1

So, I have a Custom Link pointing to some static resource, this link is flagged as executable javascript. Then, I'm associating this link with custom component.Those are actually steps described here. This feature is under the constant risk of being removed in future, but currently it's something valid.

My question is - is is possible to add an exectulable javascript as a custom component without any visual representation at all?

One obvious quick and dirty solution will be just find relevant box in DOM and hide it, but I'm looking for something less kludgy.

shabunc
  • 133
  • 8

1 Answers1

1

There is at least for the aloha UI no officially supported path to inject JS into the standard domain outside of iframe security silos.

This is "by design" because of security concerns. One focus seems to be to protect the setup.

But still I think it would be worth either to allow controlled xss for local static resources or to fix the most pressing pains in aloha to make as many of injections obsolete as possible.

You did not tell us exactly what your use-case is, for which you want the injection for. May be there is an other workaround, but it depends. There are a lot of things actually only possible with injections.

But there is hope manifested as Lightning (future version for desktop-use). I attended an event in Munich last week which gave me the impression that Skip and Doug are very well aware of what we need as contemporary developers. I learned there will be no more iframes and supported solutions for many things we need. And they really want to deliver.

So to avoid falling in the "stay calm and wait" mantra, I would recommend to describe the reason which makes us think about injections and bring these patters together with possible solutions back to salesforce. May be we could either achieve to convice them on small improvements to Visualforce or we might be able to apply for a longer grace-time until they shut down the existing methods to more than the level communicated for summer15.

If we would have a roadmap that allows us to help ourselves within the currently published summer15-ruleset until we have a good desktop version of Lightning, I would say: fair enough.

Uwe Heim
  • 28,350
  • 18
  • 115
  • 283