Who owns this node?

Firefox’s implementation of Javascript is quite forgiving: often a little too forgiving, when it ought to be strict about issues that could pose a security risk. Indeed, Firefox’s silent “the programmer meant this” in the instance I’ve just been tackling was only revealed by the IE error:

No such interface supported

Enlightening, no? The error message is spread like a rash over online fora, so it was difficult to see exactly which problem I was having. However, it generally relates to weird DOM manipulations, often involving different parent frames or windows. So as I was scripting between browser windows, I soon realized from this post that iI was inconsistent in my use of document objects as the factory for new nodes in the other window.

If you’re working on a particular document, and that document happens to be in another window, then IE will only let you add nodes to that document if they’ve been created by that document:

var div = window.opener.document.getElementById(”foo”);
// Works in IE and Firefox
div.appendChild(window.opener.document.createTextNode(”Hello!”));
// Fails in IE
div.appendChild(document.createTextNode(”Goodbye!”));

I suspect that in this instance IE is actually behaving properly, if pedantically. Certainly in other DOM implementations (e.g. Perl’s XML::DOM, and probably Coldfusion’s ugly DOM hacks too) you can only add nodes to the document that you used to create the node in the first place. I’ve never worked out why to my satisfaction, but there might be some underlying security issues in being able to stick nodes in other documents. It might even impact Javascript’s own security model.

I don’t honestly know if Firefox could be tempting security problems here, or even if the security all gets fixed behind the scenes (Firefox changing the node ownership). All I have to go off is IE’s robotic, confusing warnings, like Robbie The Robot after some internal electronic catastrophe, and Firefox’s mute, and possibly dangerous, consent.