Bug 35802

This bug might be more for the Sites team, but there's definitely a WebKit error being thrown that seems a bit suspect so I figured I'd start here. I work for Animoto.com, a video generation service, which publishes a lot of video to the web via a Flash video player. We include a URL in our flashvars for our Pro users to be able to provide a linkback to their websites. While Chrome loads our player just fine with standard embeds, when embedded via a Gadget embed in Sites WebKit is choking on: "Refused to load an object. URL found within request" Perhaps via XSSAuditor::canLoadObject(). Example -- if you hit this link soon you may see the problem, although the user will probably try to fix it: http://sites.google.com/a/1stnepean.ca/scout-troop/photos/2009-year-in-review. (For comparison, a non-gadgets embed with URL in Flashvars that loads fine: http://www.davidmartschinske.com/) I'm sure there are valid security reasons for calling XSSAuditor::canLoadObject to try and weed out risky content. However, passing a url into a swf's flashvars does not constitute a security risk in and of itself, as evidenced by Animoto's vanilla use case. Perhaps there's some way WebKit and the Sites team can improve this filtering a little, so that low-threat use cases aren't unnecessarily blocked. Thanks for you time -- If this needs to be passed to the Sites team please let me know if there's a way to bypass their forum as an entry point. (OK to contact me offlist regarding this specific issue)