Is it possible to run a script in an iframe?

[michaelmesser]

Is it possible to run a script in an iframe? It does not trigger for me but it works when the page is not in a frame.

System Information:

macOS version: 10.14.6
Userscripts version: 2.2.0
Safari version: 14.0.1

[michaelmesser]

@quoid Your message disappeared. But as far as I can tell https://github.com/quoid/userscripts/blob/master/extension/Userscripts%20Extension/UserscriptsSafari.js#L126 blocks it from working on an iframe. The page I am working with is not public facing so I cannot use it as an example.

[quoid]

@michaelmesser

Ninja edit:

It is not currently possible. You can see this line of code for why it doesn't happen.

Essentially every script has the @noframes option.

[quoid]

I remove my original message because it was incorrect. Your are correct, that's why it won't work.

I can make the @noframes an actual option in the next update. It will be several weeks before the next update, I am working on v3.0.0 right now.

[michaelmesser]

This code has bugs

After removing the check for the top window the following changes are needed:
In JavaScript

if (event.name === "RESP_USERSCRIPTS" && window.location.href === event.message.url) {

safari.extension.dispatchMessage("REQ_USERSCRIPTS", {"url": window.location.href});

In Swift

let url = userInfo?["url"] as? String

respData["url"] = url;

This works for my use case. It is probably possible for the url to change without reloading and the changes above do not support that. Also if there is more than one iframe with the same url, it will inject into each page twice. I don't have time to polish it. I wonder if there is some unique identifier that can be serialized for a window object that can be serialized.

[quoid]

@michaelmesser

In order to allow for iframe script injection, we really only need to remove that check linked above. Once that is removed, the @noframes key needs to be implemented. I haven't fully figured out how the implementation would look, but I reckon when returning scripts for injection it'd check for @noframes scripts and they'd pass through a different injection method (which would have the window.top check that was removed universally).

[michaelmesser]

@quoid I believe that the Swift file currently gets the page url not the frame url. So passing the frame url in the message is needed. I could be wrong. Also, I believe the check on receive on the JS side is needed to prevent the wrong scripts from running.

[quoid]

@michaelmesser you are right.

The injected script (UserscriptsSafari.js ) sends a request to the swift side asking for the code from the indiv. userscripts. The swift side checks the page url, rather than it being sent from the injected script.

What you are saying makes sense, I guess we would need the injected script send along the window.location when it is requesting code and the swift side can use that to location which userscripts should be loaded.

Maybe when the injected script gets the response, RESP_USERSCRIPTS, it can send along that page url (the one that is currently being used to get userscripts) and we can use that as a "window.top" check - for userscripts that have the @noframes key.

Does that make sense to you?

[quoid]

Maybe when the injected script gets the response, RESP_USERSCRIPTS, it can send along that page url (the one that is currently being used to get userscripts) and we can use that as a "window.top" check - for userscripts that have the @noframes key.

Looking back at your other comment, it seems like I just repeated what you wrote here:

let url = userInfo?["url"] as? String
respData["url"] = url;

[michaelmesser]

@quoid
I think the best strategy is:

• JavaScript sends a request for the scripts with window.location.href, a unique id, and if window.top === window
• Swift sends a response with the scripts that should run based on that url and if it is a frame and includes the unique id in the response
• JavaScript filters responses based on the unique id

[michaelmesser]

I am not sure how to handle the unique id yet.

[quoid]

That seems like a good strategy.

Also if there is more than one iframe with the same url, it will inject into each page twice.

I assume you are suggesting to include a unique id to somehow prevent this?

[michaelmesser]

Yes. There is no need to send a url in the Swift to JS message. Just the unique id and the scripts to run.