I have an app that I am converting to Xojo. The app uses a browser and javascript to present an email client interface to the user.
The app receives emails, some of which may be spam, and some of those may be in badly-formed html. At the moment I can use javascript to put the html into a DOM object, and then get it back again. The reason for doing this is that what I get back is then properly formed html; the browser does a better job of that than I ever could (I can then also store the corrected html).
The next thing I do is under certain conditions to modify the DOM content to prevent the downloading of images and disabling of links. This prevents the mail from phoning home and telling the spammer that this email address is live.
Only then do I swing the DOM into a document, and let the browser render it. I discovered that I have to do all this outside the document because with some browsers (perhaps all these days), once you start loading a document, then even if your javascript is still running, it will start to do speculative downloading of images. My modifications to the document’s DOM would thus come too late to prevent the phoning home.
I’m trying to see how I could do all this in Xojo. In my converted app I already use an htmlviewer for received mails, and I see I can send it a string of javascript for execution. Are there any other ways to get javascript executed? Is the javascript I send to the htmlviewer limited in any way as to what it is allowed to do? Could it, for example, replace the document in the htmlviewer with another?
I would start by asking how your app is receiving emails. If you’re using a HTMLViewer to fetch them over webmail, it may already be too late to make the injections you do.
It would be optimal to receive the emails via a mail protocol, parse them with Xojo code (RegEx, string replacement, however you may choose,) and then display them with a HTMLViewer and a local html file.
Are there any other ways to get javascript executed?
In Xojo, not for your purposes. AppleScript on newer systems can execute JavaScript commands, but I never looked into how complex that actually gets, or if it would be usable in Xojo somehow.
Is the javascript I send to the htmlviewer limited in any way as to what it is allowed to do?
Not limited in feature-set, but it may be harder to implement some things. There’s no JS debugger, so it can get difficult unless you’re an expert with JavaScript. Security settings may come into play that aren’t immediately obvious.
Could it, for example, replace the document in the htmlviewer with another?
Yes. At some point it would be easier to just load a new local page though.
In my original app things are driven by the javascript, which makes ajax calls to backend PHP scripts that do the work of sending/receiving mails, and then storing them in SQLite databases. In the Xojo version, I use a thread, and all that part of the app is working fine. It’s the anti-spam refinements I’m looking at now (I’ve already converted my PHP bayesian spam filter to Xojo).
When it comes to sanitising what I have received, parsing html code myself is something I’d like to try and avoid. Originally I was doing that in PHP and it was never really satisfactory. It does seem though that the htmlviewer is write-only
I suppose I could construct a long javascript string with, embedded in it, the html it needs to clean up, but I could see that being very error-prone and hard to debug for the reasons you give.
Indeed. But nicer would be a new method for the htmlviewer: ReadPage(), to complement LoadPage(). Then I can read the corrected html back after WebKit has fixed it up.
