Cross site scripting(XSS)

Question

I am loading content from another page and depending on the content of page, changing content of my page and this is giving me cross site scripting issues.

1. When i use iframe, since the content is from other domain, content of iframe becomes inaccessible.
2. When i use ajax and try to inject the content as plain html code, XmlHttpRequest object throws permission denied exception due to cross site scripting.
3. When i use JSONP, such as getJSON in JQuery, it only supports GET protocol and it is not adequate for further processing.

I wonder what other options i can try. Heard that DOJO, GWT,Adobe Air do some XSS, but dont know which one is the best.

Thanks, Ebe.

Answer 1

Without JSON-P, your only option is to run a proxy script on your own server that fetches the content from the external site and pipes it back to the browser.

The browser fetches the content from the script on your server, hence no cross-domain issues, but the script on your server dynamically fetches it from the external site.

There's an example of such a script in PHP here: http://www.daniweb.com/code/snippet494.html (NB. I haven't personally used it).

Answer 2

To add to what RichieHindle says, there are some good script (Python+Cron) that you can plonk on your server and it will check for changes to a POST/GET location and cache the changes on your server.

Either set your triggers low (once every 10 mins/ 1 per day) or you might get blacklisted from the target.

This way, a local cache won't incur the HTTP overhead on every AJAX call from the client.

Answer 3

Thanks guys, the problem is i want to inject someone's page into someone else's page which is outside our domain and that is why the XmlHTTPObject is throwing an error. Surely there is an proxy and web service developed in C#. Any other options?

Thanks, Ebe

Answer 4

If you have control over both domains, take a look at EasyXDM. It's a library which wraps cross-browser quirks and provides an easy-to-use API for communicating in client script between different domains using the best available mechanism for that browser (e.g. postMessage if available, other mechanisms if not).

Caveat: you need to have control over both domains in order to make it work (where "control" means you can place static files on both of them). But you don't need any server-side code changes.