Enable Flash under Caja

Bridge.swf
- Adds the file

Bridge.as
- Adds logging to gadgets.log
- Adds option to suppress logging

flash.js
- Changes the flash tag setup so it's not trivially susceptible to HTML/JavaScript injection attacks

taming.js
- Instead of using the event loop to poll for the option to use registerChannel, queue requests and process them when onFlashBridgeReady fires
- formatting of taming tree
- set size of bridge flash to zero

[metaweta, 2009-09-09 20:29:33]

Ping?

[louiscryan, 2009-09-10 01:03:13]

Looks good to me.

http://codereview.appspot.com/116048/diff/1/6
File features/src/main/javascript/features/caja/taming.js (right):

http://codereview.appspot.com/116048/diff/1/6#newcode861
Line 861: //d.style.display = "none";
remove commented out line

http://codereview.appspot.com/116048/diff/1/4
File javascript/container/Bridge.as (right):

http://codereview.appspot.com/116048/diff/1/4#newcode61
Line 61: if (_root.logging) { _root.createTextField('message',0,0,0,600,600); }
this isnt necessary anymore if youre using  gadgets.log no?

[metaweta, 2009-09-10 18:01:24]

On 2009/09/10 01:03:13, louiscryan wrote:
> Looks good to me.
> 
> http://codereview.appspot.com/116048/diff/1/6
> File features/src/main/javascript/features/caja/taming.js (right):
> 
> http://codereview.appspot.com/116048/diff/1/6#newcode861
> Line 861: //d.style.display = "none";
> remove commented out line

Done.

> 
> http://codereview.appspot.com/116048/diff/1/4
> File javascript/container/Bridge.as (right):
> 
> http://codereview.appspot.com/116048/diff/1/4#newcode61
> Line 61: if (_root.logging) { _root.createTextField('message',0,0,0,600,600);
}
> this isnt necessary anymore if youre using  gadgets.log no?

Removed, and also above in the log() method.

[metaweta, 2009-09-10 21:54:05]

The latest flash update (10.0.32.18) broke LocalConnection for many people,
including me.  I have to figure out a workaround.

[metaweta, 2009-09-11 18:56:44]

I uninstalled and reinstalled flash and restarted the browser a few times, and
it finally started working again.  I have no idea why it wasn't working before.

This highlights one of the big downsides of this technique: LocalConnection is
really flaky even on the best of days, so people may have to reload; there's
also a limit of *8* localconnections on firefox:

http://advision.webevents.yahoo.com/cm/LCtest/

Playing with this page, it seems that closing the page containing the
communicating gadgets does not free up the localconnections either, so you have
to restart the browser; perhaps that's why I couldn't get this to work earlier.

[metaweta, 2009-09-11 21:19:26]

One slow but reliable alternative to the LocalConnection is using XMLSocket to
bounce messages off of a server between the sandboxed flash and the bridge.

[metaweta, 2009-09-11 21:40:11]

Another way for the future might be to use RTMFP (a udp-based protocol) and send
data as though the sandboxed flash and the bridge were on separate computers. 
It assumes, however, that there's an enabling server for getting the two
connections hooked up with each other; right now the only server that's
available is adobe's stratus beta, but apparently the plan is to let people run
their own servers.

[metaweta, 2009-09-22 23:24:50]

These alternatives are all speculative; we should commit this patch.  Mac users
can vote up the issue with Adobe, and since caja is opt-in, this won't be more
than a minor problem.

The cajoler strips <object> and <embed> tags; if someday in the future we decide
to rewrite flash as part of the cajoler, we'll do it in a way that doesn't
depend on Shindig.

Since none of the code has changed (modulo removing one unused variable and some
whitespace) since last time you said LGTM, please commit.

Thanks!