#771 - blacklisted javascrip: and about: schemas. Added test file wit…

…h Iframes that contain srv javascrip:void(0) and about:blank.
davidjbradshaw · Nov 18, 2019 · b247b67 · b247b67
1 parent 03d1780
commit b247b67
Show file tree

Hide file tree

Showing 6 changed files with 81 additions and 6 deletions.
diff --git a/js/iframeResizer.contentWindow.min.js b/js/iframeResizer.contentWindow.min.js
diff --git a/js/iframeResizer.js b/js/iframeResizer.js
@@ -1092,7 +1092,7 @@
     }
 
     function getTargetOrigin(remoteHost) {
-      return '' === remoteHost || 'file://' === remoteHost ? '*' : remoteHost
+      return '' === remoteHost || null !== remoteHost.match(/^(about:blank|javascript:|file:\/\/)/) ? '*' : remoteHost
     }
 
     function depricate(key) {

diff --git a/js/iframeResizer.map b/js/iframeResizer.map
diff --git a/js/iframeResizer.min.js b/js/iframeResizer.min.js
diff --git a/src/iframeResizer.js b/src/iframeResizer.js
@@ -1092,7 +1092,7 @@
     }
 
     function getTargetOrigin(remoteHost) {
-      return '' === remoteHost || 'file://' === remoteHost ? '*' : remoteHost
+      return '' === remoteHost || null !== remoteHost.match(/^(about:blank|javascript:|file:\/\/)/) ? '*' : remoteHost
     }
 
     function depricate(key) {

diff --git a/test/noMessageForBlackListedOrigins.html b/test/noMessageForBlackListedOrigins.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <title>QUnit LoadHide</title>
+    <link rel="stylesheet" href="resources/qunit.css" />
+  </head>
+
+  <body>
+    <div id="qunit"></div>
+    <div id="qunit-fixture">
+      <div style="width:600px;">
+        <iframe
+          src="resources/frame.content.html"
+          width="100%"
+          scrolling="no"
+        ></iframe>
+      </div>
+      <iframe
+        src="about:blank"
+        width="100%"
+        scrolling="no"
+      ></iframe>
+      <iframe
+        src="javascript:void(0)"
+        width="100%"
+        scrolling="no"
+      ></iframe>
+    </div>
+    <script src="resources/qunit.js"></script>
+    <script src="resources/jquery.js"></script>
+    <script src="resources/testLib.js"></script>
+    <script src="../js/ie8.polyfils.min.js"></script>
+    <script src="../js/iframeResizer.js"></script>
+    <script>
+      'use strict'
+      var count = 0,
+        msgId = '[iFrameSizerTest]:'
+
+      asyncTest('sendMessage (string)', function() {
+        iFrameResize({
+          //log:true,
+          onResized: function(messageData) {
+            ok(true, 'Receive init message back from iFrame.')
+            sendMessage('chkSendMsg')
+          },
+          onMessage: function(messageData) {
+            ok(
+              'message: test string' === messageData.message,
+              'Receive string message back from iFrame via sendMessage function.'
+            )
+            start()
+          }
+        })
+      })
+
+      asyncTest('sendMessage (object)', function() {
+        iFrameResize({
+          //log:true,
+          onResized: function(messageData) {
+            ok(true, 'Receive init message back from iFrame.')
+            sendMessage('chkSendObj')
+          },
+          onMessage: function(messageData) {
+            ok(
+              'test object' === messageData.message.message,
+              'Receive object message back from iFrame via sendMessage function.'
+            )
+            start()
+          }
+        })
+      })
+    </script>
+  </body>
+</html>