NS breaks "HTML preview" in Markdown-Editor extension

[akavel]

I'm a long line NS user and generally happy with it, no complaints till now (thanks!).

However, today I've tried installing a new extension in Firefox, named MarkDown Editor. And with NS enabled, its feature which allows to preview Markdown rendered as HTML seems not to work for me, unfortunately. I've tested it with NS disabled too, and it did work correctly this way. Could you possibly try to have a look at this extension, and whether it's possible to make it work, maybe by changing some option in NS, or at least if it's possible to somehow help the author of the plugin make it compatible with NS? If it would be not too hard, maybe I'd even try to fork it and tweak by myself then, although I'm not really well versed in JS.

TIA

[Thrawn]

Was the Markdown on a whitelisted site, or a blocked site?

[akavel]

The NS icon is "clear'', shows no script sources except "chrome:", and the main URL in Firefox shows as

Code: Select all

chrome://markdowneditor/content/markdowneditor.xul

, so I have no reasons to suspect it would contact external servers. That said, I don't know how to verify this 100% either way in XUL; do you know some method I could try?

[Thrawn]

OK, if it's running in chrome: context, then there won't be any script-blocking applied.

Does anything appear in the Browser Console (Ctrl+Shift+J)?

[barbaz]

I can confirm the issue.

Does anything appear in the Browser Console (Ctrl+Shift+J)?

Just this:

Code: Select all

: Component returned failure code: 0x805e0007 [nsIWebNavigation.loadURIWithOptions] browser.xml:154:0

[Guest]

Confirming what barbaz wrote, and also verified that this doesn't show up on the console if NS is disabled.

[barbaz]

OK I've disassembled Markdown Editor, and I think I see what's going on. The preview is done by dynamically loading data: URIs:

Code: Select all

        var conv = new Showdown.converter(),
            wn = Components.interfaces.nsIWebNavigation;
        var html = conv.makeHtml(textbox.value);
        var data = "data:text/html;charset=utf-8," + escape(html);
        
        //browser.loadURI(data, wn.LOAD_FLAGS_DISALLOW_INHERIT_OWNER, "utf-8");
        browser.loadURIWithFlags(data, wn.LOAD_FLAGS_DISALLOW_INHERIT_OWNER, null, "utf-8", null);

IIUC whats going on, it's that "LOAD_FLAGS_DISALLOW_INHERIT_OWNER" is causing the data: URIs to lose origin info, and NoScript completely blocks data: URIs that aren't originate from a trusted source.

No idea what's best to do about this, here are some possibilities:

• Markdown Editor's code is unfinished some places and suboptimal others (is it REALLY needed to validate URLs with a hairy regexp that ignores schemes other than http/https/ftp? Is there nothing directly provided by Gecko that can validate a URL?).
  Anyway.. Markdown Editor could change its approach, for example set innerHTML property instead.
• Can Markdown Editor be run as a standalone application via XULRunner? Or run it in its own profile? (Or is functionality lost that way?)