<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">29 jan. 2020 kl. 09:04 skrev Daniel Veditz <<a href="mailto:dveditz@mozilla.com" class="">dveditz@mozilla.com</a>>:<br class=""><div><blockquote type="cite" class=""><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:arial,sans-serif;font-size:small">It will be tons easier to distribute a small WebExtension that works on every OS than a whole browser on multiple platforms, and having to maintain a robust update infrastructure and constantly chasing the upstream source to keep up with security fixes. I STRONGLY RECOMMEND you try to make that work before taking on the responsibility of going down the custom-browser path.<br class=""></div></div></div></blockquote><div><br class=""></div>I wholly concur but WebExtensions cannot accomplish what I need. as an example, I want for my user to type in: ”sql://…” and I will look up stuff on a database, returning HTML</div><div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:arial,sans-serif;font-size:small">The extension mechanism Dave linked to can also resolve to a page internal to your extension which I would expect to be a blank shell that loads your JS libraries and generates the web content in-place--you don't necessarily have to just translate it to an HTTPS request to a server you have to keep running. </div></div></blockquote><div><br class=""></div><div>oh… I didn’t realise that… however, it does prohibit me from using a reasonable protocol name… I have to call it web+X</div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:arial,sans-serif;font-size:small">This mechanism and the HTML registerProtocolHandler API that Jonathan mentioned will only work for "documents" (windows/tabs and iframes) and not arbitrary tags like the <IMG> you gave as an example.</div></div></blockquote><div><br class=""></div><div>this is also a problem because that means the HTML I generate cannot contain references to other things that need to get fetched (like images)… in that case I’ll have to make sure to embed everything into a single page. it’s doable but it may take some thought</div><br class=""><blockquote type="cite" class=""><div dir="ltr" class=""><div class="gmail_default" style="font-family:arial,sans-serif;font-size:small">The fact that you want both makes me worry that you might be using this protocol as a "command" that affects the state of something rather than as something that returns data (there's nothing that makes sense as a document, a <script> and an <img>, for example), and exposing a command language to the web usually ends in tears. See, for example, the cautionary tale of <span class="" style="font-family: monospace;">zoomopener:</span> from last summer <a href="https://blog.assetnote.io/bug-bounty/2019/07/17/rce-on-zoom/" class="">https://blog.assetnote.io/bug-bounty/2019/07/17/rce-on-zoom/</a></div></div></blockquote><div><br class=""></div>it’s not a command, it’s a URI and its only purpose is to fetch a document</div></div></body></html>