Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Embedding a webgl-operate canvas inside a cross-origin (sandboxed) iframe leads to runtime TypeError #279

Closed
bakoe opened this issue Jan 26, 2022 · 0 comments · Fixed by #280
Labels
bug Something isn't working haeley-auxiliaries Move/to be resolved in to haeley-webgl-gltf

Comments

@bakoe
Copy link
Collaborator

bakoe commented Jan 26, 2022

Since integrating #270, embedding a webgl-operate based canvas inside a cross-origin iframe that is not explicitly trusted via sandbox="allow-top-navigation" leads to a runtime TypeError, independent of whether the GET parameters are actually set for masquerading or not.

View this CodeSandbox for a live example of the runtime error: https://codesandbox.io/s/sleepy-wood-wrxnl

SecurityError: Blocked a frame with origin "https://wrxnl.csb.app" from accessing a cross-origin frame. Protocols, domains, and ports must match.

Changing the webgl-operate version from 0.7.5 to 0.7.1 in the CodeSandbox makes the error disappear:

https://codesandbox.io/s/vigorous-mclaren-4s7p2

Thus, we should wrap the two window.top.location accesses introduced by #270 with corresponding try/catch blocks:

search = window.top.location.search;

// For iframe contents (i. e., the embedded /examples/ files), look within the top frame's search params
match = window.top.location.search.match(re);

@bakoe bakoe added haeley-auxiliaries Move/to be resolved in to haeley-webgl-gltf bug Something isn't working labels Jan 26, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working haeley-auxiliaries Move/to be resolved in to haeley-webgl-gltf
Projects
None yet
1 participant