New issue
Advanced search Search tips

Issue 594060 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Mar 2016
Cc:
rob@robwu.nl
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

window.frameElement is null in content script

Reported by klesto...@gmail.com, Mar 11 2016 
UserAgent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.87 Safari/537.36

Steps to reproduce the problem:
I don't know, whether this is bug or not. I tried to inject content script in all iframes and found that window.frameElement property is always null in all injected scripts. It is not null only when iframe is from the same domain as main page. I created small demo extension. It injects script in all iframes and prints information in console. You can test it on site with iframes, for example, google.com. It always prints 'frameElement null' whether content script is injected to main page or to iframe.

What is the expected behavior?
window.frameElement property should not be null for all content scripts in iframes. Script is already injected to iframe and has full control over it, why limit it?

What went wrong?
window.frameElement property is not null only for iframes from the same domain as main(top) page.

We can also add "permissions": ["<all_urls>"] to manifest.json. This will not help.

WebStore page: 

Did this work before? N/A 

Chrome version: 49.0.2623.87  Channel: stable
OS Version: 10.0
Flash Version:
frameElement tester.zip
542 bytes Download

Comment 1 by rob@robwu.nl, Mar 21 2016

Cc: rob@robwu.nl
Status: WontFix (was: Unconfirmed)
This is intentional.

An extension's content script is granted full access to the page. But that does not magically give access to the frame's parent.

You could use postMessage & onmessage if you want to communicate with the parent document. If the parent frame wants to identify the originator (frame), then it could loop through all frame elements in the document and check whether frame.contentWindow === event.source.

(another technical reason why this cannot be implemented is that synchronous cross-origin DOM access is not desirable or possible with out-of-process frames).
►

Sign in to add a comment