preventing frame breakout
Available news archives: comp.lang.tcl - comp.lang.python - comp.security.firewalls - sci.crypt - comp.lang.php - comp.lang.javascript
Google
 
Web news.hping.org


comp.lang.javascript archive

preventing frame breakout

From: Nathan White <changereality@gmail.com>
Date: Tue Jan 31 2006 - 16:55:56 CET

I am writing a Firefox plugin and want to be able to prevent frame
breakouts. I tried to capture the unload and beforeunload events and
prevent the event from firing. It is not possible to stop the url from
changing once these events have been fired. The typical frame breakout
script looks like:

  if (top.location != location) {
    top.location.href = document.location.href ;
  }

Does anyone know of any way to prevent this from taking over the
parent? I don't care if it uses a browser specific feature or even if
it requires specific security settings enabled. I just want to know if
its possible and if so how.

One thought I had is to attach a script to the frame that overloads the
"top" object and capture anything pass. If this could work any ideas on
how to attach a script to a loading frame that executes before anything
else?

Thanks
Received on Tue Feb 7 21:28:51 2006