Re: [webcomponents] Proposal for Cross Origin Use Case and Declarative Syntax

On Nov 12, 2013, at 6:22 AM, Elliott Sprehn <esprehn@gmail.com> wrote:
> 
> On Mon, Nov 11, 2013 at 1:33 AM, Ryosuke Niwa <rniwa@apple.com> wrote:
> [...] we’re open to creating a proxy/fake element subclass which is not visible in the global scope and identical to HTMLKnownElement in its prototype chain in the host document as well.
> 
> 
> Can you clarify why it can't be visible in the global scope?

Allowing the imported document to define arbitrary interface to the global scope of the host document will be a security vulnerability unless the host document explicitly lists the name of interfaces, or there is a strict mapping between tag names and interface names.

> Why can't I do document.body.appendChild(new FBLikeButton()) or document.body.firstElementChild instanceof FBLikeButton?

One way to accomplish this will be adding yet another attribute that imports the list of interfaces;
e.g. <link ref=import importelements=“like-button” importinterfaces=“FBLikeButton”>
or defining a map between tag names and interface names (e.g. tag-name > TagName), or exporting it on the link element. e.g. likeButtonLinkElement.importedcomponents.FBLikeButton.

- R. Niwa