How to display iframe in lightning by direct-loading content (without a src: url)

Question

I have read Is it possible to add iFrame directly in Lightning Components, this is not a duplicate. I need to display an iframe, but I cannot supply a src url.

Briefly, I need to display EmailMessage.htmlBody within my component, but the emails are coming from Outlook (via 3rd party syncing tool), so the email content includes html, head, and style tags. The client wants to keep the formatting, so I don't want to strip out the style. Both lightning:formattedRichText and ui:outputRichText strip out a number of tags including html, head, and style. Further, the way they strip them out leaves some of the xmlns:xxx attributes from the html tag present in the display, so they won't work.

I've looked at how the OOB EmailMessage view page in LEX works, and it's showing the email body inside an iframe... complete with all of the outlook-generated tags inside the iframe. But, there's no src tag on the iframe, so I assume they are loading the iframe from JS.

I've tried the following:

1. Direct setting, e.g., iframe[0].contentDocument.write(html). The wrapper object api doesn't expose contentDocument.
2. data: url, with the email body base64 encoded. CSP restriction doesn't allow Data urls. The CSP settings in SF allow for additional urls, but do not support the data: scheme (per the error message when I tried).
3. blob: url, creating the Blob in js using the email body. No CSP error, and if I debug the blob: url and paste it in the browser, I see the email body. But when I set it in the iframe in the page, I get a blank iframe. Inspecting the iframe content in chrome dev tools shows a simple empty html doc that isn't the content I put in my blob: url.

So I'm stuck. How can I render the full html which I have as an object property, but not as an url, inside an iframe, in a Ltng Component?

Answer 1

You can use aura:unescapedHtml to inject almost any kind of HTML. As usual in this case, make sure that you trust the source code to avoid injection attacks, or at least do some minimal scrubbing of potentially dangerous tags.

Answer 2

Have you tried to bind an aura attribute to the source of the iframe. When the attribute change, so the iframe source.

<aura:attribute name="vfHost"           type="String" default="" />

<iframe aura:id="vfFrame" src="{! v.vfHost }"/>

Although, if you have the content of the email in a JS var, why do you need to put it in an iframe. You can render inside a lighting component in a DIV

<div id="divEmailText"></div>

renderHTML : function(strHTML) { 
 document.getElementById('divEmailText').innerHTML = strHTML; 
}