v0.8.0

untrusted content is checked as the H5P plugins check it

@missing-elements/h5p-runtime 0.2.0 and @missing-elements/h5p-offline-player 0.8.0.

A package played untrusted now has its content checked against each library's semantics.json
before it is shown. The H5P CMS plugins run the same check on an author's upload:

• Text keeps only the tags its field allows, with every attribute written anew. No event
  handlers, no javascript: links, no styles except the ones the field allows.
• Plain text is escaped, numbers are held to their range, and a select is held to its options.
• Sub-content must be a library its field names, and is checked against that library's own
  definitions.
• Anything the definitions do not name is removed.

The check is a port of H5PContentValidator from h5p-php-library. It was run beside the PHP
original on 78 known XSS vectors and on real packages, and gave the same result. Content that has
already been through an H5P platform comes through unchanged. Content made elsewhere is filtered
the way a platform would filter it on upload.

The frame's script policy already stopped scripts in content markup from running. What the check
adds is everything markup can do without a script: a form asking for a password, a frame, styles
laid over the page, a tracking image. It also enforces each field's type, which content types
often put into class names unescaped.

Content whose main library has no semantics.json does not play. The library pack carries them
all. If you serve a library bundle of your own with untrusted, keep its semantics.json files.
When the check changes something worth knowing about, it says so in the console.

The two packages go together. Player 0.8 serves an untrusted package's content only to a
runtime that checks it, so with runtime 0.1 such a package fails to load instead of playing
unchecked. The player's peer range is now ^0.2.0. Packages played without untrusted behave as
before with either runtime.

On a CDN, update both URLs: h5p-offline-player@0.8.0 and h5p-runtime@0.2.0.

The boot script grows from about 4 kB to 10 kB compressed. The frame loads it once, and the
browser caches it.

What this changes in the setup advice

With the check in place, untrusted contains a package as well as an H5P plugin does on the same
site: no package code runs, and its content is checked. The README's Which setup table now says:

• Plays packages you did not make: Install with untrusted on them, or Embed.
• Has signed-in users: Embed, or Install with every package untrusted.

Embed still adds a separate origin on top.

@missing-elements/h5p-embed 0.5.0

The embed page plays a link from another site untrusted, so with this release that content is
checked too. It requires player 0.8 and runtime 0.2. Write and deploy your player domain again to
get them there. Nothing else changes.

@missing-elements/h5p-verify stays at 0.1.3. It plays the file you hand it, as it is, so the
check changes nothing it reports.

Full Changelog: v0.7.0...v0.8.0