Script security issues when using a custom scheme handler

[ayoung24]

I'm using a custom scheme handler which dynamically generates CSS files ("live-css://").

When the page finishes loading, I use javascript to replace the HREF of each LINK tag with a "live-css://url".

The browser loads the dynamic CSS files fine. The problem is, even after the files are finished loading, the "cssRules" property of "document.styleSheets[0]" is forever null. (I have the same problem when attempting to access style sheets which are sourced from a different domain from the page).

Is there any way to work around this?

[magreenblatt]

You'll probably need to start by identifying where document.styleSheets is populated in the source code (somewhere in third_party\WebKit\WebCore\dom\Document.cpp maybe?) and work backwards from there. Sorry I can't be more helpful .

Regards,
Marshall

[ayoung24]

I'm wondering if it has something to do with V8's "same origin policy". Other folks have reported a similar problem when trying to access offsite CSS files via jQuery. However, we are operating at a lower level than pure javascript, it seems that there should be some way around the problem.

There is a SetAccessCheckCallbacks() V8 method which allows you to allow or disallow access to specific objects, and also a SetSecurityToken() method which would allow you (I'm guessing) to specify the origin of a script. However, I don't even know what context the script in CEF is running in to begin with, so I'm not sure where to start.

[ayoung24]

I've found a workaround for the problem. It seems there is a "grantUniversalAccess()" method in WebFrame which basically enables cross-site scripting for that frame (until a new document is loaded). I've exposed it in CefFrame and it works a treat.

What I'd also like is a RevokeUniversalAccess() method as well, which looks like it would be easy enough to implement, but would require upstream changes (all the way back to WebCore).

I've attached a patch which adds a GrantUniversalAccess() method to CefFrame, perhaps you could consider it for a future revision.

[magreenblatt]

Sounds reasonable. Please create an entry for this on the CEF issue tracker so it doesn't get lost.

[ayoung24]

Issue 87: Expose GrantUniversalAccess() to enable cross-site scripting
http://code.google.com/p/chromiumembedded/issues/detail?id=87