We've had rather nice Python and Ruby support for some time, thanks to Simon Edwards on Python, Richard Dale on Ruby and Carter Beauford on the drums .. wait, no, Carter is part of some other cool group, but Simon and Richard do indeed rock out with us. ;) While I think that these are great languages for writing full applications with, I also feel that there are possibly better choices for little plugins like Plasmoids. I won't get into all those reasons here (I probably have already done so in a past blog entry, though), but there you have it.
Unfortunately, those other choices, namely JavaScript and WebKit, haven't been so great. Things have improved a lot for the 4.4 release, however. The JavaScript API has been fleshed out and pretty seriously extended. Documentation is catching up as well. There are a few improvements in particular that wanted to highlight, however.
Run-Time Extensions For JavaScript Plasmoids
The first is the ability to request API extensions for JavaScript Plasmoids. The base API is meant to be pretty safe, so that it isn't overly scary to run code from $RANDOM_PLACE on your desktop. (There are a couple of loopholes still before I'm ready to call it "sandboxed", and those will be worked on in the next development cycle and should be part of the 4.5 release.) This means that there isn't access to network access, file dialogs, reading or writing files, etc. by default. This also rather limits what is possible. While a lot of the possible annoyances are alleviated by using a DataEngine, they don't cover all the bases. So starting in 4.4 you can put things like this in your metadata.desktop file:
X-Plasma-RequiredExtensions=FileDialog,http
X-Plasma-OptionalExtensions=LaunchApp
The entries case insensitive, and if security says "yes" then the extensions are activated and the API available to that instance of the widget grows accordingly. This also allows us to quite easily know which Plasmoids will be doing things like, well, opening files or launching applications. You can read about these extensions in the aptly named Extensions section of the API documentation or by looking at the http and fileOperations examples in the kdeexamples module.
In 4.5, we'll be offering additional capabilities including writing to files. There will likely be two levels to that: one that restricts a Plasmoid to writing to files in its own package and a more "full powered" one. The control over which extensions are allowed or not allowed will also be seeing some improvements in 4.5. DataEngines will also be getting tagged for security as right now DataEngine usage is wide open for all widgets and some of the DataEngines have gotten pretty powerful. Speaking of DataEngines, in 4.5 this same extension system is also available to DataEngines and search plugin Runners written in JavaScript.
WebKit Plasmoids Improve
Thanks to work done by Petri Damstén on the WebKit Plasmoid ScriptEngine, you can now do a lot more with the HTML and JavaScript derived widgets. Besides the things that QtWebKit provides, access to DataEngines and configuration values reading and writing are also available. Petri also knocked out some annoying bugs with the WebKit ScriptEngine along the way.
This resulted in people actually writing WebKit based Plasmoids which led to a feature request for Web Inspector support. QtWebKit made that insanely simple: a one line patch and the results are:

There is more to do with the WebKit ScriptEngine, but it's already pretty nice for the 4.4 release of the KDE Software Compilation. One of the biggest things lacking is documentation. We have two examples in kdeexamples now (the above screenshot is from one of them) and there is an introductory article on Techbase, but it's really embryonic still.

5 comments:
What about security for Ruby and Python? If I am not wrong, both Python and Ruby bindings can do anything. And they are easily installed from the internet.
@David: Isn't that the same for any C++ plasmoid (as long as the user has a compiler at hand)?
@ArneBab: No, it is not the same. To use C++ plasmoids you need to know a little more. What I am talking about is the Plasma Desktop feature that easily allows downloading and installing possibly unsafe widgets.
@David Palacio: "What about security for Ruby and Python?"
we will eventually have web-of-trust based systems (signing with gpg), but beyond that there is not too much we can do with Python or Ruby as they are a bit too open and powerful.
Ruby does have some "sandboxing" support, but it's not very flexible and from the language people i've spoken with about it, it seems to be implemented in a slightly awkward way for the kind of features we need.
this is one reason i'm quite a bit more in favour of JavaScript. other benefits like "zero additional dependencies" make for a multi-faceted and compelling reason to go for the javascript approach.
About security, the PyPy project should make it possible to have sandboxed Python plasmoids
Post a Comment