JQuery on MTurk, why is the Chrome report "Unsafe JavaScript trying to access a frame with a URL"?

Question

I am doing a couple of things with jQuery in MTURK HIT, and I assume one of them is the culprit. I do not need to access the surrounding document from the iframe, so if I, I would like to know where this is happening and how to stop it!

Otherwise, MTurk may be doing something wrong (they use the 5-character & token to separate the URLs in the iframe URL, for example so that they DEFINITELY do the wrong thing).

Here are the fragments that may cause the problem. All this comes from an iframe embedded in MTUKHIT ** pages (and related):

• I embed my JS in $(window).load() . As I understand it, I need to use this instead of $(document).ready() , because the latter will not wait for my iframe to load. Please correct me if I am wrong.

• I also run RegExp.exec on window.location.href to retrieve the workerId.

I apologize in advance if this is a duplicate. In fact, after writing this, it looks like SO has a good guess: Debugging "An unsafe javascript attempt to access a frame with a URL ..." . I will answer this question if I find out before you do this.

It would be great to get a good high-level link on where to find out about it. This naturally does not apply to any topic that I know - maybe find out about cross-site scripts so that I can avoid it?

** If you do not know, MTURK HIT is a unit of work for people performing tasks on MTURK. You can see that they look pretty fast if you go to http://mturk.com and browse through the HIT.

I have drawn the code for the following chunk in jquery from the inject.js file:

try { isHiddenIFrame = !isTopWindow && window.frameElement && window.frameElement.style.display === "none"; } catch(e) {}

Answer 1

I had a similar problem running jQuery in MechanicalTurk via Chrome. The solution for me was to upload the jQuery JS files that I wanted, and then upload them to the amazon S3 secure service.
Then in my HIT, I called .js files in their new home at https://s3.amazonaws.com .

Tips on making code “safe” by chrome standards are here: http://developer.chrome.com/extensions/contentSecurityPolicy.html

Answer 2

This is not a direct answer to your question, but our laboratory successfully circumvented this problem by asking workers to click on the button inside the iframe, which opens a separate pop-up window. In the popup, you can use jQuery and any other standard JS resources you want without triggering any AMT security alarms. This method has the added benefit of letting employees view your task in a full-sized browser window instead of tiny built-in AMT frames.