Skip to content

Instantly share code, notes, and snippets.

@coreh
Last active November 4, 2021 16:23
Show Gist options
  • Save coreh/71a99aa83e5634528c138aae1c91a6d9 to your computer and use it in GitHub Desktop.
Save coreh/71a99aa83e5634528c138aae1c91a6d9 to your computer and use it in GitHub Desktop.
Iframe Blocking Script Test
<iframe src="http://127.0.0.1:5001/b.html" sandbox="allow-scripts"></iframe>
<button onclick="this.innerText = 'Clicked'">Click me</button>
<script>
while (true) {}
</script>

What this is?

This is a simple experiment to verify if browsers will block/hang execution in a page when a child iframe (of a different origin) has a running script blocked in an infinite loop.

As of Nov 4, 2021, Chrome/Edge won't block the parent page, but Firefox and Safari will.

Instructions

You'll need Node and NPM for this.

Download/clone this gist.

On one terminal window, from within this folder, run:

npx serve -p 5002

On another terminal window, from within this folder, run:

npx serve -p 5001

Open on the browser: http://localhost:5002/a.html

Verify if the parent page can be interacted with, by clicking on the button.

If button text changes to "Clicked" execution is not blocked, if nothing happens execution is blocked.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment