Modifying contentWindow in Safari/iOS

[paulmasson]

The function injectFunctions modifies the contentWindow of a 3D-scene to include additional function definitions, which cannot be passed via the JSON-parsed config dictionary. This works fine for both Firefox and Chrome, both for local files and those obtained from a server.

For Safari this also works for local files, but fails silently for those obtained from a server, even a local server running on the desktop. More accurately, one can modify the contentWindow and immediately return values from the added functions, but the definitions are subsequently not available as if scoped somehow. Curiously enough once the main file has been downloaded, function injection works completely from the JavaScript console in Safari.

Clearly there is some sort of security restriction in place for Safari that is nonstandard. How can this be circumvented?