3 ms·
If you take the output, put that into a file on a different (sub-)domain and request it as iframe src from there, you can use the Cross-Origin-Policy to your ad
by arvidkahl 14y ago
If you take the output, put that into a file on a different (sub-)domain and request it as iframe src from there, you can use the Cross-Origin-Policy to your advantage und have window.parent only respond to window.postMessage(), not direct manipulation. This will secure your parent, but will still allow for phishing inside the iframe.
- underwater 14y agoYou should be careful with subdomains. document.domain (https://developer.mozilla.org/en-US/docs/Same_origin_policy_for_JavaScript https://developer.mozilla.org/en-US/docs/Same_origin_policy_...) allows a page strip the subdomain. So pages on your supposedly safe third-party-code.example.com can act as though their domain is plain old example.com.
- eurleif 14y agoThat only works if you explicitly set document.domain = "example.com" from the pages on example.com, as well as from the pages on the subdomain. See: https://developer.mozilla.org/en-US/docs/DOM/document.domain https://developer.mozilla.org/en-US/docs/DOM/document.domain