"Rigid" Chrome, this is also cross-Origin

Source: Internet
Author: User

Today, I saw a post in the Forum

In Chrome, The contentWindow of IFRAME cannot be obtained.

 

If there is no cross-origin, this is impossible, and it is only possible to obtain it, so I wrote the following two test pages.

 

Page:

 

<! Doctype HTML public "-// W3C // dtd xhtml 1.0 transitional // en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <br/> <HTML xmlns = "http://www.w3.org/1999/xhtml"> <br/> <pead> <br/> <meta http-equiv = "Content-Type" content = "text/html; charset = UTF-8 "/> <br/> <title> untitled document </title> <br/> <MCE: style type =" text/CSS "> <! -- <Br/> * {padding: 0; margin: 0 ;}</P> <p> --> </MCE: style> <style type = "text/CSS" mce_bogus = "1"> * {padding: 0; margin: 0 ;} <br/> </style> <br/> </pead> <br/> <body> <br/> <MCE: script Type = "text/JavaScript"> <! -- <Br/> function show () {<br/> VaR _ IFRAME = document. getelementbyid ('A'); <br/> _ IFRAME. contentWindow. B (); <br/>}< br/> function a () {<br/> alert ('page '); <br/>}< br/> // --> </MCE: SCRIPT> <br/> <IFRAME id = "AA" name = "AA" src = "4.html" mce_src = "4.html" frameborder = "0" scrolling = "no" width = "100%" Height = "200"> </iframe> <br/> <input type = "button" value = "click" onclick = "show () "/> <br/> </body> <br/> </ptml>

 

 

Page B:

 

<! Doctype HTML public "-// W3C // dtd xhtml 1.0 transitional // en" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <br/> <HTML xmlns = "http://www.w3.org/1999/xhtml"> <br/> <pead> <br/> <meta http-equiv = "Content-Type" content = "text/html; charset = UTF-8 "/> <br/> <title> untitled document </title> <br/> <MCE: style type =" text/CSS "> <! -- <Br/> * {padding: 0; margin: 0 ;}< br/> --> </MCE: style> <style type = "text/CSS" mce_bogus = "1"> * {padding: 0; margin: 0 ;} </style> <br/> </pead> <br/> <body> <br/> <MCE: Script Type = "text/JavaScript"> <! -- <Br/> (function () {<br/> parent. window. A (); <br/>}) (); <br/> function B () {<br/> alert ('page B '); <br/>}< br/> // --> </MCE: SCRIPT> <br/> </body> <br/> </ptml> <br/>

 

The following browsers are tested: ff3.6, IE6, opera10, safair, and chrome.

 

Except for the last chrome, all others can run normally and get the correct result.

 

Speechless...

 

So I opened

Chrome's Js Controller showed a JS error:

 

Unsafe JavaScript attempt to access frame with URL File: // D:/test/4.html

From frame with URL File: // D:/test/3.html

. Domains, protocols and ports must match.


It means:

Javascript between page 3.html and page 4.html is insecure. Domain,

Protocol and Port

Must match

.

 

You say you are dizzy...

 

When the browser opens the page 3.html directly in the browser (url = "file: // D:/test/3.html"), the 4.html in the same folder as 3.html is in the same domain,


Chrome does not recognize it.

 



So I had to go to IIS which had been left aside for a long time.

Enter http: // localhost/test/3.html in the browser

 

Test passed...

 

 

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.