Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.
Sign upFramebusting on 3rd party sites break Cypress automation #886
Comments
brian-mann
added
the
type: unexpected behavior
label
Nov 7, 2017
jennifer-shehane
added
the
stage: proposal
label
Nov 7, 2017
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment
Hide comment
brian-mann
Feb 11, 2018
Member
A study of common framebusting / clickjacking techniques.
https://seclab.stanford.edu/websec/framebusting/framebust.pdf
We will likely implement enough to cover the bases described here on page 3
| unique sites | conditional statement |
|---|---|
| 38% | if (top != self) |
| 22.5% | if (top.location != self.location) |
| 13.5% | if (top.location != location) |
| 8% | if (parent.frames.length > 0) |
| 5.5% | if (window != top) |
| 5.5% | if (window.top !== window.self) |
| 2% | if (window.self != window.top) |
| 2% | if (parent && parent != window) |
| 2% | if (parent && parent.frames && parent.frames.length>0) |
| 2% | if((self.parent&&!(self.parent===self))&&(self.parent.frames.length!=0)) |
|
A study of common framebusting / clickjacking techniques. https://seclab.stanford.edu/websec/framebusting/framebust.pdf We will likely implement enough to cover the bases described here on page 3
|
brian-mann
self-assigned this
Feb 11, 2018
brian-mann
added this to the 2.0.0 milestone
Feb 11, 2018
added a commit
that referenced
this issue
Feb 11, 2018
brian-mann
closed this
in
a648ee4
Feb 12, 2018
This was referenced Feb 12, 2018
Closed
Closed
Closed
This comment has been minimized.
Show comment
Hide comment
This comment has been minimized.
Show comment
Hide comment
|
Released in |
jennifer-shehane
referenced this issue
Mar 29, 2018
Open
Application not working with Chrome-64. Failing to get URL "/__/#/tests/" #1497
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
brian-mann commentedNov 7, 2017
•
edited
Sites that implement old school security measures such as clickjacking or framebusting break Cypress.