iFrame, getSelection(), and unauthorized access

[Brent]

I'm trying to figure out a way to have JavaScript use getSelection()
with text located in an iFrame. I've been able to make it work, but only
when the iFrame displays a page located on the parent page's domain.
When the iFrame displays pages on other domains, I get an error --
something about unauthorized access. I'm guessing the error stems from
concerns about scripting attacks.

Is there any workaround? I was thinking about copying the selection to
the clipboard, and then pasting it into the desired location, but that
seems a bit clunky, and I don't know if it'll work in any case.

Thanks for any help.

--Brent

[Peter Michaux]

Hi Brent,

On Apr 21, 10:39 am, Brent <""b b i g l e r \"@ y a h o o . c o m">
wrote:

I'm trying to figure out a way to have JavaScript use getSelection()
with text located in an iFrame. I've been able to make it work, but only
when the iFrame displays a page located on the parent page's domain.
When the iFrame displays pages on other domains, I get an error --
something about unauthorized access. I'm guessing the error stems from
concerns about scripting attacks.

Yes it is a security restriction.

Is there any workaround?

I don't think so.

I was thinking about copying the selection to
the clipboard, and then pasting it into the desired location, but that
seems a bit clunky, and I don't know if it'll work in any case.

Copying to the clipboard works in IE through JavaScript or with a
browser running Flash (which can be controlled by JavaScript.)

Peter

[Randy Webb]

Peter Michaux said the following on 4/21/2007 1:58 PM:

Hi Brent,

On Apr 21, 10:39 am, Brent <""b b i g l e r \"@ y a h o o . c o m">
wrote:

>I'm trying to figure out a way to have JavaScript use getSelection()
with text located in an iFrame. I've been able to make it work, but only
when the iFrame displays a page located on the parent page's domain.
When the iFrame displays pages on other domains, I get an error --
something about unauthorized access. I'm guessing the error stems from
concerns about scripting attacks.

Yes it is a security restriction.

With a very simple example to show the flaw :-) Suppose I put your bank
page in a 100% IFrame. Would you want my page to be able to read the
information from your Bank site? :-)

>Is there any workaround?

I don't think so.

There isn't.

>I was thinking about copying the selection to
the clipboard, and then pasting it into the desired location, but that
seems a bit clunky, and I don't know if it'll work in any case.

Copying to the clipboard works in IE through JavaScript or with a
browser running Flash (which can be controlled by JavaScript.)

That won't work either for the same reason. You can't read it from the
parent and you can't paste to the child from the parent. Same Security
issue.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javascript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[-Lost]

"Randy Webb" <Hi************@aol.comwrote in message
news:sa********************@giganews.com...

Peter Michaux said the following on 4/21/2007 1:58 PM:

>Hi Brent,

On Apr 21, 10:39 am, Brent <""b b i g l e r \"@ y a h o o . c o m">
wrote:

>>I'm trying to figure out a way to have JavaScript use getSelection()
with text located in an iFrame. I've been able to make it work, but only
when the iFrame displays a page located on the parent page's domain.
When the iFrame displays pages on other domains, I get an error --
something about unauthorized access. I'm guessing the error stems from
concerns about scripting attacks.

Yes it is a security restriction.

With a very simple example to show the flaw :-) Suppose I put your bank page in a 100%
IFrame. Would you want my page to be able to read the information from your Bank site?
:-)

>>Is there any workaround?

I don't think so.

There isn't.

>>I was thinking about copying the selection to
the clipboard, and then pasting it into the desired location, but that
seems a bit clunky, and I don't know if it'll work in any case.

Copying to the clipboard works in IE through JavaScript or with a
browser running Flash (which can be controlled by JavaScript.)

That won't work either for the same reason. You can't read it from the parent and you
can't paste to the child from the parent. Same Security issue.

I cannot help but think that "dynodes" could assist in this matter. Or modified to
assist.

No... yes... ?

-Lost

[Peter Michaux]

On Apr 21, 10:34 pm, "-Lost" <[e-mail]:

"Randy Webb" <[e-mail] in message

Copying to the clipboard works in IE through JavaScript or with a
browser running Flash (which can be controlled by JavaScript.)

That won't work either for the same reason. You can't read it from the parent and you
can't paste to the child from the parent. Same Security issue.

I didn't make it clear that I was just talking about copying to the
clipboard in general.

I cannot help but think that "dynodes" could assist in this matter. Or modified to
assist.

No... yes... ?

I doubt it but what are "dynodes"?

Peter

[Randy Webb]

Peter Michaux said the following on 4/22/2007 1:49 AM:

On Apr 21, 10:34 pm, "-Lost" <[e-mail]:

<snip>

>I cannot help but think that "dynodes" could assist in this matter. Or modified to
assist.

No... yes... ?

I doubt it but what are "dynodes"?

It is a crazy stupid name someone dreamed up to describe dynamic script
insertion. And no, it won't work for this situation.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javascript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/