Mailing-List: contact dev-help@cordova.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@cordova.apache.org
Received-SPF: pass (athena.apache.org: domain of mmocny@google.com designates
 209.85.220.173 as permitted sender)
MIME-Version: 1.0
Sender: mmocny@google.com
In-Reply-To: 
 <CABiQX1WEhoOyXngbHmyhqLHK_yfbMv3RKH=g8ms-KLy8ZKs6QA@mail.gmail.com>
References: 
 <CABiQX1WEhoOyXngbHmyhqLHK_yfbMv3RKH=g8ms-KLy8ZKs6QA@mail.gmail.com>
From: Michal Mocny <mmocny@chromium.org>
Date: Tue, 3 Mar 2015 11:22:45 -0500
Message-ID: 
 <CAEeF2TdXe8=UCsomQyBMBOpnQ+RbXpi=0WGk79Zn8T+1oi4aOg@mail.gmail.com>
Subject: Re: Android's new Whitelist Plugins
To: dev <dev@cordova.apache.org>
Content-Type: multipart/alternative; boundary=bcaec547c675e12dc1051064bf89

--bcaec547c675e12dc1051064bf89
Content-Type: text/plain; charset=UTF-8

My thoughts:

- The split between <allow-navigation>, <allow-intent>, and <access>: Like
it a lot.
- I think the defaults *for the plugin* are very reasonable.  However, we
may want to provide a default set of tags for the hello world app.  A year
or so ago we added a default access * whitelist and I think maybe we should
continue that.  (on the other hand, I've gotten used to explicitly
whitelisting every url as part of chrome packaged app development and its
not so bad).
  - Additionally, that means this plugin should be installed by default.
As we discussed this morning, with the new plugin --save functionality we
could just add this to the helloworld config.xml, I think!
- Do you really need a CSP meta tag *and* <access> declarations?   Thats
what the README.md implies, but I would assume CSP trumps?

-Michal

On Mon, Mar 2, 2015 at 9:38 PM, Andrew Grieve <agrieve@chromium.org> wrote:

> I've tried to explain it in the plugin's readme:
>
> https://github.com/apache/cordova-plugins/tree/master/url-policy
>
> Some points for discussion:
> - What should the default behaviour be for the three whitelists (what
> should happen if not whitelist plugin is installed).
>   - right now it can't open external URLs
>   - and can't do XHRs to http(s)
> - Is the plugin name decent ("url-policy"). We should make a dedicated git
> repo for it (as well as for legacy-whitelist plugin)
>

--bcaec547c675e12dc1051064bf89--