How to check if script has access to properties in another frame/window ?

Hi,

Under the same-origin policy, if a script tries to access properties in
another frame or window that is from another host/protocol/etc, it will
not be allowed by the browser and a permission denied error is given.

I was wondering if anyone knew of a way to check if a particular
frame's or window's properties were accessible before attempting to
access them, to prevent getting the error.

Thanks,

-Adnan.

re: How to check if script has access to properties in another frame/window ?

adnanx82@gmail.com wrote:
[color=blue]
> [Same Origin Policy]
> I was wondering if anyone knew of a way to check if a particular
> frame's or window's properties were accessible before attempting to
> access them, to prevent getting the error.[/color]

That would include checking whether the second-level domain is the same
or not. You could try accessing the `location' property the respective
Window object; that property not subject to the SOP:

<http://devedge-temp.mozilla.org/library/manuals/2000/javascript/1.3/guide/sec.html#1015705>

You could also try exception handling, i.e. access the property and handle
the exception that is thrown if that fails; this will, of course, only
apply to and work in more recent user agents.


PointedEars

re: How to check if script has access to properties in another frame/window ?

Thanks for your reply. I couldn't find any property of location object
that is not subject to SOP. According to the link you sent, properties
'x' and 'y' of location object are not subject to SOP; however, I could
not find any such properties in the location object. Do you know what
the 'x' and 'y' refer to?

Thanks,

-Adnan.

re: How to check if script has access to properties in another frame/window ?

adnanx82@gmail.com wrote:
[color=blue]
> Thanks for your reply. I couldn't find any property of location object
> that is not subject to SOP.[/color]

Yes, but the `location' property value itself is not subject to the SOP,
i.e. access to `foo.location.href' is forbidden but access to `foo.location'
is not.
[color=blue]
> According to the link you sent, properties 'x' and 'y' of location object
> are not subject to SOP; however, I could not find any such properties in
> the location object. Do you know what the 'x' and 'y' refer to?[/color]

Probably the submit coordinates when input[type="image"] is used.


PointedEars
--
What one man can invent another can discover.
-- Sherlock Holmes in Sir A.C. Doyle's
"The Adventure of the Dancing Men"