Hey!
I would like to propose and discuss a slightly different approach to address the browser integration issues and difficulties that we suffered from over the years.
My quick summary of the situation:
- support for the system browser in SWT is a constant source of issues and difficulties
- the support is outdated and problematic - and I don’t see a solution for this coming up anytime soon
My proposal:
- remove the system browser integration from SWT altogether
- ship a Chromium-based rendering engine as part of SWT
I don't see these ^ two as depending on each other. While having Chromium based rendering engine is good for the Eclipse IDE it would be totally useless for standalone SWT applications as Chromium based engine is as big as operating system installs nowadays. I say that as some of the hardest issues worked and fixed lately are coming on behalf of a company shipping standalone apps.
The details:
- there are different technical proposals around to integrate Chromium with SWT (e.g. (J)CEF and Electron offscreen rendering)
- pick the most promising one (performance-wise probably CEF)
- include the latest (CEF) runtimes that are available
The security/CVE question:
- restrict the rendering engine to work on local resources only (trusted resources)
- restrict the rendering engine to basically "not render anything from the internet“ (not trusted resources)
Local only is also questionable as many javadocs ( docs in general ) tend to refer to http content for complete info.
Overall, I think that if there is someone dedicated to spend the resources on adding Chromium support - do it ASAP, let it prove to be a viable solution and if there are no people to keep system browsers integration let them die - platform by platform, version by version. I know for sure that for at least for some of them there are more people working on system browser integration compared to chromium one and sometimes not even care about cross-platform.
- this would allow us to have a solid rendering engine inside of SWT to implement HTML/CSS-based UIs in SWT, show hover content, javadoc help, do a real cool terminal integration, etc.
- this would avoid the need to always ship the latest Chromium runtimes on the same day. Instead, we could just include the latest Chromium runtimes that are around when building an SWT release - and don’t worry about updating the rendering engine independently all the time a new CVE fix comes along
This would follow (at least to a certain degree) the way VSCode uses Chromium and Electron for their UIs. Their chromium version is way behind the latest one that is available, but they don’t always need the latest CVE fixes since there they use the embedded Chromium to render their own content - not random stuff from the internet.
What do you think?
Cheers
Martin
_______________________________________________
eclipse-ide-wg mailing list
eclipse-ide-wg@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://www.eclipse.org/mailman/listinfo/eclipse-ide-wg
