How to check if script has access to properties in another frame/window ?

[adnanx82]

Hi,

Under the same-origin policy, if a script tries to access properties in
another frame or window that is from another host/protocol/etc, it will
not be allowed by the browser and a permission denied error is given.

I was wondering if anyone knew of a way to check if a particular
frame's or window's properties were accessible before attempting to
access them, to prevent getting the error.

Thanks,

-Adnan.

[Thomas 'PointedEars' Lahn]

ad******@gmail.com wrote:

[Same Origin Policy]
I was wondering if anyone knew of a way to check if a particular
frame's or window's properties were accessible before attempting to
access them, to prevent getting the error.

That would include checking whether the second-level domain is the same
or not. You could try accessing the `location' property the respective
Window object; that property not subject to the SOP:

<http://devedge-temp.mozilla.org/library/manuals/2000/javascript/1.3/guide/sec.html#1015705>

You could also try exception handling, i.e. access the property and handle
the exception that is thrown if that fails; this will, of course, only
apply to and work in more recent user agents.
PointedEars

[adnanx82]

Thanks for your reply. I couldn't find any property of location object
that is not subject to SOP. According to the link you sent, properties
'x' and 'y' of location object are not subject to SOP; however, I could
not find any such properties in the location object. Do you know what
the 'x' and 'y' refer to?

Thanks,

-Adnan.

[Thomas 'PointedEars' Lahn]

ad******@gmail.com wrote:

Thanks for your reply. I couldn't find any property of location object
that is not subject to SOP.
Yes, but the `location' property value itself is not subject to the SOP,
i.e. access to `foo.location.href' is forbidden but access to `foo.location'
is not.
According to the link you sent, properties 'x' and 'y' of location object
are not subject to SOP; however, I could not find any such properties in
the location object. Do you know what the 'x' and 'y' refer to?

Probably the submit coordinates when input[type="image"] is used.
PointedEars
--
What one man can invent another can discover.
-- Sherlock Holmes in Sir A.C. Doyle's
"The Adventure of the Dancing Men"