[next] Dart should allow cross frame dom access to windows from the same origin.

[vsmenon]

We currently only allow limited access to the cross-frame windows. JavaScript allows complete access - so long as the window is from the same origin. We should just match JavaScript.

At the moment, folks are just using dart:js to circumvent this restriction, so we're not really achieving anything with this.

This change will a fair bit of work - at least the following:

• An API change in dart:html
• Plumbing in dart2js to correctly handle DOM types in different frames
• Plumbing and correct SOP security checks in dartium
• Fixes in js-interop

[vsmenon]

Issue #19123 has been merged into this issue.

[efortuna]

Issue #18657 has been merged into this issue.

[rakudrama]

Is it expected that a List allocated with the same-origin-cross-frame-window context's constructor behaves as a List?

In JavaScript:

  > var a = new (document.getElementById('myIframe').contentWindow.Array)(5)
  > a
  [undefined x 5]
  > a instanceof Array
  false
  > a.constructor === Array
  false

[vsmenon]

Issue #20407 has been merged into this issue.

[vsmenon]

Issue #20216 has been merged into this issue.

[vsmenon]

Stephen: how would your example materialize in Dart? Can we ever get a hold of a native object whose constructor is another frame's Array?

[vsmenon]

Issue #9224 has been merged into this issue.

[vsmenon]

Issue #20944 has been merged into this issue.

[DartBot]

This comment was originally written by @zoechi

---

Friendly ping. Any plans to address this?
See also http://stackoverflow.com/questions/27048607

[DartBot]

This comment was originally written by @Emasoft

---

This is a major security flaw of javascript. Dart should allow it, but it should also offer improved security over javascript.
I suggest to add some strong security check before allowing access to another frame, and the option to disallow it completely.

[leafpetersen]

Assigning to Terry, since his changes may cause this to happen.

---

Set owner to @terrylucas.

[alan-knight]

See also 17936, possibly these should be combined.

---

Changed the title to: "[next] Dart should allow cross frame dom access to windows from the same origin.".

[alan-knight]

Issue #19715 has been merged into this issue.

[alan-knight]

Added Accepted label.

[DanielJoyce]

Bumping into this issue in a multi window chrome app. This is a dumb restriction. Wasted 3 days so far. Thinking of jumping to TypeScript.

[jobukkit]

Blocker for me.

[zoechi]

I really hope this will be fixed with the next Dartium version due in the next weeks.

[alan-knight]

I think that Dartium in 1.13 actually returns a Window rather than a WindowBase for a cross-frame Window. That isn't so much an intentional change as an unintended consequence of going via JS Interop and not inserting the matching type conversion. So what is it you're looking to see fixed in Dartium? At this point the primary effort on Dartium is rolling to a current Chrome version.

@Jop-V can you be more specific about what's blocking you? I don't think dart2js behaviour has changed. But it should still be possible to work around this fairly easily by accessing in JS.

[mouze]

I want to write comment here, because we need solve this issue.

DART is very good language and we are pleased to work in it.

We work on large application and we need build some content of page inside iframe.
Content is completely built by main window. It must be in iframe because we need load different style for it, which use CSS3 Media Queries.

We use little hack, but from DART 1.14 there is new bug. And we are also limited by other bugs in JS interop and dart2js.

See:
#25871
#17936
...

thank you for great work