Issue 2084 - Detect our content script instead checking for anonymous frames

include.preload.js

Index: include.preload.js
===================================================================
--- a/include.preload.js
+++ b/include.preload.js
@@ -79,22 +79,29 @@
     ext.backgroundPage.sendMessage({type: "add-sitekey", token: attr});
 }
 
-function isInlineFrame(element)
+function isFrameWithoutContentScript(element)
 {
-  var contentDocument;
+  var contentWindow;
   try
   {
-    contentDocument = element.contentDocument;
+    contentWindow = element.contentWindow;

[Wladimir Palant, 2015/03/04 19:31:36]

Accessing element.contentWindow is actually allowed for third-party frames,
otherwise you wouldn't be able to call postMessage() on it for example.

You could use element.contentDocument.defaultView instead, this will also take
care of the check below (this will throw if element.contentDocument is
undefined). I would consider running into an exception here ugly however, so the
other option is keeping the contentDocument variable and merely using
contentDocument.defaultView below. Up to you.

[Sebastian Noack, 2015/03/04 20:36:13]

You are right. Also I realized that we can actually access third-party frames.
Even contentWindow.isFrameWithoutContentScript won't raise an exception, but
contentDocument does. Moreover, I realized that <object> elements only have
contentDocument, but no contentDocument anyway.

   }
   catch (e)
   {
-    return false;  // third-party
+    // This is a third-party frame. Hence we can't access it.
+    // But that's fine, our content script should already run there.
+    return false;
   }
 
-  if (!contentDocument)
-    return false;  // not a frame
+  // The element isn't a <frame>, <iframe> or <object> with "data" attribute.
+  if (!contentWindow)
+    return false;
 
-  return contentDocument.location.protocol == "about:";
+  // Return true, if the element is a first-party frame which doesn't
+  // have this function, hence our content script isn't running there.
+  // Those are dynamically created frames as well as frames
+  // with "about:blank", "about:srcdoc" and "javascript:" URL.
+  return !("isFrameWithoutContentScript" in contentWindow);

[Wladimir Palant, 2015/03/04 19:31:36]

I wonder whether there can be any timing issues here, what if the content script
didn't load yet? I guess you tested that this works correctly?

[Sebastian Noack, 2015/03/04 20:36:13]

Yes, I tested it on a few websites of course, but timing issues aren't usually
reliably reproducible. However, we run this content script at "document_start",
but this check is performed on "load" event, so we should be safe.

For reference:
In the case of "document_start", the files are injected after any files from
css, but before any other DOM is constructed or any other script is run. 

 }
 
 function reinjectRulesWhenRemoved(document, style)
@@ -256,7 +263,7 @@
     // about:srcdoc and javascript: URLs. Moreover, as of Chrome 40
     // "load" and "error" events aren't dispatched there. So we have
     // to apply element hiding and collapsing from the parent frame.
-    if (/\bChrome\//.test(navigator.userAgent) && isInlineFrame(element))
+    if (/\bChrome\//.test(navigator.userAgent) && isFrameWithoutContentScript(element))
     {
       init(element.contentDocument);