Implement window.{alert, prompt, confirm} removal from cross-origin iframes
1–10 of 160 posts
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#2They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-came-along web app to keep working.
Who the hell is in charge over there, and what compels them to incessantly break the web?
[0]: https://developer.chrome.com/origintrials/#/register_trial/2...
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#3> We decided to disable this deprecation temporarily (for 2 weeks, until August 15, 2021) to provide more time for websites to address the issues caused by this change, or enroll affected origins in the origin trial.
Most sites aren't even gonna find out about it in a two week period, let alone be able to fix it.
(Side note: Google has broken the text selection on this page, at least in Firefox. Didn't try in Chrome. Copy/pasting a paragraph was a trial.)
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#4They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-c…
Who the hell is in charge over there, and what compels them to incessantly break the web?
Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#5> We decided to disable this deprecation temporarily (for 2 weeks, until August 15, 2021) to provide more time for websites to address the issues caused by this change, or enroll affected origins in the origin trial. Most sites aren't even gonna find out about it in a two week period, let alone be able to fix it. (Side note: Google has broken the text selection on this page, at least in Firefox. Didn't try in Chrome.…
Coping test seems to work fine in Chrome and Safari, so don't think Google broke anything in regards to text selection/copy/paste on the page.
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#6> We decided to disable this deprecation temporarily (for 2 weeks, until August 15, 2021) to provide more time for websites to address the issues caused by this change, or enroll affected origins in the origin trial. Most sites aren't even gonna find out about it in a two week period, let alone be able to fix it. (Side note: Google has broken the text selection on this page, at least in Firefox. Didn't try in Chrome.…
Coping test seems to work fine in Chrome and Safari, so don't think Google broke anything in regards to text selection/copy/paste on the page.
Works fine in Firefox, too.
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#7What's a legit use for this?
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#8> We decided to disable this deprecation temporarily (for 2 weeks, until August 15, 2021) to provide more time for websites to address the issues caused by this change, or enroll affected origins in the origin trial. Most sites aren't even gonna find out about it in a two week period, let alone be able to fix it. (Side note: Google has broken the text selection on this page, at least in Firefox. Didn't try in Chrome.…
Coping test seems to work fine in Chrome and Safari, so don't think Google broke anything in regards to text selection/copy/paste on the page.
Something's definitely misbehaving in Firefox on the page. Using a mouse to highlight text in a comment and then trying to move the highlight to the next paragraph, the selection jumps to the first paragraph as soon as the cursor leaves the `span` of each paragraph.
From a quick look at the DOM, I'd bet dollars to donuts it's the weird combination of custom WebComponents and the #shadow-root stuff and other various markup excess that they just didn't bother to test with Firefox. Whether it's a bug with Firefox itself and how these elements are handled, I guess would need some investigation. But if it were my web app, I'd probably just fix it instead of blaming the browser.
Screen capture: https://imgur.com/RmoSZRB
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#9They've even eschewed the standard way to opt-in iframes to powerful, dangerous features like `alert` and `confirm` - you can't even `sandbox` the iframe to allow it. You have to enroll your website in a Chrome Origin Trial[0], which only lasts until December, and also requires you to create a Google account, agree to Google ToS, and you might be blessed with the ability for your perfectly-fine-before-Chromium-team-c…
Who the hell is in charge over there, and what compels them to incessantly break the web? Google has a vested interest in doing so, and change is their weapon; it keeps control of the web in their hands when no other organisation has enough brute force to keep up with their changes.
Idk why everyone jumps to these paranoid conspiracy theories - alert() box to trick people has been a thing for decades, and its super rare for it to be used legitly outside of debugging.
Re: Implement window.{alert, prompt, confirm} removal from cross-origin iframes
#10What's a legit use for this?
Penetration testing proof of concept XSS code. We commonly use alert to demo that it is executing code. Certainly there are other options, it’s just a common tool for many testers.