The ELC Community Blog
A knowledge exchange on Ruby on Rails and Agile Development
Beating The Browser's Iframe Security
by stevend on November 02, 2006
I recently ran into the problem of cross domain communication between iframes while working on RightCart. We wanted to be able to pop up a LightBox outside the cart iframe, but the event had to be triggered by something happening inside the iframe. To make matters worse, the parent frame could be any domain and the child frame was always RightCart. After some research, I found that DoJo and the Windows Live Team claimed to have done this using nested iFrames.
No one else seemed to be using this technique is would describe EXACTLY how it is to be done, so here we go:
The situation:
- Parent frame is http://www.somedomain.com/somepath/somefile
- Child iframe is http://rightcart.com/cart
- Parent executes some javascript initially which we control
- Child is completely controlled by us, and wants to call functions in parent
How I did it:
The child knows the URL of the parent through the HTTP referer (sic) header. If it creates a "subchild" iframe within the child pointing to the same top level URL as the parent, then 1-way communication is possible. How? The child can set the location of the subchild (but not read the location) and the parent can read the location of subchild, as long as the domain is the same as the parent.
So how do you transmit messages on a URL? Use the hash!
The hash is the portion of the URL after the # sign. You can change that portion of the URL and not mess with the browser. Most importantly, the browser will not go make a new request if it already has the page, regardless of what the hash value is.
For example, I could send a message to the parent by setting the location of the subchild using document.getElementById('...').src to http://www.somedomain.com#message_is_here. The parent can get the hash of the subchild by executing some javascript like window.frames[0].frames[0].location.hash. Got it? In order to send more complex messages, you'll want to Base64 encode the contents of the hash.
As for synchronization, I gave the messages sequence numbers, so that the parent knew if they had already seen the message. I also set a limit to how often messages could be sent (every 500 ms in my case). So the child had to queue messages if they came in too quickly:
1 function sendJavascriptToParent(js) {
2 rightcart_comm_queue[rightcart_comm_queue.length] = js;
3 }
This is important, because there's only 1-way communication involved and the parent cannot tell the child that it is ready for the next message. I set both frames up at a 500 ms interval to update and check the message respectively. This is not 100% reliable, but if you're worried, try simply checking for messages twice as often as your minimum update delay.
Here's my code to check for messages in the parent:
1 <pre>function check_for_comm()
2 {
3 var rcFrame = null;
4 var innerFrame = null;
5 rcFrame = window.frames["rightcart"];
6 if (rcFrame) {
7 innerFrame = rcFrame.frames[0];
8 if (innerFrame) {
9 var loc = innerFrame.location;
10 debug_print("InnerFrame location = "+loc.href);
11 var frag = loc.hash.substr(1);
12 var seqnum = frag.split("!")[0];
13 var data = frag.split("!")[1];
14 debug_print("SeqNum: "+seqnum+", Data="+data);
15 if (data.length > 0 && seqnum != comm_last_seq)
16 {
17 comm_last_seq = seqnum;
18 var decoded_data = decodeBase64(data);
19 debug_print("Running: "+decoded_data);
20 eval(decoded_data);
21 }
22 }
23 }
24 }
25 </pre>
And my code to send a message from the child:
1 <pre>function doSend() {
2 if (rightcart_comm_queue.length > 0) {
3 var seq = new Date().getTime();
4 var ifr = document.getElementById('rightcart_comm_frame');
5 var all_js = '';
6 for(var i=0; i<rightcart_comm_queue.length; i++) {
7 var js = rightcart_comm_queue[i];
8 all_js += js+'\\n';
9 }
10 var data = encodeBase64(all_js);
11 var url = rightcart_comm_baseurl+'#'+seq+'!'+data;
12 /*alert('Sending Data: '+all_js+' using url '+url);*/
13 ifr.src = url;
14 rightcart_comm_queue = [];
15 }
16 }</pre>
I had trouble using the EXACT same URL as the parent for the subchild. To solve this, I dissected the URL and set it to robots.txt in the same domain. This will cause a browser request for the first message.
Timeline
- ActiveRecord attribute update semantics
- Installing Webmin on Ec2
- Interactive Capistrano deploys
- Ruby on Rails on EC2
- Upgrade EC2 FC4/Base to FC5
- Beating The Browser's Iframe Security
Comments
Gilda is getting it up her ass for the first time. She likes cock and she likes the sticky load that comes out of it after she has had a time sucking and fucking the man stick. But her ass hole is virgin territory. Click Here To Visit Latin Bitches!
The chubbier Melissa gets the hornier she is. This is her third boyfriend of the week, and by the looks of it he won’t last long either. Too bad because there’s no one sexier than Melissa who’s got the sexiest ass and tits in town. Next time you see a babe that spills out of her clothes, treat her to something nice. Maybe she’ll let you fuck her. Click Here To Visit Chunky Club!
Playing redcoat and friar is just the thing to inspire these two highly creative studs to be even more creative. Paris and Troy will not add to the world’s population by fucking but they sure will be inspired to more creativity. Click Here To Visit Gay Asses!
This grandma has got it made. She’s been fucking men for forty years and she hasn’t stopped wanting them. Now that she’s in her late fifties she’s developed a taste for black dudes. And this black guy is just the first for the day. Click Here To Visit Moms Gone Wild!
This nasty bitch thought she was a little too good to suck cock but then … well … like all hoes, she needed the cash. Well we’re always down for helping a damsel in distress … and we’ll even help out a skanky hoe too so we promised her the loot if she got down and dirty and sucked some cock. We didn’t tell the bitch we were going to dump a load on her face … I guess it shows huh? Click Here To Visit Blowjobs Masters!
Cheating wife sex video previews candy apple sex. Cp hardcore sex video. Big black moms sex black sex sex woman! Erotic hardcore sex online sex store. Sex party arizona, australian swinger sex. Fetish sex cams anal sex little boys, needles sex. Familt sex pics. Free local lesbian sex personals. Sex servant website. Free oral sex picures. Have sex with therapist. Nude sex travel. Kon sex malik sherawat sex with jackie chan. Ducky sex ball licking pay by paypal for sex toys teenage sister sex naked gay simpsons sex! Housewife sex galleries! Overview of sex discrimination act 1975. Henderson nevada sex. Sex positions he’ll love. Dirty sex talk by black women bugs having sex. Oarl sex x-ray, female sex explotion video clips? Vegas sex stores first time gay lesbian sex stories sex in beckenham kent – black sex cherokee xxx – gay boy sex toys maddy’s pig pen phone sex. Sex teacher busty 3-d animal sex. Free movie sex trailer text sex contacts uk. Senior sex hair sex tourism adelaide. Hardcore sex with jenna jameson. Registered sex offenders denver co? Pleasure sex toy aneros. State of indiana sex offenders list cheerleaders having hardcore sex lindsey lohan oral sex tape. Russia whipping ass sex. Marguerite moreau sex scene redhead satin perfume sex. Teens video sex free lingirne sex vids. Lesbians sex veoh anal sexy wifes sex sluts husbands wives teaching sex pictures. New york sex offender regestation. Buddies having sex harvard man sex old woman cumshot sex videios. Sex with a dead deer. Sex as a teen home submitted sex pictures 1.00 cam sex bollywood forum indian sex sex loud. How to sex to sexty. Pregnaunt from anal sex oral sex tips and concerns free ametuer sex vid. Kori sex. Sex group eiffel tower. Girl with man sex a bad teacher in sex son having sex with his mom, nude girls having sex in pictures – gay sex rest room sex survey what do you want stockings mature sensual sex. Thong sex pics. Cam live party sex. Women low sex drive study university old men sex pics jenny sex ecard rumania sex. Guys having sex with girls asleep? Free video sex archive lesbian teen boy sex gay hermaphrodite sex videos. Vannesa minillow sex video doubl sex, free sex chat no sign up. Why does 1st time sex hurt. Sex tv sex tv sex tv game adult sex percent of repeating sex offenders, sex and video cilps sex toys movie clip. Sex shops in charleston sc. Pictures of female sex organ having sex with your father women’s health sex toys. Suzanne shaw shower sex video sex scenes with nicole sheridan boy foot sex? Eidson chen sex scandal. Mature sex with cougars backdoor entrance to sex site. Office sex webcam pics restoring sex offender rights man and women having sex video paris free sex tape sole sex, filf sex, teacher student sex scenes family sex vidio. Dog ladie sex i wanna sex doll forced family sex 17 search california sex offenders? Cartoon room sex. Anal sex and stories, sex dating in baker oklahoma. Sex meet in rippey iowa sex furs. Homemade sex movies teen virgin. Sex with narcassist. Sex advice for wives pee sex pee. Feet sex videos free bob funny fat guy having sex unprotective sex twista lyrics. Free porn babe sex pics. Free joy of sex downloads rap video girls sex indian sex story in urdu pooch sex. Free 10 min sex viedos! Sex and the city movie deput. Sex dumps alison angel sex toy. 1st time sex tips illegal little girls nude sex cartoon sex dennis. Women fucking sex machines porn, sex heels thumbs. Free home sex web cam male sex weekends! Girls dry sex. America sex stte. Viking sex fantasy pictures. Dad and my girlfriend having sex. Young teacher sex pitures of xxx sex. Hard free sex porn web girls sex web cams dhea male sex. Young grils having sex – bizzare sex rank list sex upload clips. Ebony sex sites. Sex games dice. Xxx sex italian chicks sex dating in dover georgia bizaar sex scenes, family guy movie sex scene sex atraction. Sex city criticism gay sex stories literorica. Cheap sex me, african dog sex. Amateur free gallery picture sex. Daily xxx sex videos. Buy sex toys at mypleasure. Cyber sex chat pages. Cartoon flinstone sex free. Horizontal sex mature wives sex videos. Anal sex tips why poop during. Russain teen sex free 18 sex nude girl video. Japan free sex young girls black men sex pictures, souther california sex shops, karas sex, fargo sex ads illustrated heterosexual sex. Dvd having sex with a dog – phat girlz sex pics london soho sex shop sex and the city domino effect. Ganandorf zelda sex! Tmnt sex stories, international sex slavery? Charlotte nc sex therapists cannon ball sex position. Las vegas massage parlor sex sauna extramarital sex articles.
812066116725261989