Index - Web APIs
o the system clipboard. 640 clipboard api api, async clipboard api, clipboard, clipboard api, clipboard event api, clipboardevent, landing, reference the clipboard api provides the ability to respond to clipboard commands (cut, copy, and paste) as well as to asynchronously read from and write to the system clipboard. access to the contents of the clipboard is gated behind the permissions api; without user permission, reading or altering the clipboard contents is not permitted. 641 clipboardevent api, clipboard api, event, experimental, interface the clipboardevent interface represents events providing information related to modification of the clipboard, that is cut, copy, and paste events. 642 clipboardevent() api, clipboard api, clipboardeven...
... context (or the default context if no context is specified). 1292 featurepolicy.features() the features() method of the featurepolicy interface returns a list of names of all features supported by the user agent. feature whose name appears on the list might not be allowed by the feature policy of the current execution context and/or might not be accessible because of user's permissions. 1293 featurepolicy.getallowlistforfeature() api, feature policy, feature-policy, reference the getallowlistforfeature() method of the featurepolicy allows query of the allow list for a specific feature for the current feature policy. 1294 federatedcredential api, credential management api, federatedcredential, interface, reference, credential management ...
...media streams api, mediastreamtrack, property, reference, onended the mediastreamtrack.onended event handler is used to specify a function which serves as an eventhandler to be called when the ended event occurs on the track. this event occurs when the track will no longer provide data to the stream for any reason, including the end of the media input being reached, the user revoking needed permissions, the source device being removed, or the remote peer ending a connection. 2472 mediastreamtrack.onmute event handler, media capture, media capture and streams, mediastreamtrack, property, reference, webrtc, mute, onmute mediastreamtrack's onmute event handler is called when the mute event is received. 2473 mediastreamtrack.onoverconstrained api, event handler, ...
...And 18 more matches

nsIFile
void copyto(in nsifile newparentdir, in astring newname); void copytofollowinglinks(in nsifile newparentdir, in astring newname); void copytofollowinglinksnative(in nsifile newparentdir, in acstring newname); native code only! void copytonative(in nsifile newparentdir, in acstring newname); native code only! ...
...ollowinglinks(in nsifile newparentdir, in astring newname); void copytofollowinglinksnative(in nsifile newparentdir, in acstring newname); native code only! void copytonative(in nsifile newparentdir, in acstring newname); native code only! ...
...eturns the parent nsifile for this nsifile. the parent will be null when this nsifile references the top of the volume. for example, c:\ does not have a parent. read only. path astring this attribute exposes the full platform-specific path of the nsifile (including the leafname). read only. ...
...And 7 more matches

AbsoluteOrientationSensor - Web APIs
if a feature policy blocks use of a feature it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. ...
...eframe: 'device' }; const sensor = new absoluteorientationsensor(options); sensor.addeventlistener('reading', () => { // model is a three.js object instantiated elsewhere. ...
...tions); sensor.addeventlistener('reading', () => { // model is a three.js object instantiated elsewhere. model.quaternion.fromarray(sensor.quaternion).inverse(); }); sensor.addeventlistener('error', error => { if (event.error.name == 'notreadableerror') { console.log("sensor is not available."); } }); sensor.start(); permissions example using orientation sensors requires requesting permissions for multiple device sensors. ...
...And 4 more matches

OrientationSensor - Web APIs
eframe: 'device' }; const sensor = new absoluteorientationsensor(options); sensor.addeventlistener('reading', () => { // model is a three.js object instantiated elsewhere. ...
...ptions); sensor.addeventlistener('reading', () => { // model is a three.js object instantiated elsewhere. model.quaternion.fromarray(sensor.quaternion).inverse(); }); sensor.addeventlistener('error', error => { if (event.error.name == 'notreadableerror') { console.log("sensor is not available."); } }); sensor.start(); permissions example using orientation sensors requires requsting permissions for multiple device sensors. ...
... // model is a three.js object instantiated elsewhere. model.quaternion.fromarray(sensor.quaternion).inverse(); }); sensor.addeventlistener('error', error => { if (event.error.name == 'notreadableerror') { console.log("sensor is not available."); } }); sensor.start(); permissions example using orientation sensors requires requsting permissions for multiple device sensors. becuase the permissions uses promises, a good way to request permissions is to use promise.all. ...
...And 3 more matches

Sensor APIs - Web APIs
t. listening for errors thrown during its use. handling the errors gracefully so that the user experience is enhanced rather than degraded. the code example below illustrates these principles. the try...catch block catches errors thrown during sensor instantiation. it implements a handler for sensor.onerror to catch errors thrown during use. the only time anything is shown to the user is when permissions need to be requested and when the sensor type isn't supported by the device. if a feature policy blocks use of a feature it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. see feature-policy for implementation instructions. let accelerometer = null; try { accelerometer = new accelerometer({ referenceframe...
...ometer.start(); } catch (error) { // handle construction errors. if (error.name === 'securityerror') { // see the note above about feature policy. ...
...ut feature policy. console.log('sensor construction was blocked by a feature policy.'); } else if (error.name === 'referenceerror') { console.log('sensor is not supported by the user agent.'); } else { throw error; } } permissions and feature policy sensor readings may not be taken unless the user grants permission to a specific sensor type. do this using the permissions api. a brief example, shown below, requests permission before attempting to use the sensor. navigator.permissions.query({ name: 'accelerometer' }) .then(result => { if (result.state === 'denied') { console.log('permission to use accelerometer sensor is denied.'); return; } // use the sensor. }); an alternative approach is to attempt to use the error and listen for the securityerro...
...And 3 more matches

RelativeOrientationSensor - Web APIs
if a feature policy blocks use of a feature it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. ...
...eframe: 'device' }; const sensor = new relativeorientationsensor(options); sensor.addeventlistener('reading', () => { // model is a three.js object instantiated elsewhere. ...
...ptions); sensor.addeventlistener('reading', () => { // model is a three.js object instantiated elsewhere. model.quaternion.fromarray(sensor.quaternion).inverse(); }); sensor.addeventlistener('error', error => { if (event.error.name == 'notreadableerror') { console.log("sensor is not available."); } }); sensor.start(); permissions example using orientation sensors requires requsting permissions for multiple device sensors. ...
...And 2 more matches

XRPermissionDescriptor.requiredFeatures - Web APIs
the xrpermissiondescriptor dictionary's requiredfeatures property should be set prior to calling navigator.permissions.query() to a list of webxr features which must be supported for the app to work. this ensures that permissions are checked as applicable to ensure that those features are available upon request. syntax xrpermissiondescriptor = { mode: xrsessionmode, requiredfeatures: reqfeaturelist, optionalfeatures: optfeaturelist }; xrpermissiondescriptor.requiredfeatures = reqfeaturelist; reqfeaturelist = xrpermissiondescriptor.requiredfeatures; value an array of strings indicating the webxr features which must be available for use by the app or site. ...
...ures are available upon request. syntax xrpermissiondescriptor = { mode: xrsessionmode, requiredfeatures: reqfeaturelist, optionalfeatures: optfeaturelist }; xrpermissiondescriptor.requiredfeatures = reqfeaturelist; reqfeaturelist = xrpermissiondescriptor.requiredfeatures; value an array of strings indicating the webxr features which must be available for use by the app or site. the permissions check will be performed in such a manner as to verify that all features in the list are available for use with the user's permission. currently, all features are members of the xrreferencespacetype enumerated type, indicating the reference space types that your app would like permission to use, but can operate without. future editions of webxr may add more recognized features. the permitted val...
..., and is supported by all instances of xrsession, both immersive and inline, though it's most useful for inline sessions. it's particularly useful when determining the distance between the viewer and an input, or when working with offset spaces. otherwise, typically, one of the other reference space types will be used more often. ...
...And 2 more matches

XRPermissionDescriptor - Web APIs
user permissions in the webxr device api are managed using the permissions api. to that end, the xrpermissiondescriptor dictionary is used to describe the webxr features the app needs to use, as well as those features it would like ot use if permision is granted. the xrpermissiondescriptor's name must be set to xr in order to direct the permissions api to correctly handle the request as applying to webxr. properties in addition to inheriting the properties of the parent interface, permissiondescriptor, xrpermissiondescriptor provides the following properties. mode an xrsessionmode value indicating the xr mode (inline, immersive-vr, or immersive-ar) for which the permissions are requested. optionalfeatures an array of strings, each specifying the name of a webxr feature which is requested...
...nit; see default features in xrsessioninit for further information. requiredfeatures an array of strings giving the names of the webxr features for which permission must be obtained in order to use your app or site. examples the example below demonstrates performing the permission request for an application that requires the local-floor reference space in an immersive-vr environment. if the permissions api is found to be available (by checking to see if navigator.permissions is defined), its query() method is called, specifying the permission descriptor we've established, xrpermissiondesc. when the returned promise resolves, we check the returned status. if permission has been granted, we call a function setupxr() that handles preparing the webxr environment for use. if permission is condition...
...asking for permission before enabling and starting up the environment. and for any other returned state—which is almost certainly denied, which is the only other option as of this article's writing—we do nothing, since we can't use webxr. if the permission request promise is rejected, the error is handled (currently by just dumping it to the console using domxref("console.log()")}}). ...
...And 2 more matches

Cross-domain Content Scripts - Archive of obsolete content
by default, content scripts don't have any cross-domain privileges. in particular, they can't: access content hosted in an iframe, if that content is served from a different domain make cross-domain xmlhttprequests however, you can enable these features for specific domains by adding them to your add-on's package.json under the "cross-domain-content" key, which itself lives under the "permissions" key: "permissions": { "cross-domain-content": ["http://example.org/", "http://example.com/"] } the domains listed must include the scheme and fully qualified domain name, and these must exactly match the domains serving the content - so in the example above, the content script will not be allowed to access content served from https://example.com/. wildcards are not allowed. this feature is...
... cross-domain xmlhttprequest the following add-on creates a panel whose content is the summary weather forecast for shetland. if you want to try it out, you'll need to register and get an api key. the "main.js": creates a panel whose content is supplied by "panel.htm...
...suppose your content script includes a line like: // content-script.js: unsafewindow.mycustomapi = function () {}; if you have included the "cross-domain-content" key, when th...
...suppose your content script includes a line like: // content-script.js: unsafewindow.mycustomapi = function () {}; if you have included the "cross-domain-content" key, when the page script tries to access mycustomapi this will result in a "permission denied" exceptio...

Getting File Information - Archive of obsolete content
nvenient to pass the returned time to the date constructor. var lastmod = new date(file.lastmodifiedtime); in this example, a date object is created using the modification time of a file. you can change the modification time of a file by setting the lastmodifiedtime (nsifile.attributes) attribute, or you can just write to the file, in which case the value will be adjusted automatically. file permissions several methods may be used to check for file permissions. the following four methods return true or false: nsifile.isreadable() - returns true if the file can be read from. nsifile.iswritable() - returns true if the file can be written to. nsifile.isexecutable() - returns true if the file can be executed. nsifile.ishidden() - returns true if the file is hidden. in this example, an exece...
...xeception will occur if the file cannot be written to. if (!file.iswritable()) throw "file cannot be modified"; if you aren't sure whether a file can be modified, for example, you may wish to check using nsifile.iswritable() first. otherwise, an attempt to write to the file will generate an error. the four methods above are usually sufficient for most purposes. ...
...n be modified, for example, you may wish to check using nsifile.iswritable() first. otherwise, an attempt to write to the file will generate an error. the four methods above are usually sufficient for most purposes. however, you can also use the permissions (nsifile.attributes) attribute to get the unix-style permission flags for a file. this attribute is also necessary if you need to modify the permissions. file.permissions = 0640; it is common to use an octal number (a number in base 8 beginning with 0) for permissions as it can make the value easier to read. in this case, the first digit is the permissions for the owner of the file, the second digit is the permissions for the group of the file and the third digit is the permissions for everyone else. the value is a sum of three values, 4 for r...
...number (a number in base 8 beginning with 0) for permissions as it can make the value easier to read. in this case, the first digit is the permissions for the owner of the file, the second digit is the permissions for the group of the file and the third digit is the permissions for everyone else. the value is a sum of three values, 4 for readable, 2 for writable and 1 for executable. the default permissions for files when created through an output stream is 0644, which means that the file is readable and writable by the owner of the file and read only for others. some of the permissions may not be supported on some platforms. ...

Common Firefox theme issues and solutions - Archive of obsolete content
: url("chrome://mozapps/skin/extensions/extensions.svg#greyscale"); opacity:0.3; } about:memory about:memory nodes do not collapse the styling of about:memory is a little messed up in that nodes do not collapse as they should when clicked on. to fix this issue you need to copy the following file from the latest version of firefox to your theme: chrome://global/content/aboutmemory.css. ...
...s.svg#greyscale"); opacity:0.3; } about:memory about:memory nodes do not collapse the styling of about:memory is a little messed up in that nodes do not collapse as they should when clicked on. to fix this issue you need to copy the following file from the latest version of firefox to your theme: chrome://global/content/aboutmemory.css. ...
...out:memory nodes do not collapse the styling of about:memory is a little messed up in that nodes do not collapse as they should when clicked on. to fix this issue you need to copy the following file from the latest version of firefox to your theme: chrome://global/content/aboutmemory.css. about:permissions domain names don't line up in about:permissions the domains on the domain list of about:permissions do not line up properly due to missing placeholder icons for domains without favicons. ...
...le from the latest version of firefox to your theme: chrome://global/content/aboutmemory.css. about:permissions domain names don't line up in about:permissions the domains on the domain list of about:permissions do not line up properly due to missing placeholder icons for domains without favicons. ...

