april / certainly-something

WebExtension that shows certificate chains in an aesthetically pleasing manner.
https://addons.mozilla.org/en-US/firefox/addon/certainly-something/
Mozilla Public License 2.0
92 stars 20 forks source link

links that use the handlebar helper function 'link' will now open in a new tab #43

Open tonynguyen111997 opened 5 years ago

tonynguyen111997 commented 5 years ago

Referenced Issue - #38 I wasn't sure how to have the download dialog appear on the same page without having the page turn white. Instead, the download will open on a new tab so that users won't have to refresh the certificate viewer.

I tried to use the code below inside link.js to have the download page open in a new tab and then close the new tab to have the dialog box appear without the new tab.

const handleLinkClick = url => { window.open(url).close(); return false; }

<a href="${new URL(url).href}" onclick="${() => handleLinkClick(url)}">${Handlebars.Utils.escapeExpression(text)}</a>

but I ran into "Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)." inside the console. `

image image

april commented 5 years ago

Hmm, does this leave that blank new tab open after you accept the download?

tonynguyen111997 commented 5 years ago

Yes the blank new tab stays open after you accept the download.

I wasn't sure how to add JavaScript to the link.js file to close the tab since I kept running into the issue of ""Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)."

Can you please explain to me why it console logs that message and how I could add my own JavaScript code to that file?

april commented 5 years ago

Extensions aren't allowed to have inline javascript, as part of the security model. You have to separate it out or inject it through the proper APIs.

That said, I don't know if opening a new tab and then closing it is much of an improvement over what we have. I'd really like to have the download open without having to leave the page if possible.

april commented 5 years ago

So interestingly enough, I was testing this the other day and I don't have the problem you're describing. When I click the download PEM link, it just pops up a download window and leaves me on that page. Do you have any special tweaks that you've done to your firefox installation?

tonynguyen111997 commented 5 years ago

The links under the "Miscellaneous" section, such as the PEM link, aren't using the link.js helper function, which is why the user isn't redirected. <a href="data:,{{ this.files.pem }}" download="{{ this.subject.cn }}.pem">PEM (cert)</a>, <a href="data:,{{#each ../certs}}{{ this.files.pem }}{{/each}}" download="{{ this.subject.cn }}-chain.pem">PEM (chain)</a>

Whereas the rest of the links on the certificate viewer are using the links.js helper function. Example: `

Distribution Point {{onebasedindex @index}}
            <div class="text breakable">{{{`**link**` this this}}}</div>
          </div>`

I don't think I've modified anything on my firefox installation.

april commented 5 years ago

Okay, so I don't think target="_blank" is what we want here, since apparently Firefox opens them a new window, which is super awful. I would probably approach things this way:

Pass a message to the backend code.

  • Use downloads.download() to download things like CRLs
  • For normal URLs, simply change the URL of the window away from the WebExtension's path
tonynguyen111997 commented 5 years ago

How I would approach this issue is I would use a fetch request to retrieve things like the CRLs and then using the Blob API and the download package to have users download the files.

Unfortunately, I can not continue working on this issue. Please assign this issue to someone else. Thank you.