How to prevent JavaScript from executing in an iframe

seans

Hi,

Is there some way from preventing the JavaScript code in a document
loaded into an iframe from executing? I don't have access to the pages
being loaded into the i-frame so I can't modify then. They are being
loaded from a server.

thanks again.

sean

Aug 31 '05 #1

Subscribe Reply

5501

Richard Cornford

seans wrote:

Is there some way from preventing the JavaScript code
in a document loaded into an iframe from executing?
Disable javascript in your browser, or configure the browser to ask for
permission to execute each script, and deny it for the scripts in the
frames. If you mean that you want to prevent the execution of these
scripts on other user's browsers then you cannot, it is up to them to
make that decision.
I don't have access to the pages being loaded
into the i-frame so I can't modify then.
Does this mean they are someone else's pages?
They are being loaded from a server.

Now that is a novel idea :)

Richard.

Aug 31 '05 #2

seans

Richard Cornford wrote:

seans wrote:
Is there some way from preventing the JavaScript code
in a document loaded into an iframe from executing?

Disable javascript in your browser, or configure the browser to ask for
permission to execute each script, and deny it for the scripts in the
frames. If you mean that you want to prevent the execution of these
scripts on other user's browsers then you cannot, it is up to them to
make that decision.
I don't have access to the pages being loaded
into the i-frame so I can't modify then.

Does this mean they are someone else's pages?
They are being loaded from a server.

Now that is a novel idea :)

Richard.

Hi Richard thanks for your reply. Yes they are somebody else's pages so
I can't make any changes to them.

thanks
sean

Aug 31 '05 #3

Jim Davis

"seans" <se******@yahoo .com> wrote in message
news:11******** **************@ g47g2000cwa.goo glegroups.com.. .

Hi,

Is there some way from preventing the JavaScript code in a document
loaded into an iframe from executing? I don't have access to the pages
being loaded into the i-frame so I can't modify then. They are being
loaded from a server.

I may be misunderstandin g your question but I'll give it a shot.

In general there's no simple way, but the matter rests on the source servers
for the material.

If the iFrame source is loaded from a server DIFFERENT from the one from
which the main page source was loaded then the browser security model will
prevent you from accessing the content of that page. There's no way around
this on the client-side (or, at the very least, any way around this is a
MAJOR security flaw).

In short: while you can load content from other servers into your frames and
iFrames you cannot actually "touch" that content at all. It's not yours -
hands off.

If the iFrame source is from the SAME server then you may be able to jury
rig something... but it will be a tenious solution at best. One obvious
option is to use XMLHttpRequest to fetch the source code meant for the
iFrame and maniplate it (strip out the script) before loading it into the
iFrame. This is riddled with problems however...

+) Any links or references in the iFrame will have to be examined: the
iFrame content's context will no longer be the same as if you allowed it to
be served normally. Relative links may (probably will) break. HREFs may
not (probably won't) function any longer.

+) As you've stated you have no control over the iFrame content, there's
nothing to stop it from changing and breaking your code (the likelyhood of
this happening in any so-called "screen scraping" operation is generally
assumed to be 1 in 1). If you're code to remove the offending script is too
specific it will probably break even sooner... if it's to general it will
probably break too much in the target page.

+) It also converts a simple task (changing the href of an iFrame) to a much
more complex one: this ain't never a good ideer.

All told it's really simplest to just consider it un-doable. ;^)

Jim Davis

Aug 31 '05 #4

seans

Jim Davis wrote:

"seans" <se******@yahoo .com> wrote in message
news:11******** **************@ g47g2000cwa.goo glegroups.com.. .
Hi,

Is there some way from preventing the JavaScript code in a document
loaded into an iframe from executing? I don't have access to the pages
being loaded into the i-frame so I can't modify then. They are being
loaded from a server.

I may be misunderstandin g your question but I'll give it a shot.

In general there's no simple way, but the matter rests on the source servers
for the material.

If the iFrame source is loaded from a server DIFFERENT from the one from
which the main page source was loaded then the browser security model will
prevent you from accessing the content of that page. There's no way around
this on the client-side (or, at the very least, any way around this is a
MAJOR security flaw).

In short: while you can load content from other servers into your frames and
iFrames you cannot actually "touch" that content at all. It's not yours -
hands off.

If the iFrame source is from the SAME server then you may be able to jury
rig something... but it will be a tenious solution at best. One obvious
option is to use XMLHttpRequest to fetch the source code meant for the
iFrame and maniplate it (strip out the script) before loading it into the
iFrame. This is riddled with problems however...

