CODEWITHSUNDEEP
javascriptflashsecurityiframe
James Andino
James Andino

Reputation: 25769

Java script in IFRAME security issues

On the website http://imaginaryman-test.blogspot.com/ the typewriter is inside of an IFAME . Everything works correctly on all browsers when you go to the site directly http://castedspell.com/mark/ but when viewing the version embeded in an IFRAME it does not work on IE and throws errors in Chrome.

Unsafe JavaScript attempt to access frame with URL http://imaginaryman-test.blogspot.com/ from frame with URL http://castedspell.com/mark/. Domains, protocols and ports must match.

This is the source code for the embedded IFRAME https://github.com/totheleftpanda/typeWrite/tree/master/mark

I understand that this is a security problem but I don`t know how to fix it and can not find any material that would help me solve the issue.

Upvotes: 3

Views: 1845

Answers (5)

jerebear
jerebear

Reputation: 6655

It may be waaay simpler than the above answers. It looks like this function:

function playSound(){
    swf.playSound();
}

Is written in the DOM timeline before swf is actually assigned to the swfObject in the function below it.

I would recommend moving that function down further and then retest.

Upvotes: 0

roberkules
roberkules

Reputation: 6605

Your only chance is something like easyXDM. (or do it manually using the hash, but would prefer easyXDM)

See the SO answer: Cross-domain hash change communication

eg. if you wanna call a method:
http://easyxdm.net/wp/2010/03/17/remote-procedure-calls-rpc/

EDIT:

If I try your demo in firefox I don't get the "Unsafe JavaScript attempt to access" error at all. But in Chrome it's thrown many times.
You have so much other code in your example that I'm not even sure that your code causes the problem. You should do a very limited/basic test to see if your flash-communication works, without all those other javascripts.

Upvotes: 1

Amir Raminfar
Amir Raminfar

Reputation: 34150

Take a look at http://benalman.com/projects/jquery-postmessage-plugin/. This is a jquery plugin that sends message between the two frames. The two frames do not need to be on the same domain. But you do need to access both pages to be able modify them. I also wrote a post here that answers communication between iframes. How to capture clicks from iframe on another domain?

Upvotes: 1

xavierm02
xavierm02

Reputation: 8767

The easiest method is to set a PHP (or any server language) proxy that just gets the content of the page from the other domain and outputs it. The only real drawback is that the cookies of the client for the remote domain aren't sent.

Upvotes: 3

MoarCodePlz
MoarCodePlz

Reputation: 5176

I have had similar issues with this before. Basically if you have an iframe that contains a page from a domain that differs from the main page's domain, javascript will not be able to cross the boundaries between them. Javascript within the iframe will be able to talk within the iframe, javascript in the main page will be able to talk within the main page, but they will not be able to talk to each other.

This is a security issue that aims to stop cross-site scripting attacks. There are a number of hacks that you can put in place to get around this problem but they are all (or at least the ones I know of) rather hairy.

Here are some questions that you should answer before trying to go further:

1) What exactly are you trying to do between the pages using javascript?
2) Do you have access to the source of both pages?

Upvotes: 0

Related Questions