Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #35876

Re: Send ref to frame element

Newsgroups comp.lang.javascript
Date 2018-12-09 02:51 -0800
References <O8CdneYHv5K8MZXBnZ2dnUU7-RPNnZ2d@westnet.com.au> <ae15c684-5377-4d14-9ce3-592a0bdb7bb8@googlegroups.com> <1bb3e32f-5d95-45ff-ae24-45e81e076ea8@googlegroups.com>
Message-ID <99683cda-67ca-43b7-b7b4-acd032ae02a6@googlegroups.com> (permalink)
Subject Re: Send ref to frame element
From Julio Di Egidio <julio@diegidio.name>

Show all headers | View raw

On Sunday, 9 December 2018 11:06:27 UTC+1, Julio Di Egidio  wrote:
> On Sunday, 9 December 2018 10:46:52 UTC+1, Julio Di Egidio  wrote:
<snip>
> > Beware also of other CORS issues: e.g. if it's a frame within a parent, set
> > the Content-Security-Policy frame-src (or equivalent) on the parent...
> 
> Sorry, let me clarify on that out-of-the-blue last paragraph:
> 
> Actually, to validate origins, as also shown in the examples in the docs, you
> should check the event.origin property against some list of allowed URLs.
> 
> But, if all you have is a main window communicating with an iframe, the CSP
> frame-src setting in the parent page is enough to filter out unwanted content
> in the iframe, then you can skip programmatic checks of the event-origin *in
> the parent*: you'd still need to check origins in the framed page...

Nah, just drop the last part: the main page itself could be framed by a
malicious site, and this could be posting messages, so always check origins!

I did build an app where I do what I said above: but it was a hybrid mobile
app, not a public facing web site.  Anyway, now that I think of it, I am not
anymore sure that it was not a security hole...

Just sorry for the confusion.

Julio

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-06 15:57 +1100
  Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-06 19:02 +1100
  Re: Send ref to frame element "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-12-06 10:05 +0100
    Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-09 19:44 +1100
      Re: Send ref to frame element JJ <jj4public@vfemail.net> - 2018-12-09 16:22 +0700
  Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 01:46 -0800
    Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 02:06 -0800
      Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 02:51 -0800
        Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 10:11 +1100
          Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 10:23 +1100
            Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 16:10 -0800
              Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 12:44 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-10 04:17 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 15:25 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-10 21:28 +0100
                Re: Send ref to frame element "Mark-" <nospam@mapson.xyz> - 2018-12-11 15:41 +0000
                Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-10 14:21 -0800
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-11 14:48 +1100
                Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-10 23:37 -0800
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-12 07:51 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-11 22:52 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-12 09:37 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-13 17:31 +0100
                Re: Send ref to frame element "Mark-" <nospam@mapson.xyz> - 2018-12-13 17:33 +0000
                Re: Send ref to frame element "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-12-13 19:19 +0100
                Re: Send ref to frame element "Mark-" <nospam@mapson.xyz> - 2018-12-13 20:27 +0000
                Re: Send ref to frame element "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-12-13 19:17 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-14 07:56 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-13 22:44 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-14 09:21 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-14 01:08 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-14 12:54 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-14 16:04 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-15 06:32 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-15 01:11 +0100

csiph-web