Skip to content

Instantly share code, notes, and snippets.

@jrockway

jrockway/evil.html

Created April 5, 2009 05:50
Show Gist options
  • Save jrockway/90381 to your computer and use it in GitHub Desktop.
Save jrockway/90381 to your computer and use it in GitHub Desktop.
Download ZIP
can a parent page remove "langauge features" from iframes?
Raw
evil.html
<html>
<head>
<title>Test page</title>
</head>
<body>
<h1>Test page</h1>
Hello, world.
<script language="javascript">
document.write("Before: " + top);
top = null;
document.write("After: " + top);
document.write("Here is the frame: <iframe src=\"evil2.html\" />");
</script>
</body>
</html>
Raw
evil2.html
<html>
<head>
<title>What happens?</title>
</head>
<body>
<h1>What happens?</h1>
<script language="javascript">
document.write("Top: " + top);
</script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment