Misplaced Pages

NPAPI: Difference between revisions

Article snapshot taken from Wikipedia with creative commons attribution-sharealike license. Give it a read and then ask your questions in the chat. We can research this topic together.
Browse history interactively← Previous editContent deleted Content addedVisualWikitext
Revision as of 13:12, 30 July 2015 editLonaowna (talk | contribs)Extended confirmed users5,622 edits Undid revision 673779497 by 94.212.251.133 (talk)← Previous edit Latest revision as of 07:44, 2 January 2025 edit undoDesaccointier (talk | contribs)Extended confirmed users745 edits added author 
(450 intermediate revisions by more than 100 users not shown)
Line 1: Line 1:
{{short description|Application programming interface}}
{{Refimprove|date=September 2009}}
'''Netscape Plugin Application Programming Interface''' ('''NPAPI''') is a ] ] (API) for web browser ], initially developed for ] 2.0 in 1995 and subsequently adopted by other browsers.
{{Merge from|LiveConnect|XPConnect|date=February 2014}}
'''Netscape Plugin Application Programming Interface''' ('''NPAPI''') is a ] ] architecture used by many ]s.


In the NPAPI architecture, a plugin declares ] (e.g. "audio/mp3") that it can handle. When the browser encounters a content type it cannot handle natively, it loads the appropriate plugin, sets aside space within the browser context for the plugin to render and then streams data to it. The plugin is responsible for rendering the data. The plugin runs in-place within the page, as opposed to older browsers that had to launch an external application to handle unknown content types. NPAPI requires each plugin to implement and expose approximately 15 functions for initializing, creating, deleting and positioning plugin content. NPAPI also supports scripting, printing, full-screen plugins, windowless plugins and content streaming.
It was first developed for ] browsers, starting in 1995 with ] 2.0, but was subsequently adopted and implemented by many other browsers, although some browsers later dropped support.


NPAPI was frequently used for plugins which required intensive, low-level performance such as video players, including ] and ], as well as platforms for web applications such as the ].
A plugin declares that it handles certain ] (e.g. "audio/mp3"). When the browser encounters that content type it loads the associated plugin, sets aside space within the browser context for the plugin to render and then streams data to it. The plugin is then responsible for rendering the data. The plugin runs in-place within the page, as opposed to older browsers that had to launch an external application to handle unknown content types.


NPAPI support among major browsers started to wane since 2015 and it was gradually deprecated over the following 7 years. All major web browsers have removed support for 3rd party NPAPI plugins for security and maintenance reasons while superior technology exists.<ref name="theend">{{Cite web|first=Erik|last=Costlow|date=March 15, 2021|title=The End of Applets|url=https://www.infoq.com/news/2021/03/end-of-applets/|access-date=2021-10-02|website=InfoQ|language=en}}</ref>
The ] (API) requires each plugin to implement and expose approximately 15 functions for initializing, creating, destroying and positioning plugin content. The NPAPI also supports scripting, printing, full screen plugins, windowless plugins and content streaming.


== History == == Scripting support ==
Scripting is a feature allowing ] code in a web page to interact with the plugin. Various versions of Netscape and then ] supported this feature using different technologies, including LiveConnect, XPConnect, and NPRuntime.
{{Refimprove section|date=September 2010}}
The origin of the Netscape plugin functionality started at ]. ], CEO of Adobe, and ], one of the primary authors of ], were hopeful that Adobe's fledgling ] file format could play a role beyond the desktop. Soon after Netscape released the first version of Navigator, Padgett and fellow developer Eswar Priyadarshan tried to find a way to make PDF an integral part of the Web experience. The result was a live demo shown to Warnock and Netscape CEO ]. Prior to that demo, the only native file formats on the Web were ] pages and embedded images. Links to other file types caused the user to be prompted to download the file, after which the user could open the appropriate application. In that demo, however, when a user clicked on a link to a PDF file, the file was rendered within the browser window, seamlessly blending HTML and PDF consumption. Clark excitedly asked who at Netscape had provided support for the integration, only to discover that the integration was done without Netscape involvement, but by ] the Netscape browser.


=== LiveConnect ===
The companies set out the next week to bring what was known as "Allan's Hack" to market. While Netscape was ready to incorporate PDF directly into the browser, and certainly Adobe would have gained from that, Padgett proposed his plugin architecture. Adobe developers Gordon Dow and Nabeel Al-Shamma had recently added a plugin architecture to the Acrobat Reader to leverage the development efforts of developers outside of the Reader team. Padgett had been a part of that effort, and he expected that if given a chance, other companies (and hopefully teams within Adobe) would choose to extend the Web as well. Clark and team in the end were convinced and set off designing the API that would support the new model.


'''LiveConnect''' is a feature of Web browsers that allows ] and JavaScript software to intercommunicate within a Web page. From the Java side it allows an applet to invoke the embedded scripts of a page, or to access the built-in JavaScript environment, much as scripts can. Conversely, from the JavaScript side, it allows a script to invoke applet methods, or to access Java runtime libraries, much as applets can.<ref>Flanagan, David. (2006). ''JavaScript: the Definitive Guide.'' O'Reilly, Sebastopol, California.</ref><ref>For technical details, see the Mozilla {{Webarchive|url=https://web.archive.org/web/20080514230621/http://developer.mozilla.org/en/docs/LiveConnect |date=2008-05-14 }}.</ref>
In the following years many popular internet browsers adopted the API, making it the universal standard for web browser plugin development.


LiveConnect was used in ] to implement scriptability of NPAPI plugins.
Google announced in 2013 that their browser will not support NPAPI plugins anymore, and will block plugins which use this technology. This includes Oracle's Java and Microsoft's ] plugins, although these will be whitelisted during 5 months."<ref>". ''TechCrunch''. 23 September 2013.</ref> This is due to security and stability issues with the API, among other things.


The ]-dependent implementation of LiveConnect was removed from the Mozilla source code tree in late June 2009 as part of the cleanup effort.<ref>{{cite web |url= https://bugzilla.mozilla.org/show_bug.cgi?id=442399 |title=442399 – remove LiveConnect from the tree |work=mozilla.org}}</ref> It is no longer needed with the release of a redesigned ] from Sun Microsystems. However the old implementation was restored for Gecko 1.9.2, as Apple had yet to port the newer JRE over to Mac OS X.<ref>{{cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=517355|title=517355 – Restore OJI, Liveconnect and the JEP on the 1.9.2 branch on OS X|work=mozilla.org}}</ref>
== Scripting support ==
Scripting
is a feature allowing ] code in a web page to interact with the plugin. Various versions of Netscape and then Mozilla supported this feature using different technologies, including LiveConnect, XPConnect, and npruntime.


The Java–JavaScript functionality supported by the redesigned Java Runtime Environment is still called "LiveConnect", despite the ]-specific approach having been abandoned.<ref>{{cite web|url=http://java.sun.com/javase/6/webnotes/6u10/plugin2/liveconnect/|title=Release Notes for the Next-Generation Java™ Plug-In Technology (introduced in Java SE 6 update 10)|work=sun.com}}</ref> With Netscape 4, NPAPI was extended to allow plugins to be scripted. This extension is called LiveConnect. A plugin could implement a ] ] and expose an ]. The class could be called from JavaScript and from ]s running within the page.
=== LiveConnect ===
{{Main|LiveConnect}}
With Netscape 4, the NPAPI was extended to allow plugins to be scripted. This ability was known as ]. A plugin could implement and return an instance to a ] class. The public methods exposed by this class was the scriptable interface for the plugin. The class could be called from JavaScript and from Java applets running within the page with the browser marshalling the calls between the various contexts.

The disadvantage of LiveConnect was that it was heavily tied to the version of Java within the Netscape browser. This prevented the browser from using other Java runtimes, and added bloat to the browser download size since it required Java to script plugins.


Additionally, LiveConnect was tricky to program. The developer had to define a Java class for the plugin, run it through a specialised Java header compiler and implement the native methods. Handling strings, exceptions and other Java objects from ] was non-obvious. To compound matters LiveConnect used an earlier and now obsolete API for invoking native C++ calls from Java called JRI. The JRI technology has long since been supplanted by ]. The disadvantage of LiveConnect is, that it is heavily tied to the version of Java embedded within the Netscape browser. This prevented the browser from using other Java runtimes, and added bloat to the browser download size, since it required Java to script plugins. Additionally, LiveConnect is tricky to program: The developer has to define a Java class for the plugin, run it through a specialized Java ] ], and implement native ]. Handling ], ], and other Java ] from ] is non-obvious. In addition, LiveConnect uses an earlier and now obsolete ] (API) for invoking native C++ calls from Java, called JRI. The JRI technology has long since been supplanted by ].


=== XPConnect === === XPConnect ===
'''XPConnect''' (Cross Platform Connect) is a technology which enables simple interoperation between ] and JavaScript.
{{Main|XPConnect}}
LiveConnect was problematic for Mozilla. The dependency on an obsolete and proprietary Java runtime and the JRI API meant that LiveConnect never really worked.


==== Object connection ====
Mozilla was already using ] to define the interfaces to many objects implemented in C++. Each interface was defined by an ] file, and run through an IDL compiler that produced header files and a language neutral type library that was a binary representation of the interface. This binary described the interface, the methods, the parameters, the data structures and enumerations.
XPConnect allows JavaScript objects to transparently access and manipulate XPCOM objects. It also enables JavaScript objects to present XPCOM compliant ] to be called by XPCOM objects. A main goal is that objects communicating from either side of an XPCOM style interface should not generally need to know or care about the implementation language of the object on the other side of the interface.


XPConnect's primary reason for existence is to replace handwritten code used in places where native code needs to interact with JavaScript code. An example is the ] module.
] uses the type library information to marshal calls between different thread contexts and between JavaScript and natively compiled C++. XPConnect is used extensively throughout Mozilla. Starting with Netscape 6.1 and Mozilla 0.9.2, NPAPI was extended so that a plugin could return a scriptable interface to itself and XPConnect would marshal calls to it from JavaScript and the C++ implementation.


==== Security ====
XPConnect has no Java dependency, however the technology is based on XPCOM, which is similar to ]. Thus the plugin developer must be familiar with reference counting, interfaces, IDL and more to implement scripting. The dependency on XPCOM led to certain dynamic linking issues (e.g. the ]) which had to be solved before the plugin would work correctly with different browsers. XPCOM has since been changed to supply a statically linked version to address such issues. This approach also requires an .xpt file to be installed next to the DLL; otherwise the plugin will appear to work, but scripting won't, causing confusion.
Full privileges are only granted by default to chrome scripts, i.e. scripts that are part of the application or of an extension. For remote ]/]/] documents, most XPCOM objects are not accessible by the scripts as they have limited privileges due to security reasons. Even if they are accessible (e.g. the ] object), the usual security restrictions can also be found (e.g. cannot open ] of other ]).


Mozilla was already using XPCOM to define the ] to many objects implemented in C++. Each interface was defined by an ] file, and run through an IDL compiler that produced header files and a language-neutral type library that was a binary representation of the interface. This binary described the interface, the methods, the parameters, the data structures and ].
===NPRuntime===
At the end of 2004, all major browser companies using NPAPI agreed on NPRuntime<ref></ref> as an extension to the original NPAPI to supply scripting, via an API that is similar in style to the old C-style NPAPI and is independent of other browser technologies like Java or XPCOM. It is supported by Mozilla (1.7.5+) / Firefox, Safari, Opera and Chrome.


