Bug 45622 – Unsafe JavaScript attempt to access frame with URL about:blank from frame with URL ... Domains, protocols and ports must match.

• Component: New Bugs
• Status: RESOLVED WONTFIX

[scott Schmitz]

I execute the following URL:

http://www.scottschmitz.com/SignOnTest.php

which is basically code that will sign into and out of the Google Contacts API.  When I run using Safari 5.01, I get an error:

Unsafe JavaScript attempt to access frame with URL about:blank from frame with URL h... Domains, protocols and ports must match.

The page at https://www.google.com/accounts/AuthSubRevokeTokenJS ran insecure content from http://www.google.com/uds/modules/gdata/gdata-xd.js.

I believe that this bug relates to the additional of XSS Auditor code which tries to stop malicious code from executing.  IE8 has similar code and I am able to disable errors from IE by adding this header:
X-XSS-Protection: 0

[Alexey Proskuryakov]

Actually, the error message for XSS Auditor is different (and we also support X-XSS-Protection anyway).

[scott Schmitz]

Created attachment 67472 [details]
SCreen shot showing error

[scott Schmitz]

I have included a screen shot so you can see the error for yourself.

This screen shot is from the latest build of WebKit.

[manon hendriks]

hi i see all the time by console, when i play game on face book unsafe javascript..and i can't come in my game

[Dmitri S]

The reported URL is no longer available.  Can you still replicate the problem?

[scott Schmitz]

Unfortunately, that API has been discontinued by Google and I am unable to test any more.

Scott.

[Brent Fulgham]

This is likely resolved by Bug 230499.