20

Just played around with the latest version of Moment.js , 2.18.1 and seems to play nicely with locker . Summer 17 whitelisted InstanceOf operator in locker API and that seems to have made Moment.js compatible with locker . Here are the functions and components that i just tested and seemed to work fine <aura:component implements="force:appHostable,...


19

Important: Libraries that do not support strict mode will not work with LockerService enabled. Salesforce is testing libraries to determine which ones currently will work with Locker Service. The ones they know of have been published in a Salesforce Developer Blog Post titled LockerService and Lightning Container Component: Securely Using Third-Party ...


15

@Praveen, yes, this is totally normal. Here is what is happening: When we say that the body attribute is defined on all components we mean that it's defined on the base <aura:component/> from which all components inherit. Here is a simplified version. <aura:component/> <aura:attribute name="body" type="Aura.Component[]"/> {!v.body} &...


15

There is an issue with static resources in Spring'17 that is activelit being worked on. The issue is being tracked in R&D by W-3615844 if you want to reference this in any communication with support. This will be fixed asap - once we have the fix it will go out immediately (emergency release candidate already).


13

Here is how I generally work in chrome when i see a proxy object, Use the chrome "store as global variable" on the proxy object as shown in the below screenshot Then I just use the Javascript object.keys() and add a bit of Javascript in the console like below to print keys for (let key of Object.keys(temp1)) { console.log(key + temp1); } That ...


13

Standard Agenda View Using FullCalendar javascript component. You need to add these static resources: jQuery 3.3.1 Moment JS 2.22.0 FullCalendar 3.9.0 FullCalendar Scheduler 1.9.4 Lightning Component: <aura:component implements="force:appHostable,flexipage:availableForAllPageTypes"> <ltng:require scripts="{!join(',', ...


11

Support for document.cookie being writable (scoped to your own namespace, similar to how localStorage and sessionStorage work in Locker) is at the top of our queue and (Safe Harbor :p) is planned to be released before the auto-activation date to give you time to verify functionality. I'll update this answer as progress is made. Edit (Feb 13, 2017): Read/...


9

The cases where we have seen this have all tracked back to the code being loaded failing to compile or execute because it either violates Locker (actually this has been rare) or it encounters classes, methods etc that are not currently exposed in Locker (almost 100% of the time). The afterScriptsLoaded= only runs if the code gets past compiling. If you have ...


9

We are already working on this one - its a bit tricky to explain the cause but it has to do with one of the remaining changes required in Lightning to fully support the Content Security Policy requirements from our Security team. There is a use of instanceof (long listed as something that will cause an issue once this last phase of Locker goes live) in ...


9

Ok, this was interesting. I was able to optimize a little... then a lot. First optimization: I used a forEach loop. This took the time from about 700ms to 7-14ms. Eg onButtonClick: function(component, event, helper) { var dataList = component.get("v.myDataList"); var element; console.time("loop_time"); dataList.forEach(function(item){ ...


9

@wesaw Your question touches various subjects, an I will try to answer best: Lightning components were not designed for ES6, but we don't prevent the use of ES6 features or post ES6 features. As of today, the choice is yours, but some are incompatible with the current structure of Lightning components, or with some browsers in your targeted audience. The ...


8

Those restrictions were never correctly stated and I have been working with the App Exchange review team and our technical writers to get this corrected. That "requirement" was only meant for DOM elements that the LC framework creates and manages on your behalf. It was never meant to include DOM subtrees you create yourself or via React, Angualr, etc. Trying ...


8

You guys must know that if you are using lightning component for eg. <lightning:button label="Submit" value="xyz" onclick="{! c.handleClick }" /> You can't access it's value attribute using event.target.value because DOM is not accessible due to locker service. You have to use event.getSource().get("v.value") And if you are using simple html ...


8

We've identified the issue within LockerService and it's in our queue to fix. Please open a case with support and tell them to link to our internal work item W-3198557.


