What are the exact guidelines for what is allowed in a CDF?

Question

I have read the guidelines published by Wolfram (these are restricted: non-numeric input fields, dialog windows, and data import and export) but I have a CDF that seems simple enough and seems to satisfy these constraints but does not work in the browser (gray box is all that displays). This CDF can be found here.

Answer 1

Sal there is a security problem when you embed CDFs that is analogous to when you open a CDF from an untrusted directory. So though a CDF may work on your desktop you may/will run into problems when embedded. Many causes of this including bugs in how things get screened. For example I had a case where a tick function with down values triggered a security issue whereas an equivalent tick function without down values did not (Wolfram advised that it was down values that were causing that particular problem although in the case in question it shouldn't have caused a problem. I'm told that particular bug/problem has been fixed in current builds but until a new version of Mma is released you may want to try replacing functions with pure functions and see what happens).

For other instances where the grey boxes appear there appears to be no way around this without an Mma build that allows higher level security signing. However you will note the difference between an embedded CDF and one that opens in a webpage in fullscreen and displays the dynamic content warning, i.e. the button that you press to allow dynamic content to be considered safe. So one way around some, but not all, of these problems is described here

Change

cdf.embed("http://path.to/myCDF.cdf", 500, 600);

to

cdf.embed("http://path.to/myCDF.cdf", 500, 600,{fullscreen:'true'});