Blockly is not able to create variables in chrome version 92.0.4515.107 and Edge version 92.0.902.55

Describe the bug

In chrome version 92.0.4515.107, according to https://www.chromestatus.com/feature/5148698084376576, alert(), confirm() and prompt() for cross origin frame will be blocked. It happens that it is just the way blockly uses to prompt for the names of the variables.

To Reproduce

Steps to reproduce the behavior:

1. Go to https://developers.google.com/blockly
2. Make sure that you are using google chrome and it is up to date
3. Try to create a variable
4. There will be no error, but you won’t be able to create any variables. The error shows up in the js console as “A different origin subframe tried to create a js dialog”

Expected behavior

User should be able to create variables in using any navigator.

Screenshots

https://drive.google.com/file/d/1DeSG4T01n4qmPDV_RPhbKFR__KFY9WMS/view?usp=sharing

Desktop

• OS: windows 10
• Browser: chrome and Edge
• Version: 92.0.4515.107 (chrome) and 92.0.902.55 (Edge)

Stack Traces

I didn’t get any stacktrace, maybe because it shows up as a warning.

A different origin subframe tried to create a JavaScript dialog. This is no longer allowed and was blocked. See https://www.chromestatus.com/feature/5148698084376576 for more details.

Additional context

Since this bug affects ALL versions of blockly and most of the users out there use chrome, the best workaround I found was to change browser. It is unfortunate, but chrome doesn’t offer a “flip switch” to this update, it is also sad that most of the users will blame their current page instead of blockly itself, maybe that’s why the problem didn’t show up here yet.

PS: it worked fine on Firefox, I didnt test on Opera.

[BeksOmega]

Thanks for the update @juliocpmelo ! I found the chromium tracking issue for this. It seems they’ve rolled back the change, and suspended it until Jan 2022. Apparently this change broke some hospital systems, as well as programming tutorials like codepen. Lots of people are pushing for a sandboxing option, but whether that will happen or not is unclear.

[juliocpmelo]

Hey beks,

Yep, I forgot that the function example is even better… I believe that that should work very well. The only open point right know is how to create variables without the button, changing names that way is good. For this problem I think that generating the variables with a default name such as “var” or “var_1” is fine, blockly already does that in the “count with” loop and no one complains (I think).

In browser side I’m still stuck, I was thinking about writing a Chrome extension to inject the custom prompt you sent… If this solution works, I will try to reply here in this bug, so the community can use. Right now, I’m like a Firefox seller, I checked it and firefox does offer a switch so you can choose whether to block or not the prompt from websites.

Thanks for the support once more.