Add allow-presentation to iframe sandbox flags

[tidoust]

The Presentation API spec, developed by the Second Screen Working Group, needs to introduce an allow-presentation token to the set of tokens allowed in the sandbox attribute of an iframe element, in order to allow calls to the Presentation API from nested frames, provided the parent browsing context allows it.

The definition of this flag has been in the Presentation API spec for now:
http://w3c.github.io/presentation-api/#sandboxing-and-the-allow-presentation-keyword

As the Presentation API spec is getting ready for publication as Candidate Recommendation, now seems a good time to move the definition to where it should rather be, meaning in the HTML spec.

Note the flag has made its way to the WHATWG HTML spec a few days ago in whatwg/html@0678e3d

Not sure if you can cherry-pick the commit directly. Happy to prepare the corresponding PR for the HTML5.1 spec otherwise.

(For reference, related issue on the Second Screen Working Group issue tracker: w3c/presentation-api#299)

[chaals]

Do you have tests and implementation for this? Otherwise landing it in a couple of weeks, after we've branched the HTML 5.1 CR, sounds like a more likely approach. If you do already have interoperable implementation, feel free to prepare a PR any time today to reach the current milestone...

[tidoust]

OK, "now" was not meant to convey any sense or urgency, I did not know about the milestone. I suppose this can wait until after the CR branch. We don't have tests yet and implementations are still under development.

[chaals]

@tidoust, ping? Are there implementations, tests, enough interop to set a concrete milestone for this?

[tidoust]

Hello @chaals, sandboxing tests for this flag are there:

• Sandboxing: starting a presentation from a nested context succeeds when allow-presentation is set
• Sandboxing: starting a presentation from a nested context fails when allow-presentation is not set
• Sandboxing: Reconnecting a presentation from a nested context succeeds when allow-presentation is set
• Sandboxing: Reconnecting a presentation from a nested context fails when allow-presentation is not set

Implementations:

• Tests pass in Chrome v54
• First test fails in Firefox Nightly. All other tests pass, provided the right config flags get set. Failure still needs to be investigated (and fixed!).

In short, I believe we're mostly good and the Second Screen WG would like this flag to be integrated in HTML 5.2 as soon as possible. Would you like me to prepare a PR?