Dynamic IFRAME creation

redbaks

Hi! I am trying to implement adding widgets to our template editor
(for blogs). I am worried that i might open a window for XSS attacks
so i decided to enveloped all widgets inside an iframe.

whenever a user wants to insert an external widget to his blog, a
script takes over and it will create a dynamic iframe and then the
widget script will be inserted inside the iframe.

i created a dynamic iframe using this code (I simplified it..)

<script>
<!--
function addWidget(code) {
var IFR =document.createElement('iframe');
IFR.name = IFR.id = "iframe-" + new Date().getTime();
IFR.src = "javascript: '<html><head></head><body>" +code + "</body></
html>'";
document.body.appendChild(IFR);
}
</script>

it works fine on most of the widgets, but i am getting problems adding
Google Gadgets.
My questions are:
1. Are there any other way to create a dynamic and passing a dynamic
content on the fly?
2. Is this safe enough or i am a little paranoid on doing this extra
work framing every widgets?
Thanks guys!

Apr 3 '07 #1

Subscribe Post Reply

6864

redbaks

On Apr 3, 3:23 pm, "redbaks" <redb...@gmail.comwrote:

Hi! I am trying to implement adding widgets to our template editor
(for blogs). I am worried that i might open a window for XSS attacks
so i decided to enveloped all widgets inside an iframe.

whenever a user wants to insert an external widget to his blog, a
script takes over and it will create a dynamic iframe and then the
widget script will be inserted inside the iframe.

i created a dynamic iframe using this code (I simplified it..)

<script>
<!--
function addWidget(code) {
var IFR =document.createElement('iframe');
IFR.name = IFR.id = "iframe-" + new Date().getTime();
IFR.src = "javascript: '<html><head></head><body>" +code + "</body></
html>'";
document.body.appendChild(IFR);}

</script>

it works fine on most of the widgets, but i am getting problems adding
Google Gadgets.
My questions are:
1. Are there any other way to create a dynamic and passing a dynamic
content on the fly?
2. Is this safe enough or i am a little paranoid on doing this extra
work framing every widgets?

Thanks guys!

anything guys?

Apr 10 '07 #2

by: Csaba2000 | last post by:

I want to be able to embed a single quote into an INPUT element within a dynamically generated IFRAME. The example below shows how the IFRAME is generated. Challenge: I'd like the alert box to...

Javascript

Dynamic image creation for the web...

by: Tompa | last post by:

Hi, I would like to create images on the fly as a response to an http request. I can do this with PIL like this (file create_gif.py): from PIL import Image, ImageDraw print 'Status: 200 OK'...

Python

Problem with generics and dynamic class creation

by: andrew queisser | last post by:

I've been trying to dynamically create a class DevT that's derived from a generic base GenBase<T>. It doesn't seem to work. I'm attaching a code sample below that illustrates the problem. ...

C# / C Sharp

How to: Dynamic Control Creation: ASP.NET / C#

by: charliewest | last post by:

I need to create textboxes in real-time, the actual number of which is determine by a result from a database query. I have been able to create the controls, and then add them to the ASPX page....

C# / C Sharp

document.close() on dynamic iframe on firefox does not close the connection.

by: hyejin | last post by:

I have a problem with dynamic iframe and document.close() on Firefox. Below two files create a dynamic iframe by JavaScript. These two samples do not have any problems on IE. But, on Firefox, the...

Javascript

dynamic iframe content in Firefox problem

by: mike888 | last post by:

I want to create dynamic iframe content like below but in Firefox <iframe width="100%" height="100" src="#"></iframe> <script language="JavaScript"><!-- document.frames.document.open();...

Javascript

Dynamic IFrame Creation Caching Problem

by: polymorphic | last post by:

I have succeeded in embedding PDF files in a dynamic iframe. The problem is that I need the PDF to cache. If the PDF remains the same from page load to page load then the pdf is somehow cached with...

Javascript

Dynamic Iframe (inside ModalPopUpControl ) Memory Leak In Internet Explorer

by: cdmsenthil | last post by:

I have an Infragistics UltrawebGrid . Each Row in the grid is attached to a context menu using Infragistics CSOM Upon click on the menu, I am creating an Iframe dynamically which points to...

Javascript

How to turn on java script in a villaon keypad mobile phone

by: Charles Arthur | last post by:

How do i turn on java script on a villaon, callus and itel keypad mobile phone

Java

Looking to do Android software development, any suggestions? Is flutter better?

by: nemocccc | last post by:

hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?

General

How to build RAID in BIOS?

by: Hystou | last post by:

There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...

Computer Hardware

Changing the language in Windows 10

by: Hystou | last post by:

Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...

Windows Server

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...

C / C++

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...

Windows Server

Discussion: How does Zigbee compare with other wireless protocols in smart home applications?

by: tracyyun | last post by:

Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...

General

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...

Career Advice

Access Europe - Using VBA to create a class based on a table - Wed 1 May

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...

Microsoft Access / VBA

Dynamic IFRAME creation

Similar topics