Path: csiph.com!3.us.feeder.erje.net!feeder.erje.net!news.snarked.org!border2.nntp.dca1.giganews.com!nntp.giganews.com!buffer2.nntp.dca1.giganews.com!nntp.westnet.com.au!news.westnet.com.au.POSTED!not-for-mail
NNTP-Posting-Date: Sun, 09 Dec 2018 17:11:27 -0600
Subject: Re: Send ref to frame element
Newsgroups: comp.lang.javascript
References: <O8CdneYHv5K8MZXBnZ2dnUU7-RPNnZ2d@westnet.com.au> <ae15c684-5377-4d14-9ce3-592a0bdb7bb8@googlegroups.com> <1bb3e32f-5d95-45ff-ae24-45e81e076ea8@googlegroups.com> <99683cda-67ca-43b7-b7b4-acd032ae02a6@googlegroups.com>
From: Andrew Poulos <ap_prog@hotmail.com>
Date: Mon, 10 Dec 2018 10:11:26 +1100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.3.3
MIME-Version: 1.0
In-Reply-To: <99683cda-67ca-43b7-b7b4-acd032ae02a6@googlegroups.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Message-ID: <HfWdnZnt8M6CPJDBnZ2dnUU7-RXNnZ2d@westnet.com.au>
Lines: 42
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 14.203.210.100
X-Trace: sv3-i23aUsz2AYIiN0fiwc1Sb1skUz4pH5ZFEunm5Bw36ffbF72thNyP5mbpwig3QkIm+4PVVuwbeb/MPox!NATpWItPY3PwnIUDUnq50bW9q8T2TcO/4UXATXJHeAekwJBZje6dADa8TPzPlkjJU6MLuX7EGFrm!00lLMC/qt4Eq1oS0icSFTg==
X-Complaints-To: abuse@westnet.com.au
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
X-Original-Bytes: 3250
Xref: csiph.com comp.lang.javascript:35877

On 9/12/2018 9:51 pm, Julio Di Egidio wrote:
> On Sunday, 9 December 2018 11:06:27 UTC+1, Julio Di Egidio  wrote:
>> On Sunday, 9 December 2018 10:46:52 UTC+1, Julio Di Egidio  wrote:
> <snip>
>>> Beware also of other CORS issues: e.g. if it's a frame within a parent, set
>>> the Content-Security-Policy frame-src (or equivalent) on the parent...
>>
>> Sorry, let me clarify on that out-of-the-blue last paragraph:
>>
>> Actually, to validate origins, as also shown in the examples in the docs, you
>> should check the event.origin property against some list of allowed URLs.
>>
>> But, if all you have is a main window communicating with an iframe, the CSP
>> frame-src setting in the parent page is enough to filter out unwanted content
>> in the iframe, then you can skip programmatic checks of the event-origin *in
>> the parent*: you'd still need to check origins in the framed page...
> 
> Nah, just drop the last part: the main page itself could be framed by a
> malicious site, and this could be posting messages, so always check origins!
> 
> I did build an app where I do what I said above: but it was a hybrid mobile
> app, not a public facing web site.  Anyway, now that I think of it, I am not
> anymore sure that it was not a security hole...
> 
> Just sorry for the confusion.

Thanks but I'm still suffering with this.

<https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage>
says that I can use HTMLIFrameElement.contentWindow (to reference an 
embedded <iframe> from its parent window) but when I try this

window.parent.frames['frm'].contentWindow.postMessage(JSON.stringify(obj), 
'*');

I get "Blocked a frame with origin "http://www.example.com" from 
accessing a cross-origin frame."

Does that mean I can't call an iframe from another iframe?

Andrew Poulos