6

Stack Snippets have many uses, and while I don't use them that often on Stack Overflow (I haven't been active for while, let alone in the tag), they also have their uses on other sites in the network. Specifically, I'm trying to make it easier to keep track of the bugs and feature requests on new feature announcements. For that, it would be nice if the snippet is aware of the answer or at least the Q&A page it's embedded in.

But when I run the simple code below, it returns

https://stacksnippets.net/js

which I'm sure is correct but not helping me at all.

console.log(location.href);

Hence my question: is it possible at all for a Stack Snippet to get information about the post it's running in? I'm aiming for a reusable script which doesn't require hardcoding post IDs.

13
  • 4
    Pretty sure it's not possible, given that there's no way for editors to change the iframe's markup (let alone run JS on the top window), and given the iframe's strong sandboxing (by design). Jul 19, 2022 at 19:25
  • For the sort of dynamic content that you want, the only decent approach I can think of is to write a script that runs on a server that uses the SE API to scrape posts and then edit a post with a summary. Pretty doable, but it'd require a decent amount of effort as well as a server. Jul 19, 2022 at 19:29
  • Thanks, I'm aiming for a reusable script. If it requires hardcoding the answer ID, so be it ...
    – Glorfindel
    Jul 19, 2022 at 19:31
  • 1
    You can directly supply the question ID link and scrape the answers.
    – TheMaster
    Jul 19, 2022 at 19:32
  • I mean admittedly this does seem like an abuse of the feature. It's not meant to be used to provide that kind of interopability, it's just meant to demo why someone's jQuery thing is busted.
    – Makoto
    Jul 19, 2022 at 19:34
  • @Makoto abuse ... well, blame the millions of developers who mindlessly copy/paste code from SO without trying to understand the code. That's a recipe for exploits without 'context-awareness' for Stack Snippets which (I hope you can see) has legitimate uses. Heck, if they could change that behaviour for MSE/MSO, I would settle for it.
    – Glorfindel
    Jul 19, 2022 at 19:43
  • I mean "abuse" is just "abnormal use", not meant to be taken as one having the intent to do something malicious here @Glorfindel. It's abnormal to use Stack Snippets in this fashion, that's all I'm remarking.
    – Makoto
    Jul 19, 2022 at 20:01
  • 1
    I don't think you can use a stack snippet alone but you can use a bookmarklet or a userscript that will just generate the boilerplate for a snippet and just add the post ID you want. That would leave you with mostly a stack snippet with tiny bit of JS to scaffold it. Which is probably the most transparent result. Or you can entirely do the task in a userscript and then format the result as a table for the bugs. Would be less transparent (for other users) but all the work will be in one place.
    – VLAZ
    Jul 19, 2022 at 20:01
  • 1
    @Makoto for me, it's the only use of Stack Snippets - I can run most languages, including JavaScript, in my head ...
    – Glorfindel
    Jul 19, 2022 at 20:09
  • 2
    I posted a related proposal as an answer a while ago (skip to the second half of the answer). Not sure if I should turn that into a standalone [feature-request] question?
    – 41686d6564
    Jul 19, 2022 at 22:36
  • 2
    Did a little digging, and the closest I got was console.log(window.location.ancestorOrigins[0]);, which will produce the domain of the site the snippet is posted on (e.g. https://meta.stackoverflow.com), but nothing more specific than that.
    – zcoop98
    Jul 19, 2022 at 22:40
  • 1
    @zcoop98 only on chrome stackoverflow.com/questions/26046030/…
    – TheMaster
    Jul 19, 2022 at 22:55
  • 1
    @zcoop98 you could get the same with document.referrer, in every browser. But that also returns only the origin in stack snippets, not the full path...
    – Kaiido
    Jul 20, 2022 at 5:16

1 Answer 1

8

...probably not?

Just re-reading the announcement leads me to suggest that they intentionally and explicitly wall this off from a sandboxing perspective.

Emphasis mine.

We isolate snippets from our sites to block access to your private Stack Exchange data:

  • We use HTML5 sandboxed iframes in order to prevent many forms of malicious attack.
  • We render the Snippets on an external domain (stacksnippets.net) in order to ensure that the same-origin policy is not in effect and to keep the snippets from accessing your logged-in session or cookies.

Even on stacksnippets.net, you get the blurb about what it shields from. Mostly, just evil things.

What is this domain for?

We use this domain to render user-provided code snippets. Some of our websites have enabled interactive code snippets which can be run by other users in order to see the output. This domain is used to host the results of running those snippets. We host the results on a different domain because we must prevent same-origin from being in effect. If same-origin was possible, users could write code that caused other users to do things that they didn't want to on their Stack Exchange account. What kinds of things? Evil things. Things like logging a user out, or updating their profile, or even possibly posting questions or answers! So, this domain stops bad people from doing bad things.

So this leads me to believe that - barring some kind of exploit that I'm sure the devs would love to chat with you about - a Stack Snippet would not have any way of knowing what post it originated from.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .