Preventing child iframe from "breaking out of frame"

Question

I'm doing some simple web integration work which I'm accomplishing through use of an iframe. My main window has some javascript which interacts with my server to redirect the iframe to the required URL. One of the target pages sadly has the following piece of code inside:

if (top.location != location) {
    top.location.href = document.location.href ;
}

The script dies because of cross-site-cripting restrictions and prevents that page from rendering properly. I can't modify the source of that page (3rd party I'm integrating with).

How could I work around this?

Thanks

Answer 1

Instead of denying the wishes of the third party (to not be in a frame) can you open the third party in a new window?

The reason for that code is normally to avoid having content passed off as belong to the "framing" site. Even NoScript for FireFox allows framebusting code to run by default (via a proxy script).

Answer 2

The 'third-party' that you're 'integrating' with has made it clear that they don't want to be framed. Why not respect their wishes?

Answer 3

There is a technique to disable the frame busting code, as discussed in a newer SO question:

As it turns out, your frame-busting code can be busted, as shown here:

<script type="text/javascript">
    var prevent_bust = 0  
    window.onbeforeunload = function() { prevent_bust++ }  
    setInterval(function() {  
      if (prevent_bust > 0) {  
        prevent_bust -= 2  
        window.top.location = 'http://server-which-responds-with-204.com'  
      }  
    }, 1)  
</script>

This code does the following:

• increments a counter every time the browser attempts to navigate away from the current page, via the window.onbeforeonload event handler
• sets up a timer that fires every millisecond via setInterval(), and if it sees the counter incremented, changes the current location to a server of the attacker's control
• that server serves up a page with HTTP status code 204, which does not cause the browser to nagivate anywhere