Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Why do I get "permission denied" in Microsoft Edge when accessing parent iframe

I have some problems calling a function of a specific iframe after reloading another iframe. It works on all major browser but behaves a little weird on Microsoft Edge. You will need the following constellation to get the error. All files are in the same directory on the same server. I haven't set any Content Security Policy.

If you load the Frame1.html everything will be fine and you will get the "alert" message.

But if you click the "Click me" a-tag on the frame4.html, the frame2.html will be reloaded and you will get the "permission denied" error because the parent object (var tmpParent = parent;) is not accessible. If you click the a-tag again it will work without any error.

I think it is a Edge bug, because all other browser can handle it and it only occur on the first click.

The error will also occur if you use top insted of parent.

The code of topFrame.js is used to find the top-most Frame of my site. I cannot simply use top because it should be possible to embed my site.

Does anybody have a clue?

Thanks a lot!

Frame1.html

<!DOCTYPE html>
<html>

<head>
  <title>Frame 1</title>
  <script type="text/javascript">
    var topFrame = this;

    function myAlert() {
      alert('alert');
    }
  </script>
</head>

<body>
  <iframe id="overallContentWrapper" name="mainFrame" src="frame2.html" frameborder="0"></iframe>
</body>

</html>

Frame2.html

<!DOCTYPE html>
<html>

<head>
  <title>Frame 2</title>
  <script src="topFrame.js" type="text/javascript"></script>
  <script type="text/javascript">
    window.addEventListener("load", function load(event) {
      window.removeEventListener("load", load, false);

      try {
        topFrame.myAlert();
      } catch (e) {
        alert(e);
      }
    }, false);
  </script>
</head>

<body>
  <iframe name="subFrame" src="frame3.html" frameborder="0"></iframe>
</body>

</html>

Frame3.html

<!DOCTYPE html>
<html>

<head>
  <title>Frame 3</title>
</head>

<body>
  <iframe name="subsubFrame" src="frame4.html" frameborder="0"></iframe>
</body>

</html>

Frame4.html

<!DOCTYPE html>
<html>

<head>
  <title>Frame 4</title>
</head>

<body>
  <a href="frame2.html" target="mainFrame">Click me</a>
</body>

</html>

topFrame.js

try {
  var tmpParent = parent;
  var topFrame = tmpParent.topFrame;
  while (topFrame === undefined) {
    tmpParent = tmpParent.parent;
    topFrame = tmpParent.topFrame;
  }
} catch (e) {
  alert(e);
}
like image 504
gollum1007 Avatar asked Dec 03 '15 13:12

gollum1007


People also ask

How do I enable iframe in Microsoft edge?

Open Microsoft Edge. Type the following in the address bar: edge://flags/#enable-lazy-frame-loading . Select Enabled from the drop-down menu next to the Lazy Frame Loading line. Click on the restart button.


1 Answers

Well i know im putting my neck on the line here trying to guess what IE is trying to tell you but i would assume that using this type of communications is going against what iframes are intended to do.

If you wish to communicate between child frames to parnet frames i suggest using postMessages instead. I think(I did say think) your script is getting blocked against XSS - cross site scripting. So if you wish to communicate some information between parent frame and child frames or the other way around i suggest having a look at postMessges.

like image 129
Samuel Bergström Avatar answered Sep 19 '22 12:09

Samuel Bergström