Mailing-List: contact callback-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: callback-dev@incubator.apache.org
Received-SPF: pass (nike.apache.org: domain of shazron@gmail.com designates
 209.85.214.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAKP6k2uHicKuAfZK3txfKED3gmSFX-XRDXwZWVmabe-C2XBJVg@mail.gmail.com>
References: 
 <CAE6O_-YUy89+hSQO+8g=1BZNm=tC+m_2ksd8xAqB17aWic6BLQ@mail.gmail.com>
 <CBDABB43.6740%fil@adobe.com>
 <CAE6O_-bjd1WBTukiTJY-gSXFYTKMKY96zh=Ko7nGJpFL0obYcA@mail.gmail.com>
 <CAPihERRnzcL0FKH2xchGxjFv=O5891762yDwq2Z_ZJmHyNeC=w@mail.gmail.com>
 <CAM1AYQD2fHjrEoiEHMUK3SC=YHLjz6ib6rWnqCA461O1EexBdQ@mail.gmail.com>
 <CAMT1KGPZi5cPPybo74gc01KxUPviwOTd8iimU=d+rQUr1LnKwg@mail.gmail.com>
 <CAPihERQoaneEqPk+EUAfHqCG92KrDYeKYYO06itsTqYvmEjZBw@mail.gmail.com>
 <CADVgkyNrEASooAdtBMJTud4uT84B9xqOUD2gxoq95Ym-PtKWaw@mail.gmail.com>
 <CAPihERS3XVenXDtdWm6aFTTdnKb+BSUp+u5ea36xe1pcm=f2Sg@mail.gmail.com>
 <CADVgkyMyEWX4RGvFEUED=x_kutPvEX86V0cjZVOcHHN_Uj3faQ@mail.gmail.com>
 <CAE6O_-ZSd3vdz6j2fGnMf_TkbswMz1yc1t6b7qFqn+T4CdTsiw@mail.gmail.com>
 <CAE6O_-bj-Cyb4Y+kZH0dQ8Q9Ohfaej7bT1wVedqK_XV5=rf5XQ@mail.gmail.com>
 <CADVgkyNT7PwJahQ-u72Cgvk8Yu49jk2bCUV4A8nbey=ExZ3vXA@mail.gmail.com>
 <CAE6O_-YjufkrPAAg531rAWVOgO+V_o_5U4tP4AUGfVHa=rTL9A@mail.gmail.com>
 <CADVgkyO4q_zZNgZX8y=QLfGtv6UmqnuVQpAE_BrL46vsi=HHSg@mail.gmail.com>
 <CAE6O_-bYM399p9MyVG2yMyBttZz8bXKUG7_9bJPVQ0Es0dG9Cg@mail.gmail.com>
 <CADVgkyOFsBbQ__wGS_HQWQULp2p5u1PiXUgMjOXwkWWmE6f=nA@mail.gmail.com>
 <CAE6O_-ZaNM1x6FCwArgCjxr8nVYaNKCyKjymXk-YtuqddbnVpw@mail.gmail.com>
 <CAKP6k2uHicKuAfZK3txfKED3gmSFX-XRDXwZWVmabe-C2XBJVg@mail.gmail.com>
From: Shazron <shazron@gmail.com>
Date: Sat, 19 May 2012 21:37:13 -0700
Message-ID: 
 <CAE6O_-Zp7nG3JodkUzEE8-kF-meYZshG128GAeWoHF=3dxPd0g@mail.gmail.com>
Subject: Re: API function: Open url in system web browser
To: callback-dev@incubator.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Jesse, I understand the problem, I know what Brian is asking, I'm
afraid no one does understand with regards to the two request problem.
I was afraid someone would "go there" and suggest to compromise the
whitelist. This is a security problem if we allow any url with
_cordova-target=3D to circumvent the whitelist check, think about it -
it's a big hole.

On Sat, May 19, 2012 at 8:12 PM, Jesse <purplecabbage@gmail.com> wrote:
> Shaz: I believe Brian is proposing you look for urls
> containing _cordova-target=3D before rejecting them via the whitelist.
