Feature request: Sandboxed iframe media

[0x0ade]

It'd be great to see support for custom .html embeds in sandboxed iframes. It'd enable interactive media (f.e. PICO-8 games) to be shared more easily.

They shouldn't "autoplay" - the user should either activate the embed first, or have the chance to open it in a new tab / new window.

For metadata (f.e. title, frame size), an .embed.json could be left next to the embedded page (or must be linked as the actual media).

An example with support restricted to a whitelist is Discord:

[eelfroth]

I would love to be able to embed txt and md. html sounds scary though…

[0x0ade]

htmls are quite scary, but they should be no risk with the sandbox flag set for the iframe.

Wouldn't embedded mds require a markdown compiler / parser, though?

[eelfroth]

yeah maybe, not sure. Beaker can render md if you open it as a page, so perhaps this can be made to work in an iframe too (I tried but sadly that's not the default behaviour)

[0x0ade]

I peeked into Beaker to see how it parses / renders markdown.

Whenever a new page is opened and it's a markdown page, it injects markdown-renderer.js:

https://github.com/beakerbrowser/beaker/blob/760b90f2f265ab612d6596a0c63529a2a2101819/app/shell-window/pages.js#L649-L676

markdown-renderer.js itself uses the Remarkable parser:

https://github.com/beakerbrowser/beaker/blob/760b90f2f265ab612d6596a0c63529a2a2101819/app/markdown-renderer.js#L3-L5

I guess Electron apps could deal with newly created iframes with the help of a preloaded helper + MutationObserver, but for now, we'd need to deal with markdown content on our own.

[pfrazee]

I'll look into whether Beaker can solve that issue with iframes.

…

On Sun, Nov 19, 2017 at 4:31 PM, Maik Macho ***@***.***> wrote: I peeked into Beaker to see how it parses / renders markdown. Whenever a new page is opened and it's a markdown page, it injects markdown-renderer.js: https://github.com/beakerbrowser/beaker/blob/ 760b90f2f265ab612d6596a0c63529a2a2101819/app/shell-window/ pages.js#L649-L676 markdown-renderer.js itself uses the Remarkable parser: https://github.com/beakerbrowser/beaker/blob/ 760b90f2f265ab612d6596a0c63529a2a2101819/app/markdown-renderer.js#L3-L5 I guess Electron apps could deal with newly created iframes with the help of a preloaded helper + MutationObserver, but for now, we'd need to deal with markdown content on our own. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#100 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABNhU8rFauE7yPhjPASO1ZHVLX9JMGxCks5s4KwogaJpZM4QTi3O> .

[neauoire]

@0x0ade We've had them for a little while now, is this issue still valid?

[0x0ade]

IMO the issue is still valid for two reasons:

• No support for embeds from dat:// pages. I don't know how to do it best: A "whitelist" embedded in rotonde (similar to the current one for the "normal" web) would heavily restrict growth. On the other hand, checking every URL for a possible .embed.json (.json formatted similarly to oembed instead of contacting an oembed provider) slows down the checking process and your internet connection.

• No support for .md iframes in Beaker yet, and no markdown parser in rotonde for .md embeds.