WindowOrWorkerGlobalScope.crossOriginIsolated - Web APIs
the crossoriginisolated read-only property of the windoworworkerglobalscope interface returns a boolean value that indicates whether a sharedarraybuffer can be sent via a window.postmessage() call. this value is dependant on any cross-origin-opener-policy and cross-origin-embedder-policy headers present in the response. syntax var mycrossoriginisolated = self.crossoriginisolated; // or just crossoriginisolated value a boolean value examples if(crossoriginisolated) { // post sharedarraybuffer } else { // do something else } specifications specification status comment html living standardthe definition of 'crossoriginisolated' in that specification. living standard initial definition. ...

MediaStreamTrack - Web APIs
connected, this value can be changed but has no more effect. note: you can implement standard "mute" functionality by setting enabled to false. the muted property refers to a condition in which there's no media because of a technical issue. mediastreamtrack.id read only returns a domstring containing a unique identifier (guid) for the track; it is generated by the browser. mediastreamtrack.isolated read only returns a boolean value which is true if the track is isolated; that is, the track cannot be accessed by the document that owns the mediastreamtrack. this happens when the peeridentity property is set, or if the track comes from a cross-origin source. mediastreamtrack.kind read only returns a domstring set to "audio" if the track is an audio track and to "video", if it is a video t...
...s to ended). also available using the onended event handler property. mute sent to the mediastreamtrack when the value of the muted property is changed to true, indicating that the track is unable to provide data temporarily (such as when the network is experiencing a service malfunction). also available using the onmute event handler property. isolationchange sent whenever the value of the isolated property changes due to the document gaining or losing permission to access the track. also available through the onisolationchange event handler property. overconstrained sent when the constraints specified for the track cause the track to be incompatible and therefore to not be used. also available through the onoverconstrained event handler property. unmute sent to the track when data ...
...rack cause the track to be incompatible and therefore to not be used. also available through the onoverconstrained event handler property. unmute sent to the track when data becomes available again, ending the muted state. also available through the onunmute event handler property. specifications specification status comment identity for webrtcthe definition of 'isolated tracks' in that specification. candidate recommendation additional properties for isolated track support media capture and streamsthe definition of 'mediastreamtrack' in that specification. candidate recommendation initial definition ...

window.postMessage() - Web APIs
your site. always specify an exact target origin, not *, when you use postmessage to send data to other windows. a malicious site can change the location of the window without your knowledge, and therefore it can intercept the data sent using postmessage. secure shared memory messaging if postmessage() throws when used with sharedarraybuffer objects, you might need to make sure you cross-site isolated your site properly. shared memory is gated behind two http headers: cross-origin-opener-policy with same-origin as value (protects your origin from attackers) cross-origin-embedder-policy with require-corp as value (protects victims from your origin) cross-origin-opener-policy: same-origin cross-origin-embedder-policy: require-corp to check if cross origin isolation has been successful, y...
... example /* * in window a's scripts, with a being on <http://example.com:8080>: */ var popup = window.open(/* popup details */); // when the p...
... example /* * in window a's scripts, with a being on <http://example.com:8080>: */ var popup = window.open(/* popup details */); // when the popup has fully loaded, if not blocked by a popup blocker: // this does not...

Components.utils.Sandbox
ndbox. as of gecko 13 (firefox 13.0 / thunderbird 13.0 / seamonkey 2.10), if you don't specify a sandbox name it will default to the caller's filename. sandboxprototype a prototype object for the sandbox. the sandbox will inherit the contents of this object if it's provided. passing a content window object, setting wantxrays:true (default) and using an extended principal provides a clean, isolated execution environment in which javascript code that needs web apis (such as accessing the window's dom) can be executed without interference from untrusted content code. wantcomponents a boolean indicating whether the components object is available or not in the sandbox. default: true. if the sandbox interacts with untrusted content this should be set to false when possible to further re...
...ng scripts page. this example is to be run from scratchpad with environemnt set to browser. it alerts the dollar sign function. this code was tested on twitter.com and gets access to the jquery $. var sandboxscript = 'alert($)'; var options = { sandboxprototype: content, wantxrays: false // only set this to false if you need direct access to the page's javascript. true provides a safer, isolated context. }; var sandbox = cu.sandbox(content, options); cu.evalinsandbox(sandboxscript, sandbox); cu.nukesandbox(sandbox); ...

Virtualenv
unix or run activate.bat on windows. unix example . bin/activate once the virtualenv is activated, the virtualenv's python (and other executables) will be on your path and you will have a new environment variable, virtual_env, that points to the path of the virtualenv, as well as a deactivate function for deactivating the virtualenv. virtualenv tools virtualenv does one thing well: creates isolated virtual environments of python packages. due to its utility, tools have been built around this functionality. here are a few such tools: carton: make a self-extracting virtualenv from directories or urls of packages; http://pypi.python.org/pypi/carton velcro: a script that sets up a python project for local installation; https://bitbucket.org/kumar303/velcro/ virtualenvwrapper: a set of e...
...ty, tools have been built around this functionality. here are a few such tools: carton: make a self-extracting virtualenv from directories or urls of packages; http://pypi.python.org/pypi/carton velcro: a script that sets up a python project for local installation; https://bitbucket.org/kumar303/velcro/ virtualenvwrapper: a set of extensions to ian bicking’s virtualenv tool for creating isolated python development environments; http://www.doughellmann.com/projects...tualenvwrapper the mozilla-central virtualenv in order to make use of various python modules located throughout mozilla-central, a virtualenv is created as part of the build process: http://mxr.mozilla.org/mozilla-central/source/js/src/build/autoconf/python-virtualenv.m4 . the virtualenv is created in ${objdir}/_virtuale...

Cross-Origin-Embedder-Policy - HTTP
arraybuffer objects or performance.now() with unthrottled timers, if your document has a coep header with the value require-corp value set. cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin see also the cross-origin-opener-policy header which you'll need to set as well. ...
...ocument has a coep header with the value require-corp value set. cross-origin-embedder-policy: require-corp cross-origin-opener-policy: same-origin see also the cross-origin-opener-policy header which you'll need to set as well. to check if cross origin isolation has been successful, you can test against the crossoriginisolated property available to window and worker contexts: if (crossoriginisolated) { // post sharedarraybuffer } else { // do something else } avoiding coep blockage with cors if you enable coep using require-corp and have a cross origin resource that needs to be loaded, it needs to support cors and you need to explicitly mark the resource as loadable from another origin to avoid blockage from coep. for example, you can use the crossorigin attribute for this image from a...

Planned changes to shared memory - JavaScript
ion can be removed in the future. webassembly.memory can still be used to get an instance. unless the two headers mentioned above are set, the various postmessage() apis will throw for sharedarraybuffer objects. if they are set, postmessage() on window objects and dedicated workers will function and allow for memory sharing. to avoid having to check whether postmessage() throws, self.crossoriginisolated is being standardized (a getter that returns a boolean; true if the headers are set), available in window and worker contexts. webassembly shared memory the webassembly threads proposal allows webassembly.memory objects to be created with a new shared constructor flag. when this flag is set to true, the constructed memory object can be shared between workers via postmessage(), just like shared...
... also unconditionally allowed. further reading coop and coep explained. cross-origin-opener-policy: whatwg/html issue #3740, draft specification. cross-origin-embedder-policy: whatwg/html issue #4175, draft specification. cross-origin-resource-policy: standardized in fetch, new cross-origin value is part of the cross-origin-embedder-policy effort. postmessage() changes and self.crossoriginisolated: whatwg/html issue #4732, whatwg/html issue #4872, draft specification. ...

SharedArrayBuffer - JavaScript
call...
...calling a sharedarraybuffer constructor as a function without new will throw a ...

/loader - Archive of obsolete content
e loaded in the loader itself: let { loader, require, unload } = require('toolkit/loader'); what is it good for ? create somewhat standardized js environments that people doing non-browser js are familiar with. provide an environment for loading commonjs style modules, which makes it possible to consume lots of interesting code that has already been developed. secure each module in an isolated js sandbox and makes any capability imports explicit via calls to the require() function. create task specific loaders with restricted module access. provide unload hooks that may be used to undo changes made by anything loaded into it. instantiation the loader module provides a loader() function that may be used to instantiate new loader instances: let loader = loader(options); configurat...

