4 ms·
How is that a sandbox ? Evil users can use document.top to get the top-level context. õ_o
by arcatek 14y ago
How is that a sandbox ? Evil users can use document.top to get the top-level context. õ_o
- nicklovescode 14y agoIt's not really meant for security. As another comment stated they could just hang the browser. It's more that page code doesn't get in the way of user scripts. They're free to do $('a') or body { background: blue; } and only affect their element(s)
- arvidkahl 14y agoSo it's a sandbox for the iframe, not a sandbox from the perspective of the parent window object. For that, it's very useful. Have you looked into the security/termination problems or are they not a neccessity for your project?
- nicklovescode 14y agocorrect on both counts