Skip to main content
replaced http://meta.stackexchange.com/ with https://meta.stackexchange.com/
Source Link

Hmm, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like Chrome thinks that the utility iframe should be sandboxed from its parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates.

Hmm, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like Chrome thinks that the utility iframe should be sandboxed from its parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates.

Hmm, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like Chrome thinks that the utility iframe should be sandboxed from its parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates.

edited body
Source Link
Jeffrey Bosboom
  • 13.7k
  • 5
  • 34
  • 51

HmnHmm, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like chromeChrome thinks that the utility iframe should be sandboxed from it'sits parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates.

Hmn, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like chrome thinks that the utility iframe should be sandboxed from it's parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates

Hmm, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like Chrome thinks that the utility iframe should be sandboxed from its parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates.

added 2 characters in body
Source Link
m0sa Mod
  • 10.9k
  • 2
  • 30
  • 35

Hmn, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like chrome thinks that the utility iframe should be sandboxed from it's parent iframe.

RelevateRelevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-originallow-same-origin on the exampleour iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates

Hmn, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like chrome thinks that the utility iframe should be sandboxed from it's parent iframe.

Relevate w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on the example would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates

Hmn, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like chrome thinks that the utility iframe should be sandboxed from it's parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates

added 241 characters in body
Source Link
m0sa Mod
  • 10.9k
  • 2
  • 30
  • 35
Loading
added 84 characters in body
Source Link
m0sa Mod
  • 10.9k
  • 2
  • 30
  • 35
Loading
Source Link
m0sa Mod
  • 10.9k
  • 2
  • 30
  • 35
Loading