Appendix D: Loading Scripts - Archive of obsolete content
mespace contamination and the resulting compatibility issues are only an issue when they are imported into shared global namespaces. data sharing: as modules are loaded only once globally, every import has access to the same data and global variables no matter what context or window it was imported from. javascript modules can therefor be used for communication and data sharing between otherwise isolated contexts. debugging: chromebug (at least) can list component.utils modules and single step through them. disadvantages namespacing: as modules always execute with their own namespace, they have no direct access to the dom or window properties of windows or documents, and therefore must often pass around references to these objects and any document-specific state data that they require. ex...

Setting up an extension development environment - Archive of obsolete content
es%\mozilla firefox\firefox.exe" -no-remote -p dev on windows 64 bit: start -> run "%programfiles(x86)%\mozilla firefox\firefox.exe" -no-remote -p dev to start thunderbird or seamonkey instead of firefox, substitute thunderbird, or seamonkey for the firefox used in our examples. note: you could run firefox using your regular profile while developing. however, you won't enjoy the benefits of isolated resources, which we discussed earlier. the parameter -p profilename doesn't imply -no-remote, therefore use them together. if you are already running a firefox instance without -no-remote, and you attempt to start another instance with -p profilename (but without the -no-remote parameter), that second invocation would ignore its -p profilename parameter, instead opening a new window for the alr...

MMgc - Archive of obsolete content
lack, its already been marked so a write barrier needs to be inserted anywhere we could possibly store a pointer to a white object into a black object. in practice this means: setting a property on an object to another object (creating an arch in the reachabilty graph) native code that writes a pointer to a gc object into another gc object writing an object to a gc root 1 and 2 are pretty well isolated. 1 is the setslot method in the avm- and some assembly code in the avm+. #2 can be found by examining all non-const methods of gc objects (and making all fields private, something the avm+ code base does already). #3 is a little harder because there are a good # of gc roots. this is an unfortunate artifact of the existing code base, the avm+ is relatively clean and its reachability graph consists...

XPJS Components Proposal - Archive of obsolete content
.js file (let's call it a module) is started up and run in the context of a relatively 'raw' js global object. the standard (non-dom) js classes will be available. the xpconnectcomponents object will be available. and some additional yet to be defined objects may be available. the xpconnectcomponents object allows access to the whole repository of native and js xpcom components, so this is not as isolated an environment as it might at first sound. a 'load' or 'import' function will also be provided to let the js code import other .js files where libraries of code might be stored. this is akin to 'static' libraries. accessing other components/services via xpcom/xpconnect is more akin to 'dynamic' libraries. when a xpjs component module is first installed - or at autoregistration time - the xpjsma...

The Joy of XUL - Archive of obsolete content
. a developer can maintain one primary code base for their application and customize the logo and branding for each of their customers by supplying different skins. an application that is written and deployed with an english language user interface can be translated to french for the same customer. while such changes are extensive and affect most (if not all) of the application, they are also isolated from one another, enabling the core xul definition and application logic to be shared among all of the custom versions. supporting technologies there are number of other technologies introduced by mozilla that complement xul for building cross platform web applications. xbl the extensible bindings language (xbl) is a markup language that defines special new elements, or "...

Cascade and inheritance - Learn web development
re one in this column for each class selector, attribute selector, or pseudo-class contained inside the overall selector. ones: score one in this column for each element selector or pseudo-element contained inside the overall selector. note: the universal selector (*), combinators (+, >, ~, ' '), and negation pseudo-class (:not) have no effect on specificity. the following table shows a few isolated examples to get you in the mood. try going through these, and making sure you understand why they have the specificity that we have given them. we've not covered selectors in detail yet, but you can find details of each selector on the mdn selectors reference. selector thousands hundreds tens ones total specificity h1 0 0 0 1 0001 h1 ...