有没有办法限制父母在iframe中允许做什么？我正在寻找的是一个围绕Javascript的安全模型,它看起来像:
...
<script type="text/javascript" src="jquery-1.3.2.min.js"></script>
<script type="text/javascript">
function AllowedToAccess()
{
}
function NotAllowedToAccess()
{
}
</script>
<security>
iframe {
Deny All;
Allow javascript:AllowedToAccess();
}
iframe script.untrusted {
Deny All;
}
</security>
<iframe src="trusted.html"></iframe>
<iframe src="http://www.somesite.com/trusted.html"></iframe>
...
'trusted.html'看起来像:
<html><body>
<script type="text/javascript">
function InternalCall()
{
window.parent.AllowedToAccess();
}
function InternalCall2()
{
window.parent.NotAllowedToAccess();
}
</script>
<security>
javascript:window.parent {
Allow javascript:document.body.offsetHeight;
Allow javascript:document.title;
}
script.untrusted {
Deny All;
}
</security>
<script type="text/javascript">
window.parent.AllowedToAccess();
InternalCall();
</script>
<script type="text/javascript" src="http://www.anothersite.com/untrusted.js" secclass="untrusted"></script>
<script type="text/javascript">
window.parent.NotAllowedToAccess();
InternalCall2();
window.parent.jQuery(window.parent.body).append('<div id="badid"></div>'); …