tags:

views:

55

answers:

1

Hi, I have this self-executing function:

<script type="text/javascript">
(function() {
var sc      = document.createElement('script'); 
    sc.src   = 'http://blahblah.com/test.js';
    sc.type = 'text/javascript'; 

var s = document.getElementsByTagName('script')[0];
s.parentNode.insertBefore(sc, s);
})();
</script>

All that is contained in test.js is:

document.write('ping!');

However, it hangs -- am I doing something incorrect?

I found a way to go around the document.write but now the only question is why does this not work.

var nc = document.createElement('div');  
nc.appendChild(document.createTextNode('blah'));  
var scr = document.getElementsByTagName('script')[0];  
scr.parentNode.insertBefore(nc, scr);  
+2  A: 

I have no idea what you're trying to accomplish, but your code is valid as long as it's hosted on http://blahblah.com/.

Your browser won't let you execute remote code to manipulate the original page. It's not that dumb.

Dolph
How does embedding remote scripts work then?
Adam
There's nothing wrong with running remote scripts. The catch is when they try and manipulate the DOM, etc.
Dolph
Not quite, including external scripts in this way is perfectly valid, that's how [JSON-P](http://remysharp.com/2007/10/08/what-is-jsonp/) works for example... The real problem is [`document.write`](http://stackoverflow.com/questions/802854/why-is-document-write-considered-a-bad-practice)...
CMS
>Your browser won't let you execute remote code to manipulate the original page. It's not that dumb.ummm that's not true.
Dolph is right, if both scripts are not on the same domain it won't work. Not that way. JSON-P is working because what is fetched is eval'ed by a local script.This to work one has to download http://blahblah.com/test.js in a string then eval that string.
Claude Vedovini
@Claude @Dolph - that is not true. The remote script will have equal rights unless it's inside an iframe, and domains mismatch.
Anurag
I'm not aware of a standard for JavaScript security practices. If that's the case, browsers may implement and enforce their own proprietary security policies differently.
Dolph
http://en.wikipedia.org/wiki/Same_origin_policy
Claude Vedovini