seb-mac

seb-mac copied to clipboard

• Safe Exam Browser version: 3.0 and 3.1
• Platform: MacOS 12.4, iOS 14, iOS 15

Description: When using our custom config or the default SEB config, SEB does not load <iframe> tags on the page. In our frontend error tracker we see the error null is not an object (evaluating 'document.querySelector('[href="about:blank"]').download') appear whenever a user visits a page with one or more iframes (eg. YouTube videos or [TinyMCE])https://www.tiny.cloud) text editors). These are essential parts of the exam, meaning that these exams cannot be made inside SEB. We've also tested the same content in SEB 2.3.2 on MacOS 12.4, in which frames worked as expected.

We've prepared a simple test case at: https://learnbeat.nl/tech/youtube.html

Hmm, with default settings (modern WebView) or force classic (classic WebView) I see one YouTube video on your test page which can be played.

Probably you're using some setting which causes this. Can you provide a .seb config file for starting an exam which causes the error?

SEBClientSettings.seb.txt here's a config file using only default settings, except for the starting URL being https://www.tiny.cloud/docs/tinymce/6/basic-setup/ . The editors on the page are not working in SEB.

I've tested all the different WebView settings as well. This does not make a difference for this issue.

I solved the issue, will be in the next patch update 3.1.1 to be released in the coming days.

Thank you for the quick response! We're looking forward to whenever the patched release becomes public for our users.

Out of curiosity, what was the purpose of this now removed piece of code?

The fix is included in the 3.1.1pre1 pre-release version.

I don't remember anymore, why about:blank requests were blocked, it could be that they interfered with the URL filter somehow. We still have to test if removing this code has some side effects.

But generally speaking I never fully understood the concept of about:blank. Why should SEB load an empty page? about:blank seems to be a very strange solution for a non-issue from the early days of web browsers. You can just NOT load any page to get an empty page, why the heck should it be necessary to "load" a blank page...

I also don't understand the purpose of the about:blank page. I do still find it curious that the bug I reported didn't occur in SEB 2.3.2. So it either didn't had this filter or it was implemented differently.

We will download the pre-release version and test it for our use-case.

Just tested 3.1.1pre1 with our web app Learnbeat. iframe embeds of TinyMCE, YouTube, Prezi and Patatap work flawlessly now.

In a conversation with my colleague about this issue, he mentions that having a filter for blocking about: URLs is useful for pages such as about:config, about:plugins, about:addons, about:debugging, etc., with an exception for about:blank. But then again, this scheme is used in Firefox and Chrome, not Safari and Safari-based browsers as far as I can tell from my own testing and reading https://en.wikipedia.org/wiki/About_URI_scheme#Others, which reads "Safari only recognizes about:blank."

But generally speaking I never fully understood the concept of about:blank. Why should SEB load an empty page? about:blank seems to be a very strange solution for a non-issue from the early days of web browsers. You can just NOT load any page to get an empty page, why the heck should it be necessary to "load" a blank page...

Here's an answer:

References a blank HTML document with the media type text/html and character encoding UTF-8. This is widely used to load blank pages into browsing contexts, such as iframes within HTML, which may then be modified by scripts.

Yeah, I also got the impression that about:blank is used in special circumstances, like with iFrames. I guess for opening an empty page which is then modified by a script a link with target=_blank does the same and an explicit about:blank might not be necessary for the new page. It just seems like they also could have specified that an empty iFrame is automatically populated with an empty DOM, but honestly I don't know enough about web development and why some things work in browsers as they do...

SEB 3.0 has a refactored browser engine, especially all the code for the modern WebView (WKWebView) is completely new. I also made as much of the code for the classic and the modern WebViews common (partially also for macOS and iOS), so that's probably also why it didn't work with the classic WebView anymore. So definitely there are big changes between SEB 2.3.2 and 3.x. I'm wondering why no one reported the iFrame issues earlier, I guess they either are still using 2.3.2 or not using iFrames...

Anyways, it's always very helpful if "power users" test preview/beta versions of SEB before the final release, to help identify issues which we don't figure out in our testing (which unfortunately still is a bit limited). You can "watch" the Releases section on GitHub to get notified about pre-releases and often we also tweet about new pre-releases.