javascript - Making a Same Domain iframe Secure -


tl;dr can execute un-trusted scripts on iframe safely?

back story:

i'm trying make secure jsonp requests. lot of older browsers not support web workers means current solution came not optimal.

i figured create <iframe> , load script inside it. script perform jsonp request (creating script tag), post message main page. main page message, execute callback , destroy iframe. i've managed do sort of thing.

function jsonp(url, data, callback) {     var iframe = document.createelement("iframe");     iframe.style.display = "none";     document.body.appendchild(iframe);      var iframedoc = iframe.contentdocument || iframe.contentwindow.document;     sc = document.createelement("script");      sc.textcontent = "(function(p){ cb = function(result){p.postmessage(result,'http://fiddle.jshell.net');};})(parent);";     //sc.textcontent += "alert(cb)";     iframedoc.body.appendchild(sc);     var jr = document.createelement("script");      var getparams = ""; // serialize parameters     (var in data) {         getparams += "&" + + "=" + data[i];     }      jr.src = url + "?callback=cb" + getparams;     iframedoc.body.appendchild(jr);     window.onmessage = function (e) {         callback(e.data);         document.body.removechild(iframe);     }  }  jsonp("http://jsfiddle.net/echo/jsonp/", {     foo: "bar" }, function (result) {     alert("result: " + json.stringify(result)); });

the problem since iframes on same domain, injected script still has access external scope through .top or .parent , such.

is there way create iframe can not access data on parent scope?

i want create iframe scripts added through script tags not able access variables on parent window (and dom). tried stuff top=parent=null i'm not sure that's enough, there might other workarounds. tried running for... in loop, function stopped working , unable find out why.

note:

i know optimally webworkers better isolated environment. know jsonp "bad" technique (i had some random guy tell me he'd never use today). i'm trying create secure environment scenarios have perform jsonp queries.

you can't delete references, setting null silently fail , there way reference parent dom.

references frameelement , frameelement.defaultview etc. cannot deleted. attempting either silently fail or throw exception depending on browser.

you caja/cajita though.


Comments

Post a Comment

Popular posts from this blog

user interface - Python attempting to create a simple gui, getting "AttributeError: 'MainMenu' object has no attribute 'intro_screen'" -

complete newbie here python started learning language few days ago (with no programming experience beforehand). i'm bashing skull against desk here, trying create 1 menu button lead menu, supposed replace/hide/destroy previous menu (either works, long process can reversed). what i've come far: import wx class mainframe(wx.frame): def __init__(self): wx.frame.__init__(self, none) self.centre() self.main_menu = mainmenu(self) self.intro_screen = introscreen(self) self.intro_screen.hide() class mainmenu(wx.frame): def __init__(self, parent): wx.frame.__init__(self, parent=parent) self.main_menu = mainmenu panel = wx.panel(self) sizer = wx.boxsizer(wx.vertical) nextscreen = wx.button(panel, label='next screen', size=(150,30)) nextscreen.bind(wx.evt_button, self.nextscreen) sizer.add(nextscreen, 0, wx.center|wx.all, 5) self.show() self.c...
Read more

jquery - Common JavaScript snippet to share files on Google Drive, Dropbox, Box.net or SkyDrive -

this first assignment of file sharing. need share files our website above mentioned locations. currently, have been exploring each service’s api file sharing. question 1 : there javascript code snippet available (like addthis.com ) share files? question 2 : should use server side coding file sharing or javascript advisable? thanks viewers. found useful plug-in named "ink file picker". saves given http file resource directly users online storage engine. url: https://developers.inkfilepicker.com/docs/web/ live example: http://ctrlq.org/save/
Read more

Android Gson.fromJson error -

i've completed tutorial how connect json url , parse content using gson library. code works fine url specified in tutorial, tryed modify work this url . tryed display 1 field second ulr, base field, can't work. here code, please help: public class jsonparsingactivity extends activity { string url = "http://api.openweathermap.org/data/2.5/weather?q=london,uk"; @override public void oncreate(bundle savedinstancestate) { super.oncreate(savedinstancestate); setcontentview(r.layout.main); inputstream source = retrievestream(url); gson gson = new gson();// main gson class reader reader = new inputstreamreader(source); searchresponse response = gson.fromjson(reader, searchresponse.class); //gson.fromjson(string, class) toast.maketext(this, response.base, toast.length_short).show(); } private inputstream retrievestream(string url) { defaulthttpclient client = new defaulthttpclient(); httpget getrequest = new httpget(url);...
Read more