781509 - Kumascript does not allow to output object or iframe tag

Status: RESOLVED FIXED

(developer.mozilla.org Graveyard :: Editing, defect, P1)

Description

[Jeremie Patonnier :Jeremie]

See : https://developer.mozilla.org/en-US/docs/SVG/Element/circle and https://developer.mozilla.org/en-US/docs/Template:EmbedSVG

The EmbedSVG template is not able to output an object or an iframe to display he required SVG file.

Comment 1

[Les Orchard [:lorchard]]

Kumascript output gets sanitized by Bleach in the same way as user-produced markup. There is no exception for Kumascript. 

So, if a tag isn't whitelisted (eg. object or iframe), neither manually-authored nor Kumascript-generated markup can use that tag.

We can add <object> or <iframe> to the Bleach whitelist, but that would allow both Kumascript and anyone editing documents to use those tags.

Comment 2

[Jeremie Patonnier :Jeremie]

In order to limit security risk, is it possible to white list iframe only if they carry the sandbox attribute (only with the 'allow-scripts' value)?

Comment 3

[Les Orchard [:lorchard]]

Hmm, no, I don't think the filtering works that way. We can allow tags and specific attributes on tags - but not tags with certain attributes

Comment 4

[Jeremie Patonnier :Jeremie]

Mmmmh... this means that we really need the live sample feature ASAP

Comment 5

[John Karahalis [:openjck]]

Yes, this will likely be covered by live examples or file attachment improvements. Marking it as a dependency of the latter for now. Will sort out further later.

Comment 6

[Les Orchard [:lorchard]]

This should actually be addressed by live samples (bug 665735), which works now except for some UI improvements