[jira] Updated: (SHINDIG-416) Implement window.opener-based IE transport ("NIX") in gadgets.rpc

["John Hjelmstad (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/SHINDIG-416?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

John Hjelmstad updated SHINDIG-416:
-----------------------------------

    Attachment:     (was: rpc.js.patch)

> Implement window.opener-based IE transport ("NIX") in gadgets.rpc
> -----------------------------------------------------------------
>
>                 Key: SHINDIG-416
>                 URL: https://issues.apache.org/jira/browse/SHINDIG-416
>             Project: Shindig
>          Issue Type: Improvement
>          Components: Features (Javascript)
>            Reporter: John Hjelmstad
>            Assignee: John Hjelmstad
>
> Joey Schorr and I have been developing a technique for high-speed cross-domain message passing in IE6 and IE7 that exploits an odd property: for a given window object, window.opener can be set by any party, but only read by the controlling window.
> The message-passing technique is to pass a "channel creation" object from the container, across domain boundaries, to the gadget. The gadget uses this object to establish a bi-directional communication channel used by all subsequent gadgets.rpc calls.
> We can't pass a JavaScript object through window.opener, however, because doing so enables access to the passing agent's full window context. Eg. if the container sets window.opener = function() { ... }, then the gadget can access the entire container page with:
> var containerWindow = (new window.opener.constructor("return window;"))();
> Instead, we pass a VBScript (COM) wrapper through window.opener, since COM objects don't have this property. The gadget passes back such a wrapper as well, ensuring mutually isolated contexts.
> Patch forthcoming.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.