Skip to content

v0.7.0

Choose a tag to compare

View all tags
@alekswebnet alekswebnet released this 12 Oct 20:51
v0.7.0
8f73141

untrusted: play a package you did not make as data

@missing-elements/h5p-offline-player 0.7.0.

A package's libraries are JavaScript, and the player's frame shares your page's origin. So a
package normally runs as your site, with its storage. For a package from an author, a learner or
another site, set untrusted:

<h5p-player untrusted src="https://elsewhere.example/course.h5p"></h5p-player>

Then none of the package's own code runs:

  • Libraries come only from libraries. The package's own library folders are ignored. Without
    a libraries attribute it takes pack, since nothing could play it otherwise.
  • content/ is served as data. Only H5P's own list of content file types is served: images,
    audio, video, fonts, office documents, subtitles and JSON. Scripts, stylesheets, HTML, SVG and
    XML get a 404, and every response carries X-Content-Type-Options: nosniff.
  • The frame's script policy names exact paths. It allows the package's own path, the runtime's
    files, your custom-js and the YouTube, Vimeo and Panopto player APIs. It drops 'self', which
    would let injected markup load any script on your site, and jsDelivr, cdnjs and Google's WebFont
    loader. allow-origins still adds hosts.

Some packages need their own code. The package may carry a newer version of a library than the
sources have, or a content type they lack. Such a package is refused, and the error event's
missingLibraries.carried is true. Playing it without untrusted would run its own copy, so
ask whoever decides before you do:

player.addEventListener('error', (event) => {
  if (!event.detail.missingLibraries?.carried) return
  // Once someone has said yes: play it trusted.
  player.untrusted = false
  player.removeAttribute('src')
  player.setAttribute('src', url)
})

The mode applies from the next load. A package played without untrusted behaves exactly as
before.

Formulas render only with a library bundle that carries H5P.MathDisplay, and the pack does not.
An old Arithmetic Quiz uses its fallback fonts.

This is a first step. The H5P CMS plugins also filter every field of a package's content
against its libraries' field definitions. The player does not do that yet, so the setup advice
stands: packages you did not make, like sites with signed-in users, mean Embed.

See the frame's CSP
and Packages without libraries.

The runtime stays at 0.1.2. On a CDN, update the player's URL to h5p-offline-player@0.7.0; the
runtime's stays at h5p-runtime@0.1.2.

@missing-elements/h5p-embed 0.4.0

The page no longer asks before playing a package from another site. This applies when the page
is opened on its own or framed by a page of its own origin, and the host is not in --packages.
It plays the package untrusted with the site's own libraries: --default-libraries, or else
the pack. It never uses a bundle that the address's libraries= names, because a bundle's code
runs as your site's.

A button labelled "Open with its own scripts" appears only when the package needs its own code. It
also appears when the site has no pack to play the package with, which is a site built with
--no-libraries that does not allow jsDelivr. Unchanged: hosts in --packages, a page framed by
another site, and askInOwnFrame: false play packages as they are.

It requires player 0.7. Write and deploy your player domain again to get it there.

@missing-elements/h5p-verify stays at 0.1.3. It plays the file you hand it, so untrusted
changes nothing it checks.

Full Changelog: v0.6.3...v0.7.0

Assets 2
Loading