Could you help me understand that the implementation of the Chrome HTML5 attributes of the iframe sandbox allows single-user and enable navigation?
First question:
For example, when I check allow-same-origin, I do:
<iframe id='frm' src="file.html" sandbox="allow-same-origin"></iframe>
...
oIFrame = document.getElementById('frm');
var oDoc = (oIFrame.contentWindow || oIFrame.contentDocument);
if (oDoc.document) {
oDoc = oDoc.document;
oDoc.getElementById('foo').innerText = 'Hello man!';
...
The contents of file.html:
...
<div id="foo">Hello</div>
...
alert(document.cookie);
...
and this only works when I have an additional attribute called allow-scripts, so I have a sandbox = "allow-scripts allow-same-origin". Alone allow-same-origin does not work, and individual scripts allow you to work fine (scripts are executed, but not related to the SOP API, its relation to the HTML5 standard).
The HTML5 standard says:
"-, , , DOM ."
, Chrome ?
:
HTML5 :
"-, , .., , API .."
Chrome . ? .
Cheers,