{"action":"created","issue":{"url":"https://api.github.com/repos/englercj/resource-loader/issues/119","repository_url":"https://api.github.com/repos/englercj/resource-loader","labels_url":"https://api.github.com/repos/englercj/resource-loader/issues/119/labels{/name}","comments_url":"https://api.github.com/repos/englercj/resource-loader/issues/119/comments","events_url":"https://api.github.com/repos/englercj/resource-loader/issues/119/events","html_url":"https://github.com/englercj/resource-loader/issues/119","id":387391919,"node_id":"MDU6SXNzdWUzODczOTE5MTk=","number":119,"title":"Cross origin detection does not work within a sandboxed iframe","user":{"login":"rtibbles","id":1680573,"node_id":"MDQ6VXNlcjE2ODA1NzM=","avatar_url":"https://avatars3.githubusercontent.com/u/1680573?v=4","gravatar_id":"","url":"https://api.github.com/users/rtibbles","html_url":"https://github.com/rtibbles","followers_url":"https://api.github.com/users/rtibbles/followers","following_url":"https://api.github.com/users/rtibbles/following{/other_user}","gists_url":"https://api.github.com/users/rtibbles/gists{/gist_id}","starred_url":"https://api.github.com/users/rtibbles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtibbles/subscriptions","organizations_url":"https://api.github.com/users/rtibbles/orgs","repos_url":"https://api.github.com/users/rtibbles/repos","events_url":"https://api.github.com/users/rtibbles/events{/privacy}","received_events_url":"https://api.github.com/users/rtibbles/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-12-04T17:13:47Z","updated_at":"2018-12-05T04:06:32Z","closed_at":"2018-12-05T04:00:28Z","author_association":"CONTRIBUTOR","body":"When used within a sandboxed iframe, the cross origin auto-detection function does not function properly, as it does not currently check `window.origin` before doing a comparison of the passed in or default location object.\r\n\r\nWhen inside a sandboxed iframe that does not have the `allow-same-origin` attribute (but does have the `allow-scripts` attribute), `window.origin` is set to `null`, whereas `window.location.href` will still return the current URL.\r\n\r\nThe simplest fix that I would see would be to add a check in the `_determineCrossOrigin` method (https://github.com/englercj/resource-loader/blob/master/src/Resource.js#L890):\r\n```\r\n    _determineCrossOrigin(url, loc) {\r\n        // data: and javascript: urls are considered same-origin\r\n        if (url.indexOf('data:') === 0) {\r\n            return '';\r\n        }\r\n\r\n       if (window.origin === null) {\r\n           return 'anonymous';\r\n       }\r\n\r\n        // default is window.location\r\n        loc = loc || window.location;\r\n\r\n        if (!tempAnchor) {\r\n            tempAnchor = document.createElement('a');\r\n        }\r\n\r\n        // let the browser determine the full href for the url of this resource and then\r\n        // parse with the node url lib, we can't use the properties of the anchor element\r\n        // because they don't work in IE9 :(\r\n        tempAnchor.href = url;\r\n        url = parseUri(tempAnchor.href, { strictMode: true });\r\n\r\n        const samePort = (!url.port && loc.port === '') || (url.port === loc.port);\r\n        const protocol = url.protocol ? `${url.protocol}:` : '';\r\n\r\n        // if cross origin\r\n        if (url.host !== loc.hostname || !samePort || protocol !== loc.protocol) {\r\n            return 'anonymous';\r\n        }\r\n\r\n        return '';\r\n    }\r\n```\r\n\r\nLet me know if you need more info, or would like me to submit a PR to fix this."},"comment":{"url":"https://api.github.com/repos/englercj/resource-loader/issues/comments/444351642","html_url":"https://github.com/englercj/resource-loader/issues/119#issuecomment-444351642","issue_url":"https://api.github.com/repos/englercj/resource-loader/issues/119","id":444351642,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0NDM1MTY0Mg==","user":{"login":"englercj","id":944497,"node_id":"MDQ6VXNlcjk0NDQ5Nw==","avatar_url":"https://avatars0.githubusercontent.com/u/944497?v=4","gravatar_id":"","url":"https://api.github.com/users/englercj","html_url":"https://github.com/englercj","followers_url":"https://api.github.com/users/englercj/followers","following_url":"https://api.github.com/users/englercj/following{/other_user}","gists_url":"https://api.github.com/users/englercj/gists{/gist_id}","starred_url":"https://api.github.com/users/englercj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/englercj/subscriptions","organizations_url":"https://api.github.com/users/englercj/orgs","repos_url":"https://api.github.com/users/englercj/repos","events_url":"https://api.github.com/users/englercj/events{/privacy}","received_events_url":"https://api.github.com/users/englercj/received_events","type":"User","site_admin":false},"created_at":"2018-12-05T04:06:32Z","updated_at":"2018-12-05T04:06:32Z","author_association":"OWNER","body":"Right now! https://github.com/englercj/resource-loader/releases/tag/v2.2.0"}}
{"actor":{"display_login":"englercj"}}