6

I got this odd error in my Stack Snippet today:

Uncaught SecurityError: Sandbox access violation: Blocked a frame at "http://stacksnippets.net" from accessing a frame at "null". Both frames are sandboxed and lack the "allow-same-origin" flag.

It happens when trying to run the snippet in this post of mine. I removed the snippet and replaced it with plain code + JSFiddle link, but what's up with that? Another answer to the question includes a working snippet. Maybe it's jQuery 1.11.1 vs 2.1.1?

I've included the snippet below for testing.

I'm using Chrome 48.0.2564.116 on Ubuntu.

        $("#click").click(
            function fadeIn() {
                $("p:hidden").first().fadeIn("slow", fadeIn);

            }
        );
p {display: none}
<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.js"></script>
<button id="click">click</button>
<p>paragraph 1</p>
<p>paragraph 2</p>
<p>paragraph 3</p>
<p>paragraph 4</p>
<p>paragraph 5</p>

1
  • It seems to be something jQuery does that causes this warning.
    – SeinopSys
    Commented Feb 20, 2016 at 23:07

1 Answer 1

3

Hmm, the iframe in which we execute users scripts is sandboxed. What jQuery does is, it creates another utility iframe inside our sandboxed iframe, which it uses to determine the value of an elements display property. The exception is thrown when jQuery tries to access contents of the inner iframe.

boom

So it looks like Chrome thinks that the utility iframe should be sandboxed from its parent iframe.

Relevant w3c example: https://w3c.github.io/html/semantics.html#example-6dd42711

Setting allow-same-origin on our iframe would fix this, but discussing it internally, since it's - How is my browser protected from XSS in Stack Snippets?

Stay tuned for updates.

1
  • For how long should we stay tuned?
    – MrUpsidown
    Commented Nov 11, 2022 at 11:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .