Re: [w3c/webcomponents] shadow tree -> iframe <- contentWindow.frameElement encapsulation issue (#507)

> what has this to do with shadow DOM? The document inside shadow iframe is loaded just like a normal document in iframe and has access to the containing iframe if that is accessible with non-shadow iframe.
So, this doesn't seem to have anything to do with shadow DOM encapsulation.

This is purely Shadow DOM related as this use case wouldn't appear in any other scenario.  Like I said in previous comments, the problem is that it's not possible to close off access to the shadow tree if you're loading third-party content in the iframe.  The content isn't relevant to the component and, whilst sandboxing it would be an option, you lose the benefits that a same-domain iframe would provide.

> Perhaps iframe could have a property/attribute indicating that window.frameElement should be null in the contained window. Or hmm, still sounds more like a sandboxing thing. Should the iframe's document just be treated as a cross-domain document, so communication would need to happen via postMessage.

No, as I explained in another comment, this doesn't allow me to match the features of an iframe.  I want to provide what is, essentially, a custom iframe that provides some extra features.  Just like a standard iframe, the component user would provide the `src` to be loaded in the shadow iframe.  I don't think that content should be able to access the shadow tree of the component, but I think that it should be able to access the parent as normal (via `window.parent`).  I'm not sure how I can make it any clearer than this.

I thought this might be able to work as a patch to the [HTML spec](https://html.spec.whatwg.org/multipage/browsers.html#dom-frameelement) along the lines of

> 6. If _container_ is within a (closed?) shadow tree, then return null and abort these steps.
> 7. Return _container_.

A component author can always provide access back to the shadow tree if necessary.

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/507#issuecomment-222090586