Index
ager2 cookies, interfaces, interfaces:scriptable, xpcom, xpcom api reference, xpcom interface reference the nsicookiemanager2 interface contains additional methods that expand upon the nsicookiemanager interface. 454 nsicookiepermission cookies, interfaces, interfaces:scriptable, xpcom, xpcom api reference the nsicookiepermission interface is used to test for cookie permissions 455 nsicookiepromptservice cookies, interfaces, interfaces:scriptable, xpcom, xpcom api reference, xpcom interface reference the nsicookiepromptservice interface is to open a dialog to ask to permission to accept the cookie. 456 nsicookieservice cookies, interfaces, interfaces:scriptable, xpcom, xpcom api reference, xpcom interface reference see nsicookie...
... 653 nsifileinputstream interfaces, interfaces:scriptable, needscontent, xpcom, xpcom api reference, xpcom interface reference no summary! ...
... 653 nsifileinputstream interfaces, interfaces:scriptable, needscontent, xpcom, xpcom api reference, xpcom interface reference no summary! 654 nsifileoutputstream interfaces, interfaces:scriptable, xpcom,...
...table, xpcom, xpcom interface reference the nsipermission interface defines a "permission" object, which is used to allow or block objects (for example cookies, images) from certain sites based on user preferences. 825 nsipermissionmanager interfaces, interfaces:scriptable, xpcom, xpcom interface reference the nsipermissionmanager interface is used to persistently store permissions for different object types (cookies, images, and so on) on a site-by-site basis. 826 nsipipe interfaces, interfaces:scriptable, streams, xpcom, xpcom interface reference initialize this pipe. 827 nsiplacesimportexportservice bookmarks, interfaces, interfaces:scriptable, places, xpcom interface reference in the past, this interface also offered methods for...

nsISecurityCheckedComponent
special handing (xul controllers, the ui for the <video> tag, etc.). method overview string cancallmethod(in nsiidptr iid, in wstring methodname); string cancreatewrapper(in nsiidptr iid); string cangetproperty(in nsiidptr iid, in wstring propertyname); string cansetproperty(in nsiidptr iid, in wstring propertyname); methods cancallmethod() returns a capability string indicating what permissions are required to call the specified method on the given interface. string cancallmethod( in nsiidptr iid, in wstring methodname ); parameters iid the iid of the interface this method exists on. methodname the name of the method to be called on the interface. return value the capability required to call this method. see capability strings for details. cancreatewrapper() returns a string indi...
...d to call the specified method on the given interface. string cancallmethod( in nsiidptr iid, in wstring methodname ); parameters iid the iid of the interface this method exists on. methodname the name of the method to be called on the interface. return value the capability required to call this method. see capability strings for details. cancreatewrapper() returns a string indicating what permissions are required to create a wrapper for the given interface. string cancreatewrapper( in nsiidptr iid ); parameters iid the interface to reflect into javascript. return value the capability required to reflect this interface. note that if wrapper creation is prevented, the properties and methods will not be defined on the javascript object, whereas if wrapper creation succeeds but methods/pro...
...into javascript. return value the capability required to reflect this interface. note that if wrapper creation is prevented, the properties and methods will not be defined on the javascript object, whereas if wrapper creation succeeds but methods/properties are prevented, the properties and methods will be visible, not not usable. see capability strings for details. cangetproperty() returns the permissions required to get the specified property on the given interface. string cangetproperty( in nsiidptr iid, in wstring propertyname ); parameters iid the interface that the property to get exists on. propertyname the name of the property to be retrieved on this interface. return value the capability required to get the property. see capability strings for details. cansetproperty() returns th...
...equired to get the specified property on the given interface. string cangetproperty( in nsiidptr iid, in wstring propertyname ); parameters iid the interface that the property to get exists on. propertyname the name of the property to be retrieved on this interface. return value the capability required to get the property. see capability strings for details. cansetproperty() returns the permissions required to set the specified property on the given interface. string cansetproperty( in nsiidptr iid, in wstring propertyname ); parameters iid the interface that the property to set exists on. propertyname the name of the property to be set on this interface. return value the capability required to set the property. see capability strings for details. ...

Clipboard.read() - Web APIs
the read() method of the clipboard interface requests a copy of the clipboard's contents, delivering the data to the returned promise when the promise is resolved. unlike readtext(), the read() method can return arbitrary data, such as images. this method can also return text. to read from the clipboard, you must first have the "clipboard-read" permission. note: the asynchronous clipboard and permissions apis are still in the process of being integrated into most browsers, so they often deviate from the official rules for permissions and the like. be sure to review the compatibility table before using these methods. syntax var promise = navigator.clipboard.read(); parameters none. return value a promise that resolves with a datatransfer object containing the clipboard's contents. the promi...
... official rules for permissions and the like. be sure to review the compatibility table before using these methods. syntax var promise = navigator.clipboard.read(); parameters none. return value a promise that resolves with a datatransfer object containing the clipboard's contents. the promise is rejected if permission to access the clipboard is not granted. example after using navigator.permissions.query() to find out if we have (or if the user will be prompted to allow) "clipboard-read" access, this example fetches the data currently on the clipboard. if it's not a png image, an error message is presented. otherwise, an image element referred to using the variable imgelem has its source replaced with the clipboard's contents. ...
.... example after using navigator.permissions.query() to find out if we have (or if the user will be prompted to allow) "clipboard-read" access, this example fetches the data currently on the clipboard. if it's not a png image, an error message is presented. otherwise, an image element referred to using the variable imgelem has its source replaced with the clipboard's contents. // first, ask the permissions api if we have some kind of access to // the "clipboard-read" feature. navigator.permissions.query({name: "clipboard-read"}).then(result => { // if permission to read the clipboard is granted or if the user will // be prompted to allow it, we proceed. if (result.state == "granted" || result.state == "prompt") { navigator.clipboard.read().then(data => { for (let i=0; i<data.items...
...type != "image/png") { alert("clipboard contains non-image data. unable to access it."); } else { const blob = data.items[i].gettype("image/png"); imgelem.src = url.createobjecturl(blob); } } }); } }); note: at this time, while firefox does implement read(), it does not recognize the "clipboard-read" permission, so attempting to use the permissions api to manage access to the api will not work. specifications specification status comment clipboard api and eventsthe definition of 'read()' in that specification. working draft initial definition. ...

Using the Notifications API - Web APIs
— but going forward browsers will explicitly disallow notification permission requests not triggered in response to a user gesture. firefox is already doing this from version 72, for example, and safari has done it for some time. in addition, in chrome and firefox you cannot request notifications at all unless the site is a secure context (i.e. https), and you can no longer allow notification permissions to be requested from cross-origin <iframe>s. checking current permission status you can check to see if you already have permission by checking the value of the notification.permission read only property. it can have one of three possible values: default the user hasn't been asked for permission yet, so notifications won't be displayed. granted the user has granted permission to display n...
...requestpermission().then(function(result) { console.log(result); }); this uses the promise-based version of the method. if you want to support older versions, you might have to use the older callback version, which looks like this: notification.requestpermission(); the callback version optionally accepts a callback function that is called once the user has responded to the request to display permissions. ...
...nt to support older versions, you might have to use the older callback version, which looks like this: notification.requestpermission(); the callback version optionally accepts a callback function that is called once the user has responded to the request to display permissions. example in our todo list demo, we include an "enable notifications" button that, when pressed, requests notification permissions for the app. ...
... once the user has responded to the request to display permissions. example in our todo list demo, we include an "enable notifications" button that, when pressed, requests notification permissions for the app. ...

widget - Archive of obsolete content
onmouseout function include this to listen to the widget's mouseout event. onattach function include this to listen to the widget's attach event. tooltip string optional text to show when the user's mouse hovers over the widget. if not given, the label is used. allow object an optional object describing permissions for the content. it should contain a single key named script whose value is a boolean that indicates whether or not to execute script in the content. script defaults to true. contentscriptfile string,array a local file url or an array of local file urls of content scripts to load. content scripts specified by this property are loaded before those specified by the contentsc...
...he content script will no longer be received by the main add-on code, and vice versa. this issue is currently tracked as bug 825434. panel a panel to open when the user clicks on the widget. width the widget's width in pixels. setting it updates the widget's appearance immediately. tooltip the text of the tooltip that appears when the user hovers over the widget. allow a object describing permissions for the content. it contains a single key named script whose value is a boolean that indicates whether or not to execute script in the content. contentscriptfile a local file url or an array of local file urls of content scripts to load. contentscript a string or an array of strings containing the texts of content scripts to load. contentscriptwhen when to load the content scripts. this may...
...ll no longer be received by the main add-on code, and vice versa. this issue is currently tracked as bug 825434. panel a panel to open when the user clicks on the widget view. width the widget view's width in pixels. setting it updates the widget view's appearance immediately. tooltip the text of the tooltip that appears when the user hovers over the widget view. allow a object describing permissions for the content. it contains a single key named script whose value is a boolean that indicates whether or not to execute script in the content. contentscriptfile a local file url or an array of local file urls of content scripts to load. contentscript a string or an array of strings containing the texts of content scripts to load. contentscriptwhen when to load the content scripts. this may...

OS.File for the main thread
promise<file> open( in string path...
... file does not exist. os.file.removedir() remove an existing directory and its contents. promise<void> removedir( in string path, [optional] in object options ) arguments path a string representing the name of the file to remove. options an object that may contain the following fields ignoreabsent if false, this function will throw an error if the directory doesn't exist. ignorepermissions if true, this function will remove the directory even when lacking write permissions. promise can be rejected with os.file.error in case of any error, in particular if path isn't a directory. os.file.setcurrentdirectory() change the current directory of the process. use with extreme caution: this api may be useful for application developers but must not be used by add-ons, as it chang...
... the last access date. if numeric, milliseconds since epoch. if omitted or null, the current date will be used. modificationdate the last modification date. if numeric, milliseconds since epoch. if omitted or null, the current date will be used. promise can be rejected with os.file.error in case of any error, in particular if the path does not represent an existing file. os.file.setpermissions() sets the file's access permission bits. promise<void> setpermissions( in string path, in object options ) arguments path the complete path to the file. options the new attributes to set winattributes this is an object with following optional keys. ignored under non-windows platforms. hidden boolean. set to true to make the target hidden, or false to make it visible. readonl...

Index
} win95::x86 { equivalentplatform {winnt::x86} } sunos:5.5.1:sparc { modulename { "example unix module" } modulefile { unix/fort.so } defaultmechanismflags{0x0001} cipherenableflags{0x0001} files { unix/fort.so { relativepath{%root%/lib/fort.so} absolutepath{/usr/local/netscape/lib/fort.so} filepermissions{555} } xplat/instr.html { relativepath{%root%/docs/inst.html} absolutepath{/usr/local/netscape/docs/inst.html} filepermissions{555} } } } irix:6.2:mips { equivalentplatform { sunos:5.5.1:sparc } } } script grammar the script is basic java, allowing lists, key-value pairs, strings, and combin...
... absolute path. executable specifies that the file is to be executed during the course of the installation. typically, this string is used for a setup program provided by a module vendor, such as a self-extracting setup executable. more than one file can be specified as executable, in which case the files are run in the order in which they are specified in the script file. filepermissions sets permissions on any referenced files in a string of octal digits, according to the standard unix format. this string is a bitwise or. user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: 000...
... according to the standard unix format. this string is a bitwise or. user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: 0002 other execute: 0001 some platforms may not understand these permissions. they are applied only insofar as they make sense for the current platform. if this attribute is omitted, a default of 777 is assumed. nss database types nss originally used berkeleydb databases to store security information. the last versions of these legacy databases are: o cert8.db for certificates o key3.db for keys o secmod.db for pkcs #11 module information ...

NSS tools : modutil
--> valuelist valuelist --> value valuelist <null> value ---> key...
... --> valuelist valuelist --> value valuelist <null> value ---> key_value_pair string key_value_pair --> key { valuelist } key --> string string --> simple_string "complex_string" simple_string...
...he file as an absolute path. executable specifies that the file is to be executed during the course of the installation. typically, this string is used for a setup program provided by a module vendor, such as a self-extracting setup executable. more than one file can be specified as executable, in which case the files are run in the order in which they are specified in the script file. filepermissions sets permissions on any referenced files in a string of octal digits, according to the standard unix format. this string is a bitwise or. user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: 0002 other execute: 0001 some platforms may not understand these permissions. they are applied only insofar as ...

NSS Tools modutil
.cab } } } } win95::x86 { equivalentplatform {winnt::x86} } sunos:5.5.1:sparc { modulename { "fortezza unix module" } modulefile { unix/fort.so } defaultmechanismflags{0x0001} cipherenableflags{0x0001} files { unix/fort.so { relativepath{%root%/lib/fort.so} absolutepath{/usr/local/netscape/lib/fort.so} filepermissions{555} } xplat/instr.html { relativepath{%root%/docs/inst.html} absolutepath{/usr/local/netscape/docs/inst.html} filepermissions{555} } } } irix:6.2:mips { equivalentplatform { sunos:5.5.1:sparc } }} script grammar the script file grammar is as follows: --> valuelistvaluelist --> value valuelist <null>value...
...ath, it uses the absolute path. executable specifies that the file is to be executed during the course of the installation. typically this string would be used for a setup program provided by a module vendor, such as a self-extracting setup.exe. more than one file can be specified as executable, in which case the files are run in the order in which they are specified in the script file. filepermissions interpreted as a string of octal digits, according to the standard unix format. this string is a bitwise or of the following constants: user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: ...
...x format. this string is a bitwise or of the following constants: user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: 0002 other execute: 0001 some platforms may not understand these permissions. they are applied only insofar as they make sense for the current platform. if this attribute is omitted, a default of 777 is assumed. examples creating database filesdisplaying module informationsetting a default providerenabling a slotenabling fips complianceadding a cryptographic moduleinstalling a cryptographic module from a jar filechanging the password on a token creating database...

