Home/ Questions/Q 6161001
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-23T21:24:42+00:00

I want to bubble some information from a frame to its parent object (information

  • 0

I want to bubble some information from a frame to its parent object (information that isn’t accessible due to XSS).

Can I compare the source window sent via postMessage to the values of window.frames?

MDN (in the link above) says that the message can be used to postMessage back but doesn’t refer to testing for equality.

This works correctly on IE9 FF5 and Chrome12 but I want to know if this is dependable (i.e. is it in the standard).

Test code:

postMessageOuter.html

<!DOCTYPE html>
<html>
<head>
    <title>Outer Page</title>
    <script type="text/javascript">
        window.addEventListener("message", function (event) {
            for (var i = 0; i < frames.length; ++i)
                if (event.source == frames[i])
                    alert(i);
        }, false);
    </script>
</head>
<body>
<iframe src="postMessageInner.html"></iframe>
<iframe src="postMessageInner.html"></iframe>
<iframe src="postMessageInner.html"></iframe>
</body>
</html>

postMessageInner.html

<!DOCTYPE html>
<html>
<head>
    <title>Inner Page</title>
    <script type="text/javascript">
        function foo() {
            window.parent.postMessage("Hello", "*");
        }
    </script>
</head>
<body>
<input type="button" value="X" onclick="foo()" />    
</body>
</html>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    postMessage is part of the HTML5 draft and thus supported in the newest browsers.

    The spec says

    the source attribute must be set to the script’s global object’s WindowProxy object

    this WindowProxy is the value of the window.frame enumeration, too.

    http://www.whatwg.org/specs/web-apps/current-work/multipage/comms.html#crossDocumentMessages

    • 0