3

As a security best practice, usually when we open new windows with Javascript, we remove the opener property so that the page we open can't call window.opener and get full control of our Salesforce instance.

The common way to do this (from the article) in code is:

const otherWindow = window.open();
otherWindow.opener = null;
otherWindow.location = url;

However, in Salesforce components, the window object appears to be destroyed and not the browser window. So the first call to window.open() immediately opens a window to a location like:

https://...force.com/lightning/r/.../undefined

How do we prevent security flaws with the destroyed Aura component window object?

  • It's not destroyed, it's wrapped (via SecureWindow). However, I'm pretty sure it's not supposed to behave this way. I'd say that a bug probably needs to be logged. – sfdcfox Apr 14 at 3:56
1

After tracing through the source, it looks like using an undefined first parameter is what causes this behavior. You can fix the first part by explicitly providing an empty url:

const otherWindow = window.open('');

However, once you do this, otherWindow is now a SecureWindow, so you won't get access to otherWindow.location (it will return as undefined). In other words, this path is a non-starter.

You could probably use the lightning:navigation component to specify a location, but this won't work outside of basic Lightning experiences (Lightning, Communities, Mobile App), so not available in Lightning Out or Lightning Apps, etc.

I'd recommend logging a bug, as I'm pretty sure it is one. It should also be reasonable for SecureWindow to provide access to the remote site's location attribute (perhaps filtered to be write-only?). For now, you will probably want to just open a page you know you control (e.g. a Visualforce page) and use that to springboard to the final destination securely.

| improve this answer | |
  • I certainly appreciate the irony that it's called "SecureWindow" – Andy Ray Apr 24 at 20:23
  • @AndyRay It is still more secure than the default window object, it just has what appears to be a flaw. For example, two components in different namespaces can't use window to communicate, because it's no longer truly global. – sfdcfox Apr 24 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.