[
https://issues.apache.org/jira/browse/SHINDIG-416?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
John Hjelmstad updated SHINDIG-416:
-----------------------------------
Attachment: (was: rpc.js.patch)
> Implement window.opener-based IE transport ("NIX") in gadgets.rpc
> -----------------------------------------------------------------
>
> Key: SHINDIG-416
> URL: https://issues.apache.org/jira/browse/SHINDIG-416
> Project: Shindig
> Issue Type: Improvement
> Components: Features (Javascript)
> Reporter: John Hjelmstad
> Assignee: John Hjelmstad
>
> Joey Schorr and I have been developing a technique for high-speed
> cross-domain message passing in IE6 and IE7 that exploits an odd property:
> for a given window object, window.opener can be set by any party, but only
> read by the controlling window.
> The message-passing technique is to pass a "channel creation" object from the
> container, across domain boundaries, to the gadget. The gadget uses this
> object to establish a bi-directional communication channel used by all
> subsequent gadgets.rpc calls.
> We can't pass a JavaScript object through window.opener, however, because
> doing so enables access to the passing agent's full window context. Eg. if
> the container sets window.opener = function() { ... }, then the gadget can
> access the entire container page with:
> var containerWindow = (new window.opener.constructor("return window;"))();
> Instead, we pass a VBScript (COM) wrapper through window.opener, since COM
> objects don't have this property. The gadget passes back such a wrapper as
> well, ensuring mutually isolated contexts.
> Patch forthcoming.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
