Over-riding alert() with iframe src

Question

Here's a sample code:

HTML

<script> alert('This is alert!') </script>

JS

window.alert = function(data)  //alert() over-riding
{
     console.log("Alert over-ridden");
}

Issue:

HTML

<iframe src=javascript:alert('Iframealert')>

JS

window.alert = function(data)  //alert() over-riding
{
   console.log("Alert over-ridden"); //This doesn't execute - I mean, this over-ride function is not called when the above iframe alert is executed
}

I knew iframe in another document is not applicable for parent over-riding (due to same domain policy), but, the src JS execution happens only in the parent.

So, how do I over-ride alert() which is applicable to above iframe tag?

Update 1:

The HTML code is static, and I cannot make any modifications to it. I can only write some JS and append to the HTML.

Is there any way to over-ride the alert() of nested browsing window?

Answer 1

Nice question! The answer starts by looking at the rules for what happens when the src attribute is evaluated.

When this happens, the spec follows a number of steps during navigation. We end up step 14, which pertains to javascript: schemes.

Within that step, there are a series of sub-steps, one of which is:

Create a script, using script source as the script source, address as the script source URL, JavaScript as the scripting language, and the script settings object of the Window object of the active document of the browsing context being navigated.

The important thing here is "the Window object of the active document of the browsing context being navigated". Because you're navigating an <iframe>, you're actually dealing with a Nested Browsing Context, which has it's own window, so having overridden the parent window.alert makes no difference.

You can, however, override the alert of the inner window:

document.getElementById('myIframe').contentWindow.alert = function(msg) {
    console.log('Overridden iframe: ' + msg);
}

This will only work for the javascript: scheme url presented to the src attribute, as at the time this code executes we were simply trying to get the address of the page to navigate the <iframe> to. When navigation actually occurs, a new Document object with it's own window is created in step 23 of the navigation steps, at which point you lose your overridden alert.

This also relies on setting the src attribute using JavaScript after you've overridden the alert, you can't use an inline src attribute on the element as the element needs to be in the page to get hold of it and it's contentWindow, and putting it in the page means the src will get evaluated.

Here's a fiddle demonstrating the overriding of the alert within the <iframe>'s src attribute.