XPConnect uses the type library information to marshal calls between different thread contexts and between JavaScript and natively compiled C++. XPConnect is used extensively throughout Mozilla. Starting with Netscape 6.1 and Mozilla 0.9.2, NPAPI was extended, so that a plugin could return a scriptable interface to itself and XPConnect would marshal calls to it from JavaScript and the C++ implementation.
== Browser support ==
The following ] support NPAPI plugins:
* ]
* ]
* ]
* ] ] browser
* ] project applications, including
** ]
** ]: Firefox has reduced support for NPAPI from version 30 on.<ref></ref>
** ]
** ]
* ] and ]
* ]: NPAPI support is deprecated from Opera 20 onward. NPAPI support for Linux was removed with Opera 24.
* ] on ]
* ]


XPConnect has no Java dependency. However, the technology is based on XPCOM. Thus the plugin developer must be familiar with ], interfaces and IDL to implement scripting. The dependency on XPCOM led to certain dynamic linking issues (e.g. the ] problem) which had to be solved before the plugin would work correctly with different browsers. XPCOM has since been changed to supply a statically linked version to address such issues. This approach also requires an .xpt file to be installed next to the ] (DLL); otherwise the plugin appears to work, but the scripting does not, causing confusion.
The following browsers once supported NPAPI plugins, but have dropped support since:
* ] / ]. In September 2013, Google announced that it would phase out NPAPI support in Chrome during 2014 because "NPAPI's 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity".<ref>"". ''The Next Web''. 23 September 2013.</ref> NPAPI support was removed from the Linux version of Chrome in May 2014 (version 35).<ref>"". ''Chromium Blog''. 27 May 2014.</ref> NPAPI support is disabled by default since April 2015 (version 42) for Windows and OS X, but can be turned on in the settings. Google plans to drop Chrome NPAPI support from all platforms in September 2015 (Chrome 45).<ref>"". ''Chromium Blog''. 24 November 2014.</ref>
* ] from version 3 up to 5.5SP2. Internet Explorer for a time supported NPAPI plugins, allowing plugins that functioned in Netscape Navigator to also function in Internet Explorer. Support came via a small ] control implemented within a "<tt>plugin.ocx</tt>" file that acted as a "shim" between ActiveX and the NPAPI plugin. IE would load the control and use it to host plugins specified within the page. However, Microsoft saw this as a security issue and dropped support in version 5.5 SP2 and later in for IE 5.01.<ref name="kb303401">
</ref><ref name="giannandrea">
Giannandrea, J. (September 4, 2001) {{Wayback
|date=20071016233843
|url=http://www.meer.net/jg/broken-plugins.html |title=Microsoft breaks Web Plugins in Windows XP }}
</ref><ref name="kb306790">
</ref>


== Security == === NPRuntime ===
At the end of 2004, all major browser companies using NPAPI agreed on NPRuntime<ref>{{cite web|url=https://developer.mozilla.org/en/Gecko_Plugin_API_Reference/Scripting_plugins|title=Scripting plugins|work=Mozilla Developer Network|access-date=2009-08-29|archive-date=2008-11-18|archive-url=https://web.archive.org/web/20081118110930/https://developer.mozilla.org/en/Gecko_Plugin_API_Reference/Scripting_plugins|url-status=dead}}</ref> as an extension to the original NPAPI to supply scripting, via an API that is similar in style to the old C-style NPAPI and is independent of other browser technologies like Java or XPCOM. It is only supported by Firefox ESR (Extended Support Release) and ].
{{original research|section|date=July 2012}}
On Microsoft Windows, a popular misconception concerning the NPAPI technology is that a plugin is somehow inherently safer than an ActiveX control.{{Citation needed|date=July 2012}} Both run native machine instructions with the same privileges as the host process. If the host processes have broad privileges, a malicious plugin can do as much damage as a malicious ActiveX control.{{Citation needed|date=October 2011}} It is important to note that NPAPI plugins can be made much safer by simply running in a limited user account. It is generally possible to install and run plugins with a limited user, while installing ActiveX controls requires administrative privileges (prior to IE8) even when the ActiveX runs in a limited account. When running with limited privileges, a plugin cannot do as much damage.


== Support ==
One important difference between NPAPI and ActiveX is that NPAPI is solely for Internet plugins, while ActiveX is used for a wide variety of purposes, including application composition in Windows applications. A typical Windows user has a vast array of ActiveX controls installed, a number of which are probably marked "safe for scripting", but are not actually secure. Any of these can be used as means to subvert the user's computer prior to the introduction of the ActiveX Opt-in feature in Internet Explorer 7.<ref></ref>


Because of the age of the API, security issues, and adoption of alternative technologies such as ], many software vendors began to phase out NPAPI support in 2013.<ref>{{cite web |url=https://helpx.adobe.com/acrobat/kb/change-in-support-for-acrobat-and-reader-plug-ins-in-modern-web-.html |title=Change in support for Acrobat and Reader plug-ins in modern web browsers | date=8 February 2016 |publisher=]}}</ref><ref name="ars-nopluginjdk9">{{cite web|url=https://arstechnica.com/information-technology/2016/01/oracle-deprecates-the-java-browser-plugin-prepares-for-its-demise/|title=Oracle deprecates the Java browser plugin, prepares for its demise |website=Ars Technica |date=28 January 2016 |access-date=15 April 2016}}</ref>
Another difference is that NPAPI implementations (prior to ], see below) did not offer to automatically download or install missing plugins. A missing plugin caused the browser to display a jigsaw piece representing the plugin. If the user clicked on that they were directed to Netscape's plugin finder service where they could manually download and install the plugin for themselves. While this is inconvenient to the user, it is also an important security measure since it prevented the content using the browser as a vector for ].


