3 ms·

yeah, a malicious user can do whatever they want using window.parent. It's not for security, as far as I know there's not much that can protect against that.

• arvidkahl 14y ago
  If you take the output, put that into a file on a different (sub-)domain and request it as iframe src from there, you can use the Cross-Origin-Policy to your advantage und have window.parent only respond to window.postMessage(), not direct manipulation. This will secure your parent, but will still allow for phishing inside the iframe.
  • underwater 14y ago
    You should be careful with subdomains. document.domain (https://developer.mozilla.org/en-US/docs/Same_origin_policy_for_JavaScript https://developer.mozilla.org/en-US/docs/Same_origin_policy_...) allows a page strip the subdomain. So pages on your supposedly safe third-party-code.example.com can act as though their domain is plain old example.com.
    • eurleif 14y ago
      That only works if you explicitly set document.domain = "example.com" from the pages on example.com, as well as from the pages on the subdomain. See: https://developer.mozilla.org/en-US/docs/DOM/document.domain https://developer.mozilla.org/en-US/docs/DOM/document.domain
• underwater 14y ago
  You are specifically allowing the iframe to communicate with the parent window by specifying allow-same-origin in the sandbox attribute. Isolating code is a solved problem if you use a separate domain and allow the browser's cross domain policies to do their job. Calling this Sandbox.js is pretty irresponsible. The term is well defined and well understood. You can't just use the name because it sounds nice.