googlearchive / caja

Caja is a tool for safely embedding third party HTML, CSS and JavaScript in your website.
Apache License 2.0
1.13k stars 114 forks source link

Can host-side taming objects be host frame objects? #1563

Open kpreid opened 9 years ago

kpreid commented 9 years ago

Original issue 1563 created by ihab.awad on 2012-10-15T20:15:24.000Z:

The taming membrane currently exposes all but host-created objects as being 'instanceof' constructors in the taming frame. Would it have security implications if we were to make them host-frame objects instead?

We currently assume there are multiple host frames. We'd have to pick one. Could we do that -- is the case of a single host frame sufficiently common, and can we add some new APIs to support selecting the "chosen" host frame for the other cases?

kpreid commented 9 years ago

Comment #1 originally posted by kpreid.switchb.org on 2013-11-06T22:20:34.000Z:

See also issue 1366.

kpreid commented 9 years ago

Comment #2 originally posted by kpreid@google.com on 2013-11-07T21:11:21.000Z:

<empty>