Problem with LockerService and XMLHttpRequest

Question

I have a custom component and when I try to use the following code:

Component.cmp

<aura:component implements='forceCommunity:availableForAllPageTypes' access='global'>
      <aura:handler name="init" value="{!this}" action="{!c.executeComponentInitilization}"/>
</aura:component>

ComponentController.js

({
    executeComponentInitilization : function(component, event, helper) {
        var req = new XMLHttpRequest();     
        req.onreadystatechange = function(event) {
            // XMLHttpRequest.HEADERS_RECEIVED
            if (req.readyState == 2) {
                req.responseType = "document";
                // XMLHttpRequest.DONE
            } else if (req.readyState == 4) {
                if (req.status === 200) {                    
                    console.log(req.response);
                    debugger;
                } else {
                    // Something went wrong.
                    debugger;
                }
            }
        };

        req.open('GET', 'https://anHTMLpage.com'); // used https://sitepreview.na40.force.com for tests
        req.send(null);
    }
})

When LockerService is off, I am able to get a nice and sweet Document DOM object for the XMLHttpRequest.response when the responseType is document, but when LockerService is enabled, I only get an Object with a toString() method that returns: "SecureObject: [object HTMLDocument]{ key: {"namespace":"mynamepsace"} }"

Is this a bug? If so, will it be fixed in Summer 17? I tried to use the document.implementation.createHTMLDocument but it creates a document DOM without the right LockerService key/namespace.

Answer 1

If you haven't already, read Introducing The LockerService For Lightning Components and the more recent LockerService and Lightning Container Component: Securely Using Third-Party Libraries in Lightning Components. By design, access to the underlying DOM (and objects like XMLHttpRequest) is replaced by access through Secure JavaScript objects to accomplish the security goals of the platform. This is not something that will go away.

This Locker Service API Viewer suggests that the majority of functions are not blocked, and in theory most JavaScript code should continue to work assuming it is using mainstream JavaScript features. (Best not to assume though: test to find out.)

Do you have a specific problem with your code? If so please edit your question to provide more details in regards to your problem.