deck.js icon indicating copy to clipboard operation
deck.js copied to clipboard

Local slide decks no longer work in Chrome 45.0.2454.85+

Open Cara-Jo opened this issue 10 years ago • 8 comments

Chrome updated and fixed a 'security' hole that no longer allows local sites (in the case of a slide deck) to use the 'replicateState'.

Uncaught SecurityError: Failed to execute 'replaceState' on 'History': A history state object with URL 'file://<local file url>' cannot be created in a document with origin 'null'.

The Chrome error lists the following files as the issue:

changeHash  @   deck.core.js:340
methods.go  @   deck.core.js:466
methods.next    @   deck.core.js:479
(anonymous function)    @   deck.core.js:194
x.event.dispatch    @   jquery.min.js:5
x.event.add.v.handle    @   jquery.min.js:5

All files are being hosted locally on my machine since these slides are sometimes used in places that do not have internet.

They work in IE, Safari, and Firefox as well as in Chrome only after running a local webserver.

Cara-Jo avatar Sep 28 '15 18:09 Cara-Jo

+1

aadamovich avatar Oct 01 '15 19:10 aadamovich

:+1:

tlberglund avatar Oct 01 '15 23:10 tlberglund

What is the suggestion here? To include a thin web server w/ deck.js? To not use replaceState? Document this as a warning?

imakewebthings avatar Oct 02 '15 00:10 imakewebthings

I will confess up front to not having looked at how you use replaceState(), therefore not knowing offhand the implications of removing it, but it seems like Chrome has now made it a dead letter, and not using it is the right thing to do. Unless this kind of API retreat becomes a massive trend and JavaScript from file:// URLs becomes practically impossible, I think the thin web server option is too complex. It's an extra moving part that will be a pain in the butt across platforms, having its own dependencies, etc.

If the alternatives to replaceState() end up ballooning history in weird ways or being unacceptable for other reasons, that's cool, but absent compelling considerations there I think nuking it is the right thing to do.

tlberglund avatar Oct 02 '15 14:10 tlberglund

Workaround: Open deck.js, go to line ~340 and change window.history.replaceStats({}, "", hashPath); to try{window.history.replaceStats({}, "", hashPath);}catch(err){if (!err.message.startsWith("Failed to execute 'replaceState' on 'History'")){throw new Error(err.message);}}

Note that it is a nasty fix. Better would be to handle only this specific error (but current chrome won't work with "instanceof SecurityError") and in case of any other error just throw it through...

adderek avatar Nov 06 '15 08:11 adderek

+1

TheBox193 avatar Nov 11 '15 01:11 TheBox193

@tlberglund @sarperlman Can this be closed?

mjenkinsfuerst avatar Nov 16 '16 15:11 mjenkinsfuerst

Well, we don't have write access to this repo, so we can't close it ourselves, but good catch all the same! This was fixed in Chrome at some point in the past few months.

tlberglund avatar Nov 16 '16 15:11 tlberglund