NSS tools : modutil
} win95::x86 { equivalentplatform {winnt::x86} } sunos:5.5.1:sparc { modulename { "example unix module" } modulefile { unix/fort.so } defaultmechanismflags{0x0001} cipherenableflags{0x0001} files { unix/fort.so { relativepath{%root%/lib/fort.so} absolutepath{/usr/local/netscape/lib/fort.so} filepermissions{555} } xplat/instr.html { relativepath{%root%/docs/inst.html} absolutepath{/usr/local/netscape/docs/inst.html} filepermissions{555} } } } irix:6.2:mips { equivalentplatform { sunos:5.5.1:sparc } } } script grammar the script is basic java, allowing lists, key-value pairs, strings, and combin...
... absolute path. executable specifies that the file is to be executed during the course of the installation. typically, this string is used for a setup program provided by a module vendor, such as a self-extracting setup executable. more than one file can be specified as executable, in which case the files are run in the order in which they are specified in the script file. filepermissions sets permissions on any referenced files in a string of octal digits, according to the standard unix format. this string is a bitwise or. user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: 000...
... according to the standard unix format. this string is a bitwise or. user read: 0400 user write: 0200 user execute: 0100 group read: 0040 group write: 0020 group execute: 0010 other read: 0004 other write: 0002 other execute: 0001 some platforms may not understand these permissions. they are applied only insofar as they make sense for the current platform. if this attribute is omitted, a default of 777 is assumed. nss database types nss originally used berkeleydb databases to store security information. the last versions of these legacy databases are: o cert8.db for certificates o key3.db for keys o secmod.db for pkcs #11 module information ...

nsIPermissionManager
netwerk/base/nsipermissionmanager.idlscriptable please add a summary to this article. ...
... in string type); pruint32 testexactpermissionfromprincipal(in nsiprincipal principal, in string type); pruint32 testpermission(in nsiuri uri, in string type); pruint32 testpermissionfromprincipal(in nsiprincipal principal, in string type); attributes attribute type description enumerator nsisimpleenumerator enumerates all stored permissions. allows access to nsipermission objects. read only. constants permission type constants constant value description unknown_action 0 default permission when no entry is found for a host. it should not be used by consumers. allow_action 1 permission is allowed. deny_action 2 permission is denied. prompt_action 3 pro...
...cipal and permission type. void removefromprincipal( in nsiprincipal principal, in string type ); parameters principal the principal whose permission will be removed. type a case-sensitive ascii string, identifying the type of the permission to be removed. this must have been previously registered using the add() method. removepermission() remove a given permission from the stored permissions. void removepermission( in nsipermission perm ); parameters nsipermission the permission which will be removed. removeallsince() remove permission information for a given host string and permission type. void remove( in int64_t since ); parameters since epoch timestamp. permission information stored after this timestamp will be removed. removeall() remove permission inform...

nsIScriptableIO
the file does not have to exist already; this method simply creates the file reference which may then be passed to the newinputstream() or newoutputstream() method to open the file for reading or writing. files are located by starting at a known directory, specifie...
...e nsimultiplexinputstream interface. exceptions thrown ns_error_invalid_arg abase was null. newoutputstream() retrieves a stream to which data can be written. nsisupports newoutputstream( in nsivariant abase, in astring amode, [optional] in astring acharset, [optional] in astring areplacechar, [optional] in unsigned long abuffersize, [optional] in unsigned long apermissions ); parameters abase the base object to which to write. this should be one of the following types: nsifile: an object returned by getfile() or getfilewithpath(), or any object implementing the nsifile interface. nsitransport: a transport object such as a socket. nsioutputstream: a stream returned by a previous call to this method, or any other object that implements nsiout...
... acharset the character set to use for interpreting the text data being written. used only in conjunction with the text input mode. by default, streams are interpreted in utf-8. areplacechar the character used to replace unknown characters in the output stream. abuffersize the size of the buffer to use. by default, the buffer is 1024 bytes long. apermissions the permissions to use on a newly created file, if applicable. typically you will use an actual octal permissions value for this parameter. by default, the value 0664 is used. return value returns an nsioutputstream object to use for writing the stream. exceptions thrown ns_error_invalid_arg abase was null. example: writing to a file var json = "{ name: 'bob', age: 37}"; v...

MediaDevices.getUserMedia() - Web APIs
this time. this will happen if the browsing context is insecure (that is, the page was loaded using http rather than https). it also happens if the user has specified that the current browsing instance is not permitted access to the device, the user has denied access for the current session, or the user has denied all access to user media devices globally. on browsers that support managing media permissions with feature policy, this error is returned if feature policy is not configured to allow access to the input source(s). older versions of the specification used securityerror for this instead; securityerror has taken on a new meaning. notfounderror no media tracks of the type specified were found that satisfy the given constraints. notreadableerror although the user granted permission to u...
...nt in many browsers (though not always enabled by default, as in firefox). getusermedia() is one method which will require the use of feature policy, and your code needs to be prepared to deal with this. for example, you may need to use the allow attribute on any <iframe> that uses getusermedia(), and pages that use getusermedia() will eventually need to supply the feature-policy header. the two permissions that apply to getusermedia() are camera and microphone. for example, this line in the http headers will enable use of a camera for the document and any embedded <iframe> elements that are loaded from the same origin: feature-policy: camera 'self' this will request access to the microphone for the current origin and the specific origin https://developer.mozilla.org: feature-policy: microphone ...
...ed: a document loaded into a sandboxed <iframe> element cannot call getusermedia() unless the <iframe> has its sandbox attribute set to allow-same-origin. a document loaded using a data:// or blob:// url which has no origin (such as when one of these urls is typed by the user into the address bar) cannot call getusermedia(). these kinds of urls loaded from javascript code inherit the script's permissions. any other situation in which there is no origin, such as when the srcdoc attribute is used to specify the contents of a frame. examples width and height this example gives a preference for camera resolution, and assigns the resulting mediastream object to a video element. // prefer camera resolution nearest to 1280x720. var constraints = { audio: true, video: { width: 1280, height: 720 } }...

XRPermissionDescriptor.mode - Web APIs
the mode property of the xrpermissiondescriptor dictionary is a string taken from the xrsessionmode enumerated type, specifying which web xr session mode (inline, immersive-vr, or immersive-ar) the described permissions will be used for. syntax xrpermissiondescriptor = { mode: xrsessionmode, requiredfeatures: reqfeaturelist, optionalfeatures: optfeaturelist }; xrpermissiondescriptor.mode = xrsessionmode; xrmode = xrpermissiondescriptor.mode; value a domstring whose value is one of the strings found in the xrsessionmode enumerated type: immersive-ar the session's output will be given exclusive access to the immersive device, but the rendered content will be blended with the real-world environment. the session's environmentblendmode indicates the method to be used to blend the co...
... the example below checks to ensure that permission has been granted to allow the user to use webxr for an immersive virtual reality experience. no specific features are specified during this query; see requiredfeatures and optionalfeatures for more information on specifying features during a webxr permission check. ...
...to ensure that permission has been granted to allow the user to use webxr for an immersive virtual reality experience. no specific features are specified during this query; see requiredfeatures and optionalfeatures for more information on specifying features during a webxr permission check. ...

Web APIs
fullscreen apiggamepad api geolocation apihhtml drag and drop apihigh resolution timehistory apiiimage capture apiindexeddbintersection observer apillong tasks api mmedia capabilities api media capture and streamsmedia session apimedia source extensions mediastream recordingnnavigation timingnetwork information api ppage visibility apipayment request apiperformance apiperformance timeline apipermissions apipointer eventspointer lock apiproximity events push api rresize observer apiresource timing apisserver sent eventsservice workers apistoragestorage access apistreams ttouch eventsuurl apivvibration apivisual viewport wweb animationsweb audio apiweb authentication apiweb crypto apiweb notificationsweb storage apiweb workers apiwebglwebrtcwebvttwebxr device apiwebsockets api interfaces th...
... paymentresponse paymentvalidationerrors pbkdf2params performance performanceentry performanceeventtiming performanceframetiming performancelongtasktiming performancemark performancemeasure performancenavigation performancenavigationtiming performanceobserver performanceobserverentrylist performancepainttiming performanceresourcetiming performanceservertiming performancetiming periodicwave permissionstatus permissions photocapabilities plugin pluginarray point pointerevent popstateevent positionoptions processinginstruction progressevent promiserejectionevent publickeycredential publickeycredentialcreationoptions publickeycredentialrequestoptions pushevent pushmanager pushmessagedata pushregistrationmanager pushsubscription r rtcansweroptions rtccertificate rtcconfiguratio...
...est xmlhttprequesteventtarget xmlhttprequestresponsetype xmlserializer xpathevaluator xpathexception xpathexpression xpathnsresolver xpathresult xrboundedreferencespace xrenvironmentblendmode xreye xrframe xrframerequestcallback xrhandedness xrinputsource xrinputsourcearray xrinputsourceevent xrinputsourceeventinit xrinputsourceschangeevent xrinputsourceschangeeventinit xrpermissiondescriptor xrpermissionstatus xrpose xrreferencespace xrreferencespaceevent xrreferencespaceeventinit xrreferencespacetype xrrenderstate xrrenderstateinit xrrigidtransform xrsession xrsessionevent xrsessioneventinit xrsessioninit xrsessionmode xrspace xrsystem xrtargetraymode xrview xrviewerpose xrviewport xrvisibilitystate xrwebgllayer xrwebgllayerinit xsltprocessor ...

page-worker - Archive of obsolete content
js" file: remove the contentscriptfile option in the page() constructor. globals constructors page(options) creates an uninitialized page worker instance. parameters options : object optional options: name type contenturl string the url of the content to load in the panel. allow object an object with keys to configure the permissions on the page worker. the boolean key script controls if scripts from the page are allowed to run. script defaults to true. include string, regexp, array of (string or regexp) this is useful when your page worker loads a page which will redirect to other pages. a match pattern string or an array of match pattern strings. these define the document...
...to: send events to the content script using the port.emit function receive events from the content script using the port.on function see the guide to communicating using port for details. contenturl the url of content to load. this can point to local content loaded from your add-on's "data" directory or remote content. setting it loads the content immediately. allow a object describing permissions for the content. it contains a single key named script whose value is a boolean that indicates whether or not to execute script in the content. script defaults to true. include a set of match patterns to define the urls which the page-worker's content script will be applied. this is useful when using pages which redirect to other pages in your page-worker. contentscriptfile a local file url o...

panel - Archive of obsolete content
ssue. optional, default to true. contenturl string,url the url of the content to load in the panel. that is, they can't refer to remote scripts. the urls are usually constructed using self.data.url(). from firefox 34, you can use "./my-file.html" as an alias for self.data.url("my-file.html"). allow object an optional object describing permissions for the content. it should contain a single key named script whose value is a boolean that indicates whether or not to execute script in the content. script defaults to true. contentscriptfile string,array a url or an array of urls. the urls point to scripts to load into the panel. the scripts must be packaged with the add-on under the add-on's data directory. that is...
...ht of the panel in pixels. width the width of the panel in pixels. focus whether or not focus will be taken away when the panel is shown. this property is read-only. contenturl the url of content loaded into the panel. this can point to local content loaded from your add-on's "data" directory or remote content. setting it updates the panel's content immediately. allow an object describing permissions for the content. it contains a single key named script whose value is a boolean that indicates whether or not to execute script in the content. contentscriptfile a local file url or an array of local file urls of content scripts to load. content scripts specified by this property are loaded before those specified by the contentscript property. contentscript a string or an array of strings con...

content/symbiont - Archive of obsolete content
js, css, images) for the page has been loaded, at the time the window.onload event fires this property is optional and defaults to "end". contentscriptoptions object read-only value exposed to content scripts under self.options property. any kind of jsonable value (object, array, string, etc.) can be used here. optional. allow object permissions for the content, with the following keys: script boolean whether or not to execute script in the content. defaults to true. optional. optional. symbiont symbiont is composed from the worker trait, therefore instances of symbiont and their descendants expose all the public properties exposed by worker along with additional public properties that are listed below...
... ...

package.json - Archive of obsolete content
or your add-on, providing not only descriptive information about the add-on for presentation in the add-ons manager, but other metadata required of add-ons. some of its entries, such as icon, name, and description, have direct analogues in the install manifest format, and entries from package.json are written into the install manifest when the add-on is built using jpm xpi. others, such as lib, permissions, and preferences, represent instructions to the jpm tool itself to generate and include particular code and data structures in your add-on. creating a manifest the package.json file is initially generated in your add-on's root directory the first time you run jpm init. it looks like this (assuming the add-on's directory is "my-addon"): { "name": "my-addon", "title": "my-addon", "id": "ji...
...the parent directory. when the add-on is built as an xpi, if the fullname and title keys are not present, name is used as the add-on's em:name element in its install.rdf. packages note: this is deprecated along with cfx and is not available when using jpm. a string pointing to a directory containing additional packages. defaults to "packages". permissions an object describing the set of permissions that the add-on needs. private-browsing: a boolean indicating whether or not the add-on supports private browsing. if this value is not true or is omitted, then the add-on will not see any private windows or objects, such as tabs, that are associated with private windows. see the documentation for the private-browsing module. cross-dom...

XUL Structure - Archive of obsolete content
a a chrome url will be able to read files with the same access privileges as the installed extension. this distinction is important. this means that there are certain things that content of web pages cannot do, such as read the user's bookmarks. this distinction is not based on the kind of content being displayed; only on the type of url used. both html and xul placed on a web site have no extra permissions; however both html and xul loaded through a chrome url have enhanced permissions. remote xul was disabled in firefox 8, so the following is of historic interest only. if you are going to use xul on a web site, you can just put the xul file on the web site as you would an html file, and then load its url in a browser http://localhost/xul.php. ensure that your web server is configured to send xul...
...illa. the chrome directory is where you find all the files that describe the user interface used by the mozilla browser, mail client, and other applications. typically, you put all the xul files for an application in this directory, although extensions are installed in the extensions directory for a particular user. just copying a xul file into the chrome directory doesn't give the file any extra permissions, nor can it be accessed via a chrome url. to gain the extra privileges, you will need to create a manifest file and put that in the chrome directory. this file is easy to create, as it is typically only a couple of lines long. it is used to map a chrome url to a file or directory path on the disk where the xul files are located. details of how to create this file will be discussed in a later sect...

From object to iframe — other embedding technologies - Learn web development
maps or youtube, for example. note: github pages allow content to be served via https by default, so is useful for hosting content. if you are using different hosting and are not sure, ask your hosting provider about it. always use the sandbox attribute you want to give attackers as little power as you can to do bad things on your website, therefore you should give embedded content only the permissions needed for doing its job. of course, this applies to your own content, too. a container for code where it can be used appropriately — or for testing — but can't cause any harm to the rest of the codebase (either accidental or malicious) is called a sandbox. unsandboxed content can do way too much (executing javascript, submitting forms, popup windows, etc.) by default, you should impose all ...
...esting — but can't cause any harm to the rest of the codebase (either accidental or malicious) is called a sandbox. unsandboxed content can do way too much (executing javascript, submitting forms, popup windows, etc.) by default, you should impose all available restrictions by using the sandbox attribute with no parameters, as shown in our previous example. if absolutely required, you can add permissions back one by one (inside the sandbox="" attribute value) — see the sandbox reference entry for all the available options. one important note is that you should never add both allow-scripts and allow-same-origin to your sandbox attribute — in that case, the embedded content could bypass the same-origin policy that stops sites from executing scripts, and use javascript to turn off sandboxing alt...

FileUtils.jsm
nsifile getfile( string key, array patharray, bool followlinks ); parameters key the nsidirectoryservice key to start from (see getting special files for more info) patharray an arra...
..._wronly parameter to pr_open mode_create 0x08 corresponds to the pr_create_file parameter to pr_open mode_append 0x10 corresponds to the pr_append parameter to pr_open mode_truncate 0x20 corresponds to the pr_truncate parameter to pr_open perms_file 0644 default permissions when creating files. perms_directory 0755 default permissions when creating directories methods getfile() gets a file at the specified hierarchy under a nsidirectoryservice key. nsifile getfile( string key, array patharray, bool followlinks ); parameters key the nsidirectoryservice key to start from (see getting special files for more info) patharray an array of path components to locate beneath the directory specified by key. the la...

