Preventing frame busting with access to page source_问答_开发者

Preventing frame busting with access to page source

开发者 https://www.devze.com 2023-01-31 07:08 出处：网络

So we are loading a page in an iframe. This child page is loaded from a cache on the same domain as the parent. However external assets are not cached locally, and are loaded from the external site -

So we are loading a page in an iframe. This child page is loaded from a cache on the same domain as the parent. However external assets are not cached locally, and are loaded from the external site - including javascript. In one site we have frame-busting code:

if (top.location != self.location) {

    top.location = self.location
}

Now I know that we could use the solution from coderr but I'm not sure what the implications / knock on issues are. Given that we have access to the cached child page, I am wondering whether there is anything we can add to the child in order to override any methods or values in order to render null the framebusting. E.g in the <head> of the child I tried adding this:

<script type="text/java开发者_如何学Goscript">
    top.location = self.location
</script>

and

self.location = top.location

with pretty horrific results (infinite nesting in the first example, total and complete browser meltdown in the second).

Are there any suggestions for code we could add to the child to nullify the framebusting?

Else, we'll have to cache the js and parse out / replace framebusting script.

Thanks

And please - this is legit!!

I came across a very interesting post by Jeff Atwood a while ago, where he talks about an "impossible" to counter anti-frame-busting technique:

http://www.codinghorror.com/blog/2009/06/we-done-been-framed.html

It doesn't even require privileged access to the child frame's code!

Simple Text replacement with Tampermonkey

document.body.innerHTML = document.body.innerHTML.replace(/original/g,"new");

If using the regex version (replace all occurrences in the document) then you need to escape especial characters like / and " with the \ symbol.

To replace only a single occurrence:

var find = "if (top.location!=location) { top.location.href = location.href; }";
replace = "";
document.body.innerHTML = document.body.innerHTML.replace(find,replace);

This will not work on pages that have the <script> at the very top, up by the head.

Make sure @run-at document.start is set.