I am converting code that originally ran as remote signed jar files in Firefox to use XULRunner instead. There are several reports that are implemented as web pages with an output option. Options include an HTML page or a report viewer that is written in XUL and Javascript.
When the user submits the form, and the report viewer is selected, then I need to open a chrome window. Obviously this cannot be done directly for security reasons. I want to provide a function or use some sort of message passing method to signal to the containing chrome what needs to happen.
Can this be done and if so how? Things I am considering: 1) Adding a function to the content window's window or document object 2) Some sort of message passing function 3) Some sort of customer event send/receive 4) A special URL form with a handler such as repviewer://repname/parameters
There is a quite elaborate article on this topic on MDN. The best way to achieve this without jeopardizing security is to send a generic event from your web page. The top XUL document should call addEventListener() with the fourth parameter set to true which will allow it to receive such untrusted events. Data can be passed through an attribute of the event target, the XUL document can then inspect that attribute.