Caja security in Google Drive, GWT not compliant?

325 Views Asked by At

I want to embed a GWT into a Google Document as a sidebar. For a simple jquery webpage everything works fine, but when I embed even the smallest GWT app, it does not show up. I reduced my GWT app to the bare minimum :

public class TemplateBuilder implements EntryPoint {
    public void onModuleLoad() {
        Window.alert("hello world");
    }
}

I include this GWT application like this :

in code.gs

function showSidebar() {
  var htmlOutput = HtmlService.createHtmlOutputFromFile("sidebar.html").setTitle("Template Builder").setWidth(350);
  htmlOutput.setSandboxMode(HtmlService.SandboxMode.NATIVE);
  DocumentApp.getUi().showSidebar(htmlOutput);
}

in sidebar.html

<html>
  <head>
    <script src="http://remoteserver/templatebuilder.nocache.js"></script>
  </head>
  <body>
  <div id="globalStats" />
  </body>
</html>

As mentionned before, including jquery in the HTML file and calling a remote script with jquery statements does work well with this approach.

Now running a webapp in a Google Document, the javascript and HTML is CAJA-sanitized, I understand from what I read here : https://developers.google.com/apps-script/guides/html/restrictions. Then there is a SANDBOX mode you can set to NATIVE or EMULATED. I tried both.

You can use the setSandboxMode() method to choose between two versions of Caja: NATIVE mode imposes fewer restrictions than EMULATED mode and generally runs faster. By contrast, EMULATED mode is more likely to work in older browsers that do not support ECMAScript 5 strict mode, most notably Internet Explorer 9. (Very old browsers, including Internet Explorer 8 and below, are usually incompatible with the HTML service.)

Anyhow, nothing shows up, and from the logs below, the error is :

Object [object Object] has no method 'replace'

It would be great if I could reuse part of my application widgets for embedding into the sidebar ....

Can anybody shed some light ??

thx

For reference, the console output :

SES initialization ses-single-frame.opt.js?debug=1:46
 Problem ignored by configuration (Unsafe spec violation): Array.prototype.push does not throw on a frozen array ses-single-frame.opt.js?debug=1:43
 Problem ignored by configuration (Unsafe spec violation): Extending an array can modify read-only array length ses-single-frame.opt.js?debug=1:43
 Problem ignored by configuration (Unsafe spec violation): SyntaxErrors aren't always early ses-single-frame.opt.js?debug=1:43
 Problem ignored by configuration (Unsafe spec violation): Array.prototype.unshift ignores sealing ses-single-frame.opt.js?debug=1:43
 Problem ignored by configuration (Unsafe spec violation): Array.prototype.splice ignores sealing ses-single-frame.opt.js?debug=1:43
 Problem ignored by configuration (Unsafe spec violation): Array.prototype.shift ignores sealing ses-single-frame.opt.js?debug=1:43
 Repaired: Non-deletable RegExp statics are a global communication channel ses-single-frame.opt.js?debug=1:43
 Repaired: Date.prototype is a global communication channel ses-single-frame.opt.js?debug=1:43
 Not repaired: Eval breaks masking of named functions in non-strict code ses-single-frame.opt.js?debug=1:43
 Repaired: Array.prototype.push ignores sealing ses-single-frame.opt.js?debug=1:43
 Repair skipped: Array.prototype.push does not throw on a frozen array ses-single-frame.opt.js?debug=1:43
 Repaired: Array.prototype.push ignores frozen ses-single-frame.opt.js?debug=1:43
 Repaired: Freezing an array does not make .length immutable ses-single-frame.opt.js?debug=1:43
 Not repaired: Extending an array can modify read-only array length ses-single-frame.opt.js?debug=1:43
 Not repaired: [[ThrowTypeError]] has normal function properties ses-single-frame.opt.js?debug=1:43
 Not repaired: SyntaxErrors aren't always early ses-single-frame.opt.js?debug=1:43
 Repaired unsafely: Array.prototype.unshift ignores sealing ses-single-frame.opt.js?debug=1:43
 Repaired: Array.prototype.unshift ignores freezing ses-single-frame.opt.js?debug=1:43
 Repaired unsafely: Array.prototype.splice ignores sealing ses-single-frame.opt.js?debug=1:43
 Repaired: Array.prototype.splice ignores freezing ses-single-frame.opt.js?debug=1:43
 Repaired unsafely: Array.prototype.shift ignores sealing ses-single-frame.opt.js?debug=1:43
 Repaired: Array.prototype.shift ignores freezing ses-single-frame.opt.js?debug=1:43
 Repaired: Array methods as functions operate on global object ses-single-frame.opt.js?debug=1:43
 Max Severity: Safe spec violation(1). ses-single-frame.opt.js?debug=1:43
 440 Apparently fine ses-single-frame.opt.js?debug=1:43
 10 Deleted ses-single-frame.opt.js?debug=1:43
 1 Skipped ses-single-frame.opt.js?debug=1:43
 Max Severity: Safe spec violation(1). ses-single-frame.opt.js?debug=1:43
 initSES succeeded. ses-single-frame.opt.js?debug=1:43

Sandbox mode: NATIVE 904833574-maestro_htmlapp_bin_maestro_htmlapp.js?lib=MK7wi1l9-fBV4ffZJJ9h74zcqOPkxWgv_:192

Object [object Object] has no method 'replace' 904833574-maestro_htmlapp_bin_maestro_htmlapp.js?lib=MK7wi1l9-fBV4ffZJJ9h74zcqOPkxWgv_:66

Kp904833574-maestro_htmlapp_bin_maestro_htmlapp.js?lib=MK7wi1l9-fBV4ffZJJ9h74zcqOPkxWgv_:66
applyFunctionses-single-frame.opt.js?debug=1:1454
tamingNullAdviceses-single-frame.opt.js?debug=1:1338
applyFeralFunctionses-single-frame.opt.js?debug=1:1320
applyFeralFunctionses-single-frame.opt.js?debug=1:1347
tses-single-frame.opt.js?debug=1:1386
plugin_dispatchEventses-single-frame.opt.js?debug=1:1308
wrapperses-single-frame.opt.js?debug=1:1085
dispatchEventses-single-frame.opt.js?debug=1:781
(anonymous function)ses-single-frame.opt.js?debug=1:1090
_SubConfidence.amplifyses-single-frame.opt.js?debug=1:840
(anonymous function)ses-single-frame.opt.js?debug=1:1090
amplifierMethodses-single-frame.opt.js?debug=1:838
dispatchToListenersses-single-frame.opt.js?debug=1:1268
(anonymous function)ses-single-frame.opt.js?debug=1:1268
(anonymous function)ses-single-frame.opt.js?debug=1:620
execDelayedScriptsses-single-frame.opt.js?debug=1:622
signalLoadedses-single-frame.opt.js?debug=1:620
(anonymous function)ses-single-frame.opt.js?debug=1:1476
fulfilledses-single-frame.opt.js?debug=1:1419
doneses-single-frame.opt.js?debug=1:1427
fulfilledses-single-frame.opt.js?debug=1:1419
(anonymous function)ses-single-frame.opt.js?debug=1:1421
runses-single-frame.opt.js?debug=1:1420
1

There are 1 best solutions below

0
On

Unfortunately GWT is not supported by GAS HTMLService. It may be possible to create a custom linker that compiles the GWT app into a single js file to make it work - but not sure.