Are generated files std HTML5 ? #1053

Darkbluetest · 2022-11-14T07:42:15Z

Darkbluetest
Nov 14, 2022

Hi

I was trying to use SingleFile to produce HTML files to be shown in Obsidian by using the Obsidian HTML Reader plugin (https://github.com/nuthrash/obsidian-html-plugin) which refers in its documentation to SingleFile as a possible source of HTMLs. But when reading with that plugin some pages generated with SingleFile, they show blank. According to plugin documentation this is normal when the file is not an "Standard HTML5 file", so hence my question, are the HTML generated by SingleFile standard HTML5 files? If not, is there some configuration I should change in SingleFile so they are?

Thank you

gildas-lormeau · 2022-11-14T12:53:54Z

gildas-lormeau
Nov 14, 2022
Maintainer

Hi,

Until proven otherwise, I confirm that the pages saved with SingleFile are valid in HTML5. Maybe the parser does not like the fact that it is "compressed"? In that case disabling "HTML content > compress HTML content" in the options page of SingleFile might fix the issue.

Could you share a URL where this issue appears?

@nuthrash, this kind of issue tells you something?

3 replies

nuthrash Nov 14, 2022

Could you share a URL where this issue appears?

@nuthrash, this kind of issue tells you something?

Hmm, I am also interesting what the URL is.
I never see any blank page while reading from the HTML file (of cause, it contains many things) produced by SingleFile with default settings.
I ever saw blank pages while reading the HTML files produced by SingleFileZ before I made this plugin support that.

Maybe a possible situation is the content of Darkbluetest's HTML file contains some bad code and them were sanitized by the HTML sanitizer.

Darkbluetest Nov 14, 2022
Author

Hi,

Thank you both for the prompt answer. I am testing with any Telegram page that has a video, like this example: https://t.me/CuCaCh/12380

It is saved correctly (apparently, because it opens just as the online version, and even the video plays), but in Obsidian -with the HTML Reader plugin- it shows only the white bar at the top with the logo and the "Download" button, and all the rest is flat white down to the bottom where the "EMBED" bar is also shown.

I have also tried to save with the page "optimizations" of SingleFile disabled. But nothing changes.

gildas-lormeau Nov 14, 2022
Maintainer

Thank you. The saved file looks valid to me. I guess this issue is related to the fact that the missing content is within an <iframe> element which would not be supported in Obsidian maybe.

nuthrash · 2022-11-15T01:30:02Z

nuthrash
Nov 15, 2022

Hmm, this is a long story....

So conclusion first,

The movie content of Telegram seems cannot be viewed directly through saved files made by SingleFie. (Tested platforms: Chrome 105, Firefox 106, Obsidian 1.0.3)
The srcdoc attribute was sanitized out by HTML sanitizer of "HTML Reader" plugin of Obsidian, so you cannot see any movie nor player interface.

Take the "Telegram_ Contact @CuCaCh - SingleFile with Notes 1.html" file inside attached file "SingleFile Q&A Discussion #1053 Are generated files std HTML5 - 1.zip" for example.

The <iframe> content:

<iframe id=telegram-post-CuCaCh-12380 scrolling=no style="overflow: hidden; border: medium none; min-width: 320px; height: 734px;" sandbox="allow-popups allow-top-navigation allow-top-navigation-by-user-activation allow-scripts allow-same-origin" srcdoc="<!DOCTYPE html> <html><meta charset=utf-8>
<title>Telegram Widget</title> ... ... ... if (shadowRoot) {processNode(shadowRoot)}}})}})()</script>" width=100% height frameborder=0></iframe>

You would see "This media is not supported in your browser" after opened this file by Chrome 105:

Maybe there is a way to view movie content of this file at Chrome?

Even allow everything including the attribute srcdoc, you would still see "This media is not supported in your browser" after opened this file by "HTML Reader 1.0.0" inside Obsidian.

Although you can see the movie player interface on the screen, it is useless to click it, no response at both platforms!

Following is technical discussion.
The usage of <iframe> by Telegram shall be treated as high potential XSS risks, so you still cannot see any movie nor player interface through Telegram's <iframe> at "HTML Reader" in the future.
The srcdoc attibute shall be sanitized out, and the sandbox attribute shall be assigned with highest restrictions. Nobody can ensure the content of srcdoc is safe enough for Obsidian, so it would be sanitized out. The sandbox attribute is the same, it would be forcely assigned with highest restrictions.