Named Shared Memory
file associated with the name. no assumptions about the persistence of data in the named file should be made. depending on platform, the shared memory may be mapped onto system paging space and be discarded at process termination. all names provided to pr_opensharedmemory should be valid filename syntax or name syntax for shared memory for the target platform. referenced directories should have permissions appropriate for writing. limits on shared memory resources different platforms have limits on both the number and size of shared memory resources. the default system limits on some platforms may be smaller than your requirements. these limits may be adjusted on some platforms either via boot-time options or by setting the size of the system paging space to accommodate more and/or larger shared ...
...latforms may be smaller than your requirements. these limits may be adjusted on some platforms either via boot-time options or by setting the size of the system paging space to accommodate more and/or larger shared memory segment(s). security considerations on unix platforms, depending on implementation, contents of the backing store for the shared memory can be exposed via the file system. set permissions and or access controls at create and attach time to ensure you get the desired security. on windows platforms, no special security measures are provided. named shared memory functions pr_opensharedmemory pr_attachsharedmemory pr_detachsharedmemory pr_closesharedmemory pr_deletesharedmemory ...

Secure Development Guidelines
s foo { private: char *ptr; public: foo() {} ~foo() { if (ptr) free(ptr); } }; constructor/destructor issues: prevention initialize the data members of an object in the constructor writing secure code: miscellaneous file i/o a lot can go wrong because a lot can be done with file input and output filenames permissions file handles and descriptors file i/o: filename divided in directories, subdirectories, and the file itself ‘/’ is separator; in windows ‘\’ would work too int openfile(char *file) { handle fh; if (strstr(file, “\”)) return -1; fh = createfilea(file, ...); writefile(fh, data, sizeofdata, null, null); } could be a normal file, direct...
...irectories, subdirectories, and the file itself ‘/’ is separator; in windows ‘\’ would work too int openfile(char *file) { handle fh; if (strstr(file, “\”)) return -1; fh = createfilea(file, ...); writefile(fh, data, sizeofdata, null, null); } could be a normal file, directory, device, or link directory traversal (../../../../) file i/o: file permissions should be set correctly be sure not to make world-writable files sensitive files shouldn’t be world readable file i/o: file descriptors and handles could be a race if instances of fh are shared between threads fh inheritence: default in unix, needs to be set in windows int main(int argc, char **argv, char **envp) { int fd = open("/etc/shadow", o_rdwr); setreuid(getuid(), ...

nsICookiePermission
the nsicookiepermission interface is used to test for cookie permissions netwerk/cookie/nsicookiepermission.idlscriptable please add a summary to this article. last changed in gecko 1.9 (firefox 3) inherits from: nsisupports method overview nscookieaccess canaccess(in nsiuri auri, in nsichannel achannel); boolean cansetcookie(in nsiuri auri, in nsichannel achannel, in nsicookie2 acookie, inout boolean aissession, inout print64 aexpiry); nsiuri getoriginatinguri(in nsichannel achannel); void setaccess(in nsiuri auri, in nscookieaccess aaccess); constants constant value description access_default 0 nscookieaccess's access default value access_allow 1 nscookieaccess's access allow value access_deny 2 nscookieaccess's access deny value access_session 8 additional ...
...the loadgroup of the channel to find the root content docshell, and the uri associated with its principal. if the root content docshell or its principal's uri cannot be obtained, this method will throw. nsiuri getoriginatinguri( in nsichannel achannel ); parameters achannel the channel for the load trying to get or set cookies. return value the originating uri. setaccess() sets cookie access permissions for the given uri. this may result in other uris being blocked as well, such as uris that share the same host name. void setaccess( in nsiuri auri, in nscookieaccess aaccess ); parameters auri the uri to block. aaccess the new cookie access permissions for the uri. see also nsicookie nsicookie2 nsicookiemanager nsicookiemanager2 ...

WebIDL bindings
hod. the include for that class must be found in a directory based on its name. [jsimplementation="@mozilla.org/dom/foo;1"] interface foo { [staticclassoverride="mozilla::dom::otherclass"] static promise<void> dosomething(); }; rather than calling into a method on the js implementation; calling foo.dosomething() will result in calling mozilla::dom::otherclass::dosomething(). checking for permissions or preferences with js-implemented webidl, the init method should only return undefined. if any other value, such as null, is returned, the bindings code will assert or crash. in other words, it acts like it has a "void" return type. preference or permission checking should be implemented by adding an extended attribute to the webidl interface. this has the advantage that if the check fails, the...
...urn type. preference or permission checking should be implemented by adding an extended attribute to the webidl interface. this has the advantage that if the check fails, the constructor or object will not show up at all. for preference checking, add an extended attribute pref="mypref.enabled" where mypref.enabled is the preference that should be checked. settingslock is an example of this. for permissions or other kinds of checking, add an extended attribute func="mypermissionchecker" where mypermissionchecker is a function implemented in c++ that returns true if the interface should be enabled. this function can do whatever checking is needed. one example of this is pushmanager. example here's an example js implementation of the above interface. the invisiblevalue field will not be accessible t...

Clipboard - Web APIs
api, providing—if the user grants permission—both read and write access to the contents of the system clipboard. the clipboard api can be used to implement cut, copy, and paste features within a web application. the system clipboard is exposed through the global navigator.clipboard property. calls to the methods of the clipboard object will not succeed if the user hasn't granted the needed permissions using the permissions api and the "clipboard-read" or "clipboard-write" permission as appropriate. note: in reality, at this time browser requirements for access to the clipboard vary significantly. please see the section clipboard availability for details. all of the clipboard api methods operate asynchronously; they return a promise which is resolved once the clipboard access has been compl...
...clipboard. clipboard availability the asynchronous clipboard api is a relatively recent addition, and the process of implementing it in browsers is not yet complete. due to both potential security concerns and technical complexities, the process of integrating this api is happening gradually in most browsers. for example, firefox does not yet support the "clipboard-read" and "clipboard-write" permissions, so access to the methods that access and change the contents of the clipboard are restricted in other ways. for webextensions, you can request the clipboardread and clipboardwrite permissions to be able to use clipboard.readtext() and clipboard.writetext(). content scripts applied on http sites do not have access to the clipboard object. see extensions in firefox 63. in addition, read() and wr...

Navigator - Web APIs
iven format and output capabilities. navigator.maxtouchpoints read only returns the maximum number of simultaneous touch contact points are supported by the current device. navigatorplugins.mimetypes read only returns an mimetypearray listing the mime types supported by the browser. navigator.online read only returns a boolean indicating whether the browser is working online. navigator.permissions read only returns a permissions object that can be used to query and update permission status of apis covered by the permissions api. navigatorid.platform read only returns a string representing the platform of the browser. do not rely on this function to return a significant value. navigatorplugins.plugins read only returns a pluginarray listing the plugins installed in the browser. ...
...ko', on any browser. this property is kept only for compatibility purpose. navigator.serviceworker read only returns a serviceworkercontainer object, which provides access to registration, removal, upgrade, and communication with the serviceworker objects for the associated document. navigatorstorage.storage read only returns the singleton storagemanager object used for managing persistence permissions and estimating available storage on a site-by-site/app-by-app basis. navigatorid.useragent read only returns the user agent string for the current browser. navigator.xr read only returns xr object, which represents the entry point into the webxr api. non-standard navigator.buildid returns the build identifier of the browser. in modern browsers this property now returns a fixed tim...

Notification.requestPermission() - Web APIs
are supported, then check if permission has been granted for the current origin to send notifications, then request permission if required, before then sending a notification. ...
... // if the user accepts, let's create a notification if (permission === "granted") { var notification = new notification("hi there!"); } }); } // at last, if the user has denied notifications, and you // want to be respectful there is no need to bother them any more. } we no longer show a live sample on this page, as chrome and firefox no longer allow notification permissions to be requested from cross-origin <iframe>s, with other browsers to follow. to see a example in action, check out our to-do list example (also see the app running live.) note: in the above example we spawn notifications in response to a user gesture (clicking a button). this is not only best practice — you should not be spamming users with notifications they didn't agree to — but going forw...

Notification - Web APIs
are supported, then check if permission has been granted for the current origin to send notifications, then request permission if required, before then sending a notification. ...
... // if the user accepts, let's create a notification if (permission === "granted") { var notification = new notification("hi there!"); } }); } // at last, if the user has denied notifications, and you // want to be respectful there is no need to bother them any more. } we no longer show a live sample on this page, as chrome and firefox no longer allow notification permissions to be requested from cross-origin <iframe>s, with other browsers to follow. to see a example in action, check out our to-do list example (also see the app running live.) note: in the above example we spawn notifications in response to a user gesture (clicking a button). this is not only best practice — you should not be spamming users with notifications they didn't agree to — but going forw...

PushManager - Web APIs
contentencodings returns an array of supported content codings that can be used to encrypt the payload of a push message. methods pushmanager.getsubscription() retrieves an existing push subscription. it returns a promise that resolves to a pushsubscription object containing details of an existing subscription. if no existing subscription exists, this resolves to a null value. pushmanager.permissionstate() returns a promise that resolves to the permission state of the current pushmanager, which will be one of 'granted', 'denied', or 'prompt'. pushmanager.subscribe() subscribes to a push service. it returns a promise that resolves to a pushsubscription object containing details of a push subscription. a new push subscription is created if the current service worker does not have an existing...
...'granted', 'denied', or 'prompt'. pushmanager.subscribe() subscribes to a push service. it returns a promise that resolves to a pushsubscription object containing details of a push subscription. a new push subscription is created if the current service worker does not have an existing subscription. deprecated methods pushmanager.haspermission() returns a promise that resolves to the pushpermissionstatus of the requesting webapp, which will be one of granted, denied, or default. replaced by pushmanager.permissionstate(). pushmanager.register() subscribes to a push subscription. replaced by pushmanager.subscribe(). pushmanager.registrations() retrieves existing push subscriptions. replaced by pushmanager.getsubscription(). pushmanager.unregister() unregisters and deletes a specifi...

Starting up and shutting down a WebXR session - Web APIs
that it remains available until you no longer need it. setting it to null signals that the polyfill can be garbage collected when no objects depending on it are using it anymore. of course, you can simplify this depending on your needs; since your app is probably not going to go back and forth much on whether or not to use the polyfill, you can simplify this to just the specific case you need. permissions and security there are a number of security measures in place revolving around webxr. first among these is that use of immersive-vr mode—which entirely replaces the user's view of the world—requires that the xr-spatial-tracking feature policy be in place. on top of that, the document needs to be secure and currently focused. finally, you must call requestsession() from a user event handler,...
...mmersive-vr mode—which entirely replaces the user's view of the world—requires that the xr-spatial-tracking feature policy be in place. on top of that, the document needs to be secure and currently focused. finally, you must call requestsession() from a user event handler, such as the handler for the click event. for more specifics about securing webxr actitvities and usage, see the article permissions and security for webxr. confirming the session type you need is available before trying to create a new webxr session, it's often wise to first check to see if the user's hardware and software support the presentation mode you wish to use. this can also be used to determine whether to use an immersive or an inline presentation, for example. to find out if a given mode is supported, simply call...

XRPermissionDescriptor.optionalFeatures - Web APIs
inline sessions. it's particularly useful when determining the distance between the viewer and an input, or when working with offset spaces. otherwise, typically, one of the other reference space types will be used more often. ...
...icularly useful when determining the distance between the viewer and an input, or when working with offset spaces. otherwise, typically, one of the other reference space types will be used more often. ...

Feature Policy - HTTP
in a nutshell feature policy provides a mechanism to explicitly declare what functionality is used (or not used), throughout your website. ...
...nular control over certain features the web provides functionality and apis that may have privacy or security risks if abused. in some cases, you may wish to strictly limit how such functionality is used on a website. there are policy-controlled features to allow functionality to be enabled/disabled for specific origins or frames within a website. where available, the feature integrates with the permissions api, or feature-specific mechanisms to check if the feature is available. the features include (see features list): accelerometer ambient light sensor autoplay camera encrypted media fullscreen geolocation gyroscope magnetometer microphone midi paymentrequest picture-in-picture usb vr / xr examples using feature policy see feature policy demos for example usage of many pol...

Feature-Policy - HTTP
the http feature-policy header provides a mechanism to allow and deny the use of browser features in its own frame, and in content within any <iframe> elements in the document. this header is still in an experimental state, and is subject to change at any time. be wary of this when implementing it on your website. the header has now been renamed to permissions-policy in the spec, and this article will eventually be updated to reflect that change. for more information, see the main feature policy article. header type response header forbidden header name yes syntax feature-policy: <directive> <allowlist> <directive> the feature policy directive to apply the allowlist to. see directives below for a list of the permitted directive names. <allowlist> an allowli...
...pis in its application. ...

Navigator.mozNotification - Archive of obsolete content
d to display the specified message with an optional url. notification createnotification( in domstring title, in domstring description, in domstring iconurloptional ); parameters title the notification title. description the text to display in the notification. iconurl optional a url identifying the image to display in the notification. return value a new notification object. permissions when using notifications in an open web app, be sure to add the desktop-notification permission in your manifest file: "permissions": { "desktop-notification": {} } usage notes in firefox 22+, the instantiation of a new notification should be done with the notification object by calling new notification(title, options). nick desaulniers has written a notification shim to cover both new...

Interacting with page scripts - Archive of obsolete content
test.addeventlistener("click", function() { alert(window.foo.greetme("page script")); }, false); </script> </body> </html> reverting to the old behavior you can switch firefox back to the old behavior in which content scripts could expose objects and functions to page scripts using unsafewindow. to do this, add an option called “unsafe-content-script” under the “permissions” key in package.json, and set it to true. "permissions": { "unsafe-content-script": true } this is only a temporary migration aid, and will be removed eventually. communicating with page scripts there are two different ways a content script can communicate with a page script: using the dom postmessage() api using custom dom events using the dom postmessage api note that before ...

