From 64bf8e7648d60a11c3d1d5cacffd073be9431713 Mon Sep 17 00:00:00 2001 From: Aleksandr Shevchuk Date: Wed, 14 Oct 2026 10:18:42 +0300 Subject: [PATCH] docs(demo): compare.html says what untrusted checks, not that nothing is checked Closes #28. Co-Authored-By: Claude Fable 5.1 --- apps/demo/demo/compare.html | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/apps/demo/demo/compare.html b/apps/demo/demo/compare.html index d6fdd25..38b82dc 100644 --- a/apps/demo/demo/compare.html +++ b/apps/demo/demo/compare.html @@ -127,7 +127,7 @@

When to choose something else

  • Your site already runs Moodle. Its built-in H5P plays and edits content, records scores in the gradebook, and plays offline in the Moodle app. Use it.
  • You want it managed for you. h5p.com hosts, edits, reports and integrates with LMSs, with support, for a subscription. This player needs someone to deploy and update it.
  • You want scores stored per learner with no code. The H5P plugins for WordPress, Drupal and Moodle keep results per user out of the box. Here results are events: your page, an LRS or cmi5 decides where they go.
    • -
  • Your users upload packages that others play. The H5P plugins check each upload before any of it runs, and this player does not; Data and trust, below, has the difference.
    • +
  • Your users upload content types the library pack lacks. The H5P plugins install new library code from an administrator’s upload; here a package played untrusted gets its libraries from a pack pinned per release, and one that needs a newer library waits for the next pack. Data and trust, below, has what the check covers.
  • You have a few packages and are happy to unzip them. h5p-standalone is smaller and has been around longer; served from static files, media streams from the host directly.
    • @@ -152,10 +152,15 @@

    Data and trust

    The H5P plugins answer that by checking what is uploaded. An upload adds library code only if the uploader may install libraries, every field of the content is filtered against what its content type allows, and by default the content folder may hold only listed file types, - none of them scripts, stylesheets, SVG or HTML. The code that passes then runs on the - site’s own origin, beside its logins. This player checks none of that and keeps packages - apart instead: the Embed setup runs them on a domain of their own, where a hostile package - cannot touch your site, though it can read what other packages stored on that domain. + none of them scripts, stylesheets, SVG or HTML. This player does the same for a package + played untrusted: none of the package’s own code runs, its libraries come + from the pack you chose, its content folder serves the plugins’ list of file types and + nothing else, and its content is checked against each library’s field definitions by a + port of the plugins’ own validator, compared with the original on 98 cases. + Packages you did not make + has the details. Embed adds a domain on top: a package then runs apart from your site + altogether, where a hostile one cannot touch your logins, though it can read what other + packages stored on that domain.