18

Is there any way to run a bookmarklet on an iFrame which is from a different domain?

For example, I have a page loaded from http://example.com, which has an iFrame whose source is set to http://example2.com. When I run the bookmarklet, it is always run on http://example.com, since that is the main page. I want to run it on the other iFrame though.

When I attempt to interact with the iFrame (e.g. by changing its source attribute to javascript:alert('test')), Chrome shows the following error:

Unsafe JavaScript attempt to access frame with URL http://example.com from frame with URL http://example2.com. Domains, protocols and ports must match.

I tried dragging and dropping the bookmarklet into the frame, but it says:

Failed to load resource

Is there any way for me to interact with an iFrame using a bookmarklet in Chrome?

NakedBrunch
  • 48,713
  • 13
  • 73
  • 98
Senseful
  • 86,719
  • 67
  • 308
  • 465

3 Answers3

3

There is a way to do cross-domain message-passing (not arbitrary code execution) using window.postMessage, yet all a frame A can do to frame B (when they are not of the same origin) is passing it a message hoping that B has a callback function listening for this message.

So here if you control exemple2.com (what's in the frame that don't get the bookmarklet), you can make the bookmarklet pass a message to the iframe and handle it in the iframe.

Else I don't think you have a solution here, except very complicated ones (like proxying).

Other links:

instanceof me
  • 38,520
  • 3
  • 31
  • 40
  • +1 for the article about same origin policy and its implementations in browsers, which is very complete – Shawn May 19 '12 at 21:22
  • If you don't control example2.com, you could still think of injecting code into the loaded pages with a browser extension. You could then register a handler for `"message"` events and then run arbitrary code. Of course, this is browser dependent. – Jean-Philippe Pellet Jan 31 '14 at 17:02
2

iFrames have alot of security on them as do ajax calls.

Any attempt to use these in a cross-domain manner will result in a security error.

Imagine you were able to interact with other iFrames on different domains. You would be able to make an iFrame (like facebook login's page) that had width and height of 100% and add a function to execute on a submit event which would email you the username and pass before submitting.

So you're gonna have a lot of trouble accomplishing what you're trying to do. You basically can't mess with a page that you don't own. You can use firebug to edit it with the html tab though.

Hope that helps

qwertymk
  • 34,200
  • 28
  • 121
  • 184
  • 12
    Well, you can run bookmarklets on pages that you don't own. The problem is that it's running the bookmarklet on the main page which hosts the iFrame, and I want to do the opposite. – Senseful Dec 19 '10 at 08:15
  • 3
    `javascript: (function(user) { var $voteUp = $('.user-details:contains(' + user + ')').parents('.answer').find('[class^=vote-up]'); window.scrollTo(0, $voteUp.offset().top - 50); (function blink() { $voteUp.fadeOut('fast', function() { $(this).fadeIn('fast', blink) }) })() })('qwertymk')` – qwertymk Aug 19 '11 at 00:37
  • 3
    @Senseful I believe bookmarklets are allowed since the user must actually click on them to launch the script. In contrast, in qwertymk's example of using a "fullscreen" iframe to rob credentials, the page the user is visiting (and which contains the iframe) executes the code, not the user, hence the security issue, hence the browser security feature which prevents this from being possible. – Shawn May 19 '12 at 21:21
1

One option if you are not in control of the page or the iframe is to load the iframe into a new window. The src attribute of the iframe is available to read by the parent JS, which can then open a new tab or window. The user can then click on the bookmarklet a second time to load it into this new page.

Iiridayn
  • 1,747
  • 21
  • 43