# Dope Search

**URL:** <https://boards.straightdope.com/t/dope-search/505613>\
**Category:** About This Message Board\
**Created:** [August 7, 2009, 8:15am UTC](https://boards.straightdope.com/t/dope-search/505613 "2009-08-07T08:15:48Z")\
**Posts on this page:** 3\
**Page:** 3

<div class="post-metadata">

**Author:** ![Liberal](https://avatars.discourse-cdn.com/v4/letter/l/848f3c/32.png) [@Liberal](https://boards.straightdope.com/u/Liberal)\
**Post date:** [August 10, 2009, 5:05am UTC](https://boards.straightdope.com/t/dope-search/505613/41 "2009-08-10T05:05:09Z")

</div>

@ choie

Well, I reckon all Windows browsers have vulnerability. Where there is scripting allowed from outside the browser’s present domain, it would seem to me that that itself qualifies as a vulnerablity — or as someone above put it: a “security no-no”. How do the browsers in which these scripts run protect themselves from the injection of malicious scripts?

---

<div class="post-metadata">

**Author:** ![alterego](https://avatars.discourse-cdn.com/v4/letter/a/6bbea6/32.png) [@alterego](https://boards.straightdope.com/u/alterego)\
**Post date:** [August 10, 2009, 6:16am UTC](https://boards.straightdope.com/t/dope-search/505613/42 "2009-08-10T06:16:20Z")

</div>

By not allowing you to access the Document Object Model of that site, which no popular browser does. Setting the source of an iframe monitors a single variable within the domain of the caller.

Firefox, Safari, Opera, etc…: document.frame.src == good, document.frame.document… == bad.  
Internet Explorer: document.frame.src == bad, document.frame.document… == bad.

Clearly, in neither case do you have the ability to modify content that does not originate at your domain.

---

<div class="post-metadata">

**Author:** ![Gary\_Robson](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gary_robson/32/3448_2.png) [@Gary\_Robson](https://boards.straightdope.com/u/Gary_Robson)\
**Post date:** [August 17, 2009, 7:05pm UTC](https://boards.straightdope.com/t/dope-search/505613/43 "2009-08-17T19:05:22Z")

</div>

Thank you for all the time you’ve put in on this, **alterego** –and for sharing it with us.

[Previous page](https://boards.straightdope.com/t/dope-search/505613.md?page=2)