Chrome userscript error: “Unsafe JavaScript attempt to access frame”

by

It’s true that ordinary javascript cannot access iframe content, that’s on a different domain, for security reasons. However, this by no means stops userscripts in Chrome, Tampermonkey or Greasemonkey.

You can process iframed content in a userscript because Chrome (and Firefox) process iframe’d pages just as if they were the main page. Accounting for that, scripting such pages is a snap.

For example, suppose you have this page at domain_A.com:

<html>
<body>
    <iframe src="http://domain_B.com/SomePage.htm"></iframe>
</body>
</html>

If you set your @match directives like this:

// @match http://domain_A.com/*
// @match http://domain_B.com/*

Then your script will run twice — once on the main page and once on the iframe as though it were a standalone page.

So if your script was like this:

// ==UserScript==
// @name  _Test iFrame processing in Chrome and Tampermonkey
// @match http://domain_A.com/*
// @match http://domain_B.com/*
// ==/UserScript==

if (/domain_A\.com/i.test (document.location.href) ) {
    //Main page
    document.body.style.setProperty ("background", "lime", "important");
}
else {
    //iFrame
    document.body.style.setProperty ("background", "pink", "important");
}

You would see the main page in lime-green, and the iframed page in pink.

Alternatively, you can test like this:

if (window.top === window.self) {
    //--- Code to run when page is the main site...
}
else {
    //--- Code to run when page is in an iframe...
}

As you discovered (per comment on another answer), you can disable the same origin policy on Chrome. Don’t do this! You will leave yourself open to all kinds of shenanigans set up by bad people. In addition to evil sites, many nominally “good” sites — that allow users to post content — could potentially track, hack, or spoof you.

More Related Contents:

  1. Injecting JS functions into the page from a Greasemonkey script on Chrome
  2. Removing an anonymous event listener
  3. Detect iFrame embedding in Javascript
  4. Why is window (and unsafeWindow) not the same from a userscript as from a tag?
  5. Can a website know if I am running a userscript?
  6. Simulating a mousedown, click, mouseup sequence in Tampermonkey?
  7. Unsafe JavaScript attempt to access frame in Google Chrome
  8. How to change a class CSS with a Greasemonkey/Tampermonkey script?
  9. UserScripts & Greasemonkey: calling a website’s JavaScript functions
  10. Save images to hard disk WITHOUT prompt?
  11. How can I load a shared web worker with a user-script?
  12. ‘load’ event not firing when iframe is loaded in Chrome
  13. Is there a way to uniquely identify an iframe that the content script runs in for my Chrome extension?
  14. How can two instances of a userscript communicate between frames?
  15. Using iframe with local files in Chrome
  16. How to override the alert function with a userscript?
  17. How to use GM_xmlhttpRequest in Injected Code?
  18. iframe not reading cookies in Chrome
  19. Clicking a button on a page using a Greasemonkey/userscript in Chrome
  20. Can a website detect when you are using Selenium with chromedriver?
  21. How to launch html using Chrome at “–allow-file-access-from-files” mode?
  22. Uncaught SyntaxError: Unexpected token :
  23. How to disable JavaScript in Chrome Developer Tools?
  24. Does execCommand SaveAs work in Firefox?
  25. Chrome extension: How to remove orphaned script after chrom extension update
  26. Loading external javascript in google chrome extension
  27. Getting unique ClientID from chrome extension?
  28. Content-Security-Policy error in google chrome extension making
  29. In a Chrome Extension content script, must I wait for document.ready before processing the document?
  30. How to modify current url location in chrome via extensions

Leave a Comment