3 ms·
Couldn't this just follow same domain rules like CORS? But yeah it could break a lot of things... changing location is bad, but can it really execute JavaScrip
by jopsen 9y ago
Couldn't this just follow same domain rules like CORS?
But yeah it could break a lot of things... changing location is bad, but can it really execute JavaScript in the opener context? That would be very serious.
- parenthephobia 9y agoJavaScript is subject to CORS, but "opener" isn't generally, except in Edge. Even then, there is a risk of being surprised. If you open a page on the same site, you may expect that scripts on the opened page can't access the opening page: but because of CORS they can. Here's a fiddle with a link to another fiddle that copies the contents of a password field from the first fiddle: https://jsfiddle.net/u6rmc49c/3/ https://jsfiddle.net/u6rmc49c/3/
- bugmen0t 9y agoCORS is only for http requests. The same origin policy for DOM access allows setting the location.href attribute (getting any attribute is still disallowed). Setting location.href also works with frames in both ways, e.g. frame.location.href as well as parent.locaton.href and top.location.href