=== Internet Explorer ===
In Internet Explorer, the HTML content specifies the location where the ActiveX control resides. If the control is not already installed, IE offers to download and install the control from the specified source. For legitimate controls, this offers a more streamlined installation mechanism with minimal user interaction. However malicious content could convince the user with clever ] to ignore warnings (or their better judgement) and install something that might harm their privacy or the machine. A number of ], ] and ] sites use this mechanism to deploy executable content to machines. Microsoft has had to increase the default security settings for ActiveX and maintain blacklists of malicious controls in an attempt to mitigate this risk.
] versions 3 through 5.5 SP2 supported NPAPI, allowing plugins that functioned in Netscape Navigator to function in Internet Explorer. Support came via a small ] control (named "<code>plugin.ocx</code>") that acted as a ] between ActiveX and the NPAPI plugin. Microsoft dropped support in version 5.5 SP2 onwards for security reasons.<ref name="kb303401">{{cite web |url=https://support.microsoft.com/en-us/kb/303401|title=Netscape-Style Plug-ins Do Not Work After Upgrading Internet Explorer|date=27 July 2007|website=Support|publisher=] |edition=3.3}}</ref><ref name="giannandrea">{{cite web|url=http://www.meer.net/jg/broken-plugins.html|title=Microsoft breaks Web Plugins in Windows XP|last=Giannandrea|first=J.|date=4 September 2001|website=meer.net|archive-url=https://web.archive.org/web/20071016233843/http://www.meer.net/jg/broken-plugins.html|archive-date=16 October 2007}}</ref><ref name="kb306790">{{cite web|url=https://support.microsoft.com/en-us/kb/306790|title=Description of Internet Explorer Support for Netscape-Style Plug-ins|date=31 January 2007|website=Support|publisher=] |edition=3.4}}</ref><ref>{{cite web|url=https://technet.microsoft.com/library/security/ms03-015 |title=Microsoft Security Bulletin MS03-015 – Critical|date=23 April 2003|website=Security TechCenter|publisher=]}}</ref>


=== Google Chrome ===
] attempts to occupy a middle ground. If a plugin is missing, it notifies the user that the plugin is missing and initiates a secure connection to a plugin finder service hosted on mozilla.org. The user can permit Firefox to download and install the plugin. This model prevents content specifying where a plugin should be downloaded from – the plugin finder service does. This enables Firefox to present a fairly seamless installation mechanism but limit the service to trusted and compatible plugins from reliable sources. This model implicitly trusts the plugin finder service to return "good" plugins, increasing the security required on the host site.
] permanently dropped all NPAPI support from all platforms in September 2015.<ref>"". ''Chromium Blog''.</ref> In September 2013, Google announced that it would phase out NPAPI support in its Google Chrome browser during 2014, stating that " 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity".<ref>". ''TechCrunch''. 23 September 2013.</ref><ref>"". ''The Next Web''. 23 September 2013.</ref> In May 2014, NPAPI support was removed from the ] version of Chrome 35 and later.<ref>"". ''Chromium Blog''. 27 May 2014.</ref> In April 2015, Chrome for ] and ] (versions 42 and later) disabled NPAPI support by default. However, until September 2015 (version 45), users could re-enable NPAPI.{{Citation needed|date=August 2024}}


==PPAPI== === Opera ===
] dropped support with version 37 in May 2016.{{citation needed|date=May 2016}}
{{main|Google Native Client#Pepper}}
On August 12, 2009, a page on Google Code introduced a new project, Pepper, with the associated ,<ref></ref> "a set of modifications to NPAPI to make plugins more portable and more secure".<ref></ref> This extension is designed specifically to ease the implementation of out-of-] plugin execution. Further, the goals of the project are to provide a framework for making plugins fully cross-platform. Topics considered include:
* Uniform semantics for NPAPI across browsers.
* Execution in a separate process from the renderer/browser.
* Standardize rendering using the browser's compositing process.
* Defining standardized events and 2D rasterization functions.
* Initial attempt at providing 3D graphics access.
* Plugin registry.


=== Browser support === === Firefox ===
Mozilla ] release 52.0 in March 2017 removed all support for NPAPI except for Flash.<ref>{{Cite web|url=https://www.mozilla.org/en-US/firefox/52.0/releasenotes/|title=Firefox 52.0, See All New Features, Updates and Fixes|website=Mozilla}}</ref><ref name="fxsitecompat-npapiphaseout">{{cite web|url=https://www.fxsitecompat.com/en-CA/docs/2016/plug-in-support-has-been-dropped-other-than-flash/|title=Firefox dropping NPAPI plugins by the end of 2016—except for Flash|website=Firefox Site Compatibility|date=4 October 2016|access-date=25 January 2017|archive-date=15 March 2017|archive-url=https://web.archive.org/web/20170315173935/https://www.fxsitecompat.com/en-CA/docs/2016/plug-in-support-has-been-dropped-other-than-flash/|url-status=dead}}</ref><ref>{{cite web |url=https://support.mozilla.org/t5/Problems-with-add-ons-plugins-or/Why-do-Java-Silverlight-Adobe-Acrobat-and-other-plugins-no/ta-p/31069 |title=Why do Java, Silverlight, Adobe Acrobat and other plugins no longer work? |website=Mozilla support |access-date=2017-03-06 |url-status=dead |archive-url=https://web.archive.org/web/20170307050159/https://support.mozilla.org/t5/Problems-with-add-ons-plugins-or/Why-do-Java-Silverlight-Adobe-Acrobat-and-other-plugins-no/ta-p/31069 |archive-date=2017-03-07 }}</ref> Meanwhile, the ESR channel retained general support for this feature with version 52 ESR being the last NPAPI resort. Firefox 69.0 disabled the Flash NPAPI by default.<ref>{{Cite web|url=https://bugzilla.mozilla.org/show_bug.cgi?id=1519434|title=1519434 - Disable Flash support by default in Firefox 69|website=bugzilla.mozilla.org|language=en|access-date=2019-01-14}}</ref><ref>{{Cite web|title=Plugin Roadmap for Firefox - Plugins|url=https://developer.mozilla.org/en-US/docs/Plugins/Roadmap|access-date=2021-07-12|website=]|language=en-US}}</ref> In Firefox 85.0, released in January 2021, NPAPI support was completely removed.<ref>{{cite web |last1=Jim Mathies |title=Removal of NPAPI plugin support in Firefox 85 |url=https://groups.google.com/g/mozilla.dev.platform/c/NsdReYslBU4 |website=mozilla.dev.platform (via Google Groups) |access-date=10 February 2021 |date=13 November 2020}}</ref><ref>{{cite web |title=Plugin Roadmap for Firefox |url=https://developer.mozilla.org/en-US/docs/Plugins/Roadmap |website=MDN |access-date=10 February 2021 |archive-url=https://web.archive.org/web/20210121102341/https://developer.mozilla.org/en-US/docs/Plugins/Roadmap |archive-date=21 January 2021 |date=19 January 2021}}</ref> In the ESR channel, support for Flash NPAPI ended with version 78.15.0, released in October 2021.<ref>{{Cite web|title=Firefox for Enterprise 91 - Release notes {{!}} Firefox for Enterprise Help|url=https://support.mozilla.org/en-US/kb/firefox-enterprise-91-release-notes|access-date=2022-02-13|website=support.mozilla.org}}</ref><ref>{{Cite web|title=Firefox ESR 78.15.0, See All New Features, Updates and Fixes|url=https://www.mozilla.org/en-US/firefox/78.15.0/releasenotes/|access-date=2022-01-03|website=Mozilla|language=en}}</ref>
The following web browsers support PPAPI plugins:
* ]
** ] Google's open source browser was the development web browser that first utilized the new browser plug-in model.<ref></ref>
* ] (since version 24<ref></ref>)


=== Safari ===
On {{date | 2011-05-26}}, Mozilla announced that it was "not interested in or working on Pepper at this time."<ref></ref>
] has dropped support for all NPAPI plugins except for Flash with version 12 released in September 2018.<ref>{{cite web |url=https://www.macrumors.com/2018/09/17/apple-releases-safari-12-macos-high-sierra/ |title=Apple Releases Safari 12 for macOS Sierra and macOS High Sierra |date=September 17, 2018 |last=Clover |first=Juli |website=MacRumors }}</ref> Flash support has been removed from Safari 14, released in September 2020.<ref>{{cite web |title=Safari 14 Release Notes |url=https://developer.apple.com/documentation/safari-release-notes/safari-14-release-notes |website=Apple Developer Documentation}}</ref>


=== SeaMonkey ===
In February 2012, Adobe Systems announced that future GNU/Linux versions of Flash Player would only be provided via PPAPI, although the previous release, Flash Player 11.2, with NPAPI support, would receive security updates for five years.<ref></ref>
]<ref> ''NPAPI plugins''</ref> stopped supporting NPAPI plugins from version 2.53.1, with the exception of Flash. NPAPI support was completely removed in SeaMonkey 2.53.7, released in March 2021.<ref>{{cite web |title=SeaMonkey 2.53.7 Release Notes |url=https://www.seamonkey-project.org/releases/seamonkey2.53.7/ |access-date=14 March 2021}}</ref>

=== Support ===
The following list of ] support all NPAPI plugins: <!-- Forum posts from before 2017 are not valid sources -->
* ] ({{zh|360安全浏览器}}) or 360 Extreme Explorer ({{lang-zh|360极速浏览器}})<ref>. ''NPAPI 插件.''</ref>
* ]<ref>. ''Basilisk features.''</ref>
* ]<ref>.''Third party plugins.''</ref> (] engine)<ref> ''K-Meleon Hybrid (Goanna over Pro).''</ref>
* ]<ref>"". ''Pale Moon: Technical Details''</ref> (Pale Moon future ])<ref>. ''Pale Moon future roadmap.''</ref>
* ]<ref>. ''Uzbl FAQ.''</ref>

== Similar technologies ==

=== ActiveX ===
{{Main|ActiveX}}Internet Explorer and ] use ActiveX controls, ActiveX documents and ActiveX scripting to offer in-page extensibility on par with NPAPI. Although commonly associated with Internet Explorer, ActiveX is integration technology that allows any computer program to integrate parts of other computer programs that support such integration.<ref>{{cite web|url = https://support.microsoft.com/en-us/kb/154544|title = Description of ActiveX Technologies|date = 19 January 2007|website = Support|publisher = ]}}</ref> Internet Explorer, however, is discontinued and its replacement, Microsoft Edge, does not support ActiveX.

=== PPAPI ===
{{See also|Google Native Client#Pepper}}
On 12 August 2009 a page on Google Code<ref>{{cite web|url = https://code.google.com/p/ppapi/|title = ppapi|website = ]|archive-url =https://web.archive.org/web/20100702000807/http://code.google.com/p/ppapi/|url-status = dead|archive-date =2010-07-02}}</ref> introduced a new project called Pepper, with the associated Pepper Plugin API (PPAPI);<ref>{{cite web|url=https://www.chromium.org/nativeclient/getting-started/getting-started-background-and-basics#TOC-Pepper-Plugin-API-PPAPI-|title=Getting Started: Background and Basics – The Chromium Projects|work=chromium.org}}</ref> PPAPI is a derivative of NPAPI aimed to make plugins more portable and more secure.<ref>{{cite web|url=https://code.google.com/p/ppapi/Concepts|title=Concepts - ppapi - Important concepts for working with PPAPI. - Pepper Plugin API – Google Project Hosting|work=google.com}}</ref> This extension is designed specifically to ease the implementation of out-of-] plugin execution.

PPAPI was initially only supported by Google Chrome and ]. Later, other Chromium-based browsers such as ] and ] added PPAPI plugin support.

In February 2012 ] announced that future Linux versions of Adobe Flash Player would be provided only via PPAPI. The previous release, Flash Player 11.2, with NPAPI support, would receive security updates for five years.<ref>{{cite web|url=http://blogs.adobe.com/flashplayer/2012/02/adobe-and-google-partnering-for-flash-player-on-linux.html|title=Adobe and Google Partnering for Flash Player on Linux|work=adobe.com|access-date=2012-03-07|archive-url=https://web.archive.org/web/20120223062713/http://blogs.adobe.com/flashplayer/2012/02/adobe-and-google-partnering-for-flash-player-on-linux.html|archive-date=2012-02-23|url-status=dead}}</ref> In August 2016 Adobe announced that, contrary to their previous statement, it would again support the NPAPI Flash Player on Linux and keep releasing new versions of it.<ref>{{cite web|last1=Campbell|first1=Chris|title=Beta News – Flash Player NPAPI for Linux|url=https://blogs.adobe.com/flashplayer/2016/08/beta-news-flash-player-npapi-for-linux.html|website=Adobe AIR and Adobe Flash Player Team Blog|publisher=Adobe Systems|access-date=8 September 2016|date=31 August 2016}}</ref>

In August 2020, Google announced that support for PPAPI would be removed from Google Chrome and Chromium in June 2022.<ref>{{cite web |url=https://blog.chromium.org/2020/08/changes-to-chrome-app-support-timeline.html |title=Changes to the Chrome App Support Timeline
|date=August 10, 2020 |author=Anthony Laforge |website=Chromium Blog }}</ref>


== See also == == See also ==
Line 107: Line 93:


== References == == References ==
{{Reflist|30em}} {{Reflist}}


== External links == == External links ==
* on Mozilla Developer Center, including the NPAPI API * {{Webarchive|url=https://web.archive.org/web/20120803092052/https://developer.mozilla.org/en/Plugins |date=2012-08-03 }} on Mozilla Developer Center, including the NPAPI API
* – a replacement for plugin.ocx that was removed from Internet Explorer. * – a replacement for plugin.ocx that was removed from Internet Explorer.
* *
* *
* (, , ) * (, , )
* *


{{Web interfaces}} {{Web interfaces}}
{{Mozilla projects}}
{{Netscape}}


__FORCETOC__
{{DEFAULTSORT:Npapi}}

] ]
] ]

Latest revision as of 07:44, 2 January 2025

Application programming interface

Netscape Plugin Application Programming Interface (NPAPI) is a deprecated application programming interface (API) for web browser plugins, initially developed for Netscape Navigator 2.0 in 1995 and subsequently adopted by other browsers.

In the NPAPI architecture, a plugin declares content types (e.g. "audio/mp3") that it can handle. When the browser encounters a content type it cannot handle natively, it loads the appropriate plugin, sets aside space within the browser context for the plugin to render and then streams data to it. The plugin is responsible for rendering the data. The plugin runs in-place within the page, as opposed to older browsers that had to launch an external application to handle unknown content types. NPAPI requires each plugin to implement and expose approximately 15 functions for initializing, creating, deleting and positioning plugin content. NPAPI also supports scripting, printing, full-screen plugins, windowless plugins and content streaming.

NPAPI was frequently used for plugins which required intensive, low-level performance such as video players, including Adobe Flash Player and Microsoft Silverlight, as well as platforms for web applications such as the Java Runtime Environment.

NPAPI support among major browsers started to wane since 2015 and it was gradually deprecated over the following 7 years. All major web browsers have removed support for 3rd party NPAPI plugins for security and maintenance reasons while superior technology exists.

Scripting support

Scripting is a feature allowing JavaScript code in a web page to interact with the plugin. Various versions of Netscape and then Mozilla supported this feature using different technologies, including LiveConnect, XPConnect, and NPRuntime.

LiveConnect

LiveConnect is a feature of Web browsers that allows Java and JavaScript software to intercommunicate within a Web page. From the Java side it allows an applet to invoke the embedded scripts of a page, or to access the built-in JavaScript environment, much as scripts can. Conversely, from the JavaScript side, it allows a script to invoke applet methods, or to access Java runtime libraries, much as applets can.

LiveConnect was used in Netscape 4 to implement scriptability of NPAPI plugins.

The Open Java Interface-dependent implementation of LiveConnect was removed from the Mozilla source code tree in late June 2009 as part of the Mozilla 2 cleanup effort. It is no longer needed with the release of a redesigned Java Runtime Environment from Sun Microsystems. However the old implementation was restored for Gecko 1.9.2, as Apple had yet to port the newer JRE over to Mac OS X.

The Java–JavaScript functionality supported by the redesigned Java Runtime Environment is still called "LiveConnect", despite the Open Java Interface-specific approach having been abandoned. With Netscape 4, NPAPI was extended to allow plugins to be scripted. This extension is called LiveConnect. A plugin could implement a Java class and expose an instance of it. The class could be called from JavaScript and from Java applets running within the page.

The disadvantage of LiveConnect is, that it is heavily tied to the version of Java embedded within the Netscape browser. This prevented the browser from using other Java runtimes, and added bloat to the browser download size, since it required Java to script plugins. Additionally, LiveConnect is tricky to program: The developer has to define a Java class for the plugin, run it through a specialized Java header compiler, and implement native methods. Handling strings, exceptions, and other Java objects from C++ is non-obvious. In addition, LiveConnect uses an earlier and now obsolete application programming interface (API) for invoking native C++ calls from Java, called JRI. The JRI technology has long since been supplanted by JNI.

XPConnect

XPConnect (Cross Platform Connect) is a technology which enables simple interoperation between XPCOM and JavaScript.

Object connection

XPConnect allows JavaScript objects to transparently access and manipulate XPCOM objects. It also enables JavaScript objects to present XPCOM compliant interfaces to be called by XPCOM objects. A main goal is that objects communicating from either side of an XPCOM style interface should not generally need to know or care about the implementation language of the object on the other side of the interface.

XPConnect's primary reason for existence is to replace handwritten code used in places where native code needs to interact with JavaScript code. An example is the DOM module.

Security

Full privileges are only granted by default to chrome scripts, i.e. scripts that are part of the application or of an extension. For remote HTML/XHTML/XUL documents, most XPCOM objects are not accessible by the scripts as they have limited privileges due to security reasons. Even if they are accessible (e.g. the XMLHttpRequest object), the usual security restrictions can also be found (e.g. cannot open URLs of other domains).

Mozilla was already using XPCOM to define the interfaces to many objects implemented in C++. Each interface was defined by an IDL file, and run through an IDL compiler that produced header files and a language-neutral type library that was a binary representation of the interface. This binary described the interface, the methods, the parameters, the data structures and enumerations.

XPConnect uses the type library information to marshal calls between different thread contexts and between JavaScript and natively compiled C++. XPConnect is used extensively throughout Mozilla. Starting with Netscape 6.1 and Mozilla 0.9.2, NPAPI was extended, so that a plugin could return a scriptable interface to itself and XPConnect would marshal calls to it from JavaScript and the C++ implementation.

XPConnect has no Java dependency. However, the technology is based on XPCOM. Thus the plugin developer must be familiar with reference counting, interfaces and IDL to implement scripting. The dependency on XPCOM led to certain dynamic linking issues (e.g. the fragile base class problem) which had to be solved before the plugin would work correctly with different browsers. XPCOM has since been changed to supply a statically linked version to address such issues. This approach also requires an .xpt file to be installed next to the dynamic-link library (DLL); otherwise the plugin appears to work, but the scripting does not, causing confusion.

NPRuntime

At the end of 2004, all major browser companies using NPAPI agreed on NPRuntime as an extension to the original NPAPI to supply scripting, via an API that is similar in style to the old C-style NPAPI and is independent of other browser technologies like Java or XPCOM. It is only supported by Firefox ESR (Extended Support Release) and Safari.

Support

Because of the age of the API, security issues, and adoption of alternative technologies such as HTML5, many software vendors began to phase out NPAPI support in 2013.

Internet Explorer

Internet Explorer versions 3 through 5.5 SP2 supported NPAPI, allowing plugins that functioned in Netscape Navigator to function in Internet Explorer. Support came via a small ActiveX control (named "plugin.ocx") that acted as a shim between ActiveX and the NPAPI plugin. Microsoft dropped support in version 5.5 SP2 onwards for security reasons.

Google Chrome

Google Chrome permanently dropped all NPAPI support from all platforms in September 2015. In September 2013, Google announced that it would phase out NPAPI support in its Google Chrome browser during 2014, stating that " 90s-era architecture has become a leading cause of hangs, crashes, security incidents, and code complexity". In May 2014, NPAPI support was removed from the Linux version of Chrome 35 and later. In April 2015, Chrome for Windows and OS X (versions 42 and later) disabled NPAPI support by default. However, until September 2015 (version 45), users could re-enable NPAPI.

Opera

Opera dropped support with version 37 in May 2016.

Firefox

Mozilla Firefox release 52.0 in March 2017 removed all support for NPAPI except for Flash. Meanwhile, the ESR channel retained general support for this feature with version 52 ESR being the last NPAPI resort. Firefox 69.0 disabled the Flash NPAPI by default. In Firefox 85.0, released in January 2021, NPAPI support was completely removed. In the ESR channel, support for Flash NPAPI ended with version 78.15.0, released in October 2021.

Safari

Safari has dropped support for all NPAPI plugins except for Flash with version 12 released in September 2018. Flash support has been removed from Safari 14, released in September 2020.

SeaMonkey

SeaMonkey stopped supporting NPAPI plugins from version 2.53.1, with the exception of Flash. NPAPI support was completely removed in SeaMonkey 2.53.7, released in March 2021.

Support

The following list of web browsers support all NPAPI plugins:

Similar technologies

ActiveX

Main article: ActiveX

Internet Explorer and browsers based on Internet Explorer use ActiveX controls, ActiveX documents and ActiveX scripting to offer in-page extensibility on par with NPAPI. Although commonly associated with Internet Explorer, ActiveX is integration technology that allows any computer program to integrate parts of other computer programs that support such integration. Internet Explorer, however, is discontinued and its replacement, Microsoft Edge, does not support ActiveX.

PPAPI

See also: Google Native Client § Pepper

On 12 August 2009 a page on Google Code introduced a new project called Pepper, with the associated Pepper Plugin API (PPAPI); PPAPI is a derivative of NPAPI aimed to make plugins more portable and more secure. This extension is designed specifically to ease the implementation of out-of-process plugin execution.

PPAPI was initially only supported by Google Chrome and Chromium. Later, other Chromium-based browsers such as Opera and Vivaldi added PPAPI plugin support.

In February 2012 Adobe Systems announced that future Linux versions of Adobe Flash Player would be provided only via PPAPI. The previous release, Flash Player 11.2, with NPAPI support, would receive security updates for five years. In August 2016 Adobe announced that, contrary to their previous statement, it would again support the NPAPI Flash Player on Linux and keep releasing new versions of it.

In August 2020, Google announced that support for PPAPI would be removed from Google Chrome and Chromium in June 2022.

See also

References

  1. Costlow, Erik (March 15, 2021). "The End of Applets". InfoQ. Retrieved 2021-10-02.
  2. Flanagan, David. (2006). JavaScript: the Definitive Guide. O'Reilly, Sebastopol, California.
  3. For technical details, see the Mozilla Developer Documentation on LiveConnect Archived 2008-05-14 at the Wayback Machine.
  4. "442399 – remove LiveConnect from the tree". mozilla.org.
  5. "517355 – Restore OJI, Liveconnect and the JEP on the 1.9.2 branch on OS X". mozilla.org.
  6. "Release Notes for the Next-Generation Java™ Plug-In Technology (introduced in Java SE 6 update 10)". sun.com.
  7. "Scripting plugins". Mozilla Developer Network. Archived from the original on 2008-11-18. Retrieved 2009-08-29.
  8. "Change in support for Acrobat and Reader plug-ins in modern web browsers". Adobe. 8 February 2016.
  9. "Oracle deprecates the Java browser plugin, prepares for its demise". Ars Technica. 28 January 2016. Retrieved 15 April 2016.
  10. "Netscape-Style Plug-ins Do Not Work After Upgrading Internet Explorer". Support (3.3 ed.). Microsoft. 27 July 2007.
  11. Giannandrea, J. (4 September 2001). "Microsoft breaks Web Plugins in Windows XP". meer.net. Archived from the original on 16 October 2007.
  12. "Description of Internet Explorer Support for Netscape-Style Plug-ins". Support (3.4 ed.). Microsoft. 31 January 2007.
  13. "Microsoft Security Bulletin MS03-015 – Critical". Security TechCenter. Microsoft. 23 April 2003.
  14. "The final countdown for NPAPI". Chromium Blog.
  15. Google will start blocking most Netscape Plug-In API plug-ins in January 2014, will whitelist Silverlight, Unity & others". TechCrunch. 23 September 2013.
  16. "Google looks to drop Netscape Plugin API support in Chrome, starting with blocking most plugins in January 2014". The Next Web. 23 September 2013.
  17. "Update on NPAPI deprecation". Chromium Blog. 27 May 2014.
  18. "Firefox 52.0, See All New Features, Updates and Fixes". Mozilla.
  19. "Firefox dropping NPAPI plugins by the end of 2016—except for Flash". Firefox Site Compatibility. 4 October 2016. Archived from the original on 15 March 2017. Retrieved 25 January 2017.
  20. "Why do Java, Silverlight, Adobe Acrobat and other plugins no longer work?". Mozilla support. Archived from the original on 2017-03-07. Retrieved 2017-03-06.
  21. "1519434 - Disable Flash support by default in Firefox 69". bugzilla.mozilla.org. Retrieved 2019-01-14.
  22. "Plugin Roadmap for Firefox - Plugins". MDN Web Docs. Retrieved 2021-07-12.
  23. Jim Mathies (13 November 2020). "Removal of NPAPI plugin support in Firefox 85". mozilla.dev.platform (via Google Groups). Retrieved 10 February 2021.
  24. "Plugin Roadmap for Firefox". MDN. 19 January 2021. Archived from the original on 21 January 2021. Retrieved 10 February 2021.
  25. "Firefox for Enterprise 91 - Release notes | Firefox for Enterprise Help". support.mozilla.org. Retrieved 2022-02-13.
  26. "Firefox ESR 78.15.0, See All New Features, Updates and Fixes". Mozilla. Retrieved 2022-01-03.
  27. Clover, Juli (September 17, 2018). "Apple Releases Safari 12 for macOS Sierra and macOS High Sierra". MacRumors.
  28. "Safari 14 Release Notes". Apple Developer Documentation.
  29. "Why do Oracle Java, Microsoft Silverlight, Adobe Acrobat Reader and other plugins no longer work?" NPAPI plugins
  30. "SeaMonkey 2.53.7 Release Notes". Retrieved 14 March 2021.
  31. "NPAPI 是重型武器，当别的方法无法到达你的目的时，才建议使用。". NPAPI 插件.
  32. "Support for all NPAPI plugins (Unity, Silverlight, Flash, Java, authentication plugins, etc.)". Basilisk features.
  33. "Most third-party plug-ins designed for Mozilla/Netscape will also work with K-Meleon".Third party plugins.
  34. "Load all NPAPI-Plugins, Java, Silverlight, etc." K-Meleon Hybrid (Goanna over Pro).
  35. "Full and ongoing support for NPAPI plugins (Java, Silverlight, etc.)". Pale Moon: Technical Details
  36. "Pale Moon supports NPAPI plug-ins. Unlike Firefox, we will not be deprecating or removing support for these kinds of plug-ins". Pale Moon future roadmap.
  37. "We use the NPAPI plugin architecture (just like Mozilla) so just install the plugins normally, and things should work". Uzbl FAQ.
  38. "Description of ActiveX Technologies". Support. Microsoft. 19 January 2007.
  39. "ppapi". Google Code. Archived from the original on 2010-07-02.
  40. "Getting Started: Background and Basics – The Chromium Projects". chromium.org.
  41. "Concepts - ppapi - Important concepts for working with PPAPI. - Pepper Plugin API – Google Project Hosting". google.com.
  42. "Adobe and Google Partnering for Flash Player on Linux". adobe.com. Archived from the original on 2012-02-23. Retrieved 2012-03-07.
  43. Campbell, Chris (31 August 2016). "Beta News – Flash Player NPAPI for Linux". Adobe AIR and Adobe Flash Player Team Blog. Adobe Systems. Retrieved 8 September 2016.
  44. Anthony Laforge (August 10, 2020). "Changes to the Chrome App Support Timeline". Chromium Blog.

External links

Web interfaces
Server-side
Protocols
Server APIs
Apache modules
Topics
Client-side
Browser APIs
Web APIs
WHATWG
W3C
Khronos
Others
Topics
Related topics
Categories: