On Sat, Apr 16, 2016 at 7:14 AM, Melisa Bok <[email protected]> wrote:
> I'm wanting to generate some tools to create DOM objects in the host place
> and return the object created to the guest. I tried with several options
> and I couldn't. Here is my code:
>
...
> var div = document.createElement("div");
> var t = document.createTextNode("This is a paragraph");
> div.appendChild(t);
> return caja.tame(div);
>
Special measures are required for DOM nodes that were not *created or first
seen by *the guest. Specifically, call
frame.domicile.tameNodeAsForeign(div)
before passing it back. The Google APIs taming
(src/com/google/caja/apitaming) is an existing example of doing this.
Caveats:
- This also sets a policy that the guest is not allowed to look at or
modify that node or its children (they are “opaque nodes”). If that is not
what you need, the only *current* way around this is to not pass a DOM
node back, but create the nodes in a container passed out and let the guest
walk the tree to find them. (I would not recommend doing that.)
- frame.domicile is not really a public API. We should provide a better
one, but don't currently.
--
---
You received this message because you are subscribed to the Google Groups
"Google Caja Discuss" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
