Add allow-presentation to iframe sandbox flags

[tidoust]

The Presentation API spec, developed by the Second Screen Working Group, needs to introduce an allow-presentation token to the set of tokens allowed in the sandbox attribute of an iframe element, in order to allow calls to the Presentation API from nested frames, provided the parent browsing context allows it.

The definition of this flag has been in the Presentation API spec for now:
http://w3c.github.io/presentation-api/#sandboxing-and-the-allow-presentation-keyword

As the Presentation API spec is getting ready for publication as Candidate Recommendation, now seems a good time to move the definition to where it should rather be, meaning in the HTML spec.

Note the flag has made its way to the WHATWG HTML spec a few days ago in whatwg/html@0678e3d

Not sure if you can cherry-pick the commit directly. Happy to prepare the corresponding PR for the HTML5.1 spec otherwise.

(For reference, related issue on the Second Screen Working Group issue tracker: w3c/presentation-api#299)

[chaals]

Do you have tests and implementation for this? Otherwise landing it in a couple of weeks, after we've branched the HTML 5.1 CR, sounds like a more likely approach. If you do already have interoperable implementation, feel free to prepare a PR any time today to reach the current milestone...

[tidoust]

OK, "now" was not meant to convey any sense or urgency, I did not know about the milestone. I suppose this can wait until after the CR branch. We don't have tests yet and implementations are still under development.

[chaals]

@tidoust, ping? Are there implementations, tests, enough interop to set a concrete milestone for this?

[tidoust]

Hello @chaals, sandboxing tests for this flag are there:

• Sandboxing: starting a presentation from a nested context succeeds when allow-presentation is set
• Sandboxing: starting a presentation from a nested context fails when allow-presentation is not set
• Sandboxing: Reconnecting a presentation from a nested context succeeds when allow-presentation is set
• Sandboxing: Reconnecting a presentation from a nested context fails when allow-presentation is not set

Implementations:

• Tests pass in Chrome v54
• First test fails in Firefox Nightly. All other tests pass, provided the right config flags get set. Failure still needs to be investigated (and fixed!).

In short, I believe we're mostly good and the Second Screen WG would like this flag to be integrated in HTML 5.2 as soon as possible. Would you like me to prepare a PR?

[chaals]

@tidoust yes, we would love you to prepare a PR...

[tidoust]

The checks on the sandboxing flag have been moved to the PresentationRequest constructor in the Presentation API (and are no longer done in response to calls to start, reconnect and getAvailability). The tests have been updated accordingly:

• Sandboxing: Creating a PresentationRequest from a nested context fails when allow-presentation is not set
• Sandboxing: Creating a PresentationRequest from a nested context succeeds when allow-presentation is set

These tests pass in Chrome Canary.
The first test fails in Mozilla Firefox Nightly for Android, which has apparently not yet been updated to perform that check on the constructor.

[chaals]

done in 32c8a64

[chaals]

@tidoust so implementation is in canary and mozilla, and there are bugs? That's enough to mark it at-risk IMHO…

[tidoust]

@chaals Right, no objection from me to mark the feature as at-risk in HTML 5.2, with the understanding that if it cannot make it to HTML 5.2, the feature could still remain in the HTML Editor's Draft (unless the work on the Presentation API stops from some reason). I'll report on implementation status before the end of the HTML 5.2 CR period.