javascript - Is it possible to send a function to another window using postMessage without having to eval it? -

postmessage accepts strings, has converted string (which isn't problem). once there needs executed. best way this?

don't send function, , don't eval receive in onmessage event - come anywhere.

cross document messaging designed hole in same origin security policy implemented browsers, if you're going purposely work around policy incumbent on understand you're doing , handle security yourself. calling eval on you're offering run on page, presumably containing user's data, javascript hacker can trick page accepting.

a better way whitelist allowed operations , select among them based on what's passed onmessage.

function receivemessage(event) {   // trust sender of message?   // test domain sending messages   if (event.origin !== "http://example.com:")     return;    if (event.data == 'command1') docommand1(); //define these functions elsewhere   if (event.data == 'command2') docommand2(); //note no data passed event }  window.addeventlistener("message", receivemessage, false); 

if want pass parameters use json.stringify(). if there's predefined set of parameters expect can use same approach above, no need ever pass string potentially unknown source direct code. if need deal variable parameter take standard precautions string unknown source.