+) Any links or references in the iFrame will have to be examined: the
iFrame content's context will no longer be the same as if you allowed it to
be served normally. Relative links may (probably will) break. HREFs may
not (probably won't) function any longer.

+) As you've stated you have no control over the iFrame content, there's
nothing to stop it from changing and breaking your code (the likelyhood of
this happening in any so-called "screen scraping" operation is generally
assumed to be 1 in 1). If you're code to remove the offending script is too
specific it will probably break even sooner... if it's to general it will
probably break too much in the target page.

+) It also converts a simple task (changing the href of an iFrame) to a much
more complex one: this ain't never a good ideer.

All told it's really simplest to just consider it un-doable. ;^)

Jim Davis

Hi,

Sorry for the late reply. Thanks for all your responses.

sean

Sep 16 '05 #5

Similar topics

2592

Javascript and iframe question

by: S'fly | last post by:

Hi, I'm struggling with the famous "gatekeeper" a little. Normally, it opens in a popup window, and from there it goes on. But I like this script to open in an iframe, and not in a popup. It opens with a link. This is in the main page (where also the iframe): <script language="javascript"> <!--- begin

Javascript

3209

Yet another Javascript and iframe question........

by: Dany P. Wu | last post by:

Hi everyone, I am trying to create a site with pages containing iframes. This is the first time I've used inline frames and am still struggling with the concept. This site will have 10 pages and so far I have created 20 files, each page having to use a pair of files. One file for the actual page, and one file for the content of the inline frame. It sounds bloody silly to me but then again I am only a beginner at web

Javascript

35026

How to make Javascript update IFRAME SRC?

by: Dave Anderson | last post by:

How can I make an onchange event update the src for an IFRAME? I would like to do it without reloading the page, is this possible? Dave

Javascript

2870

Javascript created IFrame document, weird domain issue

by: Robert Oschler | last post by:

I have an IFrame whose document is created completely by Javascript code at runtime. The document in the IFrame accesses Javascript functions in the top level document. This works fine most of the time. But every now and then, when I hit the back button, the browser suddenly thinks the Javascript created document in the IFrame is not from the same domain as the topmost document, and therefore I start getting "permission denied" errors...

Javascript

1824

Javascript and Iframe load date with ASP

by: cevatkerim | last post by:

Ok simple project! a login page with a hidden iframe when u click on submit after inserting your user and pass it pushes those values to iframe and asp query the db and returns a code if it is ok then whe whole page redirect to a url if not an error code is showed on the page how do I do this? I am really confused?!?!

Javascript

3225

Prevent Javascript from being downloaded

by: Ryu | last post by:

Hi, May I know how to prevent Javascript from being dlownloaded when the user saves at "View Source"? I have added "js" at IIS's application configuration's mapping and i have added the following at web.config: But the javascript is still being downloaded. Please help <httpHandlers> <add verb="*" path="../ig_common.js" type="System.Web.HttpForbiddenHandler"/>

ASP.NET

9576

Javascript inside iFrame

by: Lupus | last post by:

Hi everyone, I've got a problem with javascript. I have a webpage which contains some javascript functions and an iFrame which contains a second webpage: <html> <head> .... <script....>

Javascript

16865

Converting javascript into iframe

by: gwong123 | last post by:

Hey, I need to convert this javascript code into iframe. The javascript goes into a server and brings out an ad banner. The X's is the server IP. <script language="javascript" type="text/javascript" src="http://XXX.XXX.XXX.XXX/blahblah/0000/blahblahblah.php"></script> What I need to do is convert that line of code into an iframe format so that it does the same job of going into the server and pulling out the banner. Right now if I just...

Javascript

7904

Changing the language in Windows 10

by: Hystou | last post by:

Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...

Windows Server

8398

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...

C / C++

8400

Maximizing Business Potential: The Nexus of Website Design and Digital Marketing

by: jinu1996 | last post by:

In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...

Online Marketing

6725

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...

Career Advice

5850

Access Europe - Using VBA to create a class based on a table - Wed 1 May

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...

Microsoft Access / VBA

5438

Couldn’t get equations in html when convert word .docx file to html file in C#.

by: conductexam | last post by:

I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...

C# / C Sharp

3898

Trying to create a lan-to-lan vpn between two differents networks

by: TSSRALBI | last post by:

Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...

Networking - Hardware / Configuration

3940

Windows Forms - .Net 8.0

by: adsilva | last post by:

A Windows Forms form does not have the event Unload, like VB6. What one acts like?

Visual Basic .NET

1250

Comprehensive Guide to Website Development in Toronto: Expert Insights from BSMN Consultancy

by: bsmnconsultancy | last post by:

In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

General