Content Scripts - Archive of obsolete content
ripts by default, content scripts don't have any cross-domain privileges. in particular, they can't access content hosted in an iframe, if that content is served from a different domain, or make cross-domain xmlhttprequests. however, you can enable these features for specific domains by adding them to your add-on's package.json under the "cross-domain-content" key, which itself lives under the "permissions" key. see the article on cross-domain content scripts. ...

private-browsing - Archive of obsolete content
browser window. the user enters private browsing by opening a new private browser window. when they do this, any existing non-private windows are kept open, so the user will typically have both private and non-private windows open at the same time. ...

content/loader - Archive of obsolete content
mcontentloaded event "end": load content scripts once all the content (dom, js, css, images) for the page has been loaded, at the time the window.onload event fires contentscriptoptions read-only value exposed to content scripts under self.options property. any kind of jsonable value (object, array, string, etc.) can be used here. optional. contenturl the url of the content loaded. allow permissions for the content, with the following keys: ...

Extension Packaging - Archive of obsolete content
les directly if you know the location of the application (if you are installing an extension as part of the application installer, for example), you can install the extension files directly to <appdir>/extensions/<extensionid>. the extension will be found automatically by the extension manager the next time the application is launched. when using this method you must verify that the file system permissions for the directories, and files for the extension, are set properly. otherwise, the extension manager may not function properly with the extension, or the extension itself may not work properly. including add-ons in a customized application a customized application can include add-ons, including extensions and themes, by placing the unpacked (that is, not the xpi files, but the packages' content...

How to convert an overlay extension to restartless - Archive of obsolete content
s.nsifileinputstream) .queryinterface(components.interfaces.nsiseekablestream); stream.init(file, 0x01, 0444, 0); // read-only, read by owner/group/others, normal behavior /* do stuff */ }); this bit of code is paraphrased and probably not to be recommended as-is, but it should work. (note that the usage of an octal integer literal, while standard for handling permissions, is dangerous and deprecated; usage of use es5 strict mode to disable this and other foot-guns is recommended) if you need to read/manipulate binary data, a nsibinaryinputstream instance is what you'll use on that stream (e.g. 32-bit integers, or fun stuff like 48-bit integers). not ideal, but it works and performs more than sufficiently well. all of that code above is no longer viable if you als...

Appendix: What you should know about open-source software licenses - Archive of obsolete content
nternet (copying from server to client). distributing software would be selling that cd-r or publishing the software on the internet. modifying software would be changing its functionality or adding new functions. duplication: copying a piece of software distribution: passing a piece of software to another person modification: modifying the software a typical software license will grant these permissions in return for a fee, and will still restrict some normally unrestricted uses. the software that microsoft sells, such as windows, comes with a license that permits only limited duplication in exchange for a fee, so, although customers can install it on their computers, they cannot modify it. and essential freedoms, such as reverse-engineering, are also restricted. this use permit is displayed wh...

Local Storage - Archive of obsolete content
nd creates it if necessary. getlocaldirectory : function() { let directoryservice = cc["@mozilla.org/file/directory_service;1"]. getservice(ci.nsiproperties); // this is a reference to the profile dir (profd) now. let localdir = directoryservice.get("profd", ci.nsifile); localdir.append("xulschool"); if (!localdir.exists() || !localdir.isdirectory()) { // read and write permissions to owner and group, read-only for others. localdir.create(ci.nsifile.directory_type, 0774); } return localdir; }, profd is a special identifier for the profile directory that exists so that you don't need to figure out its location. in general this is the only directory flag you'll need, but sometimes you'll need access to other system directories, and you don't want to have to worry a...

Extensions support in SeaMonkey 2 - Archive of obsolete content
are listed below: url in firefox url in seamonkey overlays chrome://browser/content/browser.xul chrome://navigator/content/navigator.xul main browser window chrome://browser/content/pageinfo/pageinfo.xul chrome://navigator/content/pageinfo/pageinfo.xul page info window chrome://browser/content/preferences/permissions.xul chrome://communicator/content/permis...onsmanager.xul permissions manager dialog urls added in 2.1 url in firefox url in seamonkey chrome://browser/content/bookmarks/bookmarkspanel.xul chrome://communicator/content/bookmarks/bm-panel.xul chrome://browser/content/places/places.xul chrome://communicator/...

Session store API - Archive of obsolete content
uired (one for each window that was saved in the session store), and cookies and the list of recently closed tabs are restored. after that, the following steps are taken for each tab being restored: either an existing tab is reused or a new tab is created. in the latter case, a tabopen event is sent. the tab's persistent xul attributes (those saved due to calls to persisttabattribute()) and permissions are restored. the sstabrestoring event is sent. the tab is told to load the url it should be displaying. when the page is finished loading, text fields and scroll state are restored. finally, the sstabrestored event is sent. if you want to set permissions or otherwise manipulate a restored tab before the page is loaded into it, you should watch sstabrestoring. if you want to do something af...

Index - Archive of obsolete content
. 3356 makefile - .mk files no summary! 3415 misc top level these pages were moved from the top level of mdn in a spate of furious reorganization. 3416 bypassing security restrictions and signing code security, web development early versions of firefox allowed web sites to segregate principals using signed scripts, and request extra permissions for scopes within signed scripts using a function called enableprivelege. these privilege manager feature was not used much (aside from abuse), and its complexity made performance improvements difficult. signed script segregation was removed in bug 726125, the enableprivilege prompt was removed in bug 750859, and enableprivilege itself was nerfed in bug 757046. 3417 creating a web base...

Index of archived content - Archive of obsolete content
homeprovider.jsm homestorage nativewindow contextmenus doorhanger menu toast notifications.jsm pageactions.jsm prompt.jsm runtimepermissions.jsm snackbars.jsm sound.jsm tab addons developer guide code snippets creating a user interface firefox hub walkthrough initialization and cleanup prerequisites walkthrough webextensions for firefox for android ...

Bypassing Security Restrictions and Signing Code - Archive of obsolete content
early versions of firefox allowed web sites to segregate principals using signed scripts, and request extra permissions for scopes within signed scripts using a function called enableprivelege. these privilege manager feature was not used much (aside from abuse), and its complexity made performance improvements difficult. signed script segregation was removed in bug 726125, the enableprivilege prompt was removed in bug 750859, and enableprivilege itself was nerfed in bug 757046. the privilege manager has been deprecated in firefox 12 and disabled in firefox 17. sites that require additional permissions should now ask firefox users to install an extension, which can interact with non-privileged pages if needed. ...

Java in Firefox Extensions - Archive of obsolete content
s leading to this jar and all other jars in your extension within an array of java.net.url's, pass to java.net.urlclassloader to get a class loader, and finally pass the classloader and array to a function which gives the necessary privileges: // this function will be called to give the necessary privileges to your jar files // however, the policy never comes into play, because // (1) adding permissions doesn't add to the policy itself, and // (2) addurl alone does not set the grant codebase function policyadd (loader, urls) { try { //if have trouble with the policy try changing it to //edu.mit.simile.javafirefoxextensionutils.urlsetpolicy var str = 'edu.mit.simile.javafirefoxextensionutils.urlsetpolicy'; var policyclass = java.lang.class.forname( ...

Remotely debugging Firefox for Metro - Archive of obsolete content
or a different port, enter the appropriate hostname and port number and then press "connect." in the windows 8 (metro) browser next you'll see a dialog in firefox for metro asking you to confirm the connection. press the "ok" button to continue. tip: if the remote connection times out, flip to the desktop via the desktop tile and check if windows firewall has thrown up an incoming connection permissions prompt. on the desktop next, the desktop shows you a dialog that looks something like this: this is asking whether you want to debug web content running in a browser tab, or to debug the browser code itself. you'll see one entry under "available remote tabs" for each open tab, and clicking it will attach the debugging tools to the web content hosted by that tab. if you want to debug your ...

Return Codes - Archive of obsolete content
-212 the silent installation privilege has not been granted. no_such_component -213 the specified component is not present in the client version registry. does_not_exist -214 the specified file cannot be deleted because it does not exist. read_only -215 the specified file cannot be deleted because its permissions are set to read only. is_directory -216 the specified file cannot be deleted because it is a directory. network_file_is_in_use -217 the specified file cannot be deleted because it is in use. apple_single_err -218 an error occurred when unpacking a file in applesingle format. invalid_path_err ...

IO - Archive of obsolete content
ory named sample.txt. var file = io.getfile("profile", "sample.txt"); the nsiscriptableio object is a global object always available within an application or extension. it provides a number of useful functions for dealing with files. retrieve a file object for information about getting a file object, see accessing files get information about a file available information about a file include the permissions, size, and last modified date of a file. see getting file information for more details. reading from a file for information about reading from text and binary files, see reading from files. writing to a file for information about writing to text and binary files, see writing to files. copying and moving files files may be moved and copied on disk. for details, see copying a file and moving a file...

Manifest Files - Archive of obsolete content
es in the chrome directory will be examined when a mozilla application starts up to see what packages are installed. that means that all you need to do to install a new package is add a new manifest file either into the application chrome directory or the user specific chrome directory. this latter chrome directory is normally the one used since the application directory might not have sufficient permissions to write into it. note: starting in gecko 2.0, only the file named chrome.manifest is read automatically; if you need to read multiple manifest files, use the manifest command in that file to import additional manifests. use manifest flags to configure the scenarios in which the secondary manifest is imported. if you just want to try testing privileged xul code in the firefox browser, you can ...

iframe - Archive of obsolete content
o specify the content of the frame. this content is a separate document. the children of the iframe are ignored. currently, xul iframes running in remote processes are not supported. if you want to run content in a remote process, use a xul browser element. warning: when used in chrome-privileged documents (either html or xul) such as firefox addons, the contents of the frame may have the same permissions as firefox itself. this can be a serious security vulnerability, for example if you use src="http://...". when used in this case, please see displaying web content in an extension without security issues. more information is available in the xul tutorial. attributes showcaret, src, type, transparent properties accessibletype, contentdocument, contentwindow, docshell, webnavigation examp...

prefwindow - Archive of obsolete content
is not open, a new one is opened displaying the supplied url. showpane( prefpane ) return type: no return value switch to a particular pane. notes usage patterns opening/initializing a prefwindow note that you can define an initwithparams() function in your sub window - to handle parameters passed using openwindow() in case the window was already open. for example the permissions manager ui in firefox uses the same window for three dialogs: images, software installation and popups. it uses initwithparams() to change the dialog type without closing and re-opening it. the suggested usage pattern is as follows: // subwindow.js function onload(ev) { // do some initialization... initwithparams(window.arguments[0]); // we expect a single parameter to be passed to the win...

Deploying XULRunner - Archive of obsolete content
le of the pkginfo file aapl???? edit this as you need to, but cfbundleexecutable must be xulrunner, and cfbundleiconfile and cfbundleurliconfile should be set to the filename of your application icon (app_icon.icns). finally : you can use any paint or graphics utility to create your application's icon, which should be provided as a 512 by 512 pixel png file. to make it all work, change the permissions of your bundle by running chmod -r 755 yourapp.app. linux most linux applications are distributed as simple .tar.bz2 archives which can be unpacked by the user wherever they wish. the archive should be structured as follows: appname/ application.ini components/ ... components which are part of the application chrome/ ... chrome which is part of the ...

application/http-index-format specification - Archive of obsolete content
123 date format url encoded. content-type mime content type. whitespace and 8-bit characters must be url-encoded. the mime-type for a directory can be given as application/http-index-format. file-type one of the following keywords to represent a special status for a file: file directory symbolic-link sym-file (a symbolic link to a file) sym-directory (a symbolic link to a directory) permissions unix type file permission syntax. 3 slots either 'r', 'w', 'x', or '-' representing, in order, read, write, or execute permissions. a '-' indicates that the particular permission is not set. example "rw-" means read and write permission, but not execute. example 100: this is a comment! do not present to the end-user 100: 101: the files in this directory are put forth for public 101: consumpt...

Mozprofile - Archive of obsolete content
=[("accessibility.typeaheadfind.flashbar", 0)]) using a json blob file: mozprofile --preferences myprefs.json using a .ini file: mozprofile --preferences myprefs.ini via the command line: mozprofile --pref key:value --pref key:value [...] when setting preferences from an .ini file or the --pref switch, the value will be interpolated as an integer or a boolean (true/false) if possible. setting permissions mozprofile also takes care of adding permissions to the profile. see https://github.com/mozilla/mozbase/b...permissions.py resources other mozilla programs offer additional and overlapping functionality for profiles. there is also substantive documentation on profiles and their management. profilemanager : xulrunner application for managing profiles. has a gui and cli. python-profilemanager : ...

Logging Multi-Process Plugins - Archive of obsolete content
your safest bet is your home directory (c:\users\username on windows vista and above, c:\documents and settings\username on windows xp, and ~ (home directory) on mac os x and linux). ...

CSRF - MDN Web Docs Glossary: Definitions of Web-related terms
csrf (cross-site request forgery) is an attack that impersonates a trusted user and sends a website unwanted commands. this can be done, for example, by including malicious parameters in a url behind a link that purports to go somewhere else: <img src="https://www.example.com/index.php?action=delete&id=123"> for users who have modification permissions on https://www.example.com, the <img> element executes action on https://www.example.com without their noticing, even if the element is not at https://www.example.com. there are many ways to prevent csrf, such as implementing restful api, adding secure tokens, etc. learn more general knowledge cross-site request forgery on wikipedia prevention measures ...

Third-party APIs - Learn web development
restful apis — we'll show an example later on. they usually require api keys security for browser apis tends to be handled by permission prompts, as discussed in our first article. the purpose of these is so that the user knows what is going on in the websites they visit and is less likely to fall victim to someone using an api in a malicious way. third party apis have a slightly different permissions system — they tend to use developer keys to allow developers access to the api functionality, which is more to protect the api vendor than the user. you'll find a line similar to the following in the mapquest api example: l.mapquest.key = 'your-api-key-here'; this line specifies an api or developer key to use in your application — the developer of the application must apply to get a key, a...

Client-Server Overview - Learn web development
as they can be changed by users and then resubmitted. as a result url parameters/get requests are not used for requests that update data on the server. post data. post requests add new resources, the data for which is encoded within the request body. client-side cookies. cookies contain session data about the client, including keys that the server can use to determine their login status and permissions/accesses to resources. web servers wait for client request messages, process them when they arrive, and reply to the web browser with an http response message. the response contains an http response status code indicating whether or not the request succeeded (e.g. "200 ok" for success, "404 not found" if the resource cannot be found, "403 forbidden" if the user isn't authorised to see the ...

