I am trying to add an object to the window, but I need it to be outside of the secure DOM. Is this possible?

I have functions such as runtime below that are evaluating within the secure window. I need these to run outside of the secure window if possible. Any insight would be helpful.

runtime: function(component, event, helper) {
            var path = $A.get("$Resource.sftestassets")+'/runtime.js';
            var req = new XMLHttpRequest();
            req.open("GET", path);
            req.addEventListener("load", $A.getCallback(function() {
  • 1
    Shortly. not "legally". That is what Locker Service is there to prevent. If there is a hack, however, somebody will surely comment, but I am not aware of one. – Sebastian Kessel Nov 15 '18 at 23:27
  • More importantly, what are you trying to do? What do you need that for? – Sebastian Kessel Nov 15 '18 at 23:27
  • There are no known ways to get access to the native window. If you were able to do so somehow, it would be a bug that salesforce.com would have to fix, because the purpose of Locker Service is to prevent this exact behavior. Instead, you'll need to think of a way to do whatever it is you're trying to do by another means. You basically have an x-y problem. Try asking about the original objective that led you to your current situation. – sfdcfox Nov 15 '18 at 23:31
  • I am trying to run an injected angular app from the lightning component. When I run the scripts manually from my chrome console, everything runs as expected. When doing the same from within the lightning component controller it won't work – pedrum golriz Nov 15 '18 at 23:59

The lightning:container component is meant to provide access to third-party library apps (e.g. React, Angular) in a secure, controlled environment where the script will run without breaking Locker Service protocols. A basic example of that looks like this:

<aura:component access="global" implements="flexipage:availableForAllPageTypes">
    <lightning:container src="{!$Resource.myReactApp + '/index.html'}"/>

There's also a way to pass in parameters and enable two-way communication with the container app, if necessary.

  • This method never worked for me. I kept getting the xframe same origin issue, even with all the clickjack settings off and dev mode on/off. – pedrum golriz Nov 16 '18 at 0:12
  • @pedrumgolriz You're doing something wrong then... Clickjack settings have no effect on static resources. You need to be using a SPA (Single Page Application). – sfdcfox Nov 16 '18 at 0:17
  • That defeats the purpose, I need it to be in a community. Salesforce is way too restrictive... – pedrum golriz Nov 16 '18 at 0:48
  • @pedrumgolriz without seeing the code and whatnot, not sure why you're having problems with it, it should work just fine in a community. It's not that they're trying to be restrictive, they're trying to be secure. – sfdcfox Nov 16 '18 at 0:56
  • My lightning container code looks pretty identical to yours except for the resource library. Using a standard iframe works but that is bad practice – pedrum golriz Nov 16 '18 at 1:06

I ended up using sessionStorage for each of the Angular resources and eval()'ing them when the window has loaded.

See https://github.com/pedrumgolriz/ngSalesforce

  • This is the kind of thing that, even if you do manage to get working, is very much NOT what you should ever do in a production Lightning solution. It's hacky, insecure and likely to break in a future release. Lightning Components are their own front-end framework and mixing it with others in the same DOM elements is never recommended. – Charles T Nov 27 '18 at 5:37
  • This is not much different on how SF injects React framework and other frameworks. The only difference is that Angular needs time for the DOM to render while the others do not. Source link – pedrum golriz Nov 28 '18 at 1:32
  • There's nothing in that link that suggests it's a good idea to try injecting Angular directly into the Lightning DOM. You are purposely sidestepping LockerService security and using eval(). If you are deploying this in a production enterprise solution, does it belong to your company? To a client? Would the CIO be OK with hearing that you sidestepped a Salesforce security restriction in such an environment, especially on a Community where external users are logging in? – Charles T Nov 28 '18 at 2:22
  • Interesting... Well that's an improvement. I still think that inline Angular inside a Lightning Component is asking for trouble and could break from release to release. – Charles T Nov 29 '18 at 2:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.