Support Blob URLs and window.URL API

[tapananand]

Currently, Caja does not support the window.URL API and hence using the Blob as a URL as described here is not possible.

Please add support for it if possible. Are there any risks associated with it?

[kpreid]

New features for Caja are pretty much on hold for the time being. However, if you'd like to write a patch to add this one we'd be happy to review and incorporate it.

As to issues in supporting it, the thing that comes to mind is that it would be undesirable if the guest could revokeObjectURL on URLs created by the host that the guest comes to know. This could be handled for simple cases by remembering (for the session) every URL gotten through createObjectURL and using that as a whitelist on the revoke operation, but that might be worse than the alternative for some applications.

[tapananand]

Thanks for the quick response.

This could be handled for simple cases by remembering (for the session) every URL gotten through createObjectURL and using that as a whitelist on the revoke operation, but that might be worse than the alternative for some applications

Are you saying it might be worse due to performance?
Also, is there a particular reason why new features are on hold?

[kpreid]

Are you saying it might be worse due to performance?

No, due to the resulting properties. Actually, on second thought, it won't make any difference, so that strategy should be fine.

Also, is there a particular reason why new features are on hold?

There are two-and-a-half people working on Caja in spare time, and spare time and enthusiasm is a scarce resource. Thus, help wanted, patches welcome, etcetera.