8

You are calling a loop with setInterval. This loop will continue to run because it is attached to the window, but the lifecycle of your component is not the life cycle of the window. E.g. if your component is unrendered, say because a user closes the tab in which your component was running, the window object will still be there running that interval long ...


8

I believe the issue here is at the intersection of aura:iteration and Locker resulting in a sort of custody battle over ownership of the resulting DOM. Opened bug W-3458193 to track this.


8

You can view it here:- Locker Service API Viewer Secure Document Secure Element Secure Window


8

WebSocket will be exposed in Summer '17 and you can instantiate a WebSocket instance like in your example.


8

Aura (Lightning's underlying engine) runs in two modes: system-mode and user-mode (or, "trusted" and "untrusted"). Trusted code is written by salesforce.com and boots up before any components are loaded. It has full access to the entire DOM. Untrusted code, in contrast, is written by someone that isn't salesforce.com, and only has access to its specific ...


8

The root cause of this issue is $A.util.isEmpty() not being able to handle the Proxy wrapping the DOMElement. We might fix it at the LockerService layer by unwrapping the proxy around the DOMElement and passing the raw element to $A.util.isEmpty(). I will confirm the fix and timeframe once we discuss internally with the team. tl;dr LockerService wraps the ...


8

You can submit a lightning:recordEditForm programmatically. You can do so by retrieving the component via it's aura:id and calling the submit method. e.g. component.find('editForm').submit() Here are the supporting docs Since you are using the forms in an iteration, you can give them all the same aura:id and your component.find call will return an array ...


8

If you have access to the spring19 pre release org you can explore the documents on the "lightning web components security via locker service" in developer guide. The docs are available for lockerservice @ (YourDomain.lightning.force.com/docs/component-library/documentation/lwc/lwc.security_locker_service) Lets highlight some key points from document DOM ...


7

Please open a case on this to get things tracked and post the case ID here so I can follow up on it. We have not tested Chart.js yet and this is most likely an issue in Locker's secure virtual DOM implementation. Can you also provide here the specific version of Chart.js (2.1.4 is the latest I believe) you are using in /resource/Chartjs so I can get look ...


7

Please see my answer/comments here Unable to use SVG in Lightning Components with LockerService activated for related info. During the prerelease phase of Summer'16 we are actively dialing in what is exposed via LockerService's secure virtual DOM. Specifically the onsubmit issue you are seeing has been addressed in the .3 patch scheduled to deploy to ...


7

The security review process for AppExchange should not be stopping you from manipulating DOM elements that you own in a controller method - that was a misunderstanding that we have supposedly corrected. That guideline was for DOM elements that were created on your behalf by Lightning's default renderer. Please loop me into the security review for your ...


7

I'm faced with the same problem. I'm doing an aura:iteration to create a list of < th > with an onclick="{!c.func}". Since I don't know how to pass a paramater to said func, I was using the data attributes. Come LockerService, it stopped working. I've asked somewhat the same question and got a reply that it's a known SF issue and they're working on it: ...


7

When locker service is in place, the golden rule is: you cannot access the DOM of the components you do not own Why this is enforced? It is mainly to preserve the component encapsulation, so that developer can not accidentally/intentionally access the other developers component(one's they do not own) or even in worst case break other components ...


7

See this post for more information Why do some lightning components have more methods / properties than others and this is by design to enforce component encapsulation - same reason SecureComponentRef does not expose .find() - cmp.find("foo").getElement() is an anti pattern (one component reaching into the internal details of another) that Lightning ...


7

This is the first problem of this type I have heard of around jQuery and Bootstrap. jQuery is successfully being used by many many developers now in Winter'17 after the recent set of fixes in the past month. The issue with instanceOf that resulted in the warning about instanceOf is about realms which are not even in play in Winter'17 and would not result in ...


7

The Eval function of Javascript has many security vulnerabilities like XSS and hence locker blocks it .You cannot use eval with locker service The danger of eval() is that an attacker may be able to manipulate data that is eventually run through eval() in other ways. If the eval()'d string comes from an HTTP connection, the attacker may perform a MITM ...


Only top voted, non community-wiki answers of a minimum length are eligible