Inject javascript through URL

Question

I have an html that opens a webpage such as: https://mywebsite.com/index.html&audio=disabled

I have a javascript function that triggers a button in the webpage:

document.querySelector('iframe').contentWindow.document.querySelector('.Pan-Button').click();

I want to trigger this via URL. Since I am anyway disabling the audio via the URL, is it possible to trigger the button as well? Just looking for an alternate way to trigger it without calling javascript function in code.

score 0 · Answer 1 · answered Sep 09 '22 at 09:47

Adding script to a URL that is executed in the other page is called Cross site scripting (XSS)) and is bad

Instead (I assume from your code you can edit the target page)

const url = new URL(document.location);
const pan = url.searchParams.get("pan");
window.addEventListener("DOMContentLoaded", () => {
  if (pan && pan==="yes") {
    document.querySelector('iframe').contentWindow.document.querySelector('.Pan-Button').click();
  }
});

and use https://mywebsite.com/index.html?audio=disabled&pan=yes

Inject javascript through URL

1 Answers1