Server-side web frameworks - Learn web development
d by tokio — a rust-based asynchronous runtime which lets it serve web pages faster. it also has internal support for webassembly, which enables the compilation of binary code for use on the client-side. deno aims to fill in some of the loop-holes in node.js by providing a mechanism that naturally maintains better security. deno's features include: security by default. deno modules restrict permissions to file, network, or environment access unless explicitly allowed. typescript support out-of-the-box. first-class await mechanism. built-in testing facility and code formatter (deno fmt) (javascript) browser compatibility: deno programs that are written completely in javascript excluding the deno namespace (or feature test for it), should work directly in any modern browser. script bundling ...

Website security - Learn web development
ata so that it can't be used to run scripts or otherwise affect the execution of server code is known as input sanitization. many web frameworks automatically sanitize user input from html forms by default. sql injection sql injection vulnerabilities enable malicious users to execute arbitrary sql code on a database, allowing data to be accessed, modified, or deleted irrespective of the user's permissions. a successful injection attack might spoof identities, create new identities with administration rights, access all data on the server, or destroy/modify the data to make it unusable. sql injection types include error-based sql injection, sql injection based on boolean errors, and time-based sql injection. this vulnerability is present if user input that is passed to an underlying sql stateme...

Server-side website programming - Learn web development
web development, learning about server-side development is highly recommended. learning pathway getting started with server-side programming is usually easier than client-side development, because dynamic websites tend to perform a lot of very similar operations (retrieving data from a database and displaying it in a page, validating user-entered data and saving it in a database, checking user permissions and logging users in, etc.), and are constructed using web frameworks that make these and other common web server operations easy. basic knowledge of programming concepts (or of a particular programming language) is useful, but not essential. similarly, expertise in client-side coding is not required, but a basic knowledge will help you work better with the developers creating your client-side w...

Introduction to automated testing - Learn web development
d versions of node and npm: node -v npm -v if you've got node/npm already installed, you should update them to their latest versions. to update node, the most reliable way is to download and install an updated installer package from their website (see link above). to update npm, use the following command in your terminal: npm install npm@latest -g note: if the above command fails with permissions errors, fixing npm permissions should sort you out. to start using node/npm-based packages on your projects, you need to set up your project directories as npm projects. this is easy to do. for example, let's first create a test directory to allow us to play without fear of breaking anything. create a new directory somewhere sensible using your file manager ui, or, on a command line, by nav...

Embedding API for Accessibility
ul possibility is that we design an interface for setting certain preferences based on the url. if we can find a clean way to present it to the user, this would be extremely useful. for example, settings per url would allow a user to accept scripts from their known benign web pages, but not others. users may want similarity abilities with applets, background images, style sheets, etc. we have a permissions system for cookies and images based on url's. perhaps it can be extended to store accessibility preferences. this is a ui issue we'll need to settle before we know where to go with the embedding accessibility interface. ...

Android-specific test suites
ce an html report. while developing, you can launch these tests from within android studio, which is the fastest way to iterate on code and tests. disabling one failing test there is no manifest listing the android local unit tests. to disable a single test, edit the source code and insert junit's @ignore annotation before the existing @test annotation. for example, to disable org.mozilla.gecko.permissions.testsuccessrunnableisexecutedifpermissionsaregranted, add @ignore as follows: ... @runwith(testrunner.class) public class testpermissions { @ignore @test public void testsuccessrunnableisexecutedifpermissionsaregranted() { ... contact information android-test is currently owned by :sebastian and :nalexander. file tickets in the firefox for android product in bugzilla. android-ch...

Testopia
riorities on indidual case-runs new clone options uses the latest extjs 3.0 library converts testopia into a true bugzilla extension numerous bug fixes integration points testopia integrates with bugzilla products, components, versions, and milestones to allow a single management interface for high level objects. testopia allows users to login to one tool and uses bugzilla group permissions to limit access to modifying test objects. testopia allows users to attach bugs to test case run results for centralized management of the software engineering process. requirements as our development has moved forward, we have decided to try to keep abreast of the latest stable release from bugzilla (currently 5.0). this gives us a stable code base to work from. developing plugins or ...

What to do and what not to do in Bugzilla
done in bugzilla.mozilla.org. getting/upgrading bugzilla privileges if you want to get bugzilla privileges (as described below), please see this page. it lists the requirements and the email to contact. if you need faster access to get canconfirm or editbugs, especially in order to triage bugs or to participate in a bug day, then you can ask in #bmo on irc, or you may create a bug requesting permissions. include a link to your bugzilla activity page in the bug description. before you have canconfirm, you can still do good triaging by leaving comments with useful information on the bug that will help to confirm it. the same is true for editbugs: leave comments with the information you'd like to be able to edit into the bug, and that will help you get the editbugs permissions quickly. canconfir...

Eclipse CDT Manual Setup
e a very long time, we're going to cheat and set eclipse's "build" action to run jwatt's just-print-mozilla-build.py script instead. this script will complete in about 30 seconds on a warm tree (files cached in ram) if your object directory is up to date, although eclipse will take several minutes to process the "build output" that it produces. download just-print-mozilla-build.py and change its permissions to make it executable ('chmod a+x just-print-mozilla-build.py'). if you don't put just-print-mozilla-build.py somewhere in your path, then go back to the initial project properties section where you set just-print-mozilla-build.py and specify its absolute path instead of just its name. now invoke the script by clicking the build button (the button with the hammer symbol) or by selecting "projec...

Reviewer Checklist
. [fennec: all view methods should be touched only on ui thread.] [fennec: activity lifecycle awareness (works with "never keep activities"). also test with oom-fennec (https://hg.mozilla.org/users/blassey_mozilla.com/oom-fennec/)]. compatibility version files, databases, messages tag messages with ids to disambiguate callers. idl uuids are updated when the interface is updated. android permissions should be 'grouped' into a common release to avoid breaking auto-updates. android apis added since froyo should be guarded by a version check. preffability if the feature being worked on is covered by prefs, make sure they are hooked up. if working on a new feature, consider adding prefs to control the behavior. consider adding prefs to disable the feature entirely in case bugs are found ...

Error codes returned by Mozilla APIs
nsifile.iswritable() to check if the file can be written to. ns_error_file_dir_not_empty (0x80520014) when calling nsifile.remove() on a directory and the 'recursive' argument to this method is false, this error will occur if the directory is not empty. ns_error_file_access_denied (0x80520015) an operation was not performed on a file because the file cannot be accessed, typically because the permissions set for the file do not allow the operation. stream errors ns_base_stream_closed (0x80470002) this error occurs when an operation is performed on a stream that has already been closed. ns_base_stream_oserror (0x80470003) this error occurs when an operating system error occurs. currently, this error only occurs when a file stream is closed. ns_base_stream_illegal_args (0x80470004) ns_...

Blocked: Custom cookie permission
age firefox: cookieblockedbypermission=request to access cookies or storage on “x” was blocked because of custom cookie permission. what went wrong? a request to access cookies or storage was blocked because there's a custom user-defined permission set. the permission can be changed or removed by: going to preferences > content blocking > cookies and site data clicking on the manage permissions button and updating the listed exceptions ...

HTMLIFrameElement.clearMatch()
see using the browser api for more details. ...

HTMLIFrameElement.executeScript()
see using the browser api for more details. ...

HTMLIFrameElement.findAll()
dall() method of the htmliframeelement searches for a string in a browser <iframe>'s text content; if found, the first instance of the string relative to the caret position will be highlighted. invoking this method results in a mozbrowserfindchange event firing, which carries details about the search results. note: use of the browser api requires a privileged app, and browser and/or embed-apps permissions, depending on what you want to do. see using the browser api for more details. syntax instanceofhtmliframeelement.findall(searchstring, casesensitivity); returns void. parameters searchstring the string you want to search for in the browser <iframe>'s text. casesensitivity a string to declare whether you want the search to be case sensitive (case-sensitive) or insensitive (case-insens...

HTMLIFrameElement.findNext()
warning: removed in firefox 65. the findnext() method of the htmliframeelement highlights the next or previous instance of a search result after a findall() search has been carried out. invoking this method results in a mozbrowserfindchange event firing, which carries details about the search results. note: use of the browser api requires a privileged app, and browser and/or embed-apps permissions, depending on what you want to do. see using the browser api for more details. syntax instanceofhtmliframeelement.findnext(direction); return value void. parameters direction a string indicating the direction in which you want to cycle through the available search results. available values are forward and backward. examples the following functions are taken from our browser api demo, and...

Addon
true or false depending on whether the add-on is compatible with the current operating system. name read only string the name of the add-on. pendingoperations read only integer a bitfield holding all of the current operations that are waiting to be performed for this add-on. operations are generally deferred when a restart is necessary to accomplish them. permissions read only integer a bitfield holding all the the operations that can be performed on this add-on. operations my be restricted based on system policies (e.g., the system administrator may not allow certain add-ons to be uninstalled), add-on type (e.g., themes may not be disabled), or add-on state (e.g., an incompatible add-on cannot be enabled). providesupdatessecurely read only ...

AddonManager
fter the application restarts. pending_disable this add-on will be disabled after the application restarts. pending_uninstall this add-on will be uninstalled after the application restarts. pending_install this add-on will be installed after the application restarts. pending_upgrade this add-on will be upgraded after the application restarts. permissions constant description perm_can_uninstall this add-on can be uninstalled. perm_can_enable this add-on can be enabled. perm_can_disable this add-on can be disabled. perm_can_upgrade this add-on can be upgraded. operations requiring restart constant description op_needs_restart_none no operations will require...

JNI.jsm
7. if you would like to support versions before that, you can copy and paste the contents of the jsm file int jni stands for java native interface; this library allows calling java code running in java virtual machines (jvms), etc. the most common use for this module is in add-ons and other works on firefox for android (fennec). with this module, all of the android sdk functions that firefox has permissions for are at your fingertips. a note about firefox for android, this jsm file is already globally imported and is available from the privileged window scope as window.jni. there also exists a jenv variable in the window scope, so if you need to run jni from the global scope, use a different variable name then jenv. jni.jsm contains all the js-ctypes needed to communicate with the jni libraries. t...

Webapps.jsm
ps.jsm"); // exported symbol is domapplicationregistry method overview init: function() loadcurrentregistry: function() notifyappsregistrystart: function notifyappsregistrystart() notifyappsregistryready: function notifyappsregistryready() sanitizeredirects: function sanitizeredirects(asource) _savewidgetsfullpath: function(amanifest, adestapp) appkind: function(aapp, amanifest) updatepermissionsforapp: function(aid, aispreinstalled) updateofflinecacheforapp: function(aid) installpreinstalledapp: function installpreinstalledapp(aid) removeifhttpsduplicate: function(aid) installsystemapps: function() loadandupdateapps: function() updatedatastore: function(aid, aorigin, amanifesturl, amanifest) _registersystemmessagesforentrypoint: function(amanifest, aapp, aentrypoint) _registerint...

NSS 3.19.2.3 release notes
_rtm/src/ new in nss 3.19.2.3 new functionality no new functionality is introduced in this release. security fixes in nss 3.19.2.3 bug 1245528 / cve-2016-1950 - fixed a heap-based buffer overflow related to the parsing of certain asn.1 structures. an attacker could create a specially-crafted certificate which, when parsed by nss, would cause a crash or execution of arbitrary code with the permissions of the user. acknowledgements the nss development team would like to thank security researcher francis gabriel for responsibly disclosing the issue in bug 1245528. compatibility nss 3.19.2.3 shared libraries are backward compatible with all older nss 3.x shared libraries. a program linked with older nss 3.x shared libraries will work with nss 3.19.2.3 shared libraries without recompiling or ...

NSS 3.21.1 release notes
21_1_rtm/src/ new in nss 3.21.1 new functionality no new functionality is introduced in this release. security fixes in nss 3.21.1 bug 1245528 / cve-2016-1950 - fixed a heap-based buffer overflow related to the parsing of certain asn.1 structures. an attacker could create a specially-crafted certificate which, when parsed by nss, would cause a crash or execution of arbitrary code with the permissions of the user. acknowledgements the nss development team would like to thank security researcher francis gabriel for responsibly disclosing the issue in bug 1245528. compatibility nss 3.21.1 shared libraries are backward compatible with all older nss 3.x shared libraries. a program linked with older nss 3.x shared libraries will work with nss 3.21.1 shared libraries without recompiling or reli...

NSS 3.22.2 release notes
2_rtm/src/ new in nss 3.22.2 new functionality no new functionality is introduced in this release. security fixes in nss 3.22.2 bug 1245528 / cve-2016-1950 - fixed a heap-based buffer overflow related to the parsing of certain asn.1 structures. an attacker could create a specially-crafted certificate which, when parsed by nss, would cause a crash or execution of arbitrary code with the permissions of the user. notable changes in nss 3.22.2 bug 1247990 - the root ca changes from nss 3.23 have been backported. acknowledgements the nss development team would like to thank security researcher francis gabriel for responsibly disclosing the issue in bug 1245528. compatibility nss 3.22.2 shared libraries are backward compatible with all older nss 3.x shared libraries. a program linked w...

NSS 3.23 release notes
92:60:84:ec:96:3a:64:b9:6e:2a:be:01:ce:0b:a8:6a:64:fb:fe:bc:c7:aa:b5:af:c1:55:b3:7f:d7:60:66 security fixes in nss 3.23 bug 1245528 / cve-2016-1950 - fixed a heap-based buffer overflow related to the parsing of certain asn.1 structures. an attacker could create a specially-crafted certificate which, when parsed by nss, would cause a crash or execution of arbitrary code with the permissions of the user. bugs fixed in nss 3.23 this bugzilla query returns all the bugs fixed in nss 3.23: https://bugzilla.mozilla.org/buglist.cgi?resolution=fixed&classification=components&query_format=advanced&product=nss&target_milestone=3.23 acknowledgements the nss development team would like to thank security researcher francis gabriel for responsibly disclosing the issue in bug 1245528. compa...

Rhino shell
ge versions. -strict enable strict mode. -continuations enable experimental support for continuations and set the optimization level to -1 to force interpretation mode. starting with rhino 1.7 this options is no longer available. note if the shell is invoked with the system property rhino.use_java_policy_security set to true and with a security manager installed, the shell restricts scripts permissions based on their urls according to java policy settings. this is available only if jvm implements java2 security model. predefined properties scripts executing in the shell have access to some additional properties of the top-level object. arguments the arguments object is an array containing the strings of all the arguments given at the command line when the shell was invoked. environment re...

Starting WebLock
arated by a slash. on the macintosh platform, for example, files are represented as a triplet - two numbers and one string - so using a string on the macintosh does not adequately identify files on that operating system. nsifile, the file interface in xpcom, provides most of the functionally that file handling requires. that interface includes members representing the file name, file attributes, permissions, existence, and others. a related interface called nsilocalfile provides access to operations specific to local files, but the nsifile functionality is adequate for the weblock component. file interface hierarchy remote files and nsifile it is not inconceivable for remote files to be represented by the nsifile interface. someone could write an nsifile implementation that represented ftp fil...

nsIFileOutputStream
behaviorflags flags specifying various behaviors of the class; see behavior flag constants above. see also nsifileinputstream ...

nsILocalFile
ach write. pr_truncate if the file exists, its length is truncated to 0. pr_sync if set, each write will wait for both the file data and file status to be physically updated. pr_excl with pr_create_file, if the file does not exist, the file is created. if the file already exists, no action and null is returned. delete_on_close file will be deleted when closed. mode a unix-style file permissions value. for example, the octal value 0600 may be used to limit read and write access to the current user of the system. this parameter may be ignored on systems that do not support file permissions. return value if the file is successfully opened, returns a pointer to the prfiledesc created for the newly opened file. returns a null pointer if the open failed. example #include "prio.h" #includ...

nsIPropertyBag
serv...

nsIToolkitProfileService
thods). selectedprofile nsitoolkitprofile the profile that is marked as "default=1" in the profiles.ini file. (not the profile currently in use.) not sure what happens if you change this setting but someone said: you can change profiles by setting this attribute's value. this may throw an ns_error_failure (0x80004005) when trying to get the current profile if it's unavailable or if permissions restrict access. startoffline boolean startwithlastprofile boolean methods createprofile() creates a new profile. the profile temporary directory will be chosen based on where the profile directory is located. nsitoolkitprofile createprofile( in nsilocalfile arootdir, in autf8string aname ); parameters arootdir the profile directory. may be nul...

nsIWinAppHelper
ce gecko 1.9 void postupdate(in nsilocalfile logfile); obsolete since gecko 1.9.2 attributes attribute type description usercanelevate boolean read only. returns true only if all the following conditions are all true at once: the operating system is at least windows vista user account control is enabled the user is an administrator the application is not already running with elevated permissions otherwise it returns false. methods fixreg() obsolete since gecko 1.9 (firefox 3) invokes helper.exe with the /fixreg parameter. note that this parameter was never actually supported. void fixreg(); parameters none. postupdate() obsolete since gecko 1.9.2 (firefox 3.6 / thunderbird 3.1 / fennec 1.0) invokes helper.exe with the /postupdate ...

nsIZipReader
ointer', entrypointer); /* console output * "entrypointer" "bootstrap.js" scratchpad/1:18 */ console.info('entry', entry); /* console output * "entry" xpcwrappednative_nohelper { queryinterface: queryinterface(), compression: getter, size: getter, realsize: getter, crc32: getter, isdirectory: getter, lastmodifiedtime: getter, issynthetic: getter, permissions: getter, compression: 8 } scratchpad/1:19 */ if (!entry.isdirectory) { var inputstream = zr.getinputstream(entrypointer); reusablestreaminstance.init(inputstream); var filecontents = reusablestreaminstance.read(entry.realsize); console.log('contenst of file=', filecontents); } else { console.log('is directory, no...

Virtualenv
ian bicking). if you have git installed, you can clone the latest version of virtualenv: git clone git://github.com/pypa/virtualenv.git if you have pip or easy_install, you can install virtualenv directly from the web: pip install virtualenv # -or- easy_install virtualenv this will fetch virtualenv from pypi and install it in your site-packages. you may need to use sudo to obtain appropriate permissions for the system. if you do not have pip or easy_install, you will need to download from pypi or clone from the github virtualenv repository, extract from the tarball (in the pypi case), and run python setup.py install. again, you may need to use sudo to install globally. if you're running ubuntu, there is also an ubuntu package available: sudo apt-get install python-virtualenv virtualenv.py m...

about:debugging (before Firefox 68) - Firefox Developer Tools
ripts or popups, then changes you make are picked up automatically, and you'll see them the next time the content script is loaded or the popup is shown. there's a better way to handle the other cases: click the "reload" button next to the "debug" button. this does what it says: reloading any persistent scripts, such as background scripts parsing the manifest.json file again, so changes to permissions, content_scripts, browser_action or any other keys will take effect. note that in firefox 49 onwards, the reload button is only enabled for temporary add-ons. it will be disabled for all other add-ons. tabs in firefox 49 onwards, a tabs page is available in about:debugging — this provides a complete list of all the debuggable tabs open in the current firefox instance. each tab entr...

about:debugging - Firefox Developer Tools
ou change files that are loaded on demand, like content scripts or popups, then changes you make are picked up automatically, and you'll see them the next time the content script is loaded or the popup is shown. for other changes, click the reload button. this does what it says: reloads any persistent scripts, such as background scripts parses the manifest.json file again, so changes to permissions, content_scripts, browser_action or any other keys take effect installed extensions the permanently installed extensions are listed in the next section, extensions. for each one, you see something like the following: the inspect button, and the extension id and internal uuid fields are the same as for temporary extensions. just as it does with temporarily loaded extensions, the link n...

Accelerometer - Web APIs
if a feature policy blocks the use of a feature, it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. see feature-policy for implementation instructions. constructor accelerometer.accelerometer() creates a new accelerometer object. ...

AmbientLightSensor - Web APIs
if a feature policy blocks use of a feature it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. see feature-policy for implementation instructions. ...

Clipboard.readText() - Web APIs
syntax var promise = navigator.clipboard.readtext() parameters none. return value a promise that resolves with a domstring containing the textual contents of the clipboard. returns an empty string if the clipboard is empty, does not contain text, or does not include a textual representation among the datatransfer objects representing the clipboard's contents. ...

Clipboard.write() - Web APIs
note: browser support for the asynchronous clipboard apis is still in the process of being implemented. be sure to check the compatibility table as well as clipboard availability in clipboard for more information. ...

Clipboard.writeText() - Web APIs
note: browser support for the asynchronous clipboard apis is still in the process of being implemented. be sure to check the compatibility table as well as clipboard availability in clipboard for more information. ...

ClipboardItem - Web APIs
face of the clipboard api represents a single item format, used when reading or writing data via the clipboard api. that is clipboard.read() and clipboard.write() respectively. the benefit of having the clipboarditem interface to represent data, is that it enables developers to cope with the varying scope of file types and data easily. access to the contents of the clipboard is gated behind the permissions api: the clipboard-write permission is granted automatically to pages when they are in the active tab. the clipboard-read permission must be requested, which you can do by trying to read data from the clipboard. note: to work with text see the clipboard.readtext() and clipboard.writetext() methods of the clipboard interface. note: you can only pass in one clipboard item at a time. construc...

Clipboard API - Web APIs
the clipboard-read permission must be requested, which you can do by trying to read data from the clipboard. this api is designed to supersede accessing the clipboard using document.execcommand(). ...

FeaturePolicy.allowedFeatures() - Web APIs
es returned by features(). syntax const allowed = featurepolicy.allowedfeatures() parameters none. return value an array of strings representing the feature policy directive names that are allowed by the feature policy this method is called on. example the followin example logs all the allowed directives for the current document. please note that these features might be restricted by the permissions api, if the user did not grant the corrsponding permission yet. // first, get the feature policy object const featurepolicy = document.featurepolicy // then query feature for specific const allowed = featurepolicy.allowedfeatures() for (const directive of allowed){ console.log(directive) } specifications specification status comment feature policythe definition of ...

FeaturePolicy.allowsFeature() - Web APIs
specific feature name must be specified. origin name optional an origin url to check the feature on. if it is omitted the default origin is used. return value a boolean that is true if and only if the feature is allowed. example the following example queries whether or not the document is allowed to use camera api by the feature policy. please note that camera api might be restricted by the permissions api, if the user did not grant the corresponding permission yet. // first, get the feature policy object const featurepolicy = document.featurepolicy // then query feature for specific const allowed = featurepolicy.allowsfeature("camera") if (allowed){ console.log("fp allows camera.") } else { console.log("fp does not allows camera.") } specifications specification status ...

FeaturePolicy.features() - Web APIs
syntax const supportedfeatures = featurepolicy.features() parameters none. return value a list of strings that represent names of all feature policy directives supported by the user agent. ...

FeaturePolicy.getAllowlistForFeature() - Web APIs
st for the specified feature. errors the function will raise a warning if the specified feature policy directive name is not known. however, it will also return empty array, inditating that no origin is allowed to use the feature. example the followin example prints all the origins that are allowed to use camera api by the feature policy. please note that camera api might be restricted by the permissions api, if the user did not grant the corrsponding permission yet. // first, get the feature policy object const featurepolicy = document.featurepolicy // then query feature for specific const allowlist = featurepolicy.getallowlistforfeature("camera") for (const origin of allowlist){ console.log(origin) } specification specification status comment feature policythe de...

FeaturePolicy - Web APIs
ods featurepolicy.allowsfeature returns a boolean that indicates whether or not a particular feature is enabled in the specified context. featurepolicy.features returns a list of names of all features supported by the user agent. feature whose name appears on the list might not be allowed by the feature policy of the current execution context and/or might not be accessible because of user's permissions. featurepolicy.allowedfeatures returns a list of names of all features supported by the user agent and allowed by the feature policy. note that features appearing on this list might still be behind a user permission. featurepolicy.getallowlistforfeature returns the allow list for the specified feature. specification specification status comment feature policy...

FileSystemEntry.remove() - Web APIs
't empty. fileerror.invalid_state_err the file system's cached state is inconsistent with its state on disk, so the file could not be deleted for safety reasons. fileerror.no_modification_allowed_err the file system's state doesn't permit removing the file or directory. fileerror.not_found_err the file or directory doesn't exist. fileerror.security_err the entry couldn't be removed due to permissions or other access constraints, or because there are too many calls being made on file resources. example this example deletes a temporary work file. workingdirectory.getfile("tmp/workfile.json", {}, function(fileentry) { fileentry.remove(function() { /* the file was removed successfully */ }); }, handleerror); browser compatibility the compatibility table on this page is generated fro...

Gyroscope - Web APIs
if a feature policy blocks use of a feature it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. see feature-policy for implementation instructions. constructor gyroscope.gyroscope() creates a new gyroscope object. ...

Audio() - Web APIs
sent to the <audio> element when there's enough audio available to begin playback, although interruptions may occur). listen for the canplaythrough event. it is sent when it's estimated that the audio should be able to play to the end without interruption. the event-based approach is best: myaudioelement.addeventlistener("canplaythrough", event => { /* the audio is now playable; play it if permissions allow */ myaudioelement.play(); }); memory usage and management if all references to an audio element created using the audio() constructor are deleted, the element itself won't be removed from memory by the javascript runtime's garbage collection mechanism if playback is currently underway. instead, the audio will keep playing and the object will remain in memory until playback ends or is pa...

Using IndexedDB - Web APIs
e site domain or subdomain), so it cannot be accessed by any other origin. third party window content (e.g. <iframe> content) cannot access indexeddb if the browser is set to never accept third party cookies (see bug 1147821.) warning about browser shutdown when the browser shuts down (because the user chose the quit or exit option), the disk containing the database is removed unexpectedly, or permissions are lost to the database store, the following things happen: each transaction on every affected database (or all open databases, in the case of browser shutdown) is aborted with an aborterror. the effect is the same as if idbtransaction.abort() is called on each transaction. once all of the transactions have completed, the database connection is closed. finally, the idbdatabase object repres...

LinearAccelerationSensor - Web APIs
if a feature policy blocks use of a feature it is because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. ...

Magnetometer - Web APIs
if a feature policy blocks use of a feature, it's because your code is inconsistent with the policies set on your server. this is not something that would ever be shown to a user. see feature-policy for implementation instructions. ...

MediaDeviceInfo.label - Web APIs
the label readonlyinline property of the mediadeviceinfo interface returns a domstring, that is a label describing this device (for example "external usb webcam"). only available during active mediastream use, or when persistent permissions have been granted. syntax var label = mediadeviceinfo.label; value a domstring which describes the media device. for security reasons, the label is always an empty string ("") if the user has not obtained permission to use at least one media device, either by starting a stream from the microphone or camera, or by persistent permissions being granted. specifications specification status comment media capture and streamsthe definition of 'label' in that specification. candidate recommendation initial definition. ...

MediaDeviceInfo - Web APIs
+ " id = " + device.deviceid); }); }) .catch(function(err) { console.log(err.name + ": " + err.message); }); this might produce: videoinput: id = cso9c0ypaf274oucpua53cne0yhlir2yxci+sqfbzz8= audioinput: id = rkxxbyjnabbadgqnnzqlvldmxls0yketycibg+xxnvm= audioinput: id = r2/xw1xupiyzunfv1lgrkoma5wtovckwfz368xcndm0= or if one or more media streams are active, or if persistent permissions have been granted: videoinput: facetime hd camera (built-in) id=cso9c0ypaf274oucpua53cne0yhlir2yxci+sqfbzz8= audioinput: default (built-in microphone) id=rkxxbyjnabbadgqnnzqlvldmxls0yketycibg+xxnvm= audioinput: built-in microphone id=r2/xw1xupiyzunfv1lgrkoma5wtovckwfz368xcndm0= specifications specification status comment media capture and streamsthe definition of 'medi...

MediaDevices.enumerateDevices() - Web APIs
bel + " id = " + device.deviceid); }); }) .catch(function(err) { console.log(err.name + ": " + err.message); }); this might produce: videoinput: id = cso9c0ypaf274oucpua53cne0yhlir2yxci+sqfbzz8= audioinput: id = rkxxbyjnabbadgqnnzqlvldmxls0yketycibg+xxnvm= audioinput: id = r2/xw1xupiyzunfv1lgrkoma5wtovckwfz368xcndm0= or if one or more mediastreams are active or persistent permissions are granted: videoinput: facetime hd camera (built-in) id=cso9c0ypaf274oucpua53cne0yhlir2yxci+sqfbzz8= audioinput: default (built-in microphone) id=rkxxbyjnabbadgqnnzqlvldmxls0yketycibg+xxnvm= audioinput: built-in microphone id=r2/xw1xupiyzunfv1lgrkoma5wtovckwfz368xcndm0= specifications specification status comment media capture and streamsthe definition of 'mediadevic...

