Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>My experience with this kind of problem is that unless you can access the external code before feeding it to the <code>iframe</code> (either as an URL or via the <a href="https://developer.mozilla.org/en-US/docs/HTML/Element/iframe" rel="nofollow">srcdoc</a> attribute), the loop will completely interrupt any JavaScript execution. </p> <p>Whatever kind of timeout functionality you implement, it will not be called due to the iframe code execution consuming 100% resources until the browser reports a crash. </p> <p>Your options are:</p> <ul> <li><strong>Sanitize the code automatically</strong> before adding it to the <code>iframe</code>, which proves impractical since there are infinite ways to loop infinitely, and you will not be able to catch them all. You would have to write a scanner script that could detect infinite loops while not crashing in the course of scanning the code. </li> <li>Use a <strong>sandboxing solution like <a href="http://code.google.com/p/google-caja/" rel="nofollow">Google Caja</a></strong> to sanitize the code. However, this will change the code structurally if not configured heavily.</li> <li>In case of an application that has capabilites of <strong>creating virtual environments</strong> and monitoring them, you could execute the iframe code (let's say on a virtual machine of sorts), check if the process locks up and use that outcome to determine if you can safely set the <code>iframe.src</code> property to your code's URL. This might be the only solution that can guarantee some sort of guarantee that this code will not lock up immediately (however, there are many ways to have race conditions at some later point of execution, so there will not be a sure way to say it will never lock up the browser).</li> </ul> <p><strong>Summary</strong>: Unless you can find a way to test the code extensively before showing it in the <code>iframe</code>, you can not guarantee that the iframe code will not lock up the browser tab.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload