claviska/jquery-minicolors

Check for same origin before using window.top

Open

#239 创建于 2017年12月27日

在 GitHub 查看
 (1 评论) (1 反应) (0 负责人)JavaScript (955 star) (322 fork)batch import
Help Wanted

描述

With https://github.com/claviska/jquery-minicolors/pull/207 top.document should be used to attach the event handlers. When the top window is from a different origin (e.g. the site is embedded in an iframe from a different origin) then access to window.top (and therefore top.document) is prohibited by the browser. This leads to the following exception: image

Therefore access to window.top should be avoided or at least there should be a check if its safe to acces it (try catch?).

edit: I don't know why, but there is a commit that reverts the changes from https://github.com/claviska/jquery-minicolors/pull/207 see https://github.com/claviska/jquery-minicolors/commit/106c1988adc488a8b0aba4adb2a61e90de2abaa0 But its not already releaset so that the current released version still contains the access of window.top

贡献者指南

Check for same origin before using window.top · claviska/jquery-minicolors#239 | Good First Issue