MediaDevices - Web APIs
ndow.stream = stream; // make variable available to browser console video.srcobject = stream; }) .catch(function(error) { if (error.name === 'constraintnotsatisfiederror') { errormsg('the resolution ' + constraints.video.width.exact + 'x' + constraints.video.height.exact + ' px is not supported by your device.'); } else if (error.name === 'permissiondeniederror') { errormsg('permissions have not been granted to use your camera and ' + 'microphone, you need to allow the page access to your devices in ' + 'order for the demo to work.'); } errormsg('getusermedia error: ' + error.name, error); }); function errormsg(msg, error) { errorelement.innerhtml += '<p>' + msg + '</p>'; if (typeof error !== 'undefined') { console.error(error); } } specifications ...

MediaStreamTrack: ended event - Web APIs
o further data is available. bubbles no cancelable no interface event event handler property mediastreamtrack.onended usage notes ended events fire when the media stream track's source permanently stops sending data on the stream. there are various ways this can happen, including: there is no more data left to send. the user revoked the permissions needed for the data to be sent. the hardware generating the source data has been removed or ejected. a remote peer has permanently stopped sending data; pausing media does not generate an ended event. examples this example sets up an event handler for the ended event, which changes an on-screen icon to indicate that the track is no longer active. track.addeventlistener('ended', () => { le...

MediaStreamTrack.onended - Web APIs
the mediastreamtrack.onended event handler is used to specify a function which serves as an eventhandler to be called when the ended event occurs on the track. this event occurs when the track will no longer provide data to the stream for any reason, including the end of the media input being reached, the user revoking needed permissions, the source device being removed, or the remote peer ending a connection. syntax mediastreamtrack.onended = function; value a function to serve as an eventhandler for the ended event. the event handler function receives a single parameter: the event object, which is a simple event object. examples this example sets up an event handler for the ended event which changes an on-screen icon to indicate that the track is no longer active. track.onended = function(...

Navigator.clipboard - Web APIs
e read-only clipboard property, which returns the clipboard object used to read and write the clipboard's contents. the clipboard api can be used to implement cut, copy, and paste features within a web application. use of the asynchronous clipboard read and write methods requires that the user grant the web site or app permission to access the clipboard. this permission must be obtained from the permissions api using the "clipboard-read" and/or "clipboard-write" permissions. syntax theclipboard = navigator.clipboard; value the clipboard object used to access the system clipboard. examples the following code uses navigator.clipboard to access the system clipboard in order to read the contents of the clipboard. navigator.clipboard.readtext().then( cliptext => document.queryselector(".cliptex...

Notification.permission - Web APIs
upported, then check if permission has been granted for the current origin to send notifications, then request permission if required, before then sending a notification. ...

Notifications API - Web APIs
y disallow notifications not triggered in response to a user gesture. firefox is already doing this from version 72, for example. this will spawn a request dialog, along the following lines: from here the user can choose to allow notifications from this origin, or block them. once a choice has been made, the setting will generally persist for the current session. note: as of firefox 44, the permissions for notifications and push have been merged. if permission is granted for notifications, push will also be enabled. next, a new notification is created using the notification() constructor. this must be passed a title argument, and can optionally be passed an options object to specify options, such as text direction, body text, icon to display, notification sound to play, and more. in addition...

PushManager.hasPermission() - Web APIs
} ); example // tbd specification specification status comment push api working draft defines the pushmanager interface. browser compatibility the compatibility table on this page is generated from structured data. if you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request. ...

PushRegistrationManager - Web APIs
ation with details of a new registration. pushregistrationmanager.unregister() returns a promise that resolves to a pushregistration with details of the unregistered registration. pushregistrationmanager.getregistration() returns a promise that resolves the pushregistration associated with the current webapp. pushregistrationmanager.haspermission() returns a promise that resolves to the pushpermissionstatus of the requesting webapp. browser compatibility the compatibility table on this page is generated from structured data. if you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request. desktopmobilechromeedgefirefoxinternet exploreroperasafariandroid webviewchrome for androidfirefox for androidopera for androidsafari on ios...

RTCPeerConnection.close() - Web APIs
the rtcpeerconnection.close() method closes the current peer connection. syntax peerconnection.close(); this method has no parameters, and returns nothing. calling this method terminates the rtcpeerconnection's ice agent, ending any ongoing ice processing and any active streams. this also releases any resources in use by the ice agent, including turn permissions. all rtcrtpsender objects are considered to be stopped once this returns (they may still be in the process of stopping, but for all intents and purposes, they're stopped). once this method returns, the signaling state as returned by rtcpeerconnection.signalingstate is closed. make sure that you delete all references to the previous rtcpeerconnection before attempting to create a new one that connects to the same remote peer, as not ...

StorageManager - Web APIs
you can get a reference to this interface using either navigator.storage or workernavigator.storage. methods storagemanager.estimate() secure context returns a promise that resolves to a storageestimate object containing usage and quota numbers for your origin. storagemanager.persist() secure context returns a promise that resolves to true if the user agent is able to persist your site's storage. storagemanager.persisted() secure context returns a promise that resolves to true if persistence has already been granted for your site's storage. ...

Storage API - Web APIs
sion-related flags, algorithms, and types are all set to the standard defaults for a permission, except that the permission state must be the same across the entire origin, and that if the permission state isn't "granted" (meaning that for whatever reason, access to the persistent storage feature was denied), the origin's site storage unit's box mode is always "best-effort". note: see using the permissions api for further details about obtaining and managing permissions. when clearing site storage units, an origin's box is treated as a single entity; if the user agent needs to clear it and the user approves, the entire data store is cleared rather than providing some means of clearing only data from individual apis. if a box is marked as "persistent", the contents won't be cleared by the user ag...

WebRTC connectivity - Web APIs
y watching for the icegatheringstatechange event. when things go wrong during negotiation, there will be times when things just don't work out. for example, when renegotiating a connection—for example, to adapt to changing hardware or network configurations—it's possible that negotiation could reach a dead end, or some form of error might occur that prevents negotiation at all. there may be permissions issues or other problems as well, for that matter. ice rollbacks when renegotiating a connection that's already active and a situation arises in which the negotiation fails, you don't really want to kill the already-running call. after all, you were most likely just trying to upgrade or downgrade the connection, or to otherwise make adaptations to an ongoing session. aborting the call would be ...

Introduction to the Real-time Transport Protocol (RTP) - Web APIs
the remote endpoint, noise levels, traffic levels, and so forth. since rtp is simply a data transport, it is augmented by the closely-related rtp control protocol (rtcp), which is defined in rfc 3550, section 6. rtcp adds features including quality of service (qos) monitoring, participant information sharing, and the like. it isn't adequate for the purposes of fully managing users, memberships, permissions, and so forth, but provides the basics needed for an unrestricted multi-user communication session. the very fact that rtcp is defined in the same rfc as rtp is a clue as to just how closely-interrelated these two protocols are. capabilities of rtp rtp's primary benefits in terms of webrtc include: generally low latency. packets are sequence-numbered and time-stamped for reassembly if they...

WebXR Device API - Web APIs
pplications webxr uses the gamepad object to describe the controls available on complex input devices (such as hand controllers with multiple buttons and/or axes) and gamepad-like devices. in this guide, learn how to make use of these devices' controls. performance and security webxr performance guide recommendations and tips to help you optimize the performance of your webxr application. permissions and security for webxr the webxr device api has several areas of security to contend with, from establishing feature-policy to ensuring the user intends to use the mixed reality presentation before activating it. including other media positional audio in a 3d environment in 3d environments, which may either be 3d scenes rendered to the screen or a mixed reality experience experienced using...

Using the Web Speech API - Web APIs
ort for web speech api speech synthesis is still getting there across mainstream browsers, and is currently limited to the following: firefox desktop and mobile support it in gecko 42+ (windows)/44+, without prefixes, and it can be turned on by flipping the media.webspeech.synth.enabled flag to true in about:config. firefox os 2.5+ supports it, by default, and without the need for any permissions. chrome for desktop and android have supported it since around version 33, without prefixes. html and css the html and css are again pretty trivial, simply containing a title, some instructions for use, and a form with some simple controls. the <select> element is initially empty, but is populated with <option>s via javascript (see later on.) <h1>speech synthesiser</h1> <p>enter some...

WindowOrWorkerGlobalScope.fetch() - Web APIs
rors — it only rejects on network errors. you must use then handlers to check for http errors. windoworworkerglobalscope is implemented by both window and workerglobalscope, which means that the fetch() method is available in pretty much any context in which you might want to fetch resources. a fetch() promise only rejects when a network error is encountered (which is usually when there’s a permissions issue or similar). a fetch() promise does not reject on http errors (404, etc.). instead, a then() handler must check the response.ok and/or response.status properties. the fetch() method is controlled by the connect-src directive of content security policy rather than the directive of the resources it's retrieving. note: the fetch() method's parameters are identical to those of the request() ...

WorkerNavigator - Web APIs
atoronline, navigatordatastore, and navigatorconcurrenthardware interfaces. workernavigator.connectionread only provides a networkinformation object containing information about the network connection of a device. workernavigator.locks read only returns a lockmanager object which provides methods for requesting a new lock object and querying for an existing lock object. workernavigator.permissions read only returns a permissions object that can be used to query and update permission status of apis covered by the permissions api. navigator.storageread only returns a storagemanager interface for managing persistance permissions and estimating available storage. inherited properties navigatorid.appcodename read only always returns 'mozilla', in any browser. this property is ke...

XRSystem: requestSession() - Web APIs
there can only be one immersive vr session at a time. notsupportederror there is no webxr-compatible device available, or the device does not support the specified sessionmode; this can also be thrown if any of the required options are unsupported. securityerror permission to enter the specified xr mode is denied. this can happen for a number of reasons, which are covered in more detail in permissions and security in webxr device api. examples creating an immersive vr session the following example calls requestsession() requesting an "immersive-vr" session. if the promise resolves, it sets up a session and initiates the animation loop. navigator.xr.requestsession("immersive-vr") .then((xrsession) => { xrsession.addeventlistener('end', onxrsessionended); // do necessary session setup...

Guide to Web APIs - Developer guides
fullscreen apiggamepad api geolocation apihhtml drag and drop apihigh resolution timehistory apiiimage capture apiindexeddbintersection observer apillong tasks api mmedia capabilities api media capture and streamsmedia session apimedia source extensions mediastream recordingnnavigation timingnetwork information api ppage visibility apipayment request apiperformance apiperformance timeline apipermissions apipointer eventspointer lock apiproximity events push api rresize observer apiresource timing apisserver sent eventsservice workers apistoragestorage access apistreams ttouch eventsuurl apivvibration apivisual viewport wweb animationsweb audio apiweb authentication apiweb crypto apiweb notificationsweb storage apiweb workers apiwebglwebrtcwebvttwebxr device apiwebsockets api ...

<iframe>: The Inline Frame element - HTML: Hypertext Markup Language
tory. permitted parents any element that accepts embedded content. implicit aria role no corresponding role permitted aria roles application, document, img, none, presentation dom interface htmliframeelement attributes this element includes the global attributes. allow specifies a feature policy for the <iframe>. see the article privacy, permissions, and information security for details on security issues and how <iframe> works with feature policy to keep systems safe. allowfullscreen set to true if the <iframe> can activate fullscreen mode by calling the requestfullscreen() method. this attribute is considered a legacy attribute and redefined as allow="fullscreen". allowpaymentrequest set to true if a cross-origin <iframe> should b...

Feature-Policy: xr-spatial-tracking - HTTP
working draft ...

OPTIONS - HTTP
r.example/resources/post-here/ url via the following: access-control-allow-methods post, get, and options are permitted methods for the url. (this header is similar to the allow response header, but used only for cors.) access-control-allow-headers any script inspecting the response is permitted to read the values of the x-pingother and content-type headers. access-control-max-age the above permissions may be cached for 86,400 seconds (1 day). http/1.1 204 no content date: mon, 01 dec 2008 01:15:39 gmt server: apache/2.0.61 (unix) access-control-allow-origin: https://foo.example access-control-allow-methods: post, get, options access-control-allow-headers: x-pingother, content-type access-control-max-age: 86400 vary: accept-encoding, origin keep-alive: timeout=2, max=100 connection: keep-aliv...

eval() - JavaScript
ll, uses global scope, throws referenceerror because `x` is undefined (0, eval)('x + y'); // another example of indirect call } never use eval()! eval() is a dangerous function, which executes the code it's passed with the privileges of the caller. if you run eval() with a string that could be affected by a malicious party, you may end up running malicious code on the user's machine with the permissions of your webpage / extension. more importantly, a third-party code can see the scope in which eval() was invoked, which can lead to possible attacks in ways to which the similar function is not susceptible. eval() is also slower than the alternatives, since it has to invoke the javascript interpreter, while many other constructs are optimized by modern js engines. additionally, modern javascript...

Autoplay guide for media and Web Audio APIs - Web media technologies
<iframe src="mediaplayer.html" allow="autoplay 'src'"> </iframe> example: allowing autoplay and fullscreen mode adding fullscreen api permission to the previous example results in a feature-policy header like the following if fullscreen access is allowed regardless of the domain; a domain restriction can be added as well as needed. ...

Web technology for developers
possible to display complex mathematical equations and syntax. temporary the stuff below here is temporary to help keep track of things while organization work is ongoing. pay it no mind. ...

Caching compiled WebAssembly modules - WebAssembly
}) }, note: it is for this kind of usage that webassembly.instantiate() returns both a module and an instance: the module represents the compiled code and can be stored/retrieved in idb or shared between workers via postmessage(); the instance is stateful and contains the callable javascript functions, therefore it cannot be stored/shared. if opening the database failed (for example due to permissions or quota), we fall back to simply fetching and compiling the module and don't try to store the results (since there is no database to store them into). errmsg => { console.log(errmsg); return webassembly.instantiatestreaming(fetch(url)).then(results => { return results.instance }); }); } caching a wasm module with the above library function defined, getting a wasm module ...

WebAssembly Concepts - WebAssembly
readable and debuggable — webassembly is a low-level assembly language, but it does have a human-readable text format (the specification for which is still being finalized) that allows code to be written, viewed, and debugged by hand. keep secure — webassembly is specified to be run in a safe, sandboxed execution environment. like other web code, it will enforce the browser's same-origin and permissions policies. don't break the web — webassembly is designed so that it plays nicely with other web technologies and maintains backwards compatibility. note: webassembly will also have uses outside web and javascript environments (see non-web embeddings). how does webassembly fit into the web platform? the web platform can be thought of as having two parts: a virtual machine (vm) that runs...