Joost de Vries
Joost de Vries
this sounds doable using a code mirror plugin. Not a first-prio thing IMO but nice to have.
> I would like to use it not just for the favicon, but for a splash screen. And I'd like to even get stickers to pass around if possible. :)...
Valid point. I'm not sure we could keep the current architecture (using doc.write) if we host the iframe on another domain (right now, it's about:blank). Could you write a test...
We might be able to use a different domain, combined with postmessage..
Whatever approach works is fine by me. The postMessage issues in IE mostly refer to other windows/tabs and lack of support for sending objects (which is not really an issue)....
The vulnerability is now fixed and the fix is released but I'll keep this open because using a different domain is probably a better solution than the current fix (using...
@phkavitha Thanks for pointing this out! In the future though, any suspected vulnerabilities are best reported to [email protected] so we can work on a fix before disclosing.
@broerse A pr with the srcdoc polyfill for edge would be welcome. The sandboxing policy cannot be changed for security reasons. I cannot test in Edge myself and we haven't...
@camskene in your example the identation on L5 is done with two spaces and a tab. Tabs are rendered differently in different editors so that explains the issue. While this...