26LUX4MF3P3OED5ANCNFSM4ETM3BOA> .