>
> IMHO: The discussed solutions resolve to the same thing, it is just a
> semantics discussion.
>
> Given the following html placed in the document by the developer:
> <a href=3D"http://somwhere.com" target=3D"_blank">asdf<a>
>
> Providing a new API means the link becomes (or something similar):
> gap://app/openExtUrl/http%3A%2F%2Fsomwhere.com
>
> Brian's proposal means the link becomes :
> http://somwhere.com&_cordova-target=3Dblank
>
> So either native code has to watch for links with '_cordova-target=3D' or
> just handle another cordova command.
>
> Both solutions require re-writing urls on page load, or on dom change.
>
> Andrew's earlier suggestion added a document level click handler that wou=
ld
> determine if the clicked item was an <a> and do the right thing based on
> it's attributes, which I think has some merit in that it handles dynamic
> content, and it doesn't modify it, it just observes it.
>
> I will be thinking more on this and adding my recommendation in a while .=
..
>
>
>
> On Sat, May 19, 2012 at 7:43 PM, Shazron <shazron@gmail.com> wrote:
>
>> No. Read it again, especially the two request part. For urls NOT in
>> the whitelist, the first request will be rejected by the whitelist. It
>> won't work.
>>
>> On Sat, May 19, 2012 at 7:34 PM, Brian LeRoux <b@brian.io> wrote:
>> > Ok, so read that, its referring to the target attribute but it looks
>> > like you can check stil check for a url parameter on an NSURLRequest
>> > [1].
>> >
>> >
>> https://developer.apple.com/library/mac/#documentation/Cocoa/Reference/F=
oundation/Classes/NSURLProtocol_Class/Reference/Reference.html
>> >
>> > So what I'm proposing is this: cordovajs walks the dom finding all
>> > anchors with a target attribute and adds something like this to the
>> > href:
>> >
>> > <a href=3Dhttp://somwhere.com&_cordova-target=3Dblank target=3Dblank>a=
sdf<.a>
>> >
>> > Then, when clicked, touched, whatever, you capture if the URL
>> > parameter named _cordova-target exists. If it does, spawn browser.
>> >
>> > Dynamic links would be missed. I think thats an ok/fair quirk. If
>> > wanted to be aggressive we *could* watch for dom mutation events and
>> > solve that too tho I suspect it would not help performance!
>> >
>> >
>> > On Sat, May 19, 2012 at 6:00 PM, Shazron <shazron@gmail.com> wrote:
>> >> When JIRA is back up (it's under maintenance right now), see my
>> >> first/second comment on this issue:
>> >> https://issues.apache.org/jira/browse/CB-362
>> >>
>> >> It's a bit too long to rehash :)
>> >>
>> >> On Sat, May 19, 2012 at 8:17 AM, Brian LeRoux <b@brian.io> wrote:
>> >>> Sorry shaz, I must be dense but I missed the technical reasons?
>> >>> =A0On May 19, 2012 11:48 AM, "Shazron" <shazron@gmail.com> wrote:
>> >>>
>> >>>> > The method I'm proposing
>> >>>> > assumes all link events are trapped, inspected for a url param, a=
nd
>> in
>> >>>> > its absence, falls back to default behavior. Maybe thats not
>> >>>> > realistic. Seems like both iOS and Android do not trap the target
>> >>>> > attribute. Which means we'd need to add a url param so that trap =
is
>> >>>> > caught.
>> >>>> >
>> >>>>
>> >>>> It is not entirely a question of "nastiness" in adding a url param
>> >>>> with regards to why it won't work in iOS (although imo I don't like
>> >>>> it) - I have already presented valid technical reasons.
>> >>>>
>> >>>> With respect to achieving all our goals - not introducing a new API=
,
>> >>>> and fixing this bug that sorely needs fixing - ChildBrowser like yo=
u
>> >>>> proposed is the better bet then. So what should be the plan for thi=
s?
>> >>>>
>>
>
>
>
> --
> @purplecabbage
> risingj.com