Skip to main content
Participant
January 23, 2011
Question

Sandbox Bridge: questionable goals, questionable behavior

  • January 23, 2011
  • 1 reply
  • 348 views

I have two application sandbox HTML windows that each contain IFRAMEs with content loaded from the same remote domain.  I'm trying to allow those IFRAME's contents to script between each other freely.

Pulling through the parentSandboxBridge and proxying to the other IFRAME's client seems to almost work, in that I can get some simple data through, however functions are stripped from return values.  Oddly, if I pass a function reference into the parent, request and call it from the other bridge that does work, but then the same data only limitations seem to apply on arguments and return values.  In any event, I suspect the entirety of what DID seem to work there might have been a bug in the sandbox intention considering the somewhat inconsistent ways it seems to work.

In searching for a different way to share a reference between these frames I stumbled on something interesting.  I'm wondering if Adobe would consider this a bug to be fixed or something that's not unreasonable to rely upon.

I create an app HTML window with HTMLLoader.createRootWindow and its HTML loads a remote IFRAME into it.  That remote content calls "window.name='x'";

Now I repeat the process with a new HTMLLoader.createRootWindow and remote IFRAMEcombo.  But this time the remote HTML calls "var orig = window.open('', 'x');" and successfully acquires a reference to the original child IFRAME, both in the correct domain, sandbox, and seemingly having my desired level of script access between them.

Did I stumble on something you'd like to FIX or is this a halfway decent plan for accomplishing my goal?

Thanks,

Andy Lippitt

This topic has been closed for replies.

1 reply

Participant
January 25, 2011

1. This is exactly how the sandbox bridge is designed to work. You can check more details about sandbox bridges in AIR HTML Security documentation:

http://help.adobe.com/en_US/air/html/security/WS485a42d56cd1964150c3d3a8124ef1cbd62-7ffe.html

http://www.adobe.com/devnet/air/ajax/quickstart/articles/sandbox_bridge.html

2. As long as the two iframes use the same domain they have the same security origin and can access each other. I've just tested this in Safari on Mac and it works. On Chrome for example it doesn't work because the two iframes are opened in separate processes. As far as I know there are no plans to change this behavior in future versions.

Regards,

Alexandru Chiculita

Computer Scientist, AIR Team