0 replies

Darkbluetest · 2022-11-16T17:44:01Z

Darkbluetest
Nov 16, 2022
Author

Hi
I have tested the file you attached, and I guess it has been saved with the std configuration. I forgot to say that I unblocked everything under Network options of SingleFile. Then I can open the saved html I generated (which is a single file) and see the video in Firefox, Chrome 107.

Regarding HTML Reader sanitizer, I guess I can't do nothing about. The plugin does not have configuration options.

5 replies

nuthrash Nov 17, 2022

Regarding HTML Reader sanitizer, I guess I can't do nothing about. The plugin does not have configuration options.

Maybe there will be some configuration options for switching to unrestricted mode in the future versions of HTML Reader, but it might violate Obsidian's policy. Best not to get overly hopeful.

gildas-lormeau Nov 19, 2022
Maintainer

@nuthrash FYI, SingleFile injects a <meta> tag to define the CSP of the page and the frames, e.g. <meta http-equiv="content-security-policy" content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; object-src 'self' data:;">. It ensures all network requests are blocked (if any). Maybe you could do something similar in your plugin before displaying a page? Combined with a strict sandbox value for the <iframe>, risks of security issues should be very low on modern browsers. Using srcdoc also provides some security by associating the iframe content to a null origin.

nuthrash Nov 20, 2022

SingleFile injects a <meta> tag to define the CSP of the page and the frames, e.g. <meta http-equiv="content-security-policy" content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; object-src 'self' data:;">. It ensures all network requests are blocked (if any). Maybe you could do something similar in your plugin before displaying a page?

It is sad to tell you, this CSP <meta> is illegal to be placed outside the <head>, so I always see the red warning at Obsidian's Developer Console:

- The Content Security Policy 'default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:; object-src 'self' data:;' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.

Which means it never work normally at Obsidian.
I plan to add a new CSP <meta> tag to next version of "HTML Reader", and I will take your configuration as an example. Thanks a lot.

Combined with a strict sandbox value for the <iframe>, risks of security issues should be very low on modern browsers. Using srcdoc also provides some security by associating the iframe content to a null origin.

At the latest version 1.0.5 of "HTML Reader", I have forced added/overwritten the sandbox attribute to apply all restrictions.

For next version of "HTML Reader", I am coding different operating modes to let users switch by themselves, so there will be some loose modes for unrestricted usage.

HTML Reader Operating Modes setting very early preview snapshot:

All HTML attributes including srcdoc would not be sanitized by this plugin at "Low Restricted Mode" and "Unrestricted Mode", but the Obsidian app itself might adjust something. I have tested the re-generated HTML file with unblocked many options of SingleFile, it work very well after switch to "Low Restricted Mode". I think the "Low Restricted Mode" may satisfy Darkbluetest's need.

gildas-lormeau Nov 20, 2022
Maintainer

The snapshot is great! :) I also think you made a good compromise by offering an option for this.

Darkbluetest Nov 21, 2022
Author

Yes, this is wonderful! I think it will fit with what I am looking for. Thanks!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Are generated files std HTML5 ? #1053

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 8 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Are generated files std HTML5 ? #1053

Darkbluetest Nov 14, 2022

Replies: 3 comments · 8 replies

gildas-lormeau Nov 14, 2022 Maintainer

nuthrash Nov 14, 2022

Darkbluetest Nov 14, 2022 Author

gildas-lormeau Nov 14, 2022 Maintainer

nuthrash Nov 15, 2022

Darkbluetest Nov 16, 2022 Author

nuthrash Nov 17, 2022

gildas-lormeau Nov 19, 2022 Maintainer

nuthrash Nov 20, 2022

gildas-lormeau Nov 20, 2022 Maintainer

Darkbluetest Nov 21, 2022 Author

Darkbluetest
Nov 14, 2022

Replies: 3 comments 8 replies

gildas-lormeau
Nov 14, 2022
Maintainer

Darkbluetest Nov 14, 2022
Author

gildas-lormeau Nov 14, 2022
Maintainer

nuthrash
Nov 15, 2022

Darkbluetest
Nov 16, 2022
Author

gildas-lormeau Nov 19, 2022
Maintainer

gildas-lormeau Nov 20, 2022
Maintainer

Darkbluetest Nov 21, 2022
Author