Hi webmasters,

I'm fighting with a script for about 2 weeks and don't any luck. So take this as a desparate action from my side. Basically I have a script, pure JS, that generates all the content with some php back-end, but that's not important atm.

I have an iframe, created with JS. The src of the IFrame is on a remote domain. I tried to access the frame (cos basically this is just a frame, but inline, right) using the frames['framename'], without luck, triggers error of undefined. DOM's getElementById() is not quite possible as there's no ID set by the Javascript which generates the iframe. getElementsByTagName on the other hand should work, but it does not; triggers undefined error too.

Basically, what I want to do is just to set the iframe's content's style. Is that possible? I figure CSS shouldn't work. But can I set the content's style using JS methods?

I have to use JS to maintain the already existent script's flow, remember that it's pure JS, no HTML at all. All written with JS and httprequests to server side scripts which sends back json.

It's quite hard for me to explain, please, let me know if you don't understand and will create an example somewhere.

Thank you in advance

Pancho

If the content of iframe is as you say on another domain you can't.
Because the cross-site scripting protection in browsers will stop you.

Hmm,

That could be the reason why i can't access the style on DOM level. Logical, though i wasn't aware of it... Thank you for the enlightment, appreciated.

But... Firebug, I can change the style of the iframe's content with it, without issues. True, that if I try to modify the iframe DOM's any aspect i get a permission denied. But how does FireBug change the style of the iframe then? I mean the iframe content's style.

Maybe I should brake FireBug in pieces to see how does it do it?
Please, don't tell me I have to.

Firebug is not simple javascript.
It has elevated privileges that javascript does not have.

And firebug is local to your browser. We can assume fairly surely that you will not try to hijack yourself with an xss request, or just to test it.
A site injecting a xss javascript into another is something else.

Hmm. Thank you.
So firebug just resets what the browser already rendered if i understand correctly.
It's hard for me to admit, but I started to feel that Im a dead man walking with this script.

lookie here.

fr1 = document.createElement("IFRAME"); 
fr1.setAttribute("src", "http://example.com/"); 
 fr1.setAttribute("name", "collector"); 
fr1.style.width = 170+"px";
fr1.style.height = 600+"px";
document.body.appendChild(fr1);

That's the code which creates the inline frame. example.com is a remote domain, its content is irrelevant now, but accent on remote.
Later in the script, a button onclick event should modify the above created element style by setting some content's display to none.
There's only one frame, that's why frames[0] and not its name

window.frames[0].document.getElementById('top_box').style.display="none"; 

Is this XSS? if it is, why is that so dangerous that it has been restricted? Or the access to the whole remote dom has been restricted?

I have the feeling I can get a new job

Yes it is.
Basically, you are (trying to) injecting javascript at the url loaded in the iframe.
Browser prevent that, for preventing a malicious user to inject code that would , for example, send an ajax query when you login on ebay.

Imagine how easy it would be with a phishing attack first to display the target site with a lookalike url, but in an iframe, and to get the login credentials...

Because what you are trying to do is specifically what other site owner's don't want you to do: control which elements of their site display and which do not.

For example, content that is displayed next to an ad. What you want to do is have the ability to remove the ad. That's a big no way, thank god browsers don't allow this.

Of course, you COULD retrieve the content via scraping and redisplay it as part of your own site, and then do whatever you want with it. But (1) scraping sites is considered by many people to be unethical and (2) in the long run it's not worth it anyway, as all you get with it is duplicate content so you will never be able to get as far with it in terms of traffic, revenue, etc as you could with quality, unique content.