Repository navigation
.append() script string to iframe causes script execution in top window #4518
Description
index.html
<iframe id="frameID" width="200" height="200" srcdoc="<html><body></body></html>"></iframe>
<script>
var hello = 'hello';
window.onload = function() {
var script = "<script type=\"text\/javascript\" src=\"script.js\" async=\"async\"><\/script>";
$('#frameID').contents().find('body').append(script);
}
</script>
script.js
alert(hello)
I expect the script is executed in iframe body
Activity
[-]append script string to iframe causes script execution on root body using .append()[/-][+].append() script string to iframe causes script execution in top window[/+]aduggal007 commentedon Jan 17, 2020
Keep in mind the following things and your code would work
The final working code is:
<iframe id="frameID" src="data:text/html;charset=utf-8,<html><body>hi</body></html>"></iframe><script>$(document).ready(function() {//could be replace by an external script like%3cscript src="link_of_the_script"%3E%3C/script%3Evar script = "%3Cscript%3Edocument.write(1);%3C/script%3E";//get the contents of the src attributevar srcAttribute = $("#frameID")[0].src;//find index where you want to add the scriptvar beginningIndex = srcAttribute.indexOf("<body>");//change the src attribute of iframe$("#frameID")[0].src = [srcAttribute.slice(0,beginningIndex+6),script,srcAttribute.slice(beginningIndex+6)].join(''); });</script>Core:Manipulation: Fire iframe scripts in its context, add doc param …
mgol commentedon Feb 3, 2020
PR: #4601
Core:Manipulation: Fire iframe scripts in its context, add doc param …
Core:Manipulation: Fire iframe scripts in its context, add doc param …
Core: Fire iframe script in its context, add doc param in globalEval
Core: Fire iframe script in its context, add doc param in globalEval