The company I work for displays large engineering drawings in the browser; right now we have to choose between manual png conversion and loading the vectors directly (each one has its own problems). I tried the snippet application with one drawing and it renders perfectly.
For our application we have a 'Google Maps' style viewport where you pan and zoom with the mouse, though. Right now I'm seeing if Gemini 2.5 Pro can refactor the snippet application to work this way. Did you have any plans for building another type of snippet application which works in the fashion?
It could still be quite buggy with Oculus and Vive hardware. They have only enabled WebVR in "Cardboard" mode on mobile which has a much smaller surface area.
TL;DR is for people who forget "statement, explanation, example". Usually, they write some poorly formed paragraph and put a "TL;DR" at the end. Often, that TL;DR is simply the "statement" part of the paragraph that should have been at the very beginning anyway.
If anyone's interested in how the exploit works, here is my humble interpretation of the pastebin link:
jsaxton86's comment sets the scene nicely so I'll just copy it here:
"This family of JRE attacks is far too common. Basically, when an unsigned applet runs, the JRE tries really hard to prevent it from creating a ClassLoader object. However, if you manage to create a ClassLoader object, it's game over -- you can break out of the sandbox and do whatever you please."
The exploit is very clever, it never actually creates an instance of the ClassLoader object, but rather it uses Java reflection to call a particular method on a ClassLoader object, which was tricked into creation inside a separate exploit involving the JMX (Java Management Extensions) framework.
JMX has its own methods to instantiate classes, and a subclass of ClassLoader ("sun.org.mozilla.javascript.internal.GeneratedClassLoader") is passed in as a String; then the method defineClass is called via reflection in a way that deceives all the ClassLoader protection. Once this method is allowed to be invoked via reflection, it's "game over" as explained at the start.
The company I work for displays large engineering drawings in the browser; right now we have to choose between manual png conversion and loading the vectors directly (each one has its own problems). I tried the snippet application with one drawing and it renders perfectly.
For our application we have a 'Google Maps' style viewport where you pan and zoom with the mouse, though. Right now I'm seeing if Gemini 2.5 Pro can refactor the snippet application to work this way. Did you have any plans for building another type of snippet application which works in the fashion?