# US 2021/0240818 A1 · Secure membranes and cross namespace communication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0240818 A1 - Document ID: US20210240818A1 - Status: Published application - Kind: A1 - Application number: 16/991,969 - Filed: 2020-08-12 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: salesforce.com, inc. - Applicants: Salesforce.com, Inc. - Inventors: Kiril SEKSENOV; Caridy PATINO; Manuel JASSO; John-David DALTON; Dejan Mihai GITIN; Abika NIMMAKAYALA; Patterson WU; Theodore LAU; Andrew HOFFMAN; Nirankush PANCHBHAI - Web page: https://patentgrep.com/patent/US20210240818A1 ## CPC - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 16/972: {Access to data in other repository systems, e.g. legacy data or dynamic Web page generation} - G06F 16/986: {Document structures and storage, e.g. HTML extensions} - G06F 40/12: Use of codes for handling textual entities - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed embodiments are related to information security and scripting-language technologies, and in particular, to technologies for providing secure membranes and cross namespace communication between isolated components in a scripting environment. Other embodiments may be described and/or claimed. ## Claims ### Claim 1 One or more non-transitory computer-readable media (NTCRM) comprising instructions, wherein execution of the instructions is operable to cause a client computing system to: while loading a web application (app) including a plurality of components, identify a namespace of individual components of the plurality of components, create a secure membrane for each identified namespace, and execute the individual components within a corresponding secure membrane created for a namespace to which the individual components belong. ### Claim 2 (depends on 1) The one or more NTCRM of claim 1, wherein, to create the secure membrane, execution of the instructions is operable to cause the client computing system to: generate an inline frame (iframe) for each identified namespace. ### Claim 3 (depends on 2) The one or more NTCRM of claim 2, wherein, to create the iframe for each identified namespace, execution of the instructions is operable to cause the client computing system to: generate a Hypertext Markup Language (HTML) document to include an iframe tag for each namespace. ### Claim 4 (depends on 1) The one or more NTCRM of claim 1, wherein, to create the secure membrane, execution of the instructions is operable to cause the client computing system to: create a realm object for each identified namespace. ### Claim 5 (depends on 1) The one or more NTCRM of claim 1, wherein the secure membrane comprises a sandboxed realm isolated from other realms and one or more proxy objects with respective targets outside of the sandboxed realm. ### Claim 6 (depends on 5) The one or more NTCRM of claim 5, wherein, to create the secure membrane, execution of the instructions is operable to cause the client computing system to: remap global references in the sandboxed realm to be the one or more proxy objects created in the sandboxed realm. ### Claim 7 (depends on 6) The one or more NTCRM of claim 6, wherein, to remap the global references, execution of the instructions is operable to cause the client computing system to: replace function and object properties of global objects of the sandboxed realm with proxied counterparts, the proxied counterparts having respective targets to global objects outside of the sandboxed realm. ### Claim 8 (depends on 7) The one or more NTCRM of claim 7, wherein the global objects of the sandboxed realm are respective secure globalThis objects, the global objects of outside of the sandboxed realm are respective raw globalThis objects, and execution of the instructions is operable to cause the client computing system to: remap property descriptors of the secure globalThis object to property descriptors of a raw globalThis object. ### Claim 9 (depends on 7) The one or more NTCRM of claim 7, wherein the sandboxed realm is a first sandboxed realm, and the global objects outside of the first sandboxed realm are global objects within a second sandboxed realm different than the first sandboxed realm. ### Claim 10 (depends on 9) The one or more NTCRM of claim 9, wherein execution of the instructions is operable to cause the client computing system to: operate a first component and a second component of a web application (app) within the first sandboxed realm and within the second sandboxed realm, respectively; when script of the first component is to access the second component in the second sandboxed realm, generate a mirrored version of the second component for use in the first sandboxed realm by the first component, and prevent access to the second component in the second sandboxed realm by the first component. ### Claim 11 (depends on 1) The one or more NTCRM of claim 1, wherein a manifest file for the individual components defines the namespace of the individual components. ### Claim 12 A client computing system comprising: a communication system to connect with a server computing system to establish a single page web application (SPA), the SPA comprising a plurality of components; a memory system to store program code of a client app; and a processor system communicatively coupled with the memory system and the communication system, the processor system is to operate the client app to: execute a first component of the plurality of components within a first secure realm; execute a second component of the plurality of components within a second secure realm isolated from the first secure realm; and when the first component is to access the second component in the second secure realm, generate a mirrored version of the second component for use in the first secure realm by the first component, and prevent access to the second component in the second secure realm by the first component. ### Claim 13 (depends on 12) The client computing system of claim 12, wherein, to generate the mirrored version of the second component, the processor system is to operate the client app to: import functionality of the second component into the first secure realm. ### Claim 14 (depends on 12) The client computing system of claim 12, wherein the processor system is to operate the client app to: operate the first component to extend an intrinsic element in a root realm via a secure proxy, the root realm being isolated from the first secure realm and the second secure realm. ### Claim 15 (depends on 14) The client computing system of claim 14, wherein the processor system is to operate the client app to: operate the first component to import the second component into the first secure realm via a secure proxy having a target in the root realm. ### Claim 16 (depends on 15) The client computing system of claim 15, wherein the processor system is to operate the client app to: operate the second component to export the second component to the first secure realm via a reverse proxy having a target in the root realm. ### Claim 17 (depends on 16) The client computing system of claim 16, wherein, to export the second component to the first secure realm, the processor system is to operate the client app to: operate the second component to extend a class definition in the first secure realm via the root realm. ### Claim 18 (depends on 12) The client computing system of claim 12, wherein the mirrored version of the second component is a secure proxy of a reverse proxy of the second component in the second secured realm. ### Claim 19 (depends on 14) The client computing system of claim 14, wherein the processor system is to operate the client app to: while loading the web app, identify a first namespace of the first component and a second namespace of the second component, and create the first and second secure realms for the first and second identified namespaces, respectively. ### Claim 20 (depends on 19) The client computing system of claim 19, wherein, to create the first and second secure realms, the processor system is to operate the client app to: generate a first inline frame (iframe) within the web app for the first namespace; and generate a second iframe within the web app for the second namespace. ### Claim 21 (depends on 20) The client computing system of claim 20, wherein, to create the first and second secure realms, the processor system is to operate the client app to: remap global references in the first secure realm to be one or more first proxy objects with respective targets in the root realm; and remap global references in the second secure realm to be one or more second proxy objects with respective targets in the root realm. ### Claim 22 (depends on 12) The client computing system of claim 12, wherein a manifest file for the individual components defines the namespace of the individual components.