Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[next] Dart should allow cross frame dom access to windows from the same origin. #20146

Closed
vsmenon opened this issue Jul 22, 2014 · 19 comments
Closed
Assignees
Labels
area-core-library SDK core library issues (core, async, ...); use area-vm or area-web for platform specific libraries. library-html P2 A bug or feature request we're likely to work on type-enhancement A request for a change that isn't a bug

Comments

@vsmenon
Copy link
Member

vsmenon commented Jul 22, 2014

We currently only allow limited access to the cross-frame windows. JavaScript allows complete access - so long as the window is from the same origin. We should just match JavaScript.

At the moment, folks are just using dart:js to circumvent this restriction, so we're not really achieving anything with this.

This change will a fair bit of work - at least the following:

  • An API change in dart:html
  • Plumbing in dart2js to correctly handle DOM types in different frames
  • Plumbing and correct SOP security checks in dartium
  • Fixes in js-interop
@vsmenon
Copy link
Member Author

vsmenon commented Aug 1, 2014

Issue #19123 has been merged into this issue.

@efortuna
Copy link
Contributor

efortuna commented Aug 1, 2014

Issue #18657 has been merged into this issue.

@rakudrama
Copy link
Member

Is it expected that a List allocated with the same-origin-cross-frame-window context's constructor behaves as a List?

In JavaScript:

  > var a = new (document.getElementById('myIframe').contentWindow.Array)(5)
  > a
  [undefined x 5]
  > a instanceof Array
  false
  > a.constructor === Array
  false

@vsmenon
Copy link
Member Author

vsmenon commented Aug 12, 2014

Issue #20407 has been merged into this issue.

@vsmenon
Copy link
Member Author

vsmenon commented Aug 12, 2014

Issue #20216 has been merged into this issue.

@vsmenon
Copy link
Member Author

vsmenon commented Aug 12, 2014

Stephen: how would your example materialize in Dart? Can we ever get a hold of a native object whose constructor is another frame's Array?

@vsmenon
Copy link
Member Author

vsmenon commented Sep 11, 2014

Issue #9224 has been merged into this issue.

@vsmenon
Copy link
Member Author

vsmenon commented Sep 12, 2014

Issue #20944 has been merged into this issue.

@DartBot
Copy link

DartBot commented Nov 21, 2014

This comment was originally written by @zoechi


Friendly ping. Any plans to address this?
See also http://stackoverflow.com/questions/27048607

@DartBot
Copy link

DartBot commented Nov 23, 2014

This comment was originally written by @Emasoft


This is a major security flaw of javascript. Dart should allow it, but it should also offer improved security over javascript.
I suggest to add some strong security check before allowing access to another frame, and the option to disallow it completely.

@leafpetersen
Copy link
Member

Assigning to Terry, since his changes may cause this to happen.


Set owner to @terrylucas.

@alan-knight
Copy link
Contributor

See also 17936, possibly these should be combined.


Changed the title to: "[next] Dart should allow cross frame dom access to windows from the same origin.".

@alan-knight
Copy link
Contributor

Issue #19715 has been merged into this issue.

@alan-knight
Copy link
Contributor

Added Accepted label.

@DanielJoyce
Copy link

Bumping into this issue in a multi window chrome app. This is a dumb restriction. Wasted 3 days so far. Thinking of jumping to TypeScript.

@jobukkit
Copy link

Blocker for me.

@zoechi
Copy link
Contributor

zoechi commented Nov 25, 2015

I really hope this will be fixed with the next Dartium version due in the next weeks.

@alan-knight
Copy link
Contributor

I think that Dartium in 1.13 actually returns a Window rather than a WindowBase for a cross-frame Window. That isn't so much an intentional change as an unintended consequence of going via JS Interop and not inserting the matching type conversion. So what is it you're looking to see fixed in Dartium? At this point the primary effort on Dartium is rolling to a current Chrome version.

@Jop-V can you be more specific about what's blocking you? I don't think dart2js behaviour has changed. But it should still be possible to work around this fairly easily by accessing in JS.

@mouze
Copy link

mouze commented Feb 29, 2016

I want to write comment here, because we need solve this issue.

DART is very good language and we are pleased to work in it.

We work on large application and we need build some content of page inside iframe.
Content is completely built by main window. It must be in iframe because we need load different style for it, which use CSS3 Media Queries.

We use little hack, but from DART 1.14 there is new bug. And we are also limited by other bugs in JS interop and dart2js.

See:
#25871
#17936
...

thank you for great work

@kevmoo kevmoo added P2 A bug or feature request we're likely to work on type-enhancement A request for a change that isn't a bug and removed accepted labels Feb 29, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-core-library SDK core library issues (core, async, ...); use area-vm or area-web for platform specific libraries. library-html P2 A bug or feature request we're likely to work on type-enhancement A request for a change that isn't a bug
Projects
None yet
Development

No branches or pull requests