Need help resolving a plugin issue regarding cross-frame origin

I wrote this plugin and tested it locally before publishing to the marketplace. Installed from the marketplace a single one of its features won’t work due to cross-frame issues. Installed via Load unpacked plugin it works just fine. If you toggle your Developer Tools open in Logseq with this plugin, installed from the marketplace, you’re sure to notice the failing top.document line.

This was my second attempt on what should be an easy feature. The first attempt is here:

My dilemma is with the cross-frame issue of the Style Carousel plugin. I’m not sure if and/or how it can be solved unless the plugin api provides some means itself. If you have any ideas for overcoming this issue I would appreciate your reaching out—or better yet a pull request!

Thank you.

I know ways to solve this if I had control of the core code. I might open a channel of communication between the iframe and the parent similar to Web Workers, using the postMessage api. For my plugin it would send some kind of querySelector message (text) and get a deserializable json array back of matched html (text). Or alternately, with my particular plugin a count of matches would work.

The point is providing the communications channel would make it possible for embedded, isolated plugins to interact with the core app in a controlled, sandbox fashion. Then the core could decide what kinds of messages it responds to. I offered 1 or 2 as an example.

Haydenull pointed out a solution to my issue:

3 Likes

Hey, you disabled issues and now the solution is impossible to read

I don’t know what you mean.

If I try clicking in the link, it gives a 404 error

It’s because the project has issues disabled

I see. That is because people were requesting help for how to set up their CSS to do something specific. The plugin is designed for developers. If you know how to read a DOM and craft CSS, it can work for you. I use it to this day and it works without issue.

This thread (cross-frame) is no longer relevant. I’d delete it but I cannot.

Well, for people who arrive here from Google and would like to know the answer, I thinks it’s because each plugin is sandboxed in a different iframe.

You need to request your plugin to be distributed specially, setting "effect": true in the marketplace manifest

1 Like