Community
Participate
Working Groups
Build Identifier: When a BrowserFunction is installed on a page, it is also made available to remote content loaded in Frames and iFrames. From looking at the code this behavior was intended. This behavior is differs between platforms. For IE and Safari browsers, iFrames do not have access to the installed BrowserFunction but they do have access to the "window.external.callJava" function. For Mozilla browsers, iFrames have access to the installed BrowserFunctions and the "window.external.callJava" function. We have use cases where we need to restrict access to the installed BrowserFunction and "window.external.callJava". We think there are two things that need to be done. 1) Enhancement to the BrowserFunction/Browser API to allow scoping the installed BrowserFunctions to specific window/frame/iframes. 2) Secure access to the "window.external.callJava" function. Reproducible: Always Steps to Reproduce: Steps to reproduce 1. Start with the Browser widget snippet 2. Change the HTML to include an iFrame with remote content 3. Add script to the remote content that attempts to access the installed BrowserFunction Bug: If the browser is SWT.MOZILLA the remote script will successfully access the installed BrowserFunction
(In reply to comment #0) > > This behavior is differs between platforms. For IE and Safari browsers, > iFrames do not have access to the installed BrowserFunction but they do have > access to the "window.external.callJava" function. For Mozilla browsers, > iFrames have access to the installed BrowserFunctions and the > "window.external.callJava" function. > Since Mozilla browsers 1.9.2, frames/iframes have access to the installed BrowserFunctions, however frames/iframes with remote content does not have access to the BrowserFunction.
I've logged bug 343979 to deal specifically with the issue of prohibiting arbitrary JS from accessing registered BrowserFunctions directly via window.external.callJava. I've split this part out into a separate bug because it will be investigated for the 3.7 release, while the aspect of limiting a BrowserFunction's availability to specific frames/iframes will not.
Fixed > 20120309 with new constructor BrowserFunction(browser, name, top, frameNames). Patch: http://git.eclipse.org/c/platform/eclipse.platform.swt.git/commit/?id=65025a7edc821ab692899a998f097ee59dcca651 .
