Which features are inactive until a gadget is published?

To view these problems, display my new HTML Sandbox 2 gadget on the Live Spaces Developer Preview (go to this URL after you have logged into your Live Space):

http://spaces.live.com/spacesapi.aspx?wx_action=create&wx_url=http://www.ftppro.com/gadgets/HtmlSandbox2_ms.xml

--

1. The Preview is not displayed on the Live Spaces Developer Preview. The normal method of recognizing the Gallery Preview mode does not work here:

if (!p_args.module.getMode)

Please let me know how I can recognize that the gadget is running in the Live Spaces Developer Preview mode (as opposed to Author mode or View mode), and which methods will throw exceptions in this mode only.

--

2. After you install the gadget on your Live Space, add the following HTML code to “HTML Sandbox 2”:

<a href="http://www.live.com">live.com</a>

Click Save, click [Exit edit mode], and then click [Edit your space]. Everything works great.

Click [Edit HTML], and add “target=_blank” to the anchor tag. Click Save, and then click the link that you added to the gadget, which causes a popup screen with live.com to be displayed.

Now it gets weird. Click [Exit edit mode], and the live.com link is no longer shown on the “HTML Sandbox2” gadget. Click [Edit your space], and the Gadget has died. The [Edit HTML] button is no longer displayed. You have to remove the Gadget, and re-install it.

Is this behavior caused by a restriction within the Development mode, which permits a link from containing “target=_blank”?

--

3. Now display the Gadget on the Gadget Platform Test Page:

http://test.livegadgets.net/gadgets/TestPlatform/testpages.htm?m=http://www.ftppro.com/gadgets/HtmlSandbox2_ms.xml

Four of the five screens appear to display correctly. You can add links containing “target=_blank”, and everything works great.

However, the spaces.live.com (view mode) is blank, and only the first screen is “persistent”. The other screens do not retain their data after Save is clicked, and the page is refreshed.

The same problems occur when Microsoft’s original HTML Sandbox is loaded onto the Gadget Platform Test Page.

http://test.livegadgets.net/gadgets/TestPlatform/testpages.htm?m=http://download.gallery.start.com/d.dll/1~1~209~5304/gadget.xml

--

How can I confirm that my HTML Sandbox 2 gadget works correctly in Live Spaces, before I release it to the world?

[4566 byte] By [ftppro] at [2008-1-7]
# 1

To answer my own question:

The "setPreference" method stores two bytes for each blank space, and two bytes for each line feed. Therefore, it is very easy to crash the HTMLSandbox gadget: just keep pasting blank spaces and line feeds until you reach the gadget’s maximum. After you save your text, you will be unable to re-load the gadget.

The solution is exemplified here:

JavascriptExample

The Sandbox2 gadget replaces blank spaces and line feeds with special characters which only consume one byte each.
ftppro at 2007-10-2 > top of Msdn Tech,Gadgets,Web Gadget Development...
# 2

If you're just replacing two-byte items with one-byte items, you'll still have the same problem. You'll just need twice as many spaces or newlines to crash the gadget. You could even do run-length encoding (replace n spaces with 1 space and 1 number signifying 'n') if you believe you'll have a large number of contiguous spaces or newlines, but even that will eventually run up against the size limit.

The only way to truly solve the problem is to bound your input. If you can only save m characters, limit your input box to m characters and add validation code that double-checks that the user did not input n characters, where n > m. An encoding solution may allow you to store more data, but it will not prevent a malicious user from crashing the gadget (is it really malicious when all you can do is spoil your own use of the gadget?).

ToddOs at 2007-10-2 > top of Msdn Tech,Gadgets,Web Gadget Development...