Re: [GitHub] cordova-app-hello-world pull request: CB-9009 default CSP needs to...

2015-05-13 Thread Jesse
Can we use a plugin hook to modify the csp in the bb10 start html page?

localhost is not defined on most platforms afaik, so it may be less of an
issue.


@purplecabbage
risingj.com

On Wed, May 13, 2015 at 1:00 PM, Josh Soref  wrote:

>
> https://github.com/apache/cordova-app-hello-world/pull/10#issuecomment-10142
> 9782
>
> Problem:
> As is, today, Cordova projects created w/ the default cordova hello-world
> template which have any plugins won't work on BlackBerry 10 at-all
>
> My fix is to add a CSP whitelist for the BlackBerry 10 magic port...
>
> Steve Gill commented on the pull request:
> > As long as this doesn't negatively impact other platforms, merge
> away.
>
> The only downside is that if someone manages to have another application
> running on that port on a non blackberry platform,
> and if someone writes a buggy application which can be taken over,
> then that buggy application could talk to the other application w/ that
> port
> on that non blackberry platform
>
> it's pretty obscure, but...
>
> Are people OK with this?
>
> The section we're changing has a bunch of platform specific notes, it seems
> like it's really asking for a pre-processor of some sort to magically
> stitch
> up this field...
>
>
> Does anyone have an alternative proposal? If not, I'm planning to merge my
> PR on Monday.
>


RE: [GitHub] cordova-app-hello-world pull request: CB-9009 default CSP needs to...

2015-05-13 Thread Josh Soref
https://github.com/apache/cordova-app-hello-world/pull/10#issuecomment-10142
9782

Problem:
As is, today, Cordova projects created w/ the default cordova hello-world
template which have any plugins won't work on BlackBerry 10 at-all

My fix is to add a CSP whitelist for the BlackBerry 10 magic port...

Steve Gill commented on the pull request:
> As long as this doesn't negatively impact other platforms, merge away.

The only downside is that if someone manages to have another application
running on that port on a non blackberry platform,
and if someone writes a buggy application which can be taken over,
then that buggy application could talk to the other application w/ that port
on that non blackberry platform

it's pretty obscure, but...

Are people OK with this?

The section we're changing has a bunch of platform specific notes, it seems
like it's really asking for a pre-processor of some sort to magically stitch
up this field...


Does anyone have an alternative proposal? If not, I'm planning to merge my
PR on Monday.


smime.p7s
Description: S/MIME cryptographic signature