Shadow DOM 是否能够保护元素? [英] Is Shadow DOM able to secure elements?
问题描述
假设我是一个显示朋友列表的小部件的开发者，例如:
Suppose I'm the developer of a widget showing a list of friends, such as:
你的朋友 Michael、Anna 和 Shirley 喜欢这个网页！
第一种方法:创建 span
的脚本天真地，我创建了一个脚本，将这些信息放在网站上的 span 中.但是，ExampleSite 的所有者现在可以通过简单的 DOM 操作访问您朋友的姓名！
这是一个很大的隐私/安全问题.
First approach: script that creates span
Naively, I create a script which places this information in a span on the website. However, the owners of ExampleSite can now access the names of your friends by simple DOM operations!
That's a big privacy / security issue.
我不希望 ExampleSite 有权访问他们朋友的姓名.因此，我让网站所有者使用 iframe 添加小部件:
I don't want ExampleSite to have access to their friends' names. So instead, I let website owners add the widget with an iframe:
<iframe src="http://fakebook.com/friends?page=http%3A%2F%2Fexample.org%2F"></iframe>
这是可行的，因为 ExampleSite 的所有者无法抓取 iframe 的内容.然而，整个 iframe 的东西相当丑陋，因为它没有整合 到网站的样式中，而 span 可以.
This works, because the owners of ExampleSite cannot scrape the contents of the iframe. However, this whole iframe thing is rather ugly, because it does not integrate into the styling of the website, while a span does.
昨天阅读 Shadow Dom 时，我想知道这是否可以成为解决这两个问题的方法.这将允许我有一个脚本来创建原始网站无法访问的 span:
When reading about Shadow Dom yesterday, I wondered whether that could be a solution to both issues. It would allow me to have a script that creates a span the original website cannot access:
var host = document.querySelector('#friends');
var root = host.webkitCreateShadowRoot();
root.textContent = 'Your friends Michael, Anna and Shirley love this webpage!';
然而，**Shadow DOM 是否会从周围的页面中隐藏其内容?**
这里的假设是除了我的脚本之外没有人可以访问root"，但这是正确的吗?
Shadow DOM 规范 毕竟说它提供功能封装，但我实际上想要信任封装.虽然组件模型用例实际上列出了 这个用例，我不确定 Shadow DOM 是否实现了必要的限制属性.
However, **does a Shadow DOM hide its contents from the surrounding page?**
The assumption here is that nobody except my script can access `root`, but is that correct?
The Shadow DOM spec after all says that it offers functional encapsulation, but I actually want trust encapsulation. And while the Component Model Use Cases actually list this use case, I'm not sure whether Shadow DOM realizes the necessary confinement property.
推荐答案
它没有，但它正在开发中:https://www.w3.org/Bugs/Public/show_bug.cgi?id=20144
It does not, but it's in the works: https://www.w3.org/Bugs/Public/show_bug.cgi?id=20144
信任的封装将涉及为每个影子树创建一个新的脚本上下文，这在大多数情况下都是多余的.然而，正如 bug 所说，我们将添加一个允许这样做的标志(详情待定).
The encapsulation of trust will involve creating a new scripting context for each shadow tree, which is overkill for most scenarios. However, as the bug says, we'll add a flag (details TBD) that would allow this.
这篇关于Shadow DOM 是否能够保护元素?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
