Re: Send ref to frame element

Subject	Re: Send ref to frame element
Newsgroups	comp.lang.javascript
References	<O8CdneYHv5K8MZXBnZ2dnUU7-RPNnZ2d@westnet.com.au> <ae15c684-5377-4d14-9ce3-592a0bdb7bb8@googlegroups.com> <1bb3e32f-5d95-45ff-ae24-45e81e076ea8@googlegroups.com> <99683cda-67ca-43b7-b7b4-acd032ae02a6@googlegroups.com>
From	Andrew Poulos <ap_prog@hotmail.com>
Date	2018-12-10 10:11 +1100
Message-ID	<HfWdnZnt8M6CPJDBnZ2dnUU7-RXNnZ2d@westnet.com.au> (permalink)

Show all headers | View raw

On 9/12/2018 9:51 pm, Julio Di Egidio wrote:
> On Sunday, 9 December 2018 11:06:27 UTC+1, Julio Di Egidio  wrote:
>> On Sunday, 9 December 2018 10:46:52 UTC+1, Julio Di Egidio  wrote:
> <snip>
>>> Beware also of other CORS issues: e.g. if it's a frame within a parent, set
>>> the Content-Security-Policy frame-src (or equivalent) on the parent...
>>
>> Sorry, let me clarify on that out-of-the-blue last paragraph:
>>
>> Actually, to validate origins, as also shown in the examples in the docs, you
>> should check the event.origin property against some list of allowed URLs.
>>
>> But, if all you have is a main window communicating with an iframe, the CSP
>> frame-src setting in the parent page is enough to filter out unwanted content
>> in the iframe, then you can skip programmatic checks of the event-origin *in
>> the parent*: you'd still need to check origins in the framed page...
> 
> Nah, just drop the last part: the main page itself could be framed by a
> malicious site, and this could be posting messages, so always check origins!
> 
> I did build an app where I do what I said above: but it was a hybrid mobile
> app, not a public facing web site.  Anyway, now that I think of it, I am not
> anymore sure that it was not a security hole...
> 
> Just sorry for the confusion.

Thanks but I'm still suffering with this.

<https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage>
says that I can use HTMLIFrameElement.contentWindow (to reference an 
embedded <iframe> from its parent window) but when I try this

window.parent.frames['frm'].contentWindow.postMessage(JSON.stringify(obj), 
'*');

I get "Blocked a frame with origin "http://www.example.com" from 
accessing a cross-origin frame."

Does that mean I can't call an iframe from another iframe?

Andrew Poulos

Thread

Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-06 15:57 +1100
  Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-06 19:02 +1100
  Re: Send ref to frame element "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-12-06 10:05 +0100
    Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-09 19:44 +1100
      Re: Send ref to frame element JJ <jj4public@vfemail.net> - 2018-12-09 16:22 +0700
  Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 01:46 -0800
    Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 02:06 -0800
      Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 02:51 -0800
        Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 10:11 +1100
          Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 10:23 +1100
            Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-09 16:10 -0800
              Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 12:44 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-10 04:17 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-10 15:25 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-10 21:28 +0100
                Re: Send ref to frame element "Mark-" <nospam@mapson.xyz> - 2018-12-11 15:41 +0000
                Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-10 14:21 -0800
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-11 14:48 +1100
                Re: Send ref to frame element Julio Di Egidio <julio@diegidio.name> - 2018-12-10 23:37 -0800
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-12 07:51 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-11 22:52 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-12 09:37 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-13 17:31 +0100
                Re: Send ref to frame element "Mark-" <nospam@mapson.xyz> - 2018-12-13 17:33 +0000
                Re: Send ref to frame element "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-12-13 19:19 +0100
                Re: Send ref to frame element "Mark-" <nospam@mapson.xyz> - 2018-12-13 20:27 +0000
                Re: Send ref to frame element "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2018-12-13 19:17 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-14 07:56 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-13 22:44 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-14 09:21 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-14 01:08 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-14 12:54 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-14 16:04 +0100
                Re: Send ref to frame element Andrew Poulos <ap_prog@hotmail.com> - 2018-12-15 06:32 +1100
                Re: Send ref to frame element Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2018-12-15 01